@netlify/agent-runner-cli 1.192.0 → 1.193.0

package/dist/skills/netlify-edge-functions/SKILL.md

@@ -244,6 +244,36 @@ context.cookies.set({ name: 'session', value: 'abc123', path: '/', httpOnly: tru
 context.cookies.delete('session')
 ```
 
+### `context.user`
+
+The user who signed in through Netlify's SSO to reach a private project or a site protected by Netlify team login, or
+`undefined` otherwise. Netlify verifies the visitor at the edge and sets this itself, so it can't be spoofed with
+request headers.
+
+```typescript
+context.user.id        // string - user ID
+context.user.email     // string - user email address
+context.user.expiresAt // Date - when the user's access expires
+```
+
+```typescript
+// netlify/edge-functions/whoami.ts
+import type { Config, Context } from '@netlify/edge-functions'
+
+export default async (req: Request, context: Context) => {
+  if (!context.user) return new Response('Unauthorized', { status: 401 })
+  return Response.json({ id: context.user.id, email: context.user.email })
+}
+
+export const config: Config = {
+  path: '/whoami',
+}
+```
+
+This is the Netlify team member viewing the site, not a Netlify Identity user. See the
+[changelog post](https://www.netlify.com/changelog/2026-10-07-context-user-in-functions/) and the
+[Edge Functions API docs](https://docs.netlify.com/build/edge-functions/api/#user).
+
 ### `context.waitUntil(promise)`
 
 Extends execution after the response is sent:

package/dist/skills/netlify-functions/SKILL.md

@@ -215,6 +215,39 @@ context.cookies.delete('session')
 context.server.region // string - e.g., 'us-east-1'
 ```
 
+### `context.user`
+
+The user who signed in through Netlify's SSO to reach a private project or a site protected by Netlify team login.
+`undefined` when the request didn't come from such a user. Netlify verifies the visitor and sets this itself, so it
+can't be spoofed with request headers.
+
+```typescript
+context.user.id        // string - user ID
+context.user.email     // string - user email address
+context.user.expiresAt // Date - when the user's access expires
+```
+
+```typescript
+// netlify/functions/whoami.mts
+import type { Config, Context } from '@netlify/functions'
+
+export default async (req: Request, context: Context) => {
+  if (!context.user) return new Response('Unauthorized', { status: 401 })
+  return Response.json({
+    id: context.user.id,
+    email: context.user.email,
+    expiresAt: context.user.expiresAt.toISOString(),
+  })
+}
+
+export const config: Config = { path: '/whoami' }
+```
+
+This is the Netlify team member viewing the site, not a Netlify Identity user; for end-user accounts on your site use
+the `netlify-identity` skill. See the
+[changelog post](https://www.netlify.com/changelog/2026-10-07-context-user-in-functions/) and the
+[Functions API docs](https://docs.netlify.com/build/functions/api/#user).
+
 ### `context.waitUntil(promise)`
 
 Extends execution after the response is sent. Use for analytics, logging, or cleanup tasks.

package/dist/skills/netlify-identity/SKILL.md

@@ -402,6 +402,31 @@ browser sends the new cookie.
 Always use `window.location.href` (not framework router navigation) after server-side auth mutations in Next.js,
 TanStack Start, and SvelteKit. Remix `redirect()` is safe because Remix actions return real HTTP responses.
 
+## Netlify SSO Users (`context.user`)
+
+Netlify Identity is for your site's own end users. Separately, on private projects and sites protected by Netlify team
+login, Netlify Functions, Edge Functions, and Netlify Server code can read the Netlify team member who signed in through
+Netlify's SSO from the request context as `context.user` (`id`, `email`, `expiresAt`). Netlify verifies the visitor at
+the edge and sets it itself, so it can't be spoofed with request headers.
+
+Use `context.user` instead of Netlify Identity when the only people who should reach the site are members of the
+Netlify team (internal dashboards, audit logs, approval workflows): there is no signup, login UI, or `@netlify/identity`
+setup to build, and you don't run the enable script for it. Use `getUser()` from `@netlify/identity` when the site has
+its own user accounts.
+
+```typescript
+// netlify/functions/whoami.mts
+import type { Context } from '@netlify/functions'
+
+export default async (req: Request, context: Context) => {
+  if (!context.user) return new Response('Unauthorized', { status: 401 })
+  return Response.json({ id: context.user.id, email: context.user.email })
+}
+```
+
+See the [changelog post](https://www.netlify.com/changelog/2026-10-07-context-user-in-functions/), and the
+**netlify-functions**, **netlify-edge-functions**, and **netlify-server** skills for runtime-specific details.
+
 ## Identity Event Functions
 
 Subscribe to Identity lifecycle events by exporting an object whose properties are named event handlers. See the

package/dist/skills/netlify-server@netlifyserver/SKILL.md

@@ -108,6 +108,20 @@ Rules:
 - ONLY call `getContext()` while handling a request (inside a route handler, middleware, or code awaited from one). It throws outside a request.
 - Works with every server form, including WebSocket upgrade handling.
 
+### SSO user: `context.user`
+
+On private projects and sites protected by Netlify team login, the context also carries the user who signed in through Netlify's SSO: `context.user` with `id`, `email`, and `expiresAt` (a `Date`). It is `undefined` when the request didn't come from such a user. Netlify verifies the visitor and sets it itself, so it can't be spoofed with request headers. This is the Netlify team member viewing the site, not a Netlify Identity user.
+
+```javascript
+app.get('/api/whoami', (req, res) => {
+  const { user } = getContext()
+  if (!user) return res.status(401).send('Unauthorized')
+  res.json({ id: user.id, email: user.email })
+})
+```
+
+See the [changelog post](https://www.netlify.com/changelog/2026-10-07-context-user-in-functions/).
+
 ## AI inference: Netlify AI Gateway
 
 The AI Gateway works with zero configuration: provider credentials and base URLs (`OPENAI_API_KEY`, `OPENAI_BASE_URL`, and equivalents for other providers) are injected into `process.env` automatically. See the `netlify-ai-gateway` skill for supported models and usage.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@netlify/agent-runner-cli",
   "type": "module",
-  "version": "1.192.0",
+  "version": "1.193.0",
   "description": "CLI tool for running Netlify agents",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",