@agent-native/core 0.100.2 → 0.101.3

package/corpus/core/src/server/action-routes.ts

@@ -1,4 +1,5 @@
 import {
+  createError,
   defineEventHandler,
   setResponseStatus,
   setResponseHeader,
@@ -10,6 +11,7 @@ import {
 
 import { isAgentActionStopError } from "../action.js";
 import type { ActionEntry } from "../agent/production-agent.js";
+import { resolveOrgIdForEmail } from "../org/context.js";
 import { readBody } from "../server/h3-helpers.js";
 import { EMBED_TARGET_HEADER } from "../shared/embed-auth.js";
 import {
@@ -18,6 +20,10 @@ import {
   shouldAllowMcpEmbedCredentials,
 } from "../shared/mcp-embed-headers.js";
 import { notifyActionChange } from "./action-change.js";
+import {
+  seedAgentRunOwnerContext,
+  type AgentRunOwnerContext,
+} from "./agent-run-context.js";
 import {
   getAllowedCorsOrigin as resolveAllowedCorsOrigin,
   readCorsAllowedOrigins,
@@ -164,6 +170,51 @@ function handleOptionsRequest(event: any): string {
   return "";
 }
 
+/**
+ * Declarative auth adapter for the HTTP action route. Its `resolveCaller` runs
+ * BEFORE the framework's `getOwnerFromEvent` / `getSession` chain, letting an
+ * app accept caller identities `getSession` doesn't understand (e.g. an A2A
+ * JWT) without reaching into request context from a Nitro `request` hook.
+ *
+ * Scoped to `/_agent-native/actions/*` only — it does not affect other routes.
+ */
+export type ActionRouteResolvedCaller = AgentRunOwnerContext & {
+  /**
+   * Org to scope the request to, verified from the same credential as the
+   * caller identity (e.g. the A2A token's org claim). When omitted, the org
+   * is derived from the verified owner email via the framework's owner→org
+   * membership lookup. The ambient session/org state on the request is never
+   * consulted for adapter-resolved callers: a request can carry both a valid
+   * A2A bearer and an unrelated browser cookie, and the cookie user's org
+   * must not leak into the token caller's request context.
+   */
+  orgId?: string;
+};
+
+export interface ActionRouteAuthAdapter {
+  /**
+   * Resolve a caller from the raw event before the cookie/bearer chain.
+   *
+   * - Return the resolved caller to run the action scoped to that identity.
+   *   Org scoping comes exclusively from the caller: the returned `orgId` if
+   *   set, otherwise the owner-email membership lookup — never from the
+   *   request's session cookie or org context.
+   * - Return `null` when the credential isn't yours to judge — the request
+   *   defers to `getOwnerFromEvent` / `getSession`.
+   * - THROW to hard-reject: the credential is present but invalid (e.g. an
+   *   expired or forged A2A bearer). The action route responds 401 and does
+   *   NOT fall through to the cookie/session chain, so a valid same-origin
+   *   session cookie can't be used to execute the request as the logged-in
+   *   user. Do not throw merely to signal "not mine" — return `null` for that.
+   */
+  resolveCaller?: (
+    event: any,
+  ) =>
+    | ActionRouteResolvedCaller
+    | null
+    | Promise<ActionRouteResolvedCaller | null>;
+}
+
 export interface MountActionRoutesOptions {
   /** Resolve owner email from the H3 event (for data scoping). */
   getOwnerFromEvent?: (event: any) => string | Promise<string>;
@@ -173,6 +224,18 @@ export interface MountActionRoutesOptions {
   ) => string | undefined | Promise<string | undefined>;
   /** Resolve org ID from the H3 event (for org scoping). */
   resolveOrgId?: (event: any) => string | null | Promise<string | null>;
+  /**
+   * Optional caller resolver that runs before the `getOwnerFromEvent` /
+   * `getSession` chain. Lets apps accept A2A JWTs (or other bearer schemes) on
+   * the action route declaratively. See {@link ActionRouteAuthAdapter}.
+   */
+  actionRouteAuth?: ActionRouteAuthAdapter;
+}
+
+function normalizeOrgId(value: string | null | undefined): string | undefined {
+  return typeof value === "string" && value.trim().length > 0
+    ? value.trim()
+    : undefined;
 }
 
 function isAuthResolutionFailure(error: unknown): boolean {
@@ -259,7 +322,42 @@ export function mountActionRoutes(
         // Resolve auth context for per-request scoping
         let userEmail: string | undefined;
         let userName: string | undefined;
-        if (options?.getOwnerFromEvent) {
+        // An app-supplied auth adapter runs first: it can accept caller
+        // identities the framework's getSession chain doesn't understand (e.g.
+        // an A2A JWT). A resolved caller is seeded onto the event context so any
+        // downstream resolveAgentRunOwnerContext (nested agent runs) sees the
+        // same identity. The adapter is only consulted for the action route, so
+        // it can't affect other surfaces.
+        //
+        // Contract: `resolveCaller` returning `null` means "this credential
+        // isn't mine — defer to the cookie/session chain below". THROWING means
+        // "the credential is mine but invalid" (e.g. an expired/forged A2A
+        // bearer) and is a hard rejection: we surface a 401 instead of falling
+        // through, so a live same-origin session cookie can't silently execute
+        // the request as the logged-in user.
+        let resolvedCaller: ActionRouteResolvedCaller | null = null;
+        if (options?.actionRouteAuth?.resolveCaller) {
+          let caller: ActionRouteResolvedCaller | null;
+          try {
+            caller = await options.actionRouteAuth.resolveCaller(event);
+          } catch {
+            throw createError({
+              statusCode: 401,
+              statusMessage: "Unauthorized",
+            });
+          }
+          if (caller) {
+            seedAgentRunOwnerContext(event, {
+              owner: caller.owner,
+              anonymous: caller.anonymous,
+              name: caller.name,
+            });
+            userEmail = caller.owner;
+            userName = caller.name;
+            resolvedCaller = caller;
+          }
+        }
+        if (!resolvedCaller && options?.getOwnerFromEvent) {
           try {
             userEmail = await options.getOwnerFromEvent(event);
             userName = options?.getUserNameFromEvent
@@ -277,9 +375,32 @@ export function mountActionRoutes(
             }
           }
         }
-        const orgId = options?.resolveOrgId
-          ? ((await options.resolveOrgId(event)) ?? undefined)
-          : undefined;
+        // Org scoping. For adapter-resolved callers the org must come
+        // exclusively from the verified credential: the adapter-asserted
+        // orgId when present, otherwise the owner-email membership lookup.
+        // The request's ambient session/org state (`resolveOrgId`, usually
+        // getSession-backed) is deliberately NOT consulted — a request can
+        // carry both a valid A2A bearer and an unrelated same-origin browser
+        // cookie, and the cookie user's org must not become the org the
+        // token caller's actions execute under. Non-adapter callers keep the
+        // original resolveOrgId-only behavior.
+        let orgId: string | undefined;
+        if (resolvedCaller) {
+          orgId = normalizeOrgId(resolvedCaller.orgId);
+          if (!orgId && resolvedCaller.owner && !resolvedCaller.anonymous) {
+            try {
+              orgId = normalizeOrgId(
+                await resolveOrgIdForEmail(resolvedCaller.owner),
+              );
+            } catch {
+              // Org tables may not exist yet on first boot.
+            }
+          }
+        } else {
+          orgId = options?.resolveOrgId
+            ? ((await options.resolveOrgId(event)) ?? undefined)
+            : undefined;
+        }
         const timezone = readTimezoneHeader(event);
 
         return runWithRequestContext(

package/corpus/core/src/server/agent-chat/plugin-options.ts

@@ -109,6 +109,22 @@ export interface AgentChatPluginOptions {
    * agent mutations.
    */
   anonymousReadOnly?: boolean;
+  /**
+   * Optional auth adapter for the HTTP action route
+   * (`/_agent-native/actions/*`). Its `resolveCaller` runs before the
+   * cookie/bearer `getSession` chain, letting an app accept caller identities
+   * `getSession` doesn't understand (e.g. an A2A JWT verified with
+   * `verifyA2AToken`) declaratively, instead of pre-seeding request context
+   * from a Nitro `request` hook.
+   *
+   * Returning `null` defers to the normal chain; THROWING hard-rejects with a
+   * 401 (an invalid/forged credential must not fall through to a same-origin
+   * session cookie). A resolved caller's org comes exclusively from the
+   * verified credential — the returned `orgId` or the owner-email membership
+   * lookup — never from the request's session cookie.
+   * See {@link import("../action-routes.js").ActionRouteAuthAdapter}.
+   */
+  actionRouteAuth?: import("../action-routes.js").ActionRouteAuthAdapter;
   /**
    * Optional callback to append template-specific context to the system
    * prompt on each request. Runs after AGENTS.md / skills / memory are

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -134,6 +134,7 @@ import {
   WORKSPACE_OWNER,
 } from "../resources/store.js";
 import { normalizeDatabaseToolsMode } from "../scripts/db/tool-mode.js";
+import type { ResolvedKeyReference } from "../secrets/substitution.js";
 import { getSetting, putSetting } from "../settings/store.js";
 import {
   handleSharedThreadRequest,
@@ -323,6 +324,41 @@ const generateTitleRateLimit = new Map<string, number[]>();
  * so the common small-map case stays O(1). */
 const RATE_LIMIT_SWEEP_THRESHOLD = 1000;
 
+/**
+ * Pick the URL allowlist to enforce for a `${keys.NAME}` reference used by
+ * the agent fetch tool.
+ *
+ * SECURITY (audit 05 H2 alignment): the allowlist check must stay
+ * consistent with the scope a key actually resolved at (see the
+ * `getKeyAllowlist` docstring in secrets/substitution.ts). Since the fetch
+ * tool now resolves keys via `resolveKeyReferencesWithRequestScopes` — which
+ * cascades user → org → workspace scope — a plain user-scope-only allowlist
+ * lookup would silently miss an allowlist configured on the org/workspace
+ * row that actually supplied the value. When `resolvedKeys` reports which
+ * scope a key resolved at, look up the allowlist there; only fall back to
+ * the legacy user-scope lookup for a key the resolver didn't report (should
+ * not normally happen — every key the cascade resolves reports a ref).
+ */
+export async function resolveFetchToolKeyAllowlist(
+  keyName: string,
+  resolvedKeys: ResolvedKeyReference[] | undefined,
+  owner: string,
+  deps: {
+    getKeyAllowlist: (
+      name: string,
+      scope: "user",
+      scopeId: string,
+    ) => Promise<string[] | null>;
+    getResolvedKeyAllowlist: (
+      ref: ResolvedKeyReference,
+    ) => Promise<string[] | null>;
+  },
+): Promise<string[] | null> {
+  const ref = resolvedKeys?.find((candidate) => candidate.name === keyName);
+  if (ref) return deps.getResolvedKeyAllowlist(ref);
+  return deps.getKeyAllowlist(keyName, "user", owner);
+}
+
 export function createAgentChatPlugin(
   options?: AgentChatPluginOptions,
 ): NitroPluginDef {
@@ -793,21 +829,38 @@ export function createAgentChatPlugin(
       try {
         const { createFetchToolEntry } =
           await import("../extensions/fetch-tool.js");
-        const { resolveKeyReferences, validateUrlAllowlist, getKeyAllowlist } =
-          await import("../secrets/substitution.js");
+        // Resolve `${keys.NAME}` through the same request-scope cascade
+        // already used by extension fetches (extensions/routes.ts) and
+        // automation connector headers (automation/index.ts): user scope
+        // first (personal overrides win), then the active org scope (the
+        // Dispatch vault syncs workspace secrets here), then workspace
+        // scope. Org/workspace vault rows are write-gated (org-admin +
+        // Dispatch vault UI), so this is safe to read by default — unlike
+        // the opt-in-only user→workspace fallback in resolveKeyReferences
+        // (see audit 05 H2 in secrets/substitution.ts), which stays off.
+        // Previously this tool only looked at scope "user", so a
+        // ${keys.NAME} reference to a key synced into the org/workspace
+        // vault could never resolve here even though the same key already
+        // worked for extension fetches and automations.
+        const {
+          resolveKeyReferencesWithRequestScopes,
+          validateUrlAllowlist,
+          getKeyAllowlist,
+          getResolvedKeyAllowlist,
+        } = await import("../secrets/substitution.js");
         fetchTool = createFetchToolEntry({
           resolveKeys: async (text) =>
-            resolveKeyReferences(
+            resolveKeyReferencesWithRequestScopes(
               text,
-              "user",
               requireCurrentRunOwner("resolve key references"),
             ),
-          validateUrl: async (url, usedKeys) => {
+          validateUrl: async (url, usedKeys, resolvedKeys) => {
             for (const keyName of usedKeys) {
-              const allowlist = await getKeyAllowlist(
+              const allowlist = await resolveFetchToolKeyAllowlist(
                 keyName,
-                "user",
+                resolvedKeys,
                 requireCurrentRunOwner("validate URL allowlist"),
+                { getKeyAllowlist, getResolvedKeyAllowlist },
               );
               if (allowlist && !validateUrlAllowlist(url, allowlist)) {
                 return false;
@@ -1804,6 +1857,7 @@ export function createAgentChatPlugin(
           getOwnerFromEvent,
           getUserNameFromEvent,
           resolveOrgId: options?.resolveOrgId,
+          actionRouteAuth: options?.actionRouteAuth,
         });
       }
 

package/corpus/core/src/server/derived-secret.ts

@@ -20,7 +20,11 @@ export function deriveServerSecret(
 }
 
 export function getWorkspaceA2ADerivedSecret(
-  purpose: "better-auth" | "oauth-state" | "short-lived-token",
+  purpose:
+    | "better-auth"
+    | "oauth-state"
+    | "short-lived-token"
+    | "secrets-encryption",
 ): string | undefined {
   if (!isWorkspaceRuntime()) return undefined;
   const rootSecret = process.env.A2A_SECRET?.trim();

package/corpus/core/src/server/index.ts

@@ -241,6 +241,7 @@ export {
   renderAgentNativeOgImageSvg,
   type AgentNativeOgImageInput,
 } from "./social-og-image.js";
+export { resolveOgFontFiles } from "./og-fonts.js";
 export {
   createBrowserSessionActionEntries,
   type CreateBrowserSessionActionEntriesOptions,
@@ -320,7 +321,14 @@ export {
 export {
   mountActionRoutes,
   type MountActionRoutesOptions,
+  type ActionRouteAuthAdapter,
+  type ActionRouteResolvedCaller,
 } from "./action-routes.js";
+export {
+  AGENT_RUN_OWNER_CONTEXT_KEY,
+  seedAgentRunOwnerContext,
+  type AgentRunOwnerContext,
+} from "./agent-run-context.js";
 export {
   runWithRequestContext,
   hasRequestContext,

package/corpus/core/src/vite/action-types-plugin.ts

@@ -141,6 +141,10 @@ const CORE_SHARING_ACTIONS: Array<{ name: string; specifier: string }> = [
     name: "set-review-status",
     specifier: "@agent-native/core/review/actions/set-review-status",
   },
+  {
+    name: "send-review-thread-to-agent",
+    specifier: "@agent-native/core/review/actions/send-review-thread-to-agent",
+  },
 ];
 
 function isRuntimeSourceFile(filename: string): boolean {

package/corpus/templates/analytics/changelog/2026-07-14-daily-dashboard-email-captures-authenticate-with-a-sessi.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-14
+---
+
+Daily dashboard email captures authenticate with a session cookie, fall back to a lighter panel set, and record page diagnostics when a capture fails.

package/corpus/templates/analytics/changelog/2026-07-14-long-running-cross-app-analyses-now-continue-reliably-in-the.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-14
+---
+
+Long-running cross-app analyses now continue reliably in the background and can use synced workspace provider credentials.

package/corpus/templates/analytics/server/lib/dashboard-report.ts

@@ -11,6 +11,7 @@ import {
 } from "@agent-native/core/server";
 import {
   EMBED_MODE_QUERY_PARAM,
+  EMBED_SESSION_COOKIE,
   EMBED_TOKEN_QUERY_PARAM,
 } from "@agent-native/core/shared";
 
@@ -60,6 +61,7 @@ type DashboardScreenshotAttempt = {
   readyTimeout?: number;
   secondReadyTimeout?: number;
   totalTimeout?: number;
+  reportPanelLimit?: number;
 };
 
 type LaunchedScreenshotBrowser = {
@@ -466,6 +468,96 @@ async function runBoundedBrowserCleanup(
   }
 }
 
+const DIAGNOSTICS_PROBE_TIMEOUT_MS = 2_000;
+const DIAGNOSTICS_MAX_LENGTH = 700;
+const DIAGNOSTICS_COLLECTOR_LIMIT = 5;
+
+// Best-effort page inspection used when the report surface never becomes
+// visible, so failures carry enough state to tell wrong-page/wedged-renderer/
+// auth-bounce apart. Must never throw and must stay bounded even if the page
+// is hung.
+async function collectPageDiagnostics(
+  page: any,
+  consoleErrors: string[],
+  failedRequests: string[],
+): Promise<string> {
+  try {
+    let responsive = true;
+    let probeTimeout: ReturnType<typeof setTimeout> | undefined;
+    try {
+      await Promise.race([
+        Promise.resolve(page.evaluate("1")),
+        new Promise((_, reject) => {
+          probeTimeout = setTimeout(
+            () => reject(new Error("diagnostics probe timed out")),
+            DIAGNOSTICS_PROBE_TIMEOUT_MS,
+          );
+        }),
+      ]);
+    } catch {
+      responsive = false;
+    } finally {
+      if (probeTimeout) clearTimeout(probeTimeout);
+    }
+
+    if (!responsive) {
+      return `page unresponsive (renderer hung or crashed); consoleErrors=${JSON.stringify(
+        consoleErrors,
+      )} failedRequests=${JSON.stringify(failedRequests)}`.slice(
+        0,
+        DIAGNOSTICS_MAX_LENGTH,
+      );
+    }
+
+    let url = "";
+    try {
+      url = page.url();
+    } catch {
+      // page may already be closed; leave url empty
+    }
+
+    let title = "";
+    let bodyText = "";
+    let detailsTimeout: ReturnType<typeof setTimeout> | undefined;
+    try {
+      // page.evaluate ignores setDefaultTimeout, so race it like the probe —
+      // a renderer that wedges after the probe must not stall diagnostics.
+      const details = await Promise.race([
+        Promise.resolve(
+          page.evaluate(
+            `(() => ({
+              title: document.title,
+              bodyText: document.body?.innerText?.slice(0, 240) ?? "",
+            }))()`,
+          ),
+        ),
+        new Promise<never>((_, reject) => {
+          detailsTimeout = setTimeout(
+            () => reject(new Error("diagnostics details timed out")),
+            DIAGNOSTICS_PROBE_TIMEOUT_MS,
+          );
+        }),
+      ]);
+      title = (details as any)?.title ?? "";
+      bodyText = (details as any)?.bodyText ?? "";
+    } catch {
+      // best effort; leave title/bodyText empty
+    } finally {
+      if (detailsTimeout) clearTimeout(detailsTimeout);
+    }
+
+    return `page state: ${JSON.stringify({
+      url,
+      title,
+      bodyText,
+      consoleErrors,
+      failedRequests,
+    })}`.slice(0, DIAGNOSTICS_MAX_LENGTH);
+  } catch {
+    return "diagnostics unavailable";
+  }
+}
+
 async function captureDashboardPng(
   sub: DashboardReportSubscription,
   snapshot: ReportSnapshot,
@@ -488,6 +580,12 @@ async function captureDashboardPng(
   const screenshotUrl = new URL(targetPath, `${dashboardBaseUrl()}/`);
   screenshotUrl.searchParams.set(EMBED_MODE_QUERY_PARAM, "1");
   screenshotUrl.searchParams.set(EMBED_TOKEN_QUERY_PARAM, token);
+  if (attempt.reportPanelLimit) {
+    screenshotUrl.searchParams.set(
+      "reportPanelLimit",
+      String(attempt.reportPanelLimit),
+    );
+  }
 
   let browser: any;
   let cleanup = async () => {};
@@ -498,6 +596,7 @@ async function captureDashboardPng(
   let launchTimeout: ReturnType<typeof setTimeout> | undefined;
   let captureStage = "launching the screenshot browser";
   let attemptTimedOut = false;
+  let lastDiagnostics: string | null = null;
   const attemptTimeout = attempt.totalTimeout
     ? setTimeout(() => {
         attemptTimedOut = true;
@@ -530,6 +629,51 @@ async function captureDashboardPng(
 
     const timeout = screenshotTimeoutMs();
     const page = await newPage();
+
+    // Belt-and-braces auth: the query token authenticates only after the
+    // client-side bootstrap harvests it from the URL, which gives the
+    // stripped-down serverless browser several ways to end up session-less.
+    // Seeding the same signed token as a cookie authenticates every request
+    // server-side with no client cooperation. Never abort the capture over
+    // this — the query token path still exists.
+    try {
+      await page.context().addCookies([
+        {
+          name: EMBED_SESSION_COOKIE,
+          value: token,
+          url: `${dashboardBaseUrl()}/`,
+        },
+      ]);
+    } catch (err) {
+      console.warn(
+        "[dashboard-report] Failed to pre-seed embed session cookie:",
+        errorMessage(err),
+      );
+    }
+
+    // Bounded diagnostics collectors so a failed wait carries evidence of
+    // wrong-page/wedged-renderer/auth-bounce instead of a bare timeout.
+    const consoleErrors: string[] = [];
+    page.on("console", (msg: any) => {
+      if (msg.type() !== "error") return;
+      if (consoleErrors.length >= DIAGNOSTICS_COLLECTOR_LIMIT) return;
+      consoleErrors.push(msg.text().slice(0, 160));
+    });
+    const failedRequests: string[] = [];
+    page.on("requestfailed", (req: any) => {
+      if (failedRequests.length >= DIAGNOSTICS_COLLECTOR_LIMIT) return;
+      failedRequests.push(
+        `${req.method()} ${req.url().slice(0, 120)}: ${req.failure()?.errorText ?? "failed"}`,
+      );
+    });
+    page.on("response", (res: any) => {
+      if (res.status() < 400) return;
+      if (failedRequests.length >= DIAGNOSTICS_COLLECTOR_LIMIT) return;
+      failedRequests.push(
+        `${res.request().method()} ${res.url().slice(0, 120)}: HTTP ${res.status()}`,
+      );
+    });
+
     page.setDefaultTimeout(timeout);
     await page.emulateMedia({ media: "screen", colorScheme: "light" });
     await page.addInitScript(() => {
@@ -542,7 +686,14 @@ async function captureDashboardPng(
 
     captureStage = "waiting for the report surface";
     const capture = page.locator("[data-dashboard-report-capture]");
-    await capture.waitFor({ state: "visible", timeout });
+    try {
+      await capture.waitFor({ state: "visible", timeout });
+    } catch (err) {
+      lastDiagnostics = errorMessage(
+        await collectPageDiagnostics(page, consoleErrors, failedRequests),
+      );
+      throw new Error(`${errorMessage(err)}; ${lastDiagnostics}`);
+    }
     captureStage = "waiting for dashboard queries";
     await waitForDashboardReportReady(page, attempt.readyTimeout ?? timeout);
     captureStage = "rendering lazy dashboard panels";
@@ -569,7 +720,8 @@ async function captureDashboardPng(
   } catch (err) {
     if (attemptTimedOut) {
       throw new Error(
-        `${attempt.label} capture exceeded ${attempt.totalTimeout}ms while ${captureStage}`,
+        `${attempt.label} capture exceeded ${attempt.totalTimeout}ms while ${captureStage}` +
+          (lastDiagnostics ? `; ${lastDiagnostics}` : ""),
       );
     }
     throw new Error(`${captureStage}: ${errorMessage(err)}`);
@@ -612,7 +764,7 @@ function errorMessage(err: unknown): string {
 
 function storedAttemptError(message: string): string {
   const normalized = message.replace(/\s+/g, " ").trim();
-  return normalized.length > 220 ? `${normalized.slice(0, 219)}…` : normalized;
+  return normalized.length > 400 ? `${normalized.slice(0, 399)}…` : normalized;
 }
 
 async function captureDashboardPngWithFallback(
@@ -640,6 +792,7 @@ async function captureDashboardPngWithFallback(
       label: "full-lightweight",
       viewport: { width: 1200, height: 1400 },
       captureScale: 0.7,
+      reportPanelLimit: 8,
       ...(serverless
         ? {
             readyTimeout: 55_000,

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -27,6 +27,9 @@ import {
   needsCorpusWorkflowForCoverageSensitiveRequest,
   needsSourceRecordBodyWorkflowForCoverageSensitiveRequest,
 } from "../lib/real-data-actions";
+
+const ANALYTICS_BACKGROUND_RUN_SOFT_TIMEOUT_MS = 13 * 60_000;
+
 export const SIMPLE_TIME_BOUNDED_METRIC_FAST_PATH_GUIDANCE =
   "SIMPLE TIME-BOUNDED METRIC FAST PATH — When the data dictionary or a known canonical source identifies the metric, run one bounded aggregate. Once it returns a valid result, answer the explicit question immediately with the source, time window, row count, and only necessary caveats. Do not schema-discover, retry, enrich, cross-check, or add breakdowns after that successful result unless the query failed or the result conflicts with the known metric definition. This does not waive the real-data requirement: never answer from a guess, stale value, or unverified result. ";
 
@@ -271,10 +274,11 @@ export default createAgentChatPlugin({
   // Operators deploying to trusted internal environments can set
   // AGENT_PROD_CODE_EXECUTION=trusted to also enable bash/read/edit/write.
   codeExecution: { production: "sandboxed" },
-  // Analytics uses the portable A2A processor until its dedicated background
-  // worker is verified live. This explicit opt-out also protects production
-  // from a stale deploy-wide AGENT_CHAT_DURABLE_BACKGROUND flag.
-  durableBackgroundRuns: false,
+  // Long-running A2A analysis belongs on the durable worker so provider
+  // pagination, cross-source joins, and corpus reduction can outlive the
+  // standard serverless request budget without orphaning the task.
+  durableBackgroundRuns: true,
+  runSoftTimeoutMs: ANALYTICS_BACKGROUND_RUN_SOFT_TIMEOUT_MS,
   connectorCatalog: [...ANALYTICS_CONNECTOR_CATALOG],
   externalAgents: {
     // Keep the direct MCP surface deliberately curated. External agents