@agent-native/core 0.98.4 → 0.98.6

package/dist/mcp/external-agent-policy.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Policy for the default authenticated external-agent connector surface.
+ *
+ * The policy is intentionally narrow: "auto" only discovers actions that
+ * explicitly opt into authenticated, read-only public-agent exposure. It
+ * never makes an unannotated action callable and never grants writes.
+ */
+export interface ExternalAgentPolicy {
+    /** Automatically advertise authenticated GET/read-only public-agent actions. */
+    authenticatedReads?: "off" | "auto";
+    /**
+     * Keep writes behind `ask_app` by default. `allowlisted` preserves explicit
+     * connectorCatalog write exposure for apps that intentionally need it.
+     */
+    writes?: "ask_app_only" | "allowlisted";
+    /** Explicit action names to remove from the derived connector surface. */
+    denyActions?: string[];
+}
+//# sourceMappingURL=external-agent-policy.d.ts.map

package/dist/mcp/external-agent-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-agent-policy.d.ts","sourceRoot":"","sources":["../../src/mcp/external-agent-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACpC;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,GAAG,aAAa,CAAC;IACxC,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB"}

package/dist/mcp/external-agent-policy.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=external-agent-policy.js.map

package/dist/mcp/external-agent-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-agent-policy.js","sourceRoot":"","sources":["../../src/mcp/external-agent-policy.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Policy for the default authenticated external-agent connector surface.\n *\n * The policy is intentionally narrow: \"auto\" only discovers actions that\n * explicitly opt into authenticated, read-only public-agent exposure. It\n * never makes an unannotated action callable and never grants writes.\n */\nexport interface ExternalAgentPolicy {\n  /** Automatically advertise authenticated GET/read-only public-agent actions. */\n  authenticatedReads?: \"off\" | \"auto\";\n  /**\n   * Keep writes behind `ask_app` by default. `allowlisted` preserves explicit\n   * connectorCatalog write exposure for apps that intentionally need it.\n   */\n  writes?: \"ask_app_only\" | \"allowlisted\";\n  /** Explicit action names to remove from the derived connector surface. */\n  denyActions?: string[];\n}\n"]}

package/dist/mcp/index.d.ts

@@ -2,6 +2,7 @@ export { mountMCP } from "./server.js";
 export type { MCPConfig } from "./server.js";
 export { createMCPServerForRequest, verifyAuth, getAccessTokens, resolveOrgIdFromDomain, buildLinkArtifacts, } from "./build-server.js";
 export type { MCPCallerIdentity, MCPRequestMeta } from "./build-server.js";
+export type { ExternalAgentPolicy } from "./external-agent-policy.js";
 export { runMCPStdio } from "./stdio.js";
 export type { RunMCPStdioOptions } from "./stdio.js";
 export { runScreenMemoryMCPStdio } from "./screen-memory-stdio.js";

package/dist/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAG3E,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,YAAY,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EACL,QAAQ,EACR,iCAAiC,EACjC,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,MAAM,GACZ,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC3E,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGtE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,YAAY,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAG/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EACL,QAAQ,EACR,iCAAiC,EACjC,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,KAAK,MAAM,GACZ,MAAM,oBAAoB,CAAC"}

package/dist/mcp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,iFAAiF;AACjF,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAG3B,4DAA4D;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,6EAA6E;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EACL,QAAQ,EACR,iCAAiC,GAElC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,GAKX,MAAM,kBAAkB,CAAC;AAE1B,kDAAkD;AAClD,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,YAAY,EACZ,yBAAyB,GAE1B,MAAM,oBAAoB,CAAC","sourcesContent":["export { mountMCP } from \"./server.js\";\nexport type { MCPConfig } from \"./server.js\";\n\n// Shared MCP server builder (also re-exported from ./server.js for back-compat).\nexport {\n  createMCPServerForRequest,\n  verifyAuth,\n  getAccessTokens,\n  resolveOrgIdFromDomain,\n  buildLinkArtifacts,\n} from \"./build-server.js\";\nexport type { MCPCallerIdentity, MCPRequestMeta } from \"./build-server.js\";\n\n// stdio transport for `agent-native mcp serve` (Node-only).\nexport { runMCPStdio } from \"./stdio.js\";\nexport type { RunMCPStdioOptions } from \"./stdio.js\";\nexport { runScreenMemoryMCPStdio } from \"./screen-memory-stdio.js\";\nexport type { RunScreenMemoryMCPStdioOptions } from \"./screen-memory-stdio.js\";\n\n// Generic cross-app builtin tools (merged into the registry, template wins).\nexport { getBuiltinCrossAppTools } from \"./builtin-tools.js\";\nexport {\n  embedApp,\n  MCP_APP_REQUEST_ORIGIN_CSP_SOURCE,\n  type EmbedAppOptions,\n} from \"./embed-app.js\";\nexport {\n  embedRoute,\n  type EmbedRouteContext,\n  type EmbedRouteOptions,\n  type EmbedRoutePathBuilder,\n  type EmbedRouteResult,\n} from \"./embed-route.js\";\n\n// Workspace / app resolution helpers (Node-only).\nexport {\n  resolveWorkspace,\n  resolveLocalAppOrigin,\n  findWorkspaceRoot,\n} from \"./workspace-resolve.js\";\nexport type { ResolvedApp, ResolvedWorkspace } from \"./workspace-resolve.js\";\nexport {\n  fetchOrgApps,\n  resolveOrgDirectoryOrigin,\n  type OrgApp,\n} from \"./org-directory.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,iFAAiF;AACjF,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,eAAe,EACf,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAI3B,4DAA4D;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAGnE,6EAA6E;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EACL,QAAQ,EACR,iCAAiC,GAElC,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,UAAU,GAKX,MAAM,kBAAkB,CAAC;AAE1B,kDAAkD;AAClD,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,YAAY,EACZ,yBAAyB,GAE1B,MAAM,oBAAoB,CAAC","sourcesContent":["export { mountMCP } from \"./server.js\";\nexport type { MCPConfig } from \"./server.js\";\n\n// Shared MCP server builder (also re-exported from ./server.js for back-compat).\nexport {\n  createMCPServerForRequest,\n  verifyAuth,\n  getAccessTokens,\n  resolveOrgIdFromDomain,\n  buildLinkArtifacts,\n} from \"./build-server.js\";\nexport type { MCPCallerIdentity, MCPRequestMeta } from \"./build-server.js\";\nexport type { ExternalAgentPolicy } from \"./external-agent-policy.js\";\n\n// stdio transport for `agent-native mcp serve` (Node-only).\nexport { runMCPStdio } from \"./stdio.js\";\nexport type { RunMCPStdioOptions } from \"./stdio.js\";\nexport { runScreenMemoryMCPStdio } from \"./screen-memory-stdio.js\";\nexport type { RunScreenMemoryMCPStdioOptions } from \"./screen-memory-stdio.js\";\n\n// Generic cross-app builtin tools (merged into the registry, template wins).\nexport { getBuiltinCrossAppTools } from \"./builtin-tools.js\";\nexport {\n  embedApp,\n  MCP_APP_REQUEST_ORIGIN_CSP_SOURCE,\n  type EmbedAppOptions,\n} from \"./embed-app.js\";\nexport {\n  embedRoute,\n  type EmbedRouteContext,\n  type EmbedRouteOptions,\n  type EmbedRoutePathBuilder,\n  type EmbedRouteResult,\n} from \"./embed-route.js\";\n\n// Workspace / app resolution helpers (Node-only).\nexport {\n  resolveWorkspace,\n  resolveLocalAppOrigin,\n  findWorkspaceRoot,\n} from \"./workspace-resolve.js\";\nexport type { ResolvedApp, ResolvedWorkspace } from \"./workspace-resolve.js\";\nexport {\n  fetchOrgApps,\n  resolveOrgDirectoryOrigin,\n  type OrgApp,\n} from \"./org-directory.js\";\n"]}

package/dist/notifications/routes.d.ts

@@ -28,7 +28,7 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/scripts/agent-engines/list-agent-engines.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-agent-engines.d.ts","sourceRoot":"","sources":["../../../src/scripts/agent-engines/list-agent-engines.ts"],"names":[],"mappings":"AAAA;;GAEG;AAcH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAKvD,eAAO,MAAM,IAAI,EAAE,UAQlB,CAAC;AAEF,wBAAsB,GAAG,CAAC,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAoG5E"}
+{"version":3,"file":"list-agent-engines.d.ts","sourceRoot":"","sources":["../../../src/scripts/agent-engines/list-agent-engines.ts"],"names":[],"mappings":"AAAA;;GAEG;AAcH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGvD,eAAO,MAAM,IAAI,EAAE,UAQlB,CAAC;AAEF,wBAAsB,GAAG,CAAC,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmF5E"}

package/dist/scripts/agent-engines/list-agent-engines.js

@@ -4,8 +4,6 @@
 import { getAgentAppModelDefaultForCurrentRequest } from "../../agent/app-model-defaults.js";
 import { DEFAULT_MODEL } from "../../agent/default-model.js";
 import { listAgentEngines, registerBuiltinEngines, detectEngineFromEnv, detectEngineFromUserSecrets, getAgentEngineEntry, isAgentEnginePackageInstalled, isStoredEngineUsableForRequest, normalizeModelForEngine, } from "../../agent/engine/index.js";
-import { resolveHostedDefaultModelExperiment } from "../../observability/hosted-model-experiment.js";
-import { getRequestUserEmail } from "../../server/request-context.js";
 import { getSetting } from "../../settings/index.js";
 export const tool = {
     description: 'List all available AI agent engines (Anthropic, OpenAI, Gemini, Groq, etc.) and the currently selected engine. Use this to check what engines are available before calling manage-agent-engine with action="set".',
@@ -61,19 +59,9 @@ export async function run(args = {}) {
             ? current?.model
             : undefined;
     const currentEngineName = currentEntry?.name ?? "anthropic";
-    let currentModel = currentEntry && !envUnavailable
+    const currentModel = currentEntry && !envUnavailable
         ? normalizeModelForEngine(currentEntry, currentModelCandidate ?? currentEntry.defaultModel)
         : (currentModelCandidate ?? DEFAULT_MODEL);
-    const hostedExperiment = currentEntry && !currentModelCandidate
-        ? resolveHostedDefaultModelExperiment({
-            userId: getRequestUserEmail(),
-            engineName: currentEntry.name,
-            isDefaultModelSelection: true,
-            supportedModels: currentEntry.supportedModels,
-        })
-        : null;
-    if (hostedExperiment)
-        currentModel = hostedExperiment.model;
     const result = {
         engines: engines.map((e) => ({
             name: e.name,
@@ -91,12 +79,6 @@ export async function run(args = {}) {
             : {
                 engine: currentEngineName,
                 model: currentModel,
-                ...(hostedExperiment
-                    ? {
-                        modelSelectionSource: "experiment",
-                        experimentAssignment: hostedExperiment.assignment,
-                    }
-                    : {}),
             },
     };
     return JSON.stringify(result, null, 2);

package/dist/scripts/agent-engines/list-agent-engines.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-agent-engines.js","sourceRoot":"","sources":["../../../src/scripts/agent-engines/list-agent-engines.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAC;AACrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,CAAC,MAAM,IAAI,GAAe;IAC9B,WAAW,EACT,mNAAmN;IACrN,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAI,GAA2B,EAAE;IACzD,sBAAsB,EAAE,CAAC;IAEzB,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,cAAc;QAC5B,CAAC,CAAE,cAAsD;QACzD,CAAC,CAAC,IAAI,CAAC;IAET,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,WAAW,GACf,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,YAAY,GAChB,CAAC,CAAC,WAAW;QACb,CAAC,MAAM,8BAA8B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,eAAe,GACnB,OAAO,UAAU,EAAE,MAAM,KAAK,QAAQ;QACpC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GACpB,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,eAAe;QACjB,CAAC,MAAM,8BAA8B,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY;QACvC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GACb,CAAC,CAAC,QAAQ;QACV,CAAC,MAAM,8BAA8B,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC;IAChD,MAAM,eAAe,GAAG,mBAAmB,EAAE,CAAC;IAC9C,MAAM,gBAAgB,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1D,MAAM,YAAY,GAAG,cAAc;QACjC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,gBAAgB;YACjB,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACxC,gBAAgB;YAChB,eAAe;YACf,SAAS,CAAC,CAAC;IACf,MAAM,qBAAqB,GACzB,gBAAgB,IAAI,YAAY,EAAE,IAAI,KAAK,UAAU,EAAE,MAAM;QAC3D,CAAC,CAAC,UAAU,EAAE,KAAK;QACnB,CAAC,CAAC,YAAY,IAAI,YAAY,EAAE,IAAI,KAAK,OAAO,EAAE,MAAM;YACtD,CAAC,CAAC,OAAO,EAAE,KAAK;YAChB,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,iBAAiB,GAAG,YAAY,EAAE,IAAI,IAAI,WAAW,CAAC;IAC5D,IAAI,YAAY,GACd,YAAY,IAAI,CAAC,cAAc;QAC7B,CAAC,CAAC,uBAAuB,CACrB,YAAY,EACZ,qBAAqB,IAAI,YAAY,CAAC,YAAY,CACnD;QACH,CAAC,CAAC,CAAC,qBAAqB,IAAI,aAAa,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GACpB,YAAY,IAAI,CAAC,qBAAqB;QACpC,CAAC,CAAC,mCAAmC,CAAC;YAClC,MAAM,EAAE,mBAAmB,EAAE;YAC7B,UAAU,EAAE,YAAY,CAAC,IAAI;YAC7B,uBAAuB,EAAE,IAAI;YAC7B,eAAe,EAAE,YAAY,CAAC,eAAe;SAC9C,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,gBAAgB;QAAE,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAE5D,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,EAAE,cAAc;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,MAAM,EAAE,iBAAiB;gBACzB,KAAK,EAAE,YAAY;gBACnB,GAAG,CAAC,gBAAgB;oBAClB,CAAC,CAAC;wBACE,oBAAoB,EAAE,YAAY;wBAClC,oBAAoB,EAAE,gBAAgB,CAAC,UAAU;qBAClD;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;KACN,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC","sourcesContent":["/**\n * list-agent-engines — returns the registered engine registry and current selection.\n */\n\nimport { getAgentAppModelDefaultForCurrentRequest } from \"../../agent/app-model-defaults.js\";\nimport { DEFAULT_MODEL } from \"../../agent/default-model.js\";\nimport {\n  listAgentEngines,\n  registerBuiltinEngines,\n  detectEngineFromEnv,\n  detectEngineFromUserSecrets,\n  getAgentEngineEntry,\n  isAgentEnginePackageInstalled,\n  isStoredEngineUsableForRequest,\n  normalizeModelForEngine,\n} from \"../../agent/engine/index.js\";\nimport type { ActionTool } from \"../../agent/types.js\";\nimport { resolveHostedDefaultModelExperiment } from \"../../observability/hosted-model-experiment.js\";\nimport { getRequestUserEmail } from \"../../server/request-context.js\";\nimport { getSetting } from \"../../settings/index.js\";\n\nexport const tool: ActionTool = {\n  description:\n    'List all available AI agent engines (Anthropic, OpenAI, Gemini, Groq, etc.) and the currently selected engine. Use this to check what engines are available before calling manage-agent-engine with action=\"set\".',\n  parameters: {\n    type: \"object\",\n    properties: {},\n    required: [],\n  },\n};\n\nexport async function run(args: Record<string, string> = {}): Promise<string> {\n  registerBuiltinEngines();\n\n  const engines = listAgentEngines();\n  const currentSetting = await getSetting(\"agent-engine\");\n  const current = currentSetting\n    ? (currentSetting as { engine?: string; model?: string })\n    : null;\n\n  // Same priority chain resolveEngine uses after explicit request options:\n  // AGENT_ENGINE → app default → stored (if usable) → user/Builder app_secrets\n  // → env → anthropic. Gating stored/app defaults on the request-aware helper\n  // keeps the picker in step with the runtime.\n  const storedEntry =\n    typeof current?.engine === \"string\"\n      ? getAgentEngineEntry(current.engine)\n      : undefined;\n  const storedUsable =\n    !!storedEntry &&\n    (await isStoredEngineUsableForRequest(current, storedEntry));\n  const appDefault = await getAgentAppModelDefaultForCurrentRequest(args.appId);\n  const appDefaultEntry =\n    typeof appDefault?.engine === \"string\"\n      ? getAgentEngineEntry(appDefault.engine)\n      : undefined;\n  const appDefaultUsable =\n    !!appDefault &&\n    !!appDefaultEntry &&\n    (await isStoredEngineUsableForRequest(appDefault, appDefaultEntry));\n  const detectedFromUser = await detectEngineFromUserSecrets();\n  const envEntry = process.env.AGENT_ENGINE\n    ? getAgentEngineEntry(process.env.AGENT_ENGINE)\n    : undefined;\n  const envUsable =\n    !!envEntry &&\n    (await isStoredEngineUsableForRequest({ engine: envEntry.name }, envEntry));\n  const envUnavailable = !!envEntry && !envUsable;\n  const detectedFromEnv = detectEngineFromEnv();\n  const envSelectedEntry = envUsable ? envEntry : undefined;\n\n  const currentEntry = envUnavailable\n    ? undefined\n    : (envSelectedEntry ??\n      (appDefaultUsable ? appDefaultEntry : undefined) ??\n      (storedUsable ? storedEntry : undefined) ??\n      detectedFromUser ??\n      detectedFromEnv ??\n      undefined);\n  const currentModelCandidate =\n    appDefaultUsable && currentEntry?.name === appDefault?.engine\n      ? appDefault?.model\n      : storedUsable && currentEntry?.name === current?.engine\n        ? current?.model\n        : undefined;\n  const currentEngineName = currentEntry?.name ?? \"anthropic\";\n  let currentModel =\n    currentEntry && !envUnavailable\n      ? normalizeModelForEngine(\n          currentEntry,\n          currentModelCandidate ?? currentEntry.defaultModel,\n        )\n      : (currentModelCandidate ?? DEFAULT_MODEL);\n  const hostedExperiment =\n    currentEntry && !currentModelCandidate\n      ? resolveHostedDefaultModelExperiment({\n          userId: getRequestUserEmail(),\n          engineName: currentEntry.name,\n          isDefaultModelSelection: true,\n          supportedModels: currentEntry.supportedModels,\n        })\n      : null;\n  if (hostedExperiment) currentModel = hostedExperiment.model;\n\n  const result = {\n    engines: engines.map((e) => ({\n      name: e.name,\n      label: e.label,\n      description: e.description,\n      defaultModel: e.defaultModel,\n      supportedModels: e.supportedModels,\n      capabilities: e.capabilities,\n      requiredEnvVars: e.requiredEnvVars,\n      installPackage: e.installPackage,\n      packageInstalled: isAgentEnginePackageInstalled(e),\n    })),\n    current: envUnavailable\n      ? null\n      : {\n          engine: currentEngineName,\n          model: currentModel,\n          ...(hostedExperiment\n            ? {\n                modelSelectionSource: \"experiment\",\n                experimentAssignment: hostedExperiment.assignment,\n              }\n            : {}),\n        },\n  };\n\n  return JSON.stringify(result, null, 2);\n}\n"]}
+{"version":3,"file":"list-agent-engines.js","sourceRoot":"","sources":["../../../src/scripts/agent-engines/list-agent-engines.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,2BAA2B,EAC3B,mBAAmB,EACnB,6BAA6B,EAC7B,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAErD,MAAM,CAAC,MAAM,IAAI,GAAe;IAC9B,WAAW,EACT,mNAAmN;IACrN,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE;QACd,QAAQ,EAAE,EAAE;KACb;CACF,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAI,GAA2B,EAAE;IACzD,sBAAsB,EAAE,CAAC;IAEzB,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,cAAc;QAC5B,CAAC,CAAE,cAAsD;QACzD,CAAC,CAAC,IAAI,CAAC;IAET,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,6CAA6C;IAC7C,MAAM,WAAW,GACf,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ;QACjC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,YAAY,GAChB,CAAC,CAAC,WAAW;QACb,CAAC,MAAM,8BAA8B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,MAAM,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,MAAM,eAAe,GACnB,OAAO,UAAU,EAAE,MAAM,KAAK,QAAQ;QACpC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,gBAAgB,GACpB,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,eAAe;QACjB,CAAC,MAAM,8BAA8B,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY;QACvC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GACb,CAAC,CAAC,QAAQ;QACV,CAAC,MAAM,8BAA8B,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9E,MAAM,cAAc,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC;IAChD,MAAM,eAAe,GAAG,mBAAmB,EAAE,CAAC;IAC9C,MAAM,gBAAgB,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1D,MAAM,YAAY,GAAG,cAAc;QACjC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,CAAC,gBAAgB;YACjB,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;YAChD,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACxC,gBAAgB;YAChB,eAAe;YACf,SAAS,CAAC,CAAC;IACf,MAAM,qBAAqB,GACzB,gBAAgB,IAAI,YAAY,EAAE,IAAI,KAAK,UAAU,EAAE,MAAM;QAC3D,CAAC,CAAC,UAAU,EAAE,KAAK;QACnB,CAAC,CAAC,YAAY,IAAI,YAAY,EAAE,IAAI,KAAK,OAAO,EAAE,MAAM;YACtD,CAAC,CAAC,OAAO,EAAE,KAAK;YAChB,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,iBAAiB,GAAG,YAAY,EAAE,IAAI,IAAI,WAAW,CAAC;IAC5D,MAAM,YAAY,GAChB,YAAY,IAAI,CAAC,cAAc;QAC7B,CAAC,CAAC,uBAAuB,CACrB,YAAY,EACZ,qBAAqB,IAAI,YAAY,CAAC,YAAY,CACnD;QACH,CAAC,CAAC,CAAC,qBAAqB,IAAI,aAAa,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC,CAAC;SACnD,CAAC,CAAC;QACH,OAAO,EAAE,cAAc;YACrB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,MAAM,EAAE,iBAAiB;gBACzB,KAAK,EAAE,YAAY;aACpB;KACN,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC","sourcesContent":["/**\n * list-agent-engines — returns the registered engine registry and current selection.\n */\n\nimport { getAgentAppModelDefaultForCurrentRequest } from \"../../agent/app-model-defaults.js\";\nimport { DEFAULT_MODEL } from \"../../agent/default-model.js\";\nimport {\n  listAgentEngines,\n  registerBuiltinEngines,\n  detectEngineFromEnv,\n  detectEngineFromUserSecrets,\n  getAgentEngineEntry,\n  isAgentEnginePackageInstalled,\n  isStoredEngineUsableForRequest,\n  normalizeModelForEngine,\n} from \"../../agent/engine/index.js\";\nimport type { ActionTool } from \"../../agent/types.js\";\nimport { getSetting } from \"../../settings/index.js\";\n\nexport const tool: ActionTool = {\n  description:\n    'List all available AI agent engines (Anthropic, OpenAI, Gemini, Groq, etc.) and the currently selected engine. Use this to check what engines are available before calling manage-agent-engine with action=\"set\".',\n  parameters: {\n    type: \"object\",\n    properties: {},\n    required: [],\n  },\n};\n\nexport async function run(args: Record<string, string> = {}): Promise<string> {\n  registerBuiltinEngines();\n\n  const engines = listAgentEngines();\n  const currentSetting = await getSetting(\"agent-engine\");\n  const current = currentSetting\n    ? (currentSetting as { engine?: string; model?: string })\n    : null;\n\n  // Same priority chain resolveEngine uses after explicit request options:\n  // AGENT_ENGINE → app default → stored (if usable) → user/Builder app_secrets\n  // → env → anthropic. Gating stored/app defaults on the request-aware helper\n  // keeps the picker in step with the runtime.\n  const storedEntry =\n    typeof current?.engine === \"string\"\n      ? getAgentEngineEntry(current.engine)\n      : undefined;\n  const storedUsable =\n    !!storedEntry &&\n    (await isStoredEngineUsableForRequest(current, storedEntry));\n  const appDefault = await getAgentAppModelDefaultForCurrentRequest(args.appId);\n  const appDefaultEntry =\n    typeof appDefault?.engine === \"string\"\n      ? getAgentEngineEntry(appDefault.engine)\n      : undefined;\n  const appDefaultUsable =\n    !!appDefault &&\n    !!appDefaultEntry &&\n    (await isStoredEngineUsableForRequest(appDefault, appDefaultEntry));\n  const detectedFromUser = await detectEngineFromUserSecrets();\n  const envEntry = process.env.AGENT_ENGINE\n    ? getAgentEngineEntry(process.env.AGENT_ENGINE)\n    : undefined;\n  const envUsable =\n    !!envEntry &&\n    (await isStoredEngineUsableForRequest({ engine: envEntry.name }, envEntry));\n  const envUnavailable = !!envEntry && !envUsable;\n  const detectedFromEnv = detectEngineFromEnv();\n  const envSelectedEntry = envUsable ? envEntry : undefined;\n\n  const currentEntry = envUnavailable\n    ? undefined\n    : (envSelectedEntry ??\n      (appDefaultUsable ? appDefaultEntry : undefined) ??\n      (storedUsable ? storedEntry : undefined) ??\n      detectedFromUser ??\n      detectedFromEnv ??\n      undefined);\n  const currentModelCandidate =\n    appDefaultUsable && currentEntry?.name === appDefault?.engine\n      ? appDefault?.model\n      : storedUsable && currentEntry?.name === current?.engine\n        ? current?.model\n        : undefined;\n  const currentEngineName = currentEntry?.name ?? \"anthropic\";\n  const currentModel =\n    currentEntry && !envUnavailable\n      ? normalizeModelForEngine(\n          currentEntry,\n          currentModelCandidate ?? currentEntry.defaultModel,\n        )\n      : (currentModelCandidate ?? DEFAULT_MODEL);\n  const result = {\n    engines: engines.map((e) => ({\n      name: e.name,\n      label: e.label,\n      description: e.description,\n      defaultModel: e.defaultModel,\n      supportedModels: e.supportedModels,\n      capabilities: e.capabilities,\n      requiredEnvVars: e.requiredEnvVars,\n      installPackage: e.installPackage,\n      packageInstalled: isAgentEnginePackageInstalled(e),\n    })),\n    current: envUnavailable\n      ? null\n      : {\n          engine: currentEngineName,\n          model: currentModel,\n        },\n  };\n\n  return JSON.stringify(result, null, 2);\n}\n"]}

package/dist/server/agent-chat/plugin-options.d.ts

@@ -1,6 +1,7 @@
 import type { ActionEntry } from "../../agent/production-agent.js";
 import type { AgentLoopFinalResponseGuard } from "../../agent/production-agent.js";
 import type { AgentChatAttachment, AgentChatReference, MentionProvider } from "../../agent/types.js";
+import type { ExternalAgentPolicy } from "../../mcp/external-agent-policy.js";
 import type { DatabaseToolsOption } from "../../scripts/db/tool-mode.js";
 import type { PromptExamples } from "../prompts/index.js";
 /** Shape of a Nitro plugin function: receives the Nitro app instance at
@@ -264,7 +265,9 @@ export interface AgentChatPluginOptions {
      * browser-session tools) from connectors. It is no longer gated behind an
      * environment variable, and the catalog is never inferred from the client.
      *
-     * `tool-search` stays available so any trimmed tool is reachable on demand.
+     * `tool-search` stays available for discovery; a trimmed action still needs
+     * the connector catalog, authenticated-read policy, or full-catalog opt-in
+     * before an external caller can execute it.
      * Callers who need the full surface up front opt in explicitly with
      * `agent-native connect --full-catalog` (embeds a `catalog_scope: "full"`
      * claim in their connect-minted JWT) or the deployment-wide
@@ -273,6 +276,13 @@ export interface AgentChatPluginOptions {
      * Declare here rather than in MCPConfig directly; the plugin copies it through.
      */
     connectorCatalog?: string[];
+    /**
+     * Default authenticated external-agent policy. In `auto` read mode, every
+     * action explicitly marked as GET + readOnly + publicAgent.requiresAuth is
+     * added to the connector surface automatically. Writes remain ask_app-only
+     * unless `writes: "allowlisted"` is explicitly selected.
+     */
+    externalAgents?: ExternalAgentPolicy;
     /**
      * Skip mounting the remote MCP protocol route.
      *

package/dist/server/agent-chat/plugin-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-options.d.ts","sourceRoot":"","sources":["../../../src/server/agent-chat/plugin-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;4EAC4E;AAC5E,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAErE,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,wCAAwC;IACxC,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;sDAGkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EACH,OAAO,6BAA6B,EAAE,WAAW,GACjD,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,gBAAgB,CAAC,EACb,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAClD,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QACd,mEAAmE;QACnE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,uEAAuE;QACvE,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gFAAgF;QAChF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gFAAgF;QAChF,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC,CAAC;KACJ,CAAC;IACF;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxE;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,GAAG,EACV,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,2BAA2B,CAAC;IACjD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC;QACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;KACtB,KACG,IAAI,GACJ;QACE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,GACD,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,CAAC,CAAC;IACP;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC7B,OAAO,EAAE,OAAO,oBAAoB,EAAE,OAAO,CAAC;QAC9C,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,oBAAoB,EAAE,iBAAiB,CAAC;QACxD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KAC/B,KACG,OAAO,oBAAoB,EAAE,OAAO,GACpC,MAAM,GACN,IAAI,GACJ,SAAS,GACT,OAAO,CAAC,OAAO,oBAAoB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC9E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,EAAE;QACd,UAAU,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,SAAS,CAAC;QAC7C;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D"}
+{"version":3,"file":"plugin-options.d.ts","sourceRoot":"","sources":["../../../src/server/agent-chat/plugin-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AACnF,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EAChB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D;4EAC4E;AAC5E,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAErE,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,wCAAwC;IACxC,OAAO,CAAC,EACJ,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAC3B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9C,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;sDAGkD;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,MAAM,CAAC,EACH,OAAO,6BAA6B,EAAE,WAAW,GACjD,MAAM,GACN;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACtD,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,gBAAgB,CAAC,EACb,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,CAAC,MACG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAClD,kFAAkF;IAClF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,aAAa,CAAC,EAAE;QACd,mEAAmE;QACnE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,uEAAuE;QACvE,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gFAAgF;QAChF,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,gFAAgF;QAChF,KAAK,CAAC,EAAE,KAAK,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;YACjB,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;SAC1B,CAAC,CAAC;KACJ,CAAC;IACF;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACxE;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;;;;;OAcG;IACH,YAAY,CAAC,EAAE,CACb,KAAK,EAAE,GAAG,EACV,KAAK,EAAE,MAAM,KACV,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,2BAA2B,CAAC;IACjD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC;QACX,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,mBAAmB,EAAE,CAAC;QACnC,UAAU,EAAE,kBAAkB,EAAE,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;QAC/B,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;KACtB,KACG,IAAI,GACJ;QACE,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,GACD,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACrC,CAAC,CAAC;IACP;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE;QAC7B,OAAO,EAAE,OAAO,oBAAoB,EAAE,OAAO,CAAC;QAC9C,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,OAAO,oBAAoB,EAAE,iBAAiB,CAAC;QACxD,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;KAC/B,KACG,OAAO,oBAAoB,EAAE,OAAO,GACpC,MAAM,GACN,IAAI,GACJ,SAAS,GACT,OAAO,CAAC,OAAO,oBAAoB,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC9E;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE5B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;IAErC;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,EAAE;QACd,UAAU,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,SAAS,CAAC;QAC7C;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAEF;;;OAGG;IACH,UAAU,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D"}

package/dist/server/agent-chat/plugin-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-options.js","sourceRoot":"","sources":["../../../src/server/agent-chat/plugin-options.ts"],"names":[],"mappings":"","sourcesContent":["import type { ActionEntry } from \"../../agent/production-agent.js\";\nimport type { AgentLoopFinalResponseGuard } from \"../../agent/production-agent.js\";\nimport type {\n  AgentChatAttachment,\n  AgentChatReference,\n  MentionProvider,\n} from \"../../agent/types.js\";\nimport type { DatabaseToolsOption } from \"../../scripts/db/tool-mode.js\";\nimport type { PromptExamples } from \"../prompts/index.js\";\n\n/** Shape of a Nitro plugin function: receives the Nitro app instance at\n * startup and may register routes/hooks synchronously or asynchronously. */\nexport type NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\nexport interface AgentChatPluginOptions {\n  /** Template-specific actions (email ops, booking ops, etc.) */\n  actions?:\n    | Record<string, ActionEntry>\n    | (() =>\n        | Record<string, ActionEntry>\n        | Promise<Record<string, ActionEntry>>);\n  /** @deprecated Use `actions` instead */\n  scripts?:\n    | Record<string, ActionEntry>\n    | (() =>\n        | Record<string, ActionEntry>\n        | Promise<Record<string, ActionEntry>>);\n  /** System prompt for the agent. A sensible default is provided. */\n  systemPrompt?: string;\n  /** Additional system prompt prepended in dev mode */\n  devSystemPrompt?: string;\n  /** Model to use. Defaults to the resolved engine's default model. */\n  model?: string;\n  /** Optional per-app agent run chunk budget in milliseconds. Defaults to\n   * AGENT_RUN_SOFT_TIMEOUT_MS when set, otherwise no framework-imposed\n   * timeout. When reached, long runs continue through the hidden continuation\n   * path instead of surfacing a timeout warning. */\n  runSoftTimeoutMs?: number;\n  /** Optional per-app run-manager no-progress watchdog in milliseconds. */\n  runNoProgressTimeoutMs?: number;\n  /**\n   * Opt this app into Netlify durable background-function agent-chat runs. This\n   * gives hosted agent turns the 15-minute async-function budget when the app's\n   * Netlify build also emits the background function.\n   */\n  durableBackgroundRuns?: boolean;\n  /** Anthropic API key. Falls back to ANTHROPIC_API_KEY env var */\n  apiKey?: string;\n  /**\n   * Agent engine to use. Can be a pre-constructed AgentEngine, a registered\n   * engine name (e.g. \"anthropic\", \"ai-sdk:openai\"), or an object with name\n   * and config. Defaults to the \"anthropic\" engine using ANTHROPIC_API_KEY.\n   */\n  engine?:\n    | import(\"../../agent/engine/types.js\").AgentEngine\n    | string\n    | { name: string; config: Record<string, unknown> };\n  /** Route path. Default: /_agent-native/agent-chat */\n  path?: string;\n  /** Custom mention providers for @-tagging template entities */\n  mentionProviders?:\n    | Record<string, MentionProvider>\n    | (() =>\n        | Record<string, MentionProvider>\n        | Promise<Record<string, MentionProvider>>);\n  /** App ID used to exclude self from agent discovery (e.g., \"mail\", \"calendar\") */\n  appId?: string;\n  /** Optional MCP server branding surfaced during the initialize handshake. */\n  mcpServerInfo?: {\n    /** Human-facing title. Defaults to the capitalized app id/name. */\n    title?: string;\n    /** Host-facing description. Defaults to \"Agent-native <app> agent\". */\n    description?: string;\n    /** Canonical app URL. Relative URLs are resolved against the request origin. */\n    websiteUrl?: string;\n    /** App icons. Relative `src` values are resolved against the request origin. */\n    icons?: Array<{\n      src: string;\n      mimeType?: string;\n      sizes?: string[];\n      theme?: \"light\" | \"dark\";\n    }>;\n  };\n  /**\n   * Optional callback to resolve the org ID for the current request.\n   * When provided, the resolved value is set as AGENT_ORG_ID env var so\n   * that db-query/db-exec automatically scope by org_id in addition to\n   * owner_email.\n   *\n   * If not provided, the framework automatically uses `session.orgId` from\n   * Better Auth's active organization. Only provide this callback when you\n   * need custom org resolution logic (e.g., Atlassian org mapping).\n   */\n  resolveOrgId?: (event: any) => string | null | Promise<string | null>;\n  /**\n   * Optional owner resolver for public/anonymous chat surfaces. When the\n   * normal app session is missing, this callback may return a synthetic\n   * owner id for a narrowly-scoped public request (for example, a public\n   * shared document page). Anonymous requests use a read-only tool set by\n   * default so public viewers cannot mutate app data through the agent.\n   */\n  anonymousOwner?: (event: any) => string | null | Promise<string | null>;\n  /**\n   * Keep anonymous-owner requests on read-only template actions. Defaults to\n   * true. Only disable for single-tenant apps that intentionally allow public\n   * agent mutations.\n   */\n  anonymousReadOnly?: boolean;\n  /**\n   * Optional callback to append template-specific context to the system\n   * prompt on each request. Runs after AGENTS.md / skills / memory are\n   * loaded and before the schema block — use it to inject dynamic SQL\n   * context like a data dictionary, active feature flags, or whatever\n   * the agent should know about *right now* for this user/org.\n   *\n   * Return `null` or an empty string to skip. The string you return is\n   * appended verbatim, so wrap it in your own XML tags (e.g.\n   * `<data-dictionary>…</data-dictionary>`) to keep the prompt scannable.\n   *\n   * Called on every request in every prompt variant (lean, lazy, full).\n   * Templates that want to suppress it in a particular mode should return\n   * `null` from the callback based on their own logic.\n   */\n  extraContext?: (\n    event: any,\n    owner: string,\n  ) => string | null | Promise<string | null>;\n  /**\n   * Optional final-answer guard. Templates can use this to require a\n   * corrective retry before accepting a text-only final answer, e.g. forcing\n   * real data-source tool calls for analytics requests.\n   */\n  finalResponseGuard?: AgentLoopFinalResponseGuard;\n  /**\n   * Optional per-template request normalizer. Runs after authentication and\n   * before the model sees the message, so apps can translate chat attachments\n   * into template-native file handles while preserving the user's visible text.\n   */\n  prepareRequest?: (details: {\n    event: any;\n    ownerEmail: string | null;\n    message: string;\n    displayMessage?: string;\n    attachments: AgentChatAttachment[];\n    references: AgentChatReference[];\n    threadId?: string;\n    internalContinuation?: boolean;\n    mode: \"act\" | \"plan\";\n  }) =>\n    | void\n    | {\n        message?: string;\n        displayMessage?: string;\n        attachments?: AgentChatAttachment[];\n      }\n    | Promise<void | {\n        message?: string;\n        displayMessage?: string;\n        attachments?: AgentChatAttachment[];\n      }>;\n  /**\n   * Use ONLY the template's `systemPrompt` and the actions list — skip the\n   * framework prompt wrapper, resource loading (AGENTS.md/LEARNINGS.md/\n   * memory), the SQL schema block, and the workspace files/skills/agents\n   * inventory. Intended for minimal or voice-first apps where a long,\n   * generic preamble adds latency and iteration noise without adding value.\n   *\n   * When set, the same lean prompt is used in both dev and prod modes. In\n   * dev mode the tool registry is ALSO swapped to the template's actions\n   * (same set as prod) — the dev-only bash/db-exec/file-system tools\n   * and the resource/docs/chat/team/job/browser scripts are dropped. The\n   * lean system prompt has no bash-usage guidance, so routing actions\n   * through bash would break. If you need the full dev tool surface,\n   * leave this off.\n   */\n  leanPrompt?: boolean;\n  /**\n   * Skip auto-injecting the workspace files/skills/agents inventory on the\n   * first message of a conversation while keeping the normal prompt, resources,\n   * and tool surface. Use this for domain-focused apps where broad workspace\n   * inventory is mostly latency/noise unless the user explicitly references it.\n   *\n   * `leanPrompt: true` and the default `lazyContext` mode imply this because\n   * those catalogs are already discoverable through resources, docs-search,\n   * tool-search, and the compact resource indexes. Set `false` explicitly only\n   * when a workspace-wide inventory is central to the app's first-turn job.\n   */\n  skipFilesContext?: boolean;\n  /**\n   * Initial native tool schemas to send to the LLM provider. When set, the\n   * agent starts with only these tools plus `tool-search`; the live registry\n   * remains searchable, and matching schemas from `tool-search` results are\n   * loaded into the next model request. Use this for domain-focused apps that\n   * have a few common actions and many rare framework utilities. Common\n   * discovery and resource-reading tools are promoted automatically when\n   * present. Provider, MCP, extension, and code-execution schemas stay behind\n   * tool-search unless the app explicitly includes them in this list.\n   */\n  initialToolNames?: string[];\n  /**\n   * Use a compact system prompt with on-demand context loading. The system\n   * prompt includes essential behavioral rules and action signatures, but\n   * defers verbose framework details, SQL schema, skills, learnings, and\n   * memory behind tools (`get-framework-context`, `db-schema`,\n   * `resources` (action: read)). The agent fetches these on-demand when needed.\n   *\n   * This reduces the system prompt by ~60-70%, significantly improving\n   * time-to-first-token and reducing \"thinking\" time. The agent retains\n   * all capabilities — it just loads context lazily instead of upfront.\n   *\n   * Defaults to `true`. Set to `false` to use the original full prompt.\n   * Ignored when `leanPrompt` is set (lean mode is even more minimal).\n   */\n  lazyContext?: boolean;\n  /**\n   * In dev mode, register the template's actions as native tools the agent\n   * can call directly with structured JSON args — skipping the default\n   * `bash(command=\"pnpm action <name> ...\")` indirection.\n   *\n   * The default dev behavior shells out because it \"mirrors how Claude Code\n   * works locally\" and reduces empty-object tool calls for templates with\n   * simple string args. But templates whose actions take structured data\n   * (objects, arrays, nested JSON) can't round-trip those cleanly through\n   * the CLI parser — stringified JSON on the way in, loss of type fidelity\n   * on the way out.\n   *\n   * Set to `true` to get the same tool surface in dev that production uses.\n   * `leanPrompt: true` implies this already (lean mode has no bash-usage\n   * guidance, so actions must be native). Set this flag without\n   * `leanPrompt` when you want native actions AND the full system prompt.\n   *\n   * Defaults to `false`.\n   */\n  nativeActionsInDev?: boolean;\n  /**\n   * Expose raw SQL/native database tools to the app agent.\n   *\n   * Defaults to `\"read\"`: `db-schema`/`db-query` are available for inspection,\n   * while writes route through typed app actions. Set to `\"write\"` (also\n   * `true`) to expose `db-exec`/`db-patch` for scoped raw SQL maintenance.\n   * Set to `\"off\"` (also `false`) for chat-first apps that want agents to use\n   * typed actions only.\n   */\n  databaseTools?: DatabaseToolsOption;\n  /**\n   * Expose framework extension management actions (`create-extension`,\n   * `update-extension`, `list-extensions`, etc.) to the app agent. Defaults to\n   * true. Set to false for apps that do not want the LLM to create or manage\n   * sandboxed extension mini-apps, even though the core extension routes may\n   * still be mounted for other surfaces.\n   */\n  extensionTools?: boolean;\n  /**\n   * Optional A2A-only deterministic response path. Runs after inbound A2A text\n   * and user context are resolved, but before an agent engine/model is loaded.\n   * Return a message to complete the A2A task without invoking the LLM, or\n   * null/undefined to continue through the normal agent loop.\n   */\n  a2aMessageFallback?: (details: {\n    message: import(\"../../a2a/types.js\").Message;\n    text: string;\n    context: import(\"../../a2a/types.js\").A2AHandlerContext;\n    userEmail: string | undefined;\n  }) =>\n    | import(\"../../a2a/types.js\").Message\n    | string\n    | null\n    | undefined\n    | Promise<import(\"../../a2a/types.js\").Message | string | null | undefined>;\n  /**\n   * Optional injectable prompt examples for core rules (rule 5 auto-refresh\n   * examples and rule 8 external provider names). When absent, generic\n   * placeholders are used so no template-specific names appear in the core\n   * prompt by default.\n   *\n   * - `providerActions`: external provider action names this template exposes\n   *   (e.g. `[\"warehouse-query\", \"crm-records\"]` for a template).\n   * - `appActions`: representative template action names for rule 5's refresh\n   *   examples (e.g. `[\"log-meal\", \"update-form\"]` for a forms template).\n   */\n  promptExamples?: PromptExamples;\n  /**\n   * Curated allow-list of action names to serve external **connector** clients\n   * on a hosted multi-tenant deployment.\n   *\n   * Whenever this list is non-empty it is active by default for **every**\n   * caller (hosted connectors, code/stdio clients, and the local CLI): external\n   * MCP clients see (and can call) only these actions plus the builtin\n   * cross-app tools (`list_apps`, `open_app`, `ask_app`, `create_embed_session`).\n   * Calls to any tool outside the list are rejected with \"Unknown tool\".\n   * This prevents the full ~105-tool catalog from bloating external-agent\n   * context windows and removes footguns (db-exec, seed-*, extension suite,\n   * browser-session tools) from connectors. It is no longer gated behind an\n   * environment variable, and the catalog is never inferred from the client.\n   *\n   * `tool-search` stays available so any trimmed tool is reachable on demand.\n   * Callers who need the full surface up front opt in explicitly with\n   * `agent-native connect --full-catalog` (embeds a `catalog_scope: \"full\"`\n   * claim in their connect-minted JWT) or the deployment-wide\n   * `AGENT_NATIVE_MCP_FULL_CATALOG=1` env override.\n   *\n   * Declare here rather than in MCPConfig directly; the plugin copies it through.\n   */\n  connectorCatalog?: string[];\n\n  /**\n   * Skip mounting the remote MCP protocol route.\n   *\n   * Most apps should leave this off so agent chat, A2A, and MCP share one\n   * runtime. Hosted apps with a dedicated early MCP plugin can set this to\n   * true so their external connector does not depend on the heavier chat\n   * plugin initialization path.\n   */\n  disableMcp?: boolean;\n\n  /**\n   * Code-execution capability for the production agent.\n   *\n   * - `\"off\"` (default) — no code-execution tools in production.\n   * - `\"sandboxed\"` — registers the `run-code` tool (isolated Node.js sandbox\n   *   with a bridge to allowlisted registered tools). Safe for shared or\n   *   hosted deployments.\n   * - `\"trusted\"` — registers both the full coding tool registry\n   *   (bash / read / edit / write) and the `run-code` sandbox. Only use in\n   *   single-tenant or operator-controlled deployments where full shell access\n   *   to the host machine is intentional.\n   *\n   * The `AGENT_PROD_CODE_EXECUTION` environment variable (`\"trusted\"`,\n   * `\"sandboxed\"`, or `\"off\"`) takes precedence over this option, allowing\n   * per-deployment overrides without code changes.\n   *\n   * Dev-mode behavior is unchanged — both the coding tools and `run-code` are\n   * always available when the environment allows toggling.\n   */\n  codeExecution?: {\n    production?: \"off\" | \"sandboxed\" | \"trusted\";\n    /**\n     * Extra registered-tool names the sandbox bridge may forward (beyond the\n     * default allowlist: provider-api-request, provider-api-docs,\n     * provider-api-catalog, web-request).\n     */\n    bridgeTools?: string[];\n  };\n\n  /**\n   * App-level default tool-call limits. Individual actions override these with\n   * their own `timeoutMs` / `maxResultChars` declarations.\n   */\n  toolLimits?: { timeoutMs?: number; maxResultChars?: number };\n}\n"]}
+{"version":3,"file":"plugin-options.js","sourceRoot":"","sources":["../../../src/server/agent-chat/plugin-options.ts"],"names":[],"mappings":"","sourcesContent":["import type { ActionEntry } from \"../../agent/production-agent.js\";\nimport type { AgentLoopFinalResponseGuard } from \"../../agent/production-agent.js\";\nimport type {\n  AgentChatAttachment,\n  AgentChatReference,\n  MentionProvider,\n} from \"../../agent/types.js\";\nimport type { ExternalAgentPolicy } from \"../../mcp/external-agent-policy.js\";\nimport type { DatabaseToolsOption } from \"../../scripts/db/tool-mode.js\";\nimport type { PromptExamples } from \"../prompts/index.js\";\n\n/** Shape of a Nitro plugin function: receives the Nitro app instance at\n * startup and may register routes/hooks synchronously or asynchronously. */\nexport type NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\nexport interface AgentChatPluginOptions {\n  /** Template-specific actions (email ops, booking ops, etc.) */\n  actions?:\n    | Record<string, ActionEntry>\n    | (() =>\n        | Record<string, ActionEntry>\n        | Promise<Record<string, ActionEntry>>);\n  /** @deprecated Use `actions` instead */\n  scripts?:\n    | Record<string, ActionEntry>\n    | (() =>\n        | Record<string, ActionEntry>\n        | Promise<Record<string, ActionEntry>>);\n  /** System prompt for the agent. A sensible default is provided. */\n  systemPrompt?: string;\n  /** Additional system prompt prepended in dev mode */\n  devSystemPrompt?: string;\n  /** Model to use. Defaults to the resolved engine's default model. */\n  model?: string;\n  /** Optional per-app agent run chunk budget in milliseconds. Defaults to\n   * AGENT_RUN_SOFT_TIMEOUT_MS when set, otherwise no framework-imposed\n   * timeout. When reached, long runs continue through the hidden continuation\n   * path instead of surfacing a timeout warning. */\n  runSoftTimeoutMs?: number;\n  /** Optional per-app run-manager no-progress watchdog in milliseconds. */\n  runNoProgressTimeoutMs?: number;\n  /**\n   * Opt this app into Netlify durable background-function agent-chat runs. This\n   * gives hosted agent turns the 15-minute async-function budget when the app's\n   * Netlify build also emits the background function.\n   */\n  durableBackgroundRuns?: boolean;\n  /** Anthropic API key. Falls back to ANTHROPIC_API_KEY env var */\n  apiKey?: string;\n  /**\n   * Agent engine to use. Can be a pre-constructed AgentEngine, a registered\n   * engine name (e.g. \"anthropic\", \"ai-sdk:openai\"), or an object with name\n   * and config. Defaults to the \"anthropic\" engine using ANTHROPIC_API_KEY.\n   */\n  engine?:\n    | import(\"../../agent/engine/types.js\").AgentEngine\n    | string\n    | { name: string; config: Record<string, unknown> };\n  /** Route path. Default: /_agent-native/agent-chat */\n  path?: string;\n  /** Custom mention providers for @-tagging template entities */\n  mentionProviders?:\n    | Record<string, MentionProvider>\n    | (() =>\n        | Record<string, MentionProvider>\n        | Promise<Record<string, MentionProvider>>);\n  /** App ID used to exclude self from agent discovery (e.g., \"mail\", \"calendar\") */\n  appId?: string;\n  /** Optional MCP server branding surfaced during the initialize handshake. */\n  mcpServerInfo?: {\n    /** Human-facing title. Defaults to the capitalized app id/name. */\n    title?: string;\n    /** Host-facing description. Defaults to \"Agent-native <app> agent\". */\n    description?: string;\n    /** Canonical app URL. Relative URLs are resolved against the request origin. */\n    websiteUrl?: string;\n    /** App icons. Relative `src` values are resolved against the request origin. */\n    icons?: Array<{\n      src: string;\n      mimeType?: string;\n      sizes?: string[];\n      theme?: \"light\" | \"dark\";\n    }>;\n  };\n  /**\n   * Optional callback to resolve the org ID for the current request.\n   * When provided, the resolved value is set as AGENT_ORG_ID env var so\n   * that db-query/db-exec automatically scope by org_id in addition to\n   * owner_email.\n   *\n   * If not provided, the framework automatically uses `session.orgId` from\n   * Better Auth's active organization. Only provide this callback when you\n   * need custom org resolution logic (e.g., Atlassian org mapping).\n   */\n  resolveOrgId?: (event: any) => string | null | Promise<string | null>;\n  /**\n   * Optional owner resolver for public/anonymous chat surfaces. When the\n   * normal app session is missing, this callback may return a synthetic\n   * owner id for a narrowly-scoped public request (for example, a public\n   * shared document page). Anonymous requests use a read-only tool set by\n   * default so public viewers cannot mutate app data through the agent.\n   */\n  anonymousOwner?: (event: any) => string | null | Promise<string | null>;\n  /**\n   * Keep anonymous-owner requests on read-only template actions. Defaults to\n   * true. Only disable for single-tenant apps that intentionally allow public\n   * agent mutations.\n   */\n  anonymousReadOnly?: boolean;\n  /**\n   * Optional callback to append template-specific context to the system\n   * prompt on each request. Runs after AGENTS.md / skills / memory are\n   * loaded and before the schema block — use it to inject dynamic SQL\n   * context like a data dictionary, active feature flags, or whatever\n   * the agent should know about *right now* for this user/org.\n   *\n   * Return `null` or an empty string to skip. The string you return is\n   * appended verbatim, so wrap it in your own XML tags (e.g.\n   * `<data-dictionary>…</data-dictionary>`) to keep the prompt scannable.\n   *\n   * Called on every request in every prompt variant (lean, lazy, full).\n   * Templates that want to suppress it in a particular mode should return\n   * `null` from the callback based on their own logic.\n   */\n  extraContext?: (\n    event: any,\n    owner: string,\n  ) => string | null | Promise<string | null>;\n  /**\n   * Optional final-answer guard. Templates can use this to require a\n   * corrective retry before accepting a text-only final answer, e.g. forcing\n   * real data-source tool calls for analytics requests.\n   */\n  finalResponseGuard?: AgentLoopFinalResponseGuard;\n  /**\n   * Optional per-template request normalizer. Runs after authentication and\n   * before the model sees the message, so apps can translate chat attachments\n   * into template-native file handles while preserving the user's visible text.\n   */\n  prepareRequest?: (details: {\n    event: any;\n    ownerEmail: string | null;\n    message: string;\n    displayMessage?: string;\n    attachments: AgentChatAttachment[];\n    references: AgentChatReference[];\n    threadId?: string;\n    internalContinuation?: boolean;\n    mode: \"act\" | \"plan\";\n  }) =>\n    | void\n    | {\n        message?: string;\n        displayMessage?: string;\n        attachments?: AgentChatAttachment[];\n      }\n    | Promise<void | {\n        message?: string;\n        displayMessage?: string;\n        attachments?: AgentChatAttachment[];\n      }>;\n  /**\n   * Use ONLY the template's `systemPrompt` and the actions list — skip the\n   * framework prompt wrapper, resource loading (AGENTS.md/LEARNINGS.md/\n   * memory), the SQL schema block, and the workspace files/skills/agents\n   * inventory. Intended for minimal or voice-first apps where a long,\n   * generic preamble adds latency and iteration noise without adding value.\n   *\n   * When set, the same lean prompt is used in both dev and prod modes. In\n   * dev mode the tool registry is ALSO swapped to the template's actions\n   * (same set as prod) — the dev-only bash/db-exec/file-system tools\n   * and the resource/docs/chat/team/job/browser scripts are dropped. The\n   * lean system prompt has no bash-usage guidance, so routing actions\n   * through bash would break. If you need the full dev tool surface,\n   * leave this off.\n   */\n  leanPrompt?: boolean;\n  /**\n   * Skip auto-injecting the workspace files/skills/agents inventory on the\n   * first message of a conversation while keeping the normal prompt, resources,\n   * and tool surface. Use this for domain-focused apps where broad workspace\n   * inventory is mostly latency/noise unless the user explicitly references it.\n   *\n   * `leanPrompt: true` and the default `lazyContext` mode imply this because\n   * those catalogs are already discoverable through resources, docs-search,\n   * tool-search, and the compact resource indexes. Set `false` explicitly only\n   * when a workspace-wide inventory is central to the app's first-turn job.\n   */\n  skipFilesContext?: boolean;\n  /**\n   * Initial native tool schemas to send to the LLM provider. When set, the\n   * agent starts with only these tools plus `tool-search`; the live registry\n   * remains searchable, and matching schemas from `tool-search` results are\n   * loaded into the next model request. Use this for domain-focused apps that\n   * have a few common actions and many rare framework utilities. Common\n   * discovery and resource-reading tools are promoted automatically when\n   * present. Provider, MCP, extension, and code-execution schemas stay behind\n   * tool-search unless the app explicitly includes them in this list.\n   */\n  initialToolNames?: string[];\n  /**\n   * Use a compact system prompt with on-demand context loading. The system\n   * prompt includes essential behavioral rules and action signatures, but\n   * defers verbose framework details, SQL schema, skills, learnings, and\n   * memory behind tools (`get-framework-context`, `db-schema`,\n   * `resources` (action: read)). The agent fetches these on-demand when needed.\n   *\n   * This reduces the system prompt by ~60-70%, significantly improving\n   * time-to-first-token and reducing \"thinking\" time. The agent retains\n   * all capabilities — it just loads context lazily instead of upfront.\n   *\n   * Defaults to `true`. Set to `false` to use the original full prompt.\n   * Ignored when `leanPrompt` is set (lean mode is even more minimal).\n   */\n  lazyContext?: boolean;\n  /**\n   * In dev mode, register the template's actions as native tools the agent\n   * can call directly with structured JSON args — skipping the default\n   * `bash(command=\"pnpm action <name> ...\")` indirection.\n   *\n   * The default dev behavior shells out because it \"mirrors how Claude Code\n   * works locally\" and reduces empty-object tool calls for templates with\n   * simple string args. But templates whose actions take structured data\n   * (objects, arrays, nested JSON) can't round-trip those cleanly through\n   * the CLI parser — stringified JSON on the way in, loss of type fidelity\n   * on the way out.\n   *\n   * Set to `true` to get the same tool surface in dev that production uses.\n   * `leanPrompt: true` implies this already (lean mode has no bash-usage\n   * guidance, so actions must be native). Set this flag without\n   * `leanPrompt` when you want native actions AND the full system prompt.\n   *\n   * Defaults to `false`.\n   */\n  nativeActionsInDev?: boolean;\n  /**\n   * Expose raw SQL/native database tools to the app agent.\n   *\n   * Defaults to `\"read\"`: `db-schema`/`db-query` are available for inspection,\n   * while writes route through typed app actions. Set to `\"write\"` (also\n   * `true`) to expose `db-exec`/`db-patch` for scoped raw SQL maintenance.\n   * Set to `\"off\"` (also `false`) for chat-first apps that want agents to use\n   * typed actions only.\n   */\n  databaseTools?: DatabaseToolsOption;\n  /**\n   * Expose framework extension management actions (`create-extension`,\n   * `update-extension`, `list-extensions`, etc.) to the app agent. Defaults to\n   * true. Set to false for apps that do not want the LLM to create or manage\n   * sandboxed extension mini-apps, even though the core extension routes may\n   * still be mounted for other surfaces.\n   */\n  extensionTools?: boolean;\n  /**\n   * Optional A2A-only deterministic response path. Runs after inbound A2A text\n   * and user context are resolved, but before an agent engine/model is loaded.\n   * Return a message to complete the A2A task without invoking the LLM, or\n   * null/undefined to continue through the normal agent loop.\n   */\n  a2aMessageFallback?: (details: {\n    message: import(\"../../a2a/types.js\").Message;\n    text: string;\n    context: import(\"../../a2a/types.js\").A2AHandlerContext;\n    userEmail: string | undefined;\n  }) =>\n    | import(\"../../a2a/types.js\").Message\n    | string\n    | null\n    | undefined\n    | Promise<import(\"../../a2a/types.js\").Message | string | null | undefined>;\n  /**\n   * Optional injectable prompt examples for core rules (rule 5 auto-refresh\n   * examples and rule 8 external provider names). When absent, generic\n   * placeholders are used so no template-specific names appear in the core\n   * prompt by default.\n   *\n   * - `providerActions`: external provider action names this template exposes\n   *   (e.g. `[\"warehouse-query\", \"crm-records\"]` for a template).\n   * - `appActions`: representative template action names for rule 5's refresh\n   *   examples (e.g. `[\"log-meal\", \"update-form\"]` for a forms template).\n   */\n  promptExamples?: PromptExamples;\n  /**\n   * Curated allow-list of action names to serve external **connector** clients\n   * on a hosted multi-tenant deployment.\n   *\n   * Whenever this list is non-empty it is active by default for **every**\n   * caller (hosted connectors, code/stdio clients, and the local CLI): external\n   * MCP clients see (and can call) only these actions plus the builtin\n   * cross-app tools (`list_apps`, `open_app`, `ask_app`, `create_embed_session`).\n   * Calls to any tool outside the list are rejected with \"Unknown tool\".\n   * This prevents the full ~105-tool catalog from bloating external-agent\n   * context windows and removes footguns (db-exec, seed-*, extension suite,\n   * browser-session tools) from connectors. It is no longer gated behind an\n   * environment variable, and the catalog is never inferred from the client.\n   *\n   * `tool-search` stays available for discovery; a trimmed action still needs\n   * the connector catalog, authenticated-read policy, or full-catalog opt-in\n   * before an external caller can execute it.\n   * Callers who need the full surface up front opt in explicitly with\n   * `agent-native connect --full-catalog` (embeds a `catalog_scope: \"full\"`\n   * claim in their connect-minted JWT) or the deployment-wide\n   * `AGENT_NATIVE_MCP_FULL_CATALOG=1` env override.\n   *\n   * Declare here rather than in MCPConfig directly; the plugin copies it through.\n   */\n  connectorCatalog?: string[];\n\n  /**\n   * Default authenticated external-agent policy. In `auto` read mode, every\n   * action explicitly marked as GET + readOnly + publicAgent.requiresAuth is\n   * added to the connector surface automatically. Writes remain ask_app-only\n   * unless `writes: \"allowlisted\"` is explicitly selected.\n   */\n  externalAgents?: ExternalAgentPolicy;\n\n  /**\n   * Skip mounting the remote MCP protocol route.\n   *\n   * Most apps should leave this off so agent chat, A2A, and MCP share one\n   * runtime. Hosted apps with a dedicated early MCP plugin can set this to\n   * true so their external connector does not depend on the heavier chat\n   * plugin initialization path.\n   */\n  disableMcp?: boolean;\n\n  /**\n   * Code-execution capability for the production agent.\n   *\n   * - `\"off\"` (default) — no code-execution tools in production.\n   * - `\"sandboxed\"` — registers the `run-code` tool (isolated Node.js sandbox\n   *   with a bridge to allowlisted registered tools). Safe for shared or\n   *   hosted deployments.\n   * - `\"trusted\"` — registers both the full coding tool registry\n   *   (bash / read / edit / write) and the `run-code` sandbox. Only use in\n   *   single-tenant or operator-controlled deployments where full shell access\n   *   to the host machine is intentional.\n   *\n   * The `AGENT_PROD_CODE_EXECUTION` environment variable (`\"trusted\"`,\n   * `\"sandboxed\"`, or `\"off\"`) takes precedence over this option, allowing\n   * per-deployment overrides without code changes.\n   *\n   * Dev-mode behavior is unchanged — both the coding tools and `run-code` are\n   * always available when the environment allows toggling.\n   */\n  codeExecution?: {\n    production?: \"off\" | \"sandboxed\" | \"trusted\";\n    /**\n     * Extra registered-tool names the sandbox bridge may forward (beyond the\n     * default allowlist: provider-api-request, provider-api-docs,\n     * provider-api-catalog, web-request).\n     */\n    bridgeTools?: string[];\n  };\n\n  /**\n   * App-level default tool-call limits. Individual actions override these with\n   * their own `timeoutMs` / `maxResultChars` declarations.\n   */\n  toolLimits?: { timeoutMs?: number; maxResultChars?: number };\n}\n"]}

package/dist/server/agent-chat/script-entries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"script-entries.d.ts","sourceRoot":"","sources":["../../../src/server/agent-chat/script-entries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAQnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AA6CvE;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,iBAA0B,EAChC,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACzC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CA4ItC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAwEA;AAED;;GAEG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAW3E;AAED,wBAAsB,2BAA2B,IAAI,OAAO,CAC1D,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAuPA;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAqJA;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAqBtC;AAED;;;GAGG;AACH,wBAAsB,oCAAoC,IAAI,OAAO,CACnE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAUA;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAYtC"}
+{"version":3,"file":"script-entries.d.ts","sourceRoot":"","sources":["../../../src/server/agent-chat/script-entries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAQnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAwDvE;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,iBAA0B,EAChC,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACzC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAkJtC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAwEA;AAED;;GAEG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAW3E;AAED,wBAAsB,2BAA2B,IAAI,OAAO,CAC1D,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAuPA;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAqJA;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAqBtC;AAED;;;GAGG;AACH,wBAAsB,oCAAoC,IAAI,OAAO,CACnE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAUA;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAYtC"}

package/dist/server/agent-chat/script-entries.js

@@ -21,6 +21,14 @@ function wrapCliScript(tool, cliDefault, opts) {
         run: async (args) => {
             const cliArgs = [];
             for (const [k, v] of Object.entries(args)) {
+                // MCP input schemas are descriptive and some hosts can still send
+                // undeclared keys. The externally exposed DB readers must never accept
+                // the CLI-only `--db` escape hatch, which could point at another local
+                // SQLite file. Keep their runtime surface identical to the advertised
+                // schema instead of trusting the client to validate it.
+                if (opts?.allowedArgs && !opts.allowedArgs.includes(k)) {
+                    throw new Error(`Unknown argument: ${k}`);
+                }
                 const raw = v;
                 const value = raw != null && typeof raw === "object"
                     ? JSON.stringify(raw)
@@ -72,7 +80,10 @@ export async function createDbScriptEntries(mode = "read", options = {}) {
                         },
                     },
                 },
-            }, schemaMod.default, { readOnly: true }),
+            }, schemaMod.default, {
+                allowedArgs: ["format"],
+                readOnly: true,
+            }),
             "db-query": wrapCliScript({
                 description: `Read from the app's own SQL database ONLY. Runs a SELECT against the app's internal tables (settings, application_state, template tables). Results are auto-scoped to the current user/org. IMPORTANT: This tool CANNOT access external data sources like data warehouses, CRMs, issue trackers, analytics platforms, calendars, mail, docs, or other third-party services. For those, use the relevant template/provider action, MCP connector, or provider-api-catalog/provider-api-docs/provider-api-request when available. If the user names a provider, that named provider wins; do not substitute a warehouse or app database copy unless they explicitly ask for it. If a table isn't in the app schema, don't try db-query — use the data-source-specific action. ${extensionQueryGuidance}`,
                 parameters: {
@@ -98,7 +109,10 @@ export async function createDbScriptEntries(mode = "read", options = {}) {
                     },
                     required: ["sql"],
                 },
-            }, queryMod.default, { readOnly: true }),
+            }, queryMod.default, {
+                allowedArgs: ["sql", "args", "format", "limit"],
+                readOnly: true,
+            }),
         };
         if (execMod && patchMod) {
             entries["db-exec"] = wrapCliScript({