[3mdistal]

Problem

Connected agents can ask an app to perform work through ask_app or A2A. Those delegated runs currently receive internal framework tools even when direct MCP dispatch excludes them. Several automation management paths also let outside calls create or change jobs with ordinary unattended authority.

This PR gives delegated runs the app's own actions and a bounded static documentation reader, while excluding the framework runtime. The covered framework and app automation actions require outside approval and record provenance; marked runs require approval for each write.

What changed

• Filter both delegated registries after request-scoped actions merge and before initial tools, tool search, and mid-run expansion are built. Approval replay uses the same boundary. Reuse Restrict direct MCP runtime tools and enforce automation approval #8070's runtime exclusions, including code execution, framework email/fetch/database/browser tools, cross-agent delegation, workspace-file tools, and legacy manage-jobs.
• Preserve template actions available to the app's agent, including mcpTool: false and server-guarded raw SQL. Reapply agentTool and uiOnly restrictions after request-scoped merges so hidden entries cannot be dispatched by name, searched, or replayed. Analytics' warehouse actions remain available. Keep app definitions on name collisions, including a custom docs-search; use eager skill content when that name is occupied. Required db-*, provider-api-*, and seed-* exclusions remain. The served-registry report lists removals by template and name.
• Preserve caller: "tool" in delegated execution and approval replay. Carry MCP/A2A network provenance separately into approval contexts and isOutsideAgentCall, so existing template tool behavior stays intact.
• Keep only the resolved read-only static docs wrapper for bundled instructions, docs and codebase skills. Delegated runs no longer have framework resource/memory tools. Remove generated guidance for unavailable tools; in-app prompt defaults stay unchanged.
• Require outside approval on the framework automation management actions, Factory's prompt-automation create/save/restore/run actions, and Analytics' index scheduler. Covered creation and edit paths stamp mcpManaged from server context; Factory restore retains the current marker. Factory creation uses bounded conditional inserts without overwriting an existing definition. Single-line automation settings now reject line breaks. Creation stamping in factory-scheduler-job.ts uses the same strict normalization boundary as save and restore. Trusted, unmarked saves and restores of headerless text retain legacy behavior without constructing headers; prompts starting with a header block still undergo frontmatter/provenance validation. Outside or marked writes with incomplete settings return 400 invalid_request before history or persistence; previews remain lenient.
• Keep template actions such as build-data-index in marked automation runs, while excluding framework runtime tools. Each prepared write still requires approval, including writes without their own gate; persistent grants do not satisfy it. Ordinary in-app definitions remain unmarked; unmarked runs retain their runtime registry and use each action's approval predicate.

Scope and release order

This PR follows merged #8070, reusing its framework markers and prepared-write approval boundary. The branch includes normal merges of main at e9d5ffad and 798991fd, preserving reviewed history. The release order remains #8070, then this PR in the same release, with no core publish between them; #8070 alone leaves delegated calls unchanged.

Through the automation actions covered here, A2A peers need approval to create or change definitions, and marked prompt runs need approval for each write. Unattended authority must come from the person rather than a peer agent. Framework automation management, Factory saves and Analytics index-schedule changes retain enclosing outside-call provenance through isOutsideAutomationOrigin; the shared isOutsideAgentCall helper is unchanged. Existing template approval predicates otherwise remain in place.

Not in this PR

A store-level guarantee that every write path preserves and stamps outside provenance is planned as a separate follow-up. This PR covers the actions listed above.

CLI dispatch and embed-session gating remain in their owning PRs. Direct MCP eligibility and its allowlist are unchanged. This PR does not change Mail's connector catalog, Design's instructions, or catalog selectors/toolsets.

The CRM-to-Clips setup probe on main 4472c549 failed before any automation was created, so delivery was not observed there. A separate app-created personal automation reproduced the missing-org delivery gap. Outcome truthfulness, org-bound personal runs and the setup handoff are separate follow-ups and do not gate this stack.

Verification

The nested-origin repair at 3c51e63f3d3f passes 587 tests: 338 Factory owner tests across eight suites, 20 Analytics scheduler tests, and 229 Core approval/origin/export tests across eight suites. The new cases use real enclosing MCP/A2A frames with trusted inner contexts, require approval before any effect, reject changed inputs, and verify a single approved Factory write retains provenance through the real core parser. The gate controls first reproduced eight intended failures; independently reverting only the Factory provenance change reproduced four marker failures. Core build, Core/Factory/Analytics typechecks, repository lint/format, strict compiler coverage and seven named guards pass. Both shared caller-helper blobs are unchanged. Sol xhigh reviewed the bounded delta and supplied integration snippets with no P1/P2 findings; this was a source-packet review, not independent test execution. The latest Builder review confirms the two nested-origin fixes. The marked-registry comment was dispositioned under the documented delegated policy; all review threads are resolved. All nine required hosted checks are satisfied on this head: six pass and three are not applicable/skipped. Michael Wang's approving review remains in place.

The following verification was recorded on the preceding main-merge snapshot:

The latest main update is 89ce39024fb3, merging 798991fd without manual conflict edits. It passes 402 focused tests: 180 delegated/registry owners, 215 direct-MCP and durable A2A approval tests, two marked/ordinary runner controls, and five public-SDK/Analytics inventory cases. All 41 approval snapshots matched; the committed snapshot comments are preserved. Core build and typecheck, repository lint/format, strict compiler coverage, six named guards and seven positive execution-lease models pass. The shared caller-helper blobs are unchanged. Dependency linking completed; workspace postinstall still stops on the previously observed Toolkit React-type diagnostics, with no Toolkit or lockfile workaround. All nine required hosted checks pass on 89ce39024fb3; the final bounded review also examined the supplied integration snippets.

The following verification was recorded before this latest main merge:

The latest visibility repair passes 180 tests across the complete delegated-runtime, additional-actions, filter and eligibility suites; both marked/ordinary runner controls and all three ordinary Analytics inventory checks also pass. The new regressions reproduced four intended failures on the preceding implementation. Core typecheck, strict compiler coverage, repository lint/format, focused guards and the four positive execution-lease models pass. The final bounded Sol review examined the supplied integration snippets alongside the nested-origin repair.

• The latest cleanup preserves Factory's ES2020 target with checked indexing; no compiler configuration changes are included. Its normal typecheck, compiler strictness, all 334 Factory owner tests, formatting and repository lint pass. Two new public-SDK approval tests also pass; removing the helper export first produced two intended failures. Mutation-owner discovery now finds all owners, including the public entrypoint. This is not a mutation-score claim, and the mutation runner is unchanged.

• Main-update checks pass: 199 Core approval/origin tests across four suites, 137 direct-MCP tests across three suites, all 334 Factory tests across eight suites, and all 16 Analytics scheduler tests. The delegated-entry smoke and the marked/unmarked runtime controls also pass individually. This is focused validation, not a full Core-suite pass.

• Repository formatting and lint pass. The compiler strictness check passes on all three affected projects; the named MCP, source-reading, escape-hatch, assertion, strict-lint and localization guards pass. Execution-lease verification passes its four positive model configurations with all 44 coverage entries intact, without updating coverage.

• Core build and typecheck passed on the main-merge snapshot before the final type/fixture cleanup. The broader local dependency prebuild stops on a Toolkit React-type identity mismatch; no Toolkit or lockfile workaround is included. All nine required hosted checks pass on 3a227a0477c5; the later bounded Sol review examined the supplied integration snippets.

• The initial combined Core run was stopped after three failures. The entry smoke passes in isolation, and the two registry cases pass after moving their real dependency loading into setup while retaining the 30-second case budgets and all assertions. Those selected runner checks emitted database-close teardown warnings; that limitation is retained with the local results.

Earlier validation below predates this main update:

• Before the Factory save/restore repair, the rebased stack passed 808 tests across 23 core suites and 585 tests across 11 MCP suites. These cover catalog modes and aliases, initial/search/expanded registries, real loop dispatch, self/remote routing, durable A2A approvals, exact-input replay, caller semantics and static-reader privacy. That snapshot also passed Core/Toolkit builds, core typecheck, all 50 workspace typechecks, repository lint and all 93 guards.
• The Factory refusal snapshot passed 308 tests across eight suites after reproducing 105 intended failures with 150 controls passing. The preceding typed 400-response delta passed 219 tests across four affected suites after 86 intended fail-first failures; Factory typecheck, focused lint/format, localization/source-reading guards and LF/diff checks pass on that delta. The saved-metadata control passed before production changes. Analytics' unchanged schedule owner previously passed 16, and the ordinary Analytics registry test passed all three cases.
• The headerless compatibility repair passes 334 tests across eight Factory suites after reproducing 30 intended failures with 135 controls passing. Ten compatibility cases also execute pinned-main owner modules and match their stored bytes/history/CAS behavior; this is an owner-harness comparison, not deployed-main testing. Factory typecheck, focused lint/format, both i18n guards and source-reading/LF/diff checks pass. A fresh Opus 5.5 xhigh review approves this six-file delta with no P1/P2 findings.
• The actual-main registry comparison is complete: 17 isolated main processes and the final composite companion capture show no unexpected app-binding losses or identity/route changes, within the report's stated limits.
• Final targeted staged MCP/localization/source-reading guards pass without skips. Focused review of the final typed-response delta and corrected claims reports no P1/P2 findings; the preceding review held the marker, compatibility, saved-metadata and CAS behavior.

The initial Fast tests lane 2 job on 3c51e63f3d3f reported one Content editor stable-retry assertion (changed instead of prepared), with 7,284 other Content tests passing. The test, editor and flush participant are byte-identical to the merged main base. The exact case passes in isolation and the complete unchanged owner file passes 49/49 locally. Lane 2 passes on its single rerun. No source or assertion changes were made for it.

An additional unchanged scripts/docs/framework-search.spec.ts case fails locally on Windows because its existing URL.pathname path handling cannot find package docs. Standalone reproduction and byte-identical baseline evidence are retained; the required suites above pass. No source or assertion workaround was added; Linux CI remains authoritative for that extra suite.

The changed-Core mutation job on 3c51e63f3d3f repeats the initial-test failure seen on the preceding heads: the relocated Core-only sandbox resolves the template inventory's repository path to packages/core/templates, which is absent there. Stryker instruments 283 candidates but runs no mutants and produces no mutation score. This is the runtime-filesystem selection gap also observed on #8070; the mutation runner and inventory assertions remain unchanged, and the ordinary Analytics inventory passes locally.

Earlier checks on the stacked base encountered the database mock omission fixed by #8120 and the standalone Chat approval/queue race fixed by #8115. The main update includes both fixes; all nine required hosted checks pass on 3a227a0477c5.

The repair ledger preserves exact expectation changes and their reasons. Local specs exercise real registries, agent-loop dispatch, self/remote routing, durable A2A approvals, single-use replay, static-reader privacy, ordinary in-app controls and failing-first regressions. A model asking for approval in prose before issuing a tool call remains separate from the server approval lifecycle and is not claimed fixed here.

Test expectation changes

Fixture / expectation	Old → new	Reason
automations/service.spec.ts: already-applied change	Actor omits caller → caller: "frontend"; exact changed === false remains.	Unknown origin now adds provenance; this fixture represents an in-app no-op.
Same spec: lift pause during an active run	Omitted caller → frontend; exact enabled/running/error/pause assertions remain.	The fixture tests an ordinary edit, while outside takeover of a running definition is refused.
Same spec: concurrent pause/no-op	Omitted caller → frontend; exact no-change and disabled-state assertions remain.	A provenance change would make an outside call a real edit.
Same spec: retry after resource type changes	Omitted caller → frontend; exact 400 and one attempted write remain.	The retry tests definition revalidation under in-app authority.
Same spec: retry after app ownership changes	Omitted caller → frontend; exact 403 and one attempted write remain.	The fixture tests app-access revalidation, without an additional provenance transition.
Same spec: repeated concurrent changes	Omitted caller → frontend; exact 409 and no unconditional write remain.	The fixture must reach edit retry exhaustion under its intended authority.
audit/attribution.spec.ts: copied approved context	Null protocol/id → a2a/task; caller remains tool; no child approval grant.	A copied context retains origin without inheriting the one-call approval.
Same spec: context retained after invocation	Null protocol/id → a2a/task; exact expired-grant assertions remain.	Approval expiry removes authority rather than network provenance.
Same spec: defined child through a raw bridge	Null protocol/id → a2a/task; exact missing child grant remains.	The bridge preserves origin and isolates approvals.
Same spec: raw child through a raw bridge	Null protocol/id → a2a/task; caller remains tool and no child grant appears.	Raw dispatch has the same origin and approval-isolation contract.
action-filters-a2a.spec.ts: replay context	Caller a2a → tool; require exact A2A protocol/task, bound grant and isOutsideAgentCall(ctx) === true.	Tool semantics and outside origin are separate dimensions.
Same spec: replay audit row	Audit caller a2a → tool; exact protocol/task/lease/grant fields remain.	The audit record must match the actual app-tool invocation.
agent-chat-plugin.surface.spec.ts: native actions	Source-slice assertions → real-plugin A2A/MCP behavior in dev and production.	Entry identity, initial native schema/prompt and absence of CLI guidance prove the property across registry composition.
agent-chat-plugin.a2a.spec.ts: initial automation tool	Two source-spread occurrences → actual registry, initial tools and available tools contain manage-automations.	Behavioral coverage proves that composition and filtering retain the tool.
delegated-runtime.spec.ts: ten inline-MCP catalog cases	Unknown or unavailable tool: manage-automations → exact Error: Unknown tool "manage-automations"; approval-false/no-definition checks remain.	The real loop uses this reply for the intentionally absent inline tool; A2A separately requires a real approval event.
Same spec: dev in-app approval control	inAppRun() → inAppRun(true) for nativeActionsInDev; exact result/caller/no-protocol checks remain.	The native probe must be registered; default dev CLI controls retain their setup.
Real automation approval-route fixture	Guessed tables/missing leases → real organization and run-store migrations.	The durable owner/org/input/call/hash/pending/one-replay/duplicate-409 assertions require a real execution fence.
App-collision fixture lifecycle	Shared task identifier → separate dev/production task identifiers.	A completed task cannot supply the next run lease; registry and replay assertions remain exact.
Factory create/run/save bootstrap	First-use initialization inside cases → awaited real module/store setup in beforeAll.	Cold initialization finishes before each unchanged 30-second action case; one-effect assertions remain exact.
Factory save dispatch fixture	Identity action wrapper → real framework defineAction.	The test exercises actual approval binding before persistence effects.
Factory history in-app fixtures	Missing context → explicit frontend context.	These fixtures represent ordinary in-app work; missing origin retains its conservative classification.
Factory history cleanup fixture	Missing cleanup persistence leaf → observable returning/cleanup leaf.	The existing orphan-history cleanup on CAS failure and write errors remains asserted.
Factory resource fixture typing	Widened creator string → literal "system" as const.	This matches the existing resource type without changing the runtime expected value.
Factory typed-refusal fixtures	Raw Zod error → real framework error with status 400, invalid_request and affected field.	The original fake failure helper discarded status options; real failure transport and all no-write/history assertions are now checked.
Template inventory fixture isolation	All templates in one shared process → Analytics default plus explicit isolated template captures.	Package action registration is process-global; isolation prevents cross-template contamination without resetting production registries.
Factory header-validation fixtures	Untyped throw-only checks → typed 400 invalid_request, plus no history lookup or conditional write.	Refusal is limited to outside/marked writes; added trusted, unmarked headerless save/restore cases preserve pinned-main bytes.
New automation-origin owner spec	MCP-only no-frame result false → broader outside-origin result true; nested MCP/trusted-frame controls retained and tool-over-MCP/A2A controls added.	The companion already classifies an unknown origin conservatively and keeps tool semantics separate from network provenance.
Strict compiler coverage	Optional context properties explicitly accept undefined; first-call and header reads are narrowed.	These type proofs retain the same context, canonical-marker, metadata and CAS expectations.
Runner registry fixture startup	Real imports inside the action cases → real imports in a bounded setup hook; the 30-second case budgets and assertions stay unchanged.	Cold dependency loading is separated from the behavior being checked; both marked and ordinary controls pass.
Public SDK approval contract	No public-entrypoint coverage → real SDK-backed approval decisions for MCP/A2A with an ordinary-tool control.	This protects the helper export independently of its unchanged direct-module unit tests.
Scoped action visibility	Keep agentTool: false / uiOnly entries in the final delegated map → reapply app-agent visibility after the merge.	Advertising alone does not prevent a model-generated call by name; mcpTool: false and raw-input app controls remain callable.
Scoped-call replay fixture	Fixed organization context → the captured run's organization context, retaining the previous default when absent.	A caller-bound MCP action must be replayed under its actual request scope; all existing assertions remain.
Scheduler service mock	Full trigger-module replacement → partial mock retaining the real origin classifier.	The shared Factory normalizer now uses that classifier; the two existing service mocks and every owner assertion remain unchanged.

No assertion was deleted or relaxed.

An app-provided docs-search entry is preserved on both delegated loops instead of being overwritten by the framework reader. The bounded static reader is installed only as a fallback; when the app owns that name, skills are included eagerly and the exact app entry remains callable.

[github-actions]

Here's a visual recap of what changed:

Open the full interactive recap

[3mdistal]

The latest review confirms the hidden-action fixes in 3a227a0477c5 and reports no additional confirmed issue. The headerless-content thread has the intentional pinned-main compatibility disposition; it is resolved. The two nested-origin approval threads remain open for the pending focused review. No additional source change is needed for this incremental review.

[builder-io-integration]

Builder reviewed your changes and found 1 potential issue 🟡

Review Details

Code Review Summary

This update continues PR #8140’s effort to keep framework runtime tools out of delegated runs and to carry outside-caller provenance through automation management and approval replay. The approval ancestry changes in Factory save and Analytics schedule now use the shared origin-aware check, and the new replay/context coverage is a solid safeguard. The review threads for those two previously reported nested-approval issues were verified fixed and resolved.

Risk assessment: High — this PR changes approval and delegated execution boundaries. Both independent review passes identified a confirmed regression in the MCP-managed background automation action filter: it replaces the external-agent eligibility policy with only agentTool/uiOnly checks, so explicitly MCP-hidden actions and raw-query inputs can be exposed to unattended automation reads. The new runner spec exercises a mcpTool: false SQL action completing successfully, confirming the widened capability. This should be corrected before merge by retaining the external-agent/MCP eligibility checks while also excluding framework runtime actions.

The review environment could not run tests: setup failed during the toolkit TypeScript build. 🧪 Browser testing: Skipped — PR changes backend/action logic, prompts, and tests, with no user-facing UI impact.