@agent-native/core 0.101.2 → 0.101.3

package/corpus/README.md

@@ -28,4 +28,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 ## Generated Counts
 
 - core files: 2258
-- template files: 5620
+- template files: 5622

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @agent-native/core
 
+## 0.101.3
+
+### Patch Changes
+
+- 7cfb087: Keep centered chat composer skeletons aligned with the real composer while the chat UI loads.
+- 7cfb087: Document PR Visual Recap's cost drivers and cheaper model options (`claude-haiku-4-5`, `gpt-5.6-luna`/`gpt-5.6-terra`, `openai-compatible` providers), and note that the Claude backend now defaults to `claude-sonnet-5` when `VISUAL_RECAP_MODEL` is unset. Adds a matching cost/model-choice section to the Visual Plans template doc.
+- 7cfb087: Fail closed when first-party scaffolds cannot be downloaded from the CLI's immutable core version tags instead of mixing newer templates with an older runtime.
+- 7cfb087: Resolve `${keys.NAME}` in the agent fetch tool and notification webhooks through the request-scope cascade so Dispatch-vault keys scoped to the workspace/org resolve like they already do for extensions and automations.
+- 7cfb087: Resolve provider credentials from encrypted Dispatch vault secrets, keep hosted A2A agent discovery distinct from mounted workspace app inventory, and run long Analytics A2A tasks on the durable background worker.
+- 7cfb087: Expose the embedded OG font resolver so template social images keep their text visible in serverless runtimes.
+- 7cfb087: Stop agent turns from looping across alternating read-only docs and source search tools.
+- 7cfb087: Publish PR Visual Recap helpers as a dependency-light CLI package so recap workflows no longer install the full Agent-Native framework dependency graph.
+- 7cfb087: Derive workspace-shared secret encryption material from A2A_SECRET on hosted workspace deploys so vault keys decrypt across sibling apps, and stop serving stale shared ciphertext after a value is updated without shared key material.
+- Updated dependencies [7cfb087]
+- Updated dependencies [7cfb087]
+- Updated dependencies [7cfb087]
+  - @agent-native/recap-cli@0.4.0
+
 ## 0.101.2
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.101.2",
+  "version": "0.101.3",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/credentials/index.ts

@@ -3,6 +3,7 @@ import {
   decryptSecretValue,
   isEncryptedSecretValue,
 } from "../secrets/crypto.js";
+import { readAppSecret, type SecretRef } from "../secrets/storage.js";
 import { getSetting, putSetting, deleteSetting } from "../settings/store.js";
 
 const SETTING_PREFIX = "credential:";
@@ -41,6 +42,20 @@ async function readCredentialSetting(
   }
 }
 
+async function readScopedAppSecret(
+  key: string,
+  scope: SecretRef["scope"],
+  scopeId: string,
+): Promise<string | undefined> {
+  try {
+    return (await readAppSecret({ key, scope, scopeId }))?.value;
+  } catch {
+    // Older databases may not have app_secrets yet. Keep the legacy
+    // credential store available while the table bootstraps.
+    return undefined;
+  }
+}
+
 /**
  * Resolve a credential from one explicit legacy SQL credential scope.
  *
@@ -61,16 +76,21 @@ export async function resolveCredentialForScope(
 }
 
 /**
- * Resolve a credential, scoped to the caller's user (and falling back to
- * the active org's shared credential, if any).
+ * Resolve a credential across the encrypted app_secrets store and the legacy
+ * settings-backed credential store. User overrides win, followed by the
+ * active org/workspace shared value.
  *
  * SECURITY: NEVER reads from process.env. Env vars are global to the
- * deployment and would leak across users in a multi-tenant app. The only
- * sources are per-user / per-org rows in the SQL `settings` table.
+ * deployment and would leak across users in a multi-tenant app.
+ *
+ * Read order:
+ *   1. user-scoped app_secrets
+ *   2. user-scoped legacy settings credential
+ *   3. org-scoped app_secrets
+ *   4. legacy workspace-scoped app_secrets for the org
+ *   5. org-scoped legacy settings credential
  *
- * Storage keys (priority order):
- *   1. u:<email>:credential:<KEY>   — per-user override
- *   2. o:<orgId>:credential:<KEY>   — per-org shared credential (if orgId given)
+ * Without an active org, step 3 is replaced by the solo workspace scope.
  */
 export async function resolveCredential(
   key: string,
@@ -78,6 +98,9 @@ export async function resolveCredential(
 ): Promise<string | undefined> {
   if (!ctx?.userEmail) return undefined;
 
+  const userSecret = await readScopedAppSecret(key, "user", ctx.userEmail);
+  if (userSecret) return userSecret;
+
   const userSetting = await resolveCredentialForScope(key, {
     ...ctx,
     scope: "user",
@@ -85,10 +108,20 @@ export async function resolveCredential(
   if (userSetting) return userSetting;
 
   if (ctx.orgId) {
+    const orgSecret = await readScopedAppSecret(key, "org", ctx.orgId);
+    if (orgSecret) return orgSecret;
+
+    const workspaceSecret = await readScopedAppSecret(
+      key,
+      "workspace",
+      ctx.orgId,
+    );
+    if (workspaceSecret) return workspaceSecret;
+
     return resolveCredentialForScope(key, { ...ctx, scope: "org" });
   }
 
-  return undefined;
+  return readScopedAppSecret(key, "workspace", `solo:${ctx.userEmail}`);
 }
 
 /**

package/corpus/core/src/extensions/fetch-tool.ts

@@ -11,6 +11,7 @@
  */
 
 import type { ActionEntry } from "../agent/production-agent.js";
+import type { ResolvedKeyReference } from "../secrets/substitution.js";
 import {
   collectSecretValues,
   MAX_EXTENSION_PROXY_RESPONSE_SIZE,
@@ -77,9 +78,23 @@ export interface FetchToolOptions {
     resolved: string;
     usedKeys: string[];
     secretValues?: string[];
+    /**
+     * Optional: which scope (user/org/workspace) each used key actually
+     * resolved at. Populated by resolvers like
+     * `resolveKeyReferencesWithRequestScopes` so `validateUrl` can look up
+     * the allowlist at the scope the value came from rather than assuming
+     * user scope. Backwards compatible — callers that omit this (or a
+     * resolver that doesn't report it) are unaffected.
+     */
+    resolvedKeys?: ResolvedKeyReference[];
   }>;
   /** Validate URL against per-key allowlists. */
-  validateUrl?: (url: string, usedKeys: string[]) => Promise<boolean>;
+  validateUrl?: (
+    url: string,
+    usedKeys: string[],
+    /** Accumulated `resolvedKeys` from every `resolveKeys` call this request made, when the resolver reported them. */
+    resolvedKeys?: ResolvedKeyReference[],
+  ) => Promise<boolean>;
 }
 
 /**
@@ -207,6 +222,7 @@ export function createFetchToolEntry(
         let resolvedBody = rawBody;
         const allUsedKeys: string[] = [];
         const allSecretValues: string[] = [];
+        const allResolvedKeys: ResolvedKeyReference[] = [];
 
         if (opts.resolveKeys) {
           try {
@@ -214,23 +230,29 @@ export function createFetchToolEntry(
             resolvedUrl = urlResult.resolved;
             allUsedKeys.push(...urlResult.usedKeys);
             allSecretValues.push(...(urlResult.secretValues ?? []));
+            allResolvedKeys.push(...(urlResult.resolvedKeys ?? []));
 
             const headerResult = await opts.resolveKeys(rawHeaders);
             resolvedHeaders = headerResult.resolved;
             allUsedKeys.push(...headerResult.usedKeys);
             allSecretValues.push(...(headerResult.secretValues ?? []));
+            allResolvedKeys.push(...(headerResult.resolvedKeys ?? []));
 
             if (rawBody) {
               const bodyResult = await opts.resolveKeys(rawBody);
               resolvedBody = bodyResult.resolved;
               allUsedKeys.push(...bodyResult.usedKeys);
               allSecretValues.push(...(bodyResult.secretValues ?? []));
+              allResolvedKeys.push(...(bodyResult.resolvedKeys ?? []));
             }
           } catch (err: any) {
             return `Error resolving key references: ${err?.message ?? err}`;
           }
         }
         const secretValues = collectSecretValues(allSecretValues);
+        const resolvedKeys = allResolvedKeys.length
+          ? allResolvedKeys
+          : undefined;
 
         // Block SSRF targets regardless of key usage
         if (await isBlockedExtensionUrlWithDns(resolvedUrl)) {
@@ -240,7 +262,11 @@ export function createFetchToolEntry(
         // Validate URL against per-key allowlists
         if (opts.validateUrl && allUsedKeys.length > 0) {
           try {
-            const allowed = await opts.validateUrl(resolvedUrl, allUsedKeys);
+            const allowed = await opts.validateUrl(
+              resolvedUrl,
+              allUsedKeys,
+              resolvedKeys,
+            );
             if (!allowed) {
               return `URL "${rawUrl}" is not in the allowlist for the referenced keys. Check your key settings.`;
             }
@@ -298,7 +324,11 @@ export function createFetchToolEntry(
               return "Redirect to private/internal address blocked.";
             }
             if (redirectUrl && opts.validateUrl && allUsedKeys.length > 0) {
-              const allowed = await opts.validateUrl(redirectUrl, allUsedKeys);
+              const allowed = await opts.validateUrl(
+                redirectUrl,
+                allUsedKeys,
+                resolvedKeys,
+              );
               if (!allowed) {
                 return "Redirect URL is not in the allowlist for the referenced keys.";
               }

package/corpus/core/src/notifications/channels.ts

@@ -29,7 +29,7 @@
 
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import {
-  resolveKeyReferences,
+  resolveKeyReferencesWithRequestScopes,
   validateUrlAllowlist,
   getKeyAllowlist,
 } from "../secrets/substitution.js";
@@ -215,21 +215,30 @@ async function resolveWebhookRequest(
   owner: string,
   label: string,
 ): Promise<{ url: string; headers: Record<string, string> }> {
-  // Resolve `${keys.NAME}` references against the owner's user-scope secrets.
+  // Resolve `${keys.NAME}` references through the same request-scope
+  // cascade already used by extension fetches (extensions/routes.ts) and
+  // automation connector headers (automation/index.ts): user scope first
+  // (a personal override always wins), then the active org scope — where
+  // the Dispatch vault syncs workspace secrets — then workspace scope.
+  // Org/workspace vault rows are write-gated (org-admin + Dispatch vault
+  // UI), so reading them here is safe by default; this is unrelated to the
+  // opt-in-only user→workspace fallback in resolveKeyReferences (audit 05
+  // H2 in secrets/substitution.ts), which stays off. In headless contexts
+  // (e.g. a scheduled monitor check) getRequestOrgId() may be unset, in
+  // which case the cascade checks user + solo-workspace scopes only — a
+  // strict superset of the previous user-scope-only behavior.
   // Missing keys throw — the error surfaces in logs and the channel is marked
   // un-delivered, but other channels still run.
-  const { resolved: url } = await resolveKeyReferences(
+  const { resolved: url } = await resolveKeyReferencesWithRequestScopes(
     urlTemplate,
-    "user",
     owner,
   );
   const headers: Record<string, string> = {
     "Content-Type": "application/json",
   };
   if (authTemplate) {
-    const { resolved: auth } = await resolveKeyReferences(
+    const { resolved: auth } = await resolveKeyReferencesWithRequestScopes(
       authTemplate,
-      "user",
       owner,
     );
     headers.Authorization = auth;
@@ -237,6 +246,11 @@ async function resolveWebhookRequest(
 
   // If the user set an allowlist on a referenced key, enforce it here —
   // origin-level check, same rule the automations fetch-tool applies.
+  // NOTE: this still checks the allowlist at user scope only (unlike the
+  // fetch tool's validateUrl, which now consults getResolvedKeyAllowlist at
+  // the scope the key actually resolved at — see agent-chat-plugin.ts). A
+  // key that resolves at org/workspace scope with an allowlist configured
+  // on that org/workspace row will not have it enforced here.
   const keyNames = Array.from(
     new Set(
       Array.from(urlTemplate.matchAll(/\$\{keys\.([A-Za-z0-9_-]+)\}/g), (m) =>

package/corpus/core/src/secrets/crypto.ts

@@ -14,15 +14,22 @@
  * `<APP_NAME>_SECRETS_ENCRYPTION_KEY` when set, then `SECRETS_ENCRYPTION_KEY`,
  * then `BETTER_AUTH_SECRET`. The app-scoped key lets a local multi-app
  * workspace read one app's encrypted production data without replacing the
- * shared local auth secret. In production we refuse to start without
- * configured key material — a CWD-derived fallback would be effectively
- * static (e.g. `/var/task` on Lambda), so anyone with read access to the DB
- * could decrypt every secret.
+ * shared local auth secret. Hosted workspace deploys (`AGENT_NATIVE_WORKSPACE`)
+ * typically set none of those literal env vars per app; in that case the
+ * shared-key variant falls back further to material derived from the
+ * workspace-wide `A2A_SECRET` (see `getWorkspaceA2ADerivedSecret`), so sibling
+ * apps in the same workspace still land on the same shared key without any
+ * extra configuration. In production we refuse to start without configured
+ * key material — a CWD-derived fallback would be effectively static (e.g.
+ * `/var/task` on Lambda), so anyone with read access to the DB could decrypt
+ * every secret.
  *
  * Encrypted values are tagged `v1:<iv-hex>:<ct-hex>:<tag-hex>`. The `v1:` prefix
  * lets readers distinguish ciphertext from legacy plaintext during migration.
  */
 
+import { getWorkspaceA2ADerivedSecret } from "../server/derived-secret.js";
+
 type NodeCryptoModule = typeof import("node:crypto");
 
 function getNodeCrypto(): NodeCryptoModule | undefined {
@@ -75,7 +82,11 @@ function appScopedEncryptionKey(): string | undefined {
 
 function sharedEncryptionKeyMaterial(): string | undefined {
   if (typeof process === "undefined") return undefined;
-  return process.env.SECRETS_ENCRYPTION_KEY || process.env.BETTER_AUTH_SECRET;
+  return (
+    process.env.SECRETS_ENCRYPTION_KEY ||
+    process.env.BETTER_AUTH_SECRET ||
+    getWorkspaceA2ADerivedSecret("secrets-encryption")
+  );
 }
 
 function deriveSecretEncryptionKey(
@@ -129,17 +140,22 @@ export function getSecretEncryptionKey(): Buffer {
  * Derive the preferred workspace-shared key used by `app_secrets` rows.
  * Unlike generic column-level encryption, workspace vault data should decrypt
  * in sibling apps, so `SECRETS_ENCRYPTION_KEY` / `BETTER_AUTH_SECRET` take
- * precedence. The app-scoped key remains a compatibility fallback for
- * deployments that have not configured shared material yet; once the shared
- * key is configured, writes use it and reads still fall back to old rows.
+ * precedence. Hosted workspace deploys (`AGENT_NATIVE_WORKSPACE`) that set
+ * neither literal var still get stable shared material derived from the
+ * workspace-wide `A2A_SECRET` before falling further back. The app-scoped key
+ * remains a compatibility fallback for deployments that have not configured
+ * shared material yet; once the shared key is configured, writes use it and
+ * reads still fall back to old rows.
  */
 export function getSharedSecretEncryptionKey(): Buffer {
   return deriveSecretEncryptionKey(
     sharedEncryptionKeyMaterial() || appScopedEncryptionKey(),
     "[agent-native/secrets] Refusing to start in production without encryption key material for workspace secrets. " +
-      "Set SECRETS_ENCRYPTION_KEY, BETTER_AUTH_SECRET, or the app-scoped *_SECRETS_ENCRYPTION_KEY in the deploy environment.",
+      "Set SECRETS_ENCRYPTION_KEY, BETTER_AUTH_SECRET, or the app-scoped *_SECRETS_ENCRYPTION_KEY in the deploy environment " +
+      "— or, on a hosted workspace deploy, ensure A2A_SECRET is set so shared material can be derived from it.",
     "[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using app-scoped or machine-local fallback for workspace secrets. " +
-      "Set SECRETS_ENCRYPTION_KEY or BETTER_AUTH_SECRET in every workspace app so sibling apps share vault rows.",
+      "Set SECRETS_ENCRYPTION_KEY or BETTER_AUTH_SECRET in every workspace app so sibling apps share vault rows, " +
+      "or rely on A2A_SECRET-derived material on hosted workspace deploys.",
   );
 }
 

package/corpus/core/src/secrets/storage.ts

@@ -163,8 +163,9 @@ export async function writeAppSecret(args: WriteSecretArgs): Promise<string> {
   const now = Date.now();
   // Dual-write during rollout: old readers continue using encrypted_value,
   // while new readers prefer the nullable shared ciphertext. An app-only
-  // deployment leaves the shared column null; on an update, an existing
-  // shared ciphertext is preserved by the upsert below.
+  // deployment leaves the shared column null; on an update, a writer without
+  // shared key material clears any existing shared ciphertext rather than
+  // preserving it (see the upsert SQL below for why).
   const encrypted = encryptLegacyValue(value);
   const sharedEncrypted = hasSharedSecretEncryptionKeyMaterial()
     ? encryptValue(value)
@@ -182,11 +183,23 @@ export async function writeAppSecret(args: WriteSecretArgs): Promise<string> {
   // keeps its original id (any stored references stay stable); only a
   // genuinely new row gets the freshly generated `id`. This syntax is
   // portable across SQLite (UPSERT since 3.24) and Postgres.
+  //
+  // shared_encrypted_value is overwritten with `excluded.shared_encrypted_value`
+  // (NULL when this writer lacks shared key material) rather than preserved
+  // via COALESCE. Preserving an existing shared ciphertext across a value
+  // update would let a sibling app silently decrypt a STALE value after the
+  // owner rotates it — a material-less writer has no way to produce the new
+  // shared ciphertext, so it must clear the old one instead of leaving it
+  // pointing at data that's no longer current. Siblings then get an honest
+  // cache miss (falling back to the legacy column or reporting missing) until
+  // the owning app's next read repopulates shared_encrypted_value via
+  // `populateSharedAppSecret`, which only ever fills a NULL column. A
+  // temporary miss is safer than serving rotated-away plaintext.
   const upsertSql = `INSERT INTO app_secrets (id, scope, scope_id, key, encrypted_value, shared_encrypted_value, description, url_allowlist, created_at, updated_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     ON CONFLICT (scope, scope_id, key) DO UPDATE SET
       encrypted_value = excluded.encrypted_value,
-      shared_encrypted_value = COALESCE(excluded.shared_encrypted_value, app_secrets.shared_encrypted_value),
+      shared_encrypted_value = excluded.shared_encrypted_value,
       description = excluded.description,
       url_allowlist = excluded.url_allowlist,
       updated_at = excluded.updated_at`;

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -134,6 +134,7 @@ import {
   WORKSPACE_OWNER,
 } from "../resources/store.js";
 import { normalizeDatabaseToolsMode } from "../scripts/db/tool-mode.js";
+import type { ResolvedKeyReference } from "../secrets/substitution.js";
 import { getSetting, putSetting } from "../settings/store.js";
 import {
   handleSharedThreadRequest,
@@ -323,6 +324,41 @@ const generateTitleRateLimit = new Map<string, number[]>();
  * so the common small-map case stays O(1). */
 const RATE_LIMIT_SWEEP_THRESHOLD = 1000;
 
+/**
+ * Pick the URL allowlist to enforce for a `${keys.NAME}` reference used by
+ * the agent fetch tool.
+ *
+ * SECURITY (audit 05 H2 alignment): the allowlist check must stay
+ * consistent with the scope a key actually resolved at (see the
+ * `getKeyAllowlist` docstring in secrets/substitution.ts). Since the fetch
+ * tool now resolves keys via `resolveKeyReferencesWithRequestScopes` — which
+ * cascades user → org → workspace scope — a plain user-scope-only allowlist
+ * lookup would silently miss an allowlist configured on the org/workspace
+ * row that actually supplied the value. When `resolvedKeys` reports which
+ * scope a key resolved at, look up the allowlist there; only fall back to
+ * the legacy user-scope lookup for a key the resolver didn't report (should
+ * not normally happen — every key the cascade resolves reports a ref).
+ */
+export async function resolveFetchToolKeyAllowlist(
+  keyName: string,
+  resolvedKeys: ResolvedKeyReference[] | undefined,
+  owner: string,
+  deps: {
+    getKeyAllowlist: (
+      name: string,
+      scope: "user",
+      scopeId: string,
+    ) => Promise<string[] | null>;
+    getResolvedKeyAllowlist: (
+      ref: ResolvedKeyReference,
+    ) => Promise<string[] | null>;
+  },
+): Promise<string[] | null> {
+  const ref = resolvedKeys?.find((candidate) => candidate.name === keyName);
+  if (ref) return deps.getResolvedKeyAllowlist(ref);
+  return deps.getKeyAllowlist(keyName, "user", owner);
+}
+
 export function createAgentChatPlugin(
   options?: AgentChatPluginOptions,
 ): NitroPluginDef {
@@ -793,21 +829,38 @@ export function createAgentChatPlugin(
       try {
         const { createFetchToolEntry } =
           await import("../extensions/fetch-tool.js");
-        const { resolveKeyReferences, validateUrlAllowlist, getKeyAllowlist } =
-          await import("../secrets/substitution.js");
+        // Resolve `${keys.NAME}` through the same request-scope cascade
+        // already used by extension fetches (extensions/routes.ts) and
+        // automation connector headers (automation/index.ts): user scope
+        // first (personal overrides win), then the active org scope (the
+        // Dispatch vault syncs workspace secrets here), then workspace
+        // scope. Org/workspace vault rows are write-gated (org-admin +
+        // Dispatch vault UI), so this is safe to read by default — unlike
+        // the opt-in-only user→workspace fallback in resolveKeyReferences
+        // (see audit 05 H2 in secrets/substitution.ts), which stays off.
+        // Previously this tool only looked at scope "user", so a
+        // ${keys.NAME} reference to a key synced into the org/workspace
+        // vault could never resolve here even though the same key already
+        // worked for extension fetches and automations.
+        const {
+          resolveKeyReferencesWithRequestScopes,
+          validateUrlAllowlist,
+          getKeyAllowlist,
+          getResolvedKeyAllowlist,
+        } = await import("../secrets/substitution.js");
         fetchTool = createFetchToolEntry({
           resolveKeys: async (text) =>
-            resolveKeyReferences(
+            resolveKeyReferencesWithRequestScopes(
               text,
-              "user",
               requireCurrentRunOwner("resolve key references"),
             ),
-          validateUrl: async (url, usedKeys) => {
+          validateUrl: async (url, usedKeys, resolvedKeys) => {
             for (const keyName of usedKeys) {
-              const allowlist = await getKeyAllowlist(
+              const allowlist = await resolveFetchToolKeyAllowlist(
                 keyName,
-                "user",
+                resolvedKeys,
                 requireCurrentRunOwner("validate URL allowlist"),
+                { getKeyAllowlist, getResolvedKeyAllowlist },
               );
               if (allowlist && !validateUrlAllowlist(url, allowlist)) {
                 return false;

package/corpus/core/src/server/derived-secret.ts

@@ -20,7 +20,11 @@ export function deriveServerSecret(
 }
 
 export function getWorkspaceA2ADerivedSecret(
-  purpose: "better-auth" | "oauth-state" | "short-lived-token",
+  purpose:
+    | "better-auth"
+    | "oauth-state"
+    | "short-lived-token"
+    | "secrets-encryption",
 ): string | undefined {
   if (!isWorkspaceRuntime()) return undefined;
   const rootSecret = process.env.A2A_SECRET?.trim();

package/corpus/templates/analytics/changelog/2026-07-14-long-running-cross-app-analyses-now-continue-reliably-in-the.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-14
+---
+
+Long-running cross-app analyses now continue reliably in the background and can use synced workspace provider credentials.

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -27,6 +27,9 @@ import {
   needsCorpusWorkflowForCoverageSensitiveRequest,
   needsSourceRecordBodyWorkflowForCoverageSensitiveRequest,
 } from "../lib/real-data-actions";
+
+const ANALYTICS_BACKGROUND_RUN_SOFT_TIMEOUT_MS = 13 * 60_000;
+
 export const SIMPLE_TIME_BOUNDED_METRIC_FAST_PATH_GUIDANCE =
   "SIMPLE TIME-BOUNDED METRIC FAST PATH — When the data dictionary or a known canonical source identifies the metric, run one bounded aggregate. Once it returns a valid result, answer the explicit question immediately with the source, time window, row count, and only necessary caveats. Do not schema-discover, retry, enrich, cross-check, or add breakdowns after that successful result unless the query failed or the result conflicts with the known metric definition. This does not waive the real-data requirement: never answer from a guess, stale value, or unverified result. ";
 
@@ -271,10 +274,11 @@ export default createAgentChatPlugin({
   // Operators deploying to trusted internal environments can set
   // AGENT_PROD_CODE_EXECUTION=trusted to also enable bash/read/edit/write.
   codeExecution: { production: "sandboxed" },
-  // Analytics uses the portable A2A processor until its dedicated background
-  // worker is verified live. This explicit opt-out also protects production
-  // from a stale deploy-wide AGENT_CHAT_DURABLE_BACKGROUND flag.
-  durableBackgroundRuns: false,
+  // Long-running A2A analysis belongs on the durable worker so provider
+  // pagination, cross-source joins, and corpus reduction can outlive the
+  // standard serverless request budget without orphaning the task.
+  durableBackgroundRuns: true,
+  runSoftTimeoutMs: ANALYTICS_BACKGROUND_RUN_SOFT_TIMEOUT_MS,
   connectorCatalog: [...ANALYTICS_CONNECTOR_CATALOG],
   externalAgents: {
     // Keep the direct MCP surface deliberately curated. External agents