@agent-native/core 0.101.10 → 0.101.12

package/corpus/core/src/a2a/task-store.ts

@@ -24,6 +24,23 @@ async function ensureTable(): Promise<void> {
           updated_at ${intType()} NOT NULL
         )
       `;
+      const createApprovalsSql = `
+        CREATE TABLE IF NOT EXISTS a2a_approvals (
+          id TEXT PRIMARY KEY,
+          task_id TEXT NOT NULL UNIQUE,
+          owner_email TEXT NOT NULL,
+          org_id TEXT,
+          tool_name TEXT NOT NULL,
+          tool_input TEXT NOT NULL,
+          approval_key TEXT NOT NULL,
+          call_id TEXT NOT NULL,
+          status TEXT NOT NULL DEFAULT 'pending',
+          result TEXT,
+          expires_at ${intType()} NOT NULL,
+          created_at ${intType()} NOT NULL,
+          updated_at ${intType()} NOT NULL
+        )
+      `;
 
       if (isPostgres()) {
         // PG-guard: probe information_schema before issuing DDL to avoid ACCESS
@@ -40,6 +57,7 @@ async function ensureTable(): Promise<void> {
           "owner_email",
           `ALTER TABLE a2a_tasks ADD COLUMN IF NOT EXISTS owner_email TEXT`,
         );
+        await ensureTableExists("a2a_approvals", createApprovalsSql);
         return;
       }
 
@@ -58,6 +76,7 @@ async function ensureTable(): Promise<void> {
       } catch {
         // Column already exists — expected on every restart after first run.
       }
+      await client.execute(createApprovalsSql);
     })().catch((err) => {
       // Retry init on the next call after a failed startup.
       _initPromise = undefined;
@@ -67,6 +86,240 @@ async function ensureTable(): Promise<void> {
   return _initPromise;
 }
 
+export interface A2AApprovalRecord {
+  id: string;
+  taskId: string;
+  ownerEmail: string;
+  orgId: string | null;
+  tool: string;
+  input: unknown;
+  approvalKey: string;
+  callId: string;
+  status: "pending" | "processing" | "completed" | "failed";
+  result: string | null;
+  expiresAt: number;
+}
+
+async function withDbTransaction<T>(
+  client: ReturnType<typeof getDbExec>,
+  fn: (tx: ReturnType<typeof getDbExec>) => Promise<T>,
+): Promise<T> {
+  if (client.transaction) return client.transaction(fn);
+  await client.execute(isPostgres() ? "BEGIN" : "BEGIN IMMEDIATE");
+  try {
+    const result = await fn(client);
+    await client.execute("COMMIT");
+    return result;
+  } catch (error) {
+    await client.execute("ROLLBACK").catch(() => {});
+    throw error;
+  }
+}
+
+function approvalFromRow(row: any): A2AApprovalRecord {
+  return {
+    id: String(row.id),
+    taskId: String(row.task_id),
+    ownerEmail: String(row.owner_email),
+    orgId: row.org_id ? String(row.org_id) : null,
+    tool: String(row.tool_name),
+    input: JSON.parse(String(row.tool_input)),
+    approvalKey: String(row.approval_key),
+    callId: String(row.call_id),
+    status: row.status,
+    result: row.result ? String(row.result) : null,
+    expiresAt: Number(row.expires_at),
+  };
+}
+
+export async function createA2AApproval(input: {
+  taskId: string;
+  ownerEmail: string;
+  orgId?: string | null;
+  tool: string;
+  toolInput: unknown;
+  approvalKey: string;
+  callId: string;
+  ttlMs?: number;
+}): Promise<A2AApprovalRecord> {
+  await ensureTable();
+  const client = getDbExec();
+  const id = crypto.randomUUID();
+  const now = Date.now();
+  const expiresAt = now + (input.ttlMs ?? 15 * 60_000);
+  await client.execute({
+    sql: `INSERT INTO a2a_approvals (id, task_id, owner_email, org_id, tool_name, tool_input, approval_key, call_id, status, expires_at, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'pending', ?, ?, ?)`,
+    args: [
+      id,
+      input.taskId,
+      input.ownerEmail,
+      input.orgId ?? null,
+      input.tool,
+      JSON.stringify(input.toolInput ?? {}),
+      input.approvalKey,
+      input.callId,
+      expiresAt,
+      now,
+      now,
+    ],
+  });
+  return {
+    id,
+    taskId: input.taskId,
+    ownerEmail: input.ownerEmail,
+    orgId: input.orgId ?? null,
+    tool: input.tool,
+    input: input.toolInput ?? {},
+    approvalKey: input.approvalKey,
+    callId: input.callId,
+    status: "pending",
+    result: null,
+    expiresAt,
+  };
+}
+
+export async function getA2AApprovalForOwner(
+  id: string,
+  ownerEmail: string,
+  orgId?: string | null,
+): Promise<A2AApprovalRecord | null> {
+  await ensureTable();
+  const { rows } = await getDbExec().execute({
+    sql: `SELECT * FROM a2a_approvals WHERE id = ? AND owner_email = ? AND (org_id IS NULL OR org_id = ?)`,
+    args: [id, ownerEmail, orgId ?? null],
+  });
+  return rows[0] ? approvalFromRow(rows[0]) : null;
+}
+
+export async function claimA2AApproval(
+  id: string,
+  ownerEmail: string,
+  orgId?: string | null,
+): Promise<A2AApprovalRecord | null> {
+  await ensureTable();
+  const client = getDbExec();
+  const now = Date.now();
+  class ClaimRejected extends Error {}
+  try {
+    return await withDbTransaction(client, async (tx) => {
+      const approvalUpdate = await tx.execute({
+        sql: `UPDATE a2a_approvals SET status = 'processing', updated_at = ? WHERE id = ? AND owner_email = ? AND status = 'pending' AND expires_at > ? AND (org_id IS NULL OR org_id = ?)`,
+        args: [now, id, ownerEmail, now, orgId ?? null],
+      });
+      if (getAffectedRowCount(approvalUpdate) === 0) throw new ClaimRejected();
+      const { rows } = await tx.execute({
+        sql: `SELECT * FROM a2a_approvals WHERE id = ? AND owner_email = ? AND status = 'processing'`,
+        args: [id, ownerEmail],
+      });
+      if (!rows[0]) throw new ClaimRejected();
+      const approval = approvalFromRow(rows[0]);
+      const timestamp = new Date(now).toISOString();
+      const runningMessage: Message = {
+        role: "agent",
+        parts: [{ type: "text", text: "Approved action is running." }],
+      };
+      const taskUpdate = await tx.execute({
+        sql: `UPDATE a2a_tasks SET status_state = 'working', status_message = ?, status_timestamp = ?, updated_at = ? WHERE id = ? AND owner_email = ? AND status_state = 'input-required'`,
+        args: [
+          JSON.stringify(runningMessage),
+          timestamp,
+          now,
+          approval.taskId,
+          ownerEmail,
+        ],
+      });
+      if (getAffectedRowCount(taskUpdate) === 0) throw new ClaimRejected();
+      return approval;
+    });
+  } catch (error) {
+    if (error instanceof ClaimRejected) return null;
+    throw error;
+  }
+}
+
+export async function settleA2AApproval(
+  id: string,
+  status: "completed" | "failed",
+  resultText: string,
+): Promise<void> {
+  await ensureTable();
+  const client = getDbExec();
+  const now = Date.now();
+  const message: Message = {
+    role: "agent",
+    parts: [{ type: "text", text: resultText }],
+  };
+  await withDbTransaction(client, async (tx) => {
+    const { rows } = await tx.execute({
+      sql: `SELECT task_id FROM a2a_approvals WHERE id = ? AND status = 'processing'`,
+      args: [id],
+    });
+    if (!rows[0]) throw new Error("Approval is not processing");
+    const taskId = String((rows[0] as any).task_id);
+    const { rows: taskRows } = await tx.execute({
+      sql: `SELECT history FROM a2a_tasks WHERE id = ? AND status_state = 'working'`,
+      args: [taskId],
+    });
+    if (!taskRows[0]) {
+      throw new Error("Approval task is no longer awaiting settlement");
+    }
+    const history = JSON.parse(String((taskRows[0] as any).history));
+    history.push(message);
+    const timestamp = new Date(now).toISOString();
+    const taskUpdate = await tx.execute({
+      sql: `UPDATE a2a_tasks SET status_state = ?, status_message = ?, status_timestamp = ?, history = ?, updated_at = ? WHERE id = ? AND status_state = 'working'`,
+      args: [
+        status,
+        JSON.stringify(message),
+        timestamp,
+        JSON.stringify(history),
+        now,
+        taskId,
+      ],
+    });
+    if (getAffectedRowCount(taskUpdate) === 0) {
+      throw new Error("Approval task settlement lost its state claim");
+    }
+    const approvalUpdate = await tx.execute({
+      sql: `UPDATE a2a_approvals SET status = ?, result = ?, updated_at = ? WHERE id = ? AND status = 'processing'`,
+      args: [status, resultText, now, id],
+    });
+    if (getAffectedRowCount(approvalUpdate) === 0) {
+      throw new Error("Approval settlement lost its state claim");
+    }
+  });
+}
+
+export async function pauseProcessingA2ATask(
+  id: string,
+  message: Message,
+): Promise<Task | null> {
+  await ensureTable();
+  const client = getDbExec();
+  const { rows } = await client.execute({
+    sql: `SELECT * FROM a2a_tasks WHERE id = ? AND status_state = 'processing'`,
+    args: [id],
+  });
+  if (!rows[0]) return null;
+  const task = taskFromRow(rows[0]);
+  task.history?.push(message);
+  const now = Date.now();
+  const timestamp = new Date(now).toISOString();
+  const result = await client.execute({
+    sql: `UPDATE a2a_tasks SET status_state = 'input-required', status_message = ?, status_timestamp = ?, history = ?, updated_at = ? WHERE id = ? AND status_state = 'processing'`,
+    args: [
+      JSON.stringify(message),
+      timestamp,
+      JSON.stringify(task.history ?? []),
+      now,
+      id,
+    ],
+  });
+  if (getAffectedRowCount(result) === 0) return null;
+  task.status = { state: "input-required", message, timestamp };
+  return task;
+}
+
 function taskFromRow(row: any): Task & { ownerEmail?: string | null } {
   return {
     id: row.id as string,

package/corpus/core/src/a2a/types.ts

@@ -126,6 +126,12 @@ export interface JsonRpcResponse {
   error?: JsonRpcError;
 }
 
+/** One exact downstream action explicitly authorized in the caller's chat. */
+export interface A2AApprovedAction {
+  tool: string;
+  input: unknown;
+}
+
 // --- Framework config ---
 
 export interface A2AHandlerContext {
@@ -135,12 +141,27 @@ export interface A2AHandlerContext {
   metadata?: Record<string, unknown>;
   /** Current H3 event when the handler is running inside an HTTP request. */
   event?: unknown;
+  /** Exact one-time action grants from a JWT-authenticated caller. */
+  approvedActions?: A2AApprovedAction[];
   writeArtifact: (name: string, content: string, mimeType?: string) => string;
 }
 
 export interface A2AHandlerResult {
   message: Message;
   artifacts?: Artifact[];
+  /** Optional non-terminal state requested by the handler. */
+  taskState?: Extract<TaskState, "input-required">;
+}
+
+export interface A2AApprovalExecution {
+  id: string;
+  taskId: string;
+  ownerEmail: string;
+  orgId?: string | null;
+  tool: string;
+  input: unknown;
+  approvalKey: string;
+  callId: string;
 }
 
 export type A2AHandler = (
@@ -160,4 +181,9 @@ export interface A2AConfig {
   streaming?: boolean;
   /** Route async A2A work through the app's durable background worker when available. */
   durableBackgroundRuns?: boolean;
+  /** Execute a persisted, human-approved A2A tool call. */
+  executeApproval?: (approval: A2AApprovalExecution) => Promise<{
+    status: "completed" | "failed";
+    output: string;
+  }>;
 }

package/corpus/core/src/agent/production-agent.ts

@@ -2747,7 +2747,7 @@ function stableStringify(value: unknown): string {
     .join(",")}}`;
 }
 
-function toolCallCacheKey(toolName: string, input: unknown): string {
+export function toolCallCacheKey(toolName: string, input: unknown): string {
   return `${toolName}:${stableStringify(normalizeToolCallInputForHistory(input))}`;
 }
 
@@ -4180,7 +4180,10 @@ export async function runAgentLoop(opts: {
       // instead of executing. The action's side effect never happens until a
       // human re-issues the turn approving this call's stable key.
       const approvalKey = toolCallCacheKey(toolCall.name, toolCall.input);
-      if (actionEntry.needsApproval && !approvedToolCallKeys.has(approvalKey)) {
+      // Consume a grant on its first exact match. A second identical call in
+      // the same continuation must request its own human approval.
+      const wasApproved = approvedToolCallKeys.delete(approvalKey);
+      if (actionEntry.needsApproval && !wasApproved) {
         let mustApprove = false;
         try {
           mustApprove =

package/corpus/core/src/coding-tools/run-code.ts

@@ -740,8 +740,18 @@ function handleBridgeRequest(
 
   // Enforce allowlist.
   const entry = actions[toolName];
+  // Unknown/mistyped tool: report "not registered" (404) before the
+  // access-control branch below. Otherwise an undefined `entry` falls into the
+  // allowlist 403 and returns a misleading access error for a tool that simply
+  // does not exist. (Bridge-allowlisted tools always have an entry, so this
+  // cannot mask a legitimate allowlisted call.)
+  if (!entry) {
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: `Tool "${toolName}" is not registered.` }));
+    return;
+  }
   const isReadOnlyAction =
-    entry?.readOnly === true &&
+    entry.readOnly === true &&
     entry.agentTool !== false &&
     entry.toolCallable !== false;
   if (
@@ -749,21 +759,24 @@ function handleBridgeRequest(
     !extraTools.has(toolName) &&
     !isReadOnlyAction
   ) {
+    // A registered, agent-exposed action that isn't read-only is a mutation.
+    // (Unknown tools already returned 404 above, so `entry` is defined here.)
+    // Point the caller at the native tool path instead of leaving them to guess
+    // (the common trap: retrying create-extension/update-extension through
+    // appAction, which cannot work).
+    const isMutatingAction =
+      entry.agentTool !== false && entry.readOnly !== true;
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
       JSON.stringify({
-        error: `Tool "${toolName}" is not an agent-exposed read-only action or sandbox bridge allowlisted tool.`,
+        error: isMutatingAction
+          ? `Tool "${toolName}" is a mutating action and cannot be called from run-code (appAction only exposes read-only actions). Call "${toolName}" directly as a native tool. For large content bodies, stage the content and pass "contentFromAttachment" instead of an inline string rather than routing it through run-code.`
+          : `Tool "${toolName}" is not an agent-exposed read-only action or sandbox bridge allowlisted tool.`,
       }),
     );
     return;
   }
 
-  if (!entry) {
-    res.writeHead(404, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: `Tool "${toolName}" is not registered.` }));
-    return;
-  }
-
   const toolArgs = parsed.args ?? {};
   usedTools.add(toolName);
   // Run the tool with the parent request context so auth/org/owner resolution
@@ -1534,12 +1547,52 @@ async function webRead(url, init = {}) {
 /**
  * Read a Resources-backed workspace file by path. Returns the file content as
  * a string, or null if not found.
- * Supports optional offset and maxChars for paging large files.
+ *
+ * By default this returns the WHOLE file: the underlying store caps a single
+ * read at 100k chars, so this auto-pages across chunks and concatenates them,
+ * so callers never get a silently truncated body. Pass an explicit \`offset\`
+ * or \`maxChars\` to take manual control of a single page instead.
  */
 async function workspaceRead(path, opts = {}) {
-  const parsed = await workspaceReadMeta(path, opts);
-  if (parsed && parsed.ok === false) return null;
-  return parsed && typeof parsed.content === "string" ? parsed.content : null;
+  // Explicit paging requested → single read, caller owns the window.
+  if (opts.offset !== undefined || opts.maxChars !== undefined) {
+    const parsed = await workspaceReadMeta(path, opts);
+    if (parsed && parsed.ok === false) return null;
+    return parsed && typeof parsed.content === "string" ? parsed.content : null;
+  }
+  // Default → assemble the full file by paging until the store reports no more.
+  let offset = 0;
+  let out = "";
+  let found = false;
+  let complete = false;
+  // Bounded loop (files cap at 2 MB / 100k-char reads) so a misbehaving store
+  // can never spin forever.
+  for (let i = 0; i < 512; i++) {
+    const parsed = await workspaceReadMeta(path, { offset, maxChars: 100000 });
+    // A failed/missing page aborts. If it failed before the first page we never
+    // found the file (return null below); if it failed part-way through a
+    // truncated read, complete stays false and we return null rather than a
+    // silently truncated body.
+    if (!parsed || parsed.ok === false) break;
+    found = true;
+    const chunk = typeof parsed.content === "string" ? parsed.content : "";
+    out += chunk;
+    if (!parsed.truncated) {
+      complete = true;
+      break;
+    }
+    const next =
+      typeof parsed.nextOffset === "number"
+        ? parsed.nextOffset
+        : offset + chunk.length;
+    if (next <= offset) break; // no forward progress; stop rather than loop
+    offset = next;
+  }
+  if (!found) return null;
+  // Only hand back a body we know is whole. A truncated read followed by a
+  // failed/stalled page would otherwise corrupt a large clone with a partial
+  // prefix and no error signal.
+  return complete ? out : null;
 }
 
 /**