@agent-native/core 0.101.4 → 0.101.6

package/corpus/core/src/coding-tools/run-code.ts

@@ -139,7 +139,7 @@ export function createRunCodeEntry(
         "  - `workspaceList(prefix?)` — list workspace files, returns [{ path, sizeBytes, contentType, updatedAt }].",
         "Print results with `console.log()`; only stdout+stderr are returned.",
         "Timeout defaults to 120 s (max 600 s). Output is truncated to 50 000 chars by default (max 200 000).",
-        'For LONG compute — big cross-source joins, corpus-wide sweeps, scripts that could exceed ~30 s, or anything at risk of dying with the current chat run — pass `background: true`. That enqueues a durable execution and returns `{ executionId, status: "queued" }` immediately; the code runs out-of-band with a generous budget (default 10 min) and its result survives run timeouts. Continue other work, then poll by calling run-code again with just `{ executionId }` to get status and, once finished, the output. Keep quick scripts in the default foreground mode.',
+        'For LONG compute — big cross-source joins, corpus-wide sweeps, scripts that could exceed ~30 s, or anything at risk of dying with the current chat run — pass `background: true`. That enqueues a durable execution and returns `{ executionId, status: "queued" }` immediately; the code runs out-of-band with a generous budget (default 10 min) and its result survives run timeouts. Continue other work, then poll with `get-code-execution` when that dedicated tool is available; legacy hosts can call run-code again with just `{ executionId }`. Keep quick scripts in the default foreground mode.',
       ].join(" "),
       parameters: {
         type: "object",
@@ -160,12 +160,12 @@ export function createRunCodeEntry(
           background: {
             type: "boolean",
             description:
-              'Run as a durable background execution: returns { executionId, status: "queued" } immediately and the code executes out-of-band, surviving chat-run timeouts. Use for long compute (large joins, multi-page provider sweeps, heavy analysis). Poll with executionId for the result.',
+              'Run as a durable background execution: returns { executionId, status: "queued" } immediately and the code executes out-of-band, surviving chat-run timeouts. Use for long compute (large joins, multi-page provider sweeps, heavy analysis). Poll with get-code-execution when available.',
           },
           executionId: {
             type: "string",
             description:
-              "Poll a background execution started earlier: pass the executionId alone (no code) to get its status and, once finished, its output.",
+              "Legacy polling fallback for hosts without get-code-execution: pass the executionId alone (no code) to get status and output.",
           },
         },
         required: [],
@@ -582,12 +582,18 @@ function formatTerminalSandboxExecution(row: SandboxExecutionRow): string {
 /**
  * Standalone, access-scoped poll tool for background executions. Behaviorally
  * identical to calling `run-code` with only `executionId`; hosts that register
- * it as `get-code-execution` give the model a dedicated read tool (and the
- * enqueue guidance automatically points at it when present in the registry).
+ * it as `get-code-execution` give the model a dedicated volatile read tool (and
+ * the enqueue guidance automatically points at it when present in the
+ * registry). Keep the opt-out here rather than on `run-code`: repeated normal
+ * run-code calls may execute writes or outbound requests and must retain the
+ * agent loop's default duplicate-call protection.
  */
 export function createGetCodeExecutionEntry(): ActionEntry {
   return {
     readOnly: true,
+    // Polling with an identical executionId is the intended usage — the
+    // status changes over time, so this must not be deduped.
+    dedupe: false,
     tool: {
       description:
         "Check a background run-code execution: returns its status (queued | running | succeeded | failed | timed_out) and, once finished, its stdout/stderr output. Executions are scoped to the user who started them. While one is queued or running, continue other useful work and poll every ~15-30 seconds instead of busy-waiting.",

package/corpus/core/src/extensions/actions.ts

@@ -44,6 +44,15 @@ import {
   type ExtensionRow,
 } from "./store.js";
 
+// A 200k extension body containing JSON-sensitive HTML/JS characters (quotes,
+// backslashes, and newlines) expands to about 400k characters when pretty-JSON
+// serialized by the agent loop. A history detail can carry the current and
+// previous bodies plus both bodies again in its line diff (about 1.6M chars in
+// the same worst-common-case fixture). These caps add roughly 25% headroom for
+// the surrounding metadata and indentation while still bounding tool context.
+const GET_EXTENSION_MAX_RESULT_CHARS = 500_000;
+const GET_EXTENSION_HISTORY_MAX_RESULT_CHARS = 2_000_000;
+
 export function createExtensionActionEntries(): Record<string, ActionEntry> {
   return {
     "list-extensions": {
@@ -185,6 +194,9 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
           ),
         };
       },
+      // Result is JSON including the full Alpine content; account for JSON
+      // escaping and envelope metadata instead of matching the source cap.
+      maxResultChars: GET_EXTENSION_MAX_RESULT_CHARS,
       readOnly: true,
     },
 
@@ -276,6 +288,9 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
           ),
         };
       },
+      // With includeContent, history can contain current + previous source and
+      // repeat both in the diff, so it needs more headroom than get-extension.
+      maxResultChars: GET_EXTENSION_HISTORY_MAX_RESULT_CHARS,
       readOnly: true,
     },
 

package/corpus/core/src/extensions/url-safety.ts

@@ -251,17 +251,27 @@ export async function createSsrfSafeDispatcher(): Promise<unknown | null> {
  * `httpsOnly` extends the per-hop validation to the URL scheme: redirects are
  * followed only to `https:` targets, so an HTTPS-only caller cannot be
  * downgraded to plain HTTP by a 30x from the (untrusted) origin.
+ *
+ * `assertUrlAllowed` lets callers layer a stricter destination policy (for
+ * example, a credential's origin allowlist) on top of the SSRF checks. It runs
+ * before the initial request and before every redirect hop, so sensitive
+ * headers and bodies are never forwarded to a destination the caller rejects.
  */
 export async function ssrfSafeFetch(
   url: string,
   init: RequestInit = {},
-  options: { maxRedirects?: number; httpsOnly?: boolean } = {},
+  options: {
+    maxRedirects?: number;
+    httpsOnly?: boolean;
+    assertUrlAllowed?: (url: string) => void | Promise<void>;
+  } = {},
 ): Promise<Response> {
   const maxRedirects = options.maxRedirects ?? 3;
   const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;
 
   let currentUrl = url;
   for (let hop = 0; hop <= maxRedirects; hop++) {
+    await options.assertUrlAllowed?.(currentUrl);
     if (options.httpsOnly && new URL(currentUrl).protocol !== "https:") {
       throw new Error(
         `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,

package/corpus/core/src/notifications/channels.ts

@@ -29,9 +29,10 @@
 
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import {
+  getKeyAllowlist,
+  getResolvedKeyAllowlist,
   resolveKeyReferencesWithRequestScopes,
   validateUrlAllowlist,
-  getKeyAllowlist,
 } from "../secrets/substitution.js";
 import { sendEmail } from "../server/email.js";
 import { registerNotificationChannel } from "./registry.js";
@@ -72,7 +73,7 @@ function createWebhookChannel(
       // No-op when neither a per-notification nor workspace URL is set —
       // mirrors email's empty-recipients behavior so notify-all stays quiet.
       if (!urlTemplate) return false;
-      const { url, headers } = await resolveWebhookRequest(
+      const { url, headers, assertUrlAllowed } = await resolveWebhookRequest(
         urlTemplate,
         overrideUrlTemplate ? undefined : authTemplate,
         meta.owner,
@@ -92,7 +93,7 @@ function createWebhookChannel(
             emittedAt: new Date().toISOString(),
           }),
         },
-        { maxRedirects: 3 },
+        { maxRedirects: 3, assertUrlAllowed },
       );
       if (!res.ok) {
         throw new Error(
@@ -121,7 +122,7 @@ function createSlackWebhookChannel(
         metadataString(input.metadata, "slackWebhookUrl") ??
         envUrlTemplate?.trim();
       if (!urlTemplate) return false;
-      const { url, headers } = await resolveWebhookRequest(
+      const { url, headers, assertUrlAllowed } = await resolveWebhookRequest(
         urlTemplate,
         overrideUrlTemplate ? undefined : authTemplate,
         meta.owner,
@@ -165,7 +166,7 @@ function createSlackWebhookChannel(
             ],
           }),
         },
-        { maxRedirects: 3 },
+        { maxRedirects: 3, assertUrlAllowed },
       );
       if (!res.ok) {
         throw new Error(
@@ -214,7 +215,11 @@ async function resolveWebhookRequest(
   authTemplate: string | undefined,
   owner: string,
   label: string,
-): Promise<{ url: string; headers: Record<string, string> }> {
+): Promise<{
+  url: string;
+  headers: Record<string, string>;
+  assertUrlAllowed: (url: string) => void;
+}> {
   // Resolve `${keys.NAME}` references through the same request-scope
   // cascade already used by extension fetches (extensions/routes.ts) and
   // automation connector headers (automation/index.ts): user scope first
@@ -229,46 +234,72 @@ async function resolveWebhookRequest(
   // strict superset of the previous user-scope-only behavior.
   // Missing keys throw — the error surfaces in logs and the channel is marked
   // un-delivered, but other channels still run.
-  const { resolved: url } = await resolveKeyReferencesWithRequestScopes(
+  const urlResult = await resolveKeyReferencesWithRequestScopes(
     urlTemplate,
     owner,
   );
+  const url = urlResult.resolved;
   const headers: Record<string, string> = {
     "Content-Type": "application/json",
   };
+  let authResult:
+    | Awaited<ReturnType<typeof resolveKeyReferencesWithRequestScopes>>
+    | undefined;
   if (authTemplate) {
-    const { resolved: auth } = await resolveKeyReferencesWithRequestScopes(
+    authResult = await resolveKeyReferencesWithRequestScopes(
       authTemplate,
       owner,
     );
-    headers.Authorization = auth;
+    headers.Authorization = authResult.resolved;
   }
 
   // If the user set an allowlist on a referenced key, enforce it here —
   // origin-level check, same rule the automations fetch-tool applies.
-  // NOTE: this still checks the allowlist at user scope only (unlike the
-  // fetch tool's validateUrl, which now consults getResolvedKeyAllowlist at
-  // the scope the key actually resolved at — see agent-chat-plugin.ts). A
-  // key that resolves at org/workspace scope with an allowlist configured
-  // on that org/workspace row will not have it enforced here.
-  const keyNames = Array.from(
-    new Set(
-      Array.from(urlTemplate.matchAll(/\$\{keys\.([A-Za-z0-9_-]+)\}/g), (m) =>
-        String(m[1]),
-      ),
-    ),
-  );
-  const allowlists = await Promise.all(
-    keyNames.map((name) => getKeyAllowlist(name, "user", owner)),
-  );
-  keyNames.forEach((name, i) => {
-    if (!validateUrlAllowlist(url, allowlists[i])) {
-      throw new Error(
-        `[notifications] ${label} URL ${new URL(url).origin} is not in the allowlist for key "${name}"`,
+  // Validate URL and Authorization keys independently so an allowlisted auth
+  // token cannot be sent to a metadata-provided destination. Keep scope in the
+  // dedupe key because the same key name can resolve at a different scope if a
+  // credential changes between the two substitutions.
+  type ResolvedKey = NonNullable<typeof urlResult.resolvedKeys>[number];
+  const keyUsages = new Map<
+    string,
+    { name: string; resolvedKey?: ResolvedKey }
+  >();
+  for (const result of authResult ? [urlResult, authResult] : [urlResult]) {
+    for (const name of result.usedKeys) {
+      const resolved = (result.resolvedKeys ?? []).filter(
+        (ref) => ref.name === name,
       );
+      if (resolved.length === 0) {
+        keyUsages.set(`user:${owner}:${name}`, { name });
+        continue;
+      }
+      for (const resolvedKey of resolved) {
+        keyUsages.set(`${resolvedKey.scope}:${resolvedKey.scopeId}:${name}`, {
+          name,
+          resolvedKey,
+        });
+      }
     }
-  });
-  return { url, headers };
+  }
+  const usages = Array.from(keyUsages.values());
+  const allowlists = await Promise.all(
+    usages.map(({ name, resolvedKey }) =>
+      resolvedKey
+        ? getResolvedKeyAllowlist(resolvedKey)
+        : getKeyAllowlist(name, "user", owner),
+    ),
+  );
+  const assertUrlAllowed = (candidateUrl: string): void => {
+    usages.forEach(({ name }, i) => {
+      if (!validateUrlAllowlist(candidateUrl, allowlists[i])) {
+        throw new Error(
+          `[notifications] ${label} URL ${new URL(candidateUrl).origin} is not in the allowlist for key "${name}"`,
+        );
+      }
+    });
+  };
+  assertUrlAllowed(url);
+  return { url, headers, assertUrlAllowed };
 }
 
 function metadataString(

package/corpus/core/src/server/action-discovery.ts

@@ -192,6 +192,9 @@ function preserveActionFlags(entry: Record<string, any>): Partial<ActionEntry> {
   if (typeof entry.parallelSafe === "boolean") {
     out.parallelSafe = entry.parallelSafe;
   }
+  if (typeof entry.dedupe === "boolean") {
+    out.dedupe = entry.dedupe;
+  }
   if (typeof entry.toolCallable === "boolean") {
     out.toolCallable = entry.toolCallable;
   }
@@ -716,7 +719,7 @@ export async function mergeCoreSharingActions(
           run: def.run,
           ...(def.http !== undefined ? { http: def.http } : {}),
           // Carry security-relevant flags (toolCallable, publicAgent, link,
-          // mcpApp) plus readOnly/parallelSafe. Without this, the sharing
+          // mcpApp) plus readOnly/parallelSafe/dedupe. Without this, the sharing
           // actions' `toolCallable: false` (audit-H5) is dropped and the
           // tools-iframe bridge 403 in action-routes.ts never fires.
           ...preserveActionFlags(def),

package/corpus/core/src/server/agent-chat/context-tools.ts

@@ -241,6 +241,10 @@ export function createRefreshScreenEntry(): Record<string, ActionEntry> {
       // distinct `screen-refresh` poll event. Don't double-emit a generic
       // `action` event on top of that.
       readOnly: true,
+      // Refetching volatile on-screen state is the entire point of this
+      // tool — an identical repeat call (even with the same scope) is a
+      // legitimate re-refresh, not a redundant read to skip.
+      dedupe: false,
       tool: {
         description:
           "Manually refresh the user's current screen. The framework ALREADY auto-refreshes after any successful mutating action tool call (template actions and any enabled raw DB write tools) — you do NOT need to call this after a normal action. Use it only when (a) you mutated data via a path the framework can't detect (e.g. a direct write to an external system the app mirrors), or (b) you want to pass a `scope` hint so the UI narrows which queries to refetch. The UI re-fetches its queries without a full page reload.",

package/corpus/templates/analytics/AGENTS.md

@@ -20,6 +20,12 @@ details live in `.agents/skills/`.
   status) and call `list-data-dictionary` with a focused search to learn what
   exists and which table/columns/join paths to use. Don't fan out blind queries
   when the catalog already answers where a fact lives.
+- `data-source-status` always includes the built-in first-party Analytics source
+  and returns `hasConnectedExternalDataSources`,
+  `dataSourcesSetupLink` (a real deep link to `/data-sources`). Chat stays
+  available when no external provider is connected; for a request that needs
+  one, explain the missing source in context and include that returned link so
+  the user can connect it. Do not replace this with a generic canned response.
 - Simple time-bounded metric fast path: when the data dictionary or a known
   canonical source already identifies the metric, run one bounded aggregate.
   Once that query returns a valid result, answer immediately with the source,

package/corpus/templates/analytics/README.md

@@ -1,6 +1,6 @@
 # Analytics
 
-An open-source, agent-native alternative to Amplitude, Mixpanel, and Looker. Ask
+An open-source, agent-native alternative to Amplitude and FullStory. Ask
 analytics questions in plain English and get charts, dashboards, and re-runnable
 investigations back — you own the code, the queries, and the data.
 

package/corpus/templates/analytics/actions/data-source-status.ts

@@ -3,6 +3,7 @@ import {
   getWorkspaceConnectionProvider,
   listWorkspaceConnectionProvidersForTemplate,
 } from "@agent-native/core/connections";
+import { buildDeepLink } from "@agent-native/core/server";
 import {
   listWorkspaceConnectionGrants,
   listWorkspaceConnections,
@@ -22,6 +23,11 @@ import { getGitHubAccessToken } from "../server/lib/github-oauth";
 import { resolveAnalyticsProviderCredential } from "../server/lib/provider-credentials";
 
 const APP_ID = "analytics";
+const DATA_SOURCES_SETUP_LINK = buildDeepLink({
+  app: APP_ID,
+  view: "data-sources",
+  to: "/data-sources",
+});
 
 const BUILT_IN_FIRST_PARTY_PROVIDER = {
   provider: "first-party",
@@ -68,7 +74,7 @@ async function listWorkspaceConnectionsForStatus(): Promise<{
 
 export default defineAction({
   description:
-    "List which analytics data sources are available without revealing secret values. This always includes the built-in first-party Analytics event store, which is queried with `query-agent-native-analytics`; it also reports configured credentials and granted workspace connections. The `key` arg accepts exact credential names like JIRA_API_TOKEN and provider aliases like jira, pylon, bigquery, github, hubspot, gong, or slack.",
+    "List which analytics data sources are available without revealing secret values. This always includes the built-in first-party Analytics event store, which is queried with `query-agent-native-analytics`; it also reports configured credentials and granted workspace connections. The result includes `hasConnectedExternalDataSources`, `connectedExternalDataSourceCount`, and `dataSourcesSetupLink`; when a requested provider is unavailable, use that link for contextual setup guidance. The `key` arg accepts exact credential names like JIRA_API_TOKEN and provider aliases like jira, pylon, bigquery, github, hubspot, gong, or slack.",
   schema: z.object({
     key: z
       .string()
@@ -87,6 +93,7 @@ export default defineAction({
         label: "Authentication",
         message: "Sign in to view credential status.",
         settingsPath: "/data-sources",
+        dataSourcesSetupLink: DATA_SOURCES_SETUP_LINK,
       };
     }
 
@@ -221,12 +228,18 @@ export default defineAction({
                 : "credentials",
         })),
     ];
+    const connectedExternalDataSources = configuredDataSources.filter(
+      (source) => source.provider !== BUILT_IN_FIRST_PARTY_PROVIDER.provider,
+    );
     return {
       // Keep a compact, explicit summary first so models do not infer source
       // availability from the much larger per-credential list below.
       hasConfiguredDataSources: configuredDataSources.length > 0,
       configuredDataSourceCount: configuredDataSources.length,
       configuredDataSources,
+      hasConnectedExternalDataSources: connectedExternalDataSources.length > 0,
+      connectedExternalDataSourceCount: connectedExternalDataSources.length,
+      dataSourcesSetupLink: DATA_SOURCES_SETUP_LINK,
       credentials: results,
       providers: [BUILT_IN_FIRST_PARTY_PROVIDER, ...providers],
       total: results.length,
@@ -238,4 +251,9 @@ export default defineAction({
       },
     };
   },
+  link: () => ({
+    url: DATA_SOURCES_SETUP_LINK,
+    label: "Open Analytics data sources",
+    view: "data-sources",
+  }),
 });

package/corpus/templates/analytics/app/pages/adhoc/sql-dashboard/index.tsx

@@ -1147,12 +1147,16 @@ export default function SqlDashboardPage() {
   }, [dashboard]);
 
   const requestedTab = searchParams.get("tab");
-  const activeTab =
+  const selectedTab =
     tabs.length > 0
       ? requestedTab && tabs.includes(requestedTab)
         ? requestedTab
         : tabs[0]
       : null;
+  // Report captures need the complete dashboard in one image. The report
+  // URL intentionally has no `tab` parameter, so do not apply the normal
+  // first-tab selection while rendering the screenshot surface.
+  const activeTab = reportScreenshot ? null : selectedTab;
   const groupedTabs = useMemo(() => groupDashboardTabs(tabs), [tabs]);
   const activeTabGroup = activeTab
     ? groupedTabs.groups.find((group) =>

package/corpus/templates/analytics/app/routes/_index.tsx

@@ -1,9 +1,9 @@
 import { redirect, type LoaderFunctionArgs } from "react-router";
 
 const SEO_TITLE =
-  "Agent-Native Analytics - Open Source, agent-friendly Amplitude alternative";
+  "Agent-Native Analytics - Open Source Alternative to Amplitude & FullStory";
 const SEO_DESCRIPTION =
-  "Open Source analytics app where AI agents connect to warehouses, product analytics, and CRM data to answer questions and build dashboards.";
+  "Open Source analytics app and alternative to Amplitude and FullStory where AI agents connect to warehouses, product analytics, and CRM data to answer questions and build dashboards.";
 
 export function meta() {
   return [

package/corpus/templates/analytics/changelog/2026-07-14-analytics-chat-guides-you-to-connect-a-data-source-with-a-di.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-14
+---
+
+Analytics chat guides you to connect a data source with a direct setup link when live data is unavailable

package/corpus/templates/analytics/changelog/2026-07-14-analytics-landing-pages-now-clearly-position-the-app-as-an-o.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-14
+---
+
+Analytics landing pages now clearly position the app as an open-source alternative to Amplitude and FullStory

package/corpus/templates/analytics/changelog/2026-07-15-daily-dashboard-emails-now-include-the-complete-dashboard-sc.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-15
+---
+
+Daily dashboard emails now include the complete dashboard screenshot

package/corpus/templates/analytics/server/jobs/dashboard-report.ts

@@ -51,6 +51,7 @@ export async function runDashboardReportsOnce(): Promise<{
           () =>
             sendDashboardReportSubscription(sub, {
               skipEmailWithoutScreenshot: retryAt !== null,
+              allowLimitedFallback: retryAt === null,
             }),
         );
         if (!result.screenshotAttached) {
@@ -78,7 +79,13 @@ export async function runDashboardReportsOnce(): Promise<{
           await markDashboardReportResult(sub, "error", message);
           continue;
         }
-        await markDashboardReportResult(sub, "success");
+        if (result.screenshotMode !== "full" && result.screenshotError) {
+          const detail = `sent with ${result.screenshotMode} screenshot; earlier attempts failed: ${result.screenshotError}`;
+          console.warn(`[dashboard-report] Subscription ${sub.id} ${detail}`);
+          await markDashboardReportResult(sub, "success", detail);
+        } else {
+          await markDashboardReportResult(sub, "success");
+        }
       } catch (err: any) {
         failed++;
         const message = err?.message ?? String(err);

package/corpus/templates/analytics/server/lib/dashboard-report.ts

@@ -49,13 +49,17 @@ const DASHBOARD_REPORT_CID = "dashboard-report-snapshot";
 const LOCAL_SCREENSHOT_TIMEOUT_MS = 90_000;
 const SERVERLESS_SCREENSHOT_TIMEOUT_MS = 90_000;
 const SERVERLESS_SECOND_READY_TIMEOUT_MS = 45_000;
-const SERVERLESS_FULL_ATTEMPT_TIMEOUT_MS = 125_000;
-const SERVERLESS_LIGHTWEIGHT_ATTEMPT_TIMEOUT_MS = 85_000;
+// Keep enough room under Netlify's 300s background-function limit for the
+// bounded browser-close/profile-cleanup steps after each failed attempt and
+// for the final email send. The three attempts total 225s; cleanup can spend
+// up to 60s, leaving a small delivery buffer.
+const SERVERLESS_FULL_ATTEMPT_TIMEOUT_MS = 110_000;
+const SERVERLESS_LIGHTWEIGHT_ATTEMPT_TIMEOUT_MS = 70_000;
 const BROWSER_CLEANUP_TIMEOUT_MS = 10_000;
 const SCREENSHOT_VIEWPORT_PADDING = 64;
 
 type DashboardScreenshotAttempt = {
-  label: "full" | "full-lightweight";
+  label: "full" | "full-lightweight" | "limited";
   viewport: { width: number; height: number };
   captureScale?: number;
   readyTimeout?: number;
@@ -770,9 +774,10 @@ function storedAttemptError(message: string): string {
 async function captureDashboardPngWithFallback(
   sub: DashboardReportSubscription,
   snapshot: ReportSnapshot,
+  options?: { includeLimitedFallback?: boolean },
 ): Promise<{
   png: Buffer | null;
-  mode: "full" | "full-lightweight" | "none";
+  mode: "full" | "full-lightweight" | "limited" | "none";
   error?: string;
 }> {
   const serverless = isServerlessBrowserRuntime();
@@ -792,7 +797,6 @@ async function captureDashboardPngWithFallback(
       label: "full-lightweight",
       viewport: { width: 1200, height: 1400 },
       captureScale: 0.7,
-      reportPanelLimit: 8,
       ...(serverless
         ? {
             readyTimeout: 55_000,
@@ -802,13 +806,34 @@ async function captureDashboardPngWithFallback(
         : {}),
     },
   ];
+  if (options?.includeLimitedFallback) {
+    // Only added on the final sweep after the 1-hour retry window, when the
+    // alternative is a no-image fallback email. All three serverless attempt
+    // totalTimeouts sum to 225s, leaving room for bounded cleanup and email
+    // delivery under the 300s Netlify background-function timeout.
+    attempts.push({
+      label: "limited",
+      viewport: { width: 1200, height: 1400 },
+      captureScale: 0.7,
+      reportPanelLimit: 8,
+      ...(serverless
+        ? {
+            readyTimeout: 40_000,
+            secondReadyTimeout: 10_000,
+            totalTimeout: 45_000,
+          }
+        : {}),
+    });
+  }
   const errors: string[] = [];
 
   for (const attempt of attempts) {
     try {
+      const png = await captureDashboardPng(sub, snapshot, attempt);
       return {
-        png: await captureDashboardPng(sub, snapshot, attempt),
+        png,
         mode: attempt.label,
+        ...(errors.length ? { error: errors.join(" | ") } : {}),
       };
     } catch (err) {
       const attemptError = errorMessage(err);
@@ -837,7 +862,10 @@ function reportDate(snapshot: ReportSnapshot): string {
 
 function renderReportEmailHtml(
   snapshot: ReportSnapshot,
-  options: { screenshotAttached: boolean },
+  options: {
+    screenshotAttached: boolean;
+    screenshotMode: "full" | "full-lightweight" | "limited" | "none";
+  },
 ): string {
   const title = escapeHtml(snapshot.title);
   const dashboardUrl = escapeHtml(snapshot.dashboardUrl);
@@ -850,6 +878,12 @@ function renderReportEmailHtml(
     : `<div style="margin:18px 0;padding:14px 16px;border:1px solid #e5e7eb;border-radius:8px;background:#f9fafb;color:#374151;font-size:14px;line-height:1.5;">
       The dashboard image was unavailable for this run. Open the live dashboard to view the latest report.
     </div>`;
+  const limitedScreenshotNotice =
+    options.screenshotMode === "limited"
+      ? `<div style="margin:12px 0 0;padding:12px 14px;border:1px solid #f3c46b;border-radius:8px;background:#fff8e6;color:#6b4f14;font-size:13px;line-height:1.45;">
+      This is a limited fallback image and may omit some dashboard panels. <a href="${dashboardUrl}" style="color:#2563eb;text-decoration:none;">Open the full dashboard</a> to see every panel.
+    </div>`
+      : "";
 
   return `<!doctype html>
 <html>
@@ -858,6 +892,7 @@ function renderReportEmailHtml(
       Here's your report of <a href="${dashboardUrl}" style="color:#2563eb;text-decoration:none;">${title}</a> for ${date}
     </p>
     ${screenshotBlock}
+    ${limitedScreenshotNotice}
     <p style="margin:18px 0 0;color:#525866;font-size:13px;line-height:1.45;">
       <a href="${dashboardUrl}" style="color:#2563eb;text-decoration:none;">Open dashboard</a>
       <span style="color:#9ca3af;"> · </span>
@@ -869,7 +904,10 @@ function renderReportEmailHtml(
 
 function renderReportText(
   snapshot: ReportSnapshot,
-  options: { screenshotAttached: boolean },
+  options: {
+    screenshotAttached: boolean;
+    screenshotMode: "full" | "full-lightweight" | "limited" | "none";
+  },
 ): string {
   const lines = [
     `Daily dashboard report: ${snapshot.title}`,
@@ -880,6 +918,11 @@ function renderReportText(
   if (!options.screenshotAttached) {
     lines.push("Dashboard image unavailable for this run.");
   }
+  if (options.screenshotMode === "limited") {
+    lines.push(
+      `This is a limited fallback image and may omit some dashboard panels. Open the full dashboard: ${snapshot.dashboardUrl}`,
+    );
+  }
   return lines.join("\n");
 }
 
@@ -897,17 +940,20 @@ export async function sendDashboardReportSubscription(
   options: {
     requireScreenshot?: boolean;
     skipEmailWithoutScreenshot?: boolean;
+    allowLimitedFallback?: boolean;
   } = {},
 ): Promise<{
   dashboardUrl: string;
   recipientCount: number;
   screenshotAttached: boolean;
-  screenshotMode: "full" | "full-lightweight" | "none";
+  screenshotMode: "full" | "full-lightweight" | "limited" | "none";
   screenshotError?: string;
   emailsSent: boolean;
 }> {
   const snapshot = await collectReportSnapshot(sub);
-  const capture = await captureDashboardPngWithFallback(sub, snapshot);
+  const capture = await captureDashboardPngWithFallback(sub, snapshot, {
+    includeLimitedFallback: options?.allowLimitedFallback,
+  });
   if (!capture.png && options.requireScreenshot) {
     throw new Error(
       capture.error
@@ -926,8 +972,14 @@ export async function sendDashboardReportSubscription(
     };
   }
   const screenshotAttached = Boolean(capture.png);
-  const html = renderReportEmailHtml(snapshot, { screenshotAttached });
-  const text = renderReportText(snapshot, { screenshotAttached });
+  const html = renderReportEmailHtml(snapshot, {
+    screenshotAttached,
+    screenshotMode: capture.mode,
+  });
+  const text = renderReportText(snapshot, {
+    screenshotAttached,
+    screenshotMode: capture.mode,
+  });
   const subject = `Daily dashboard: ${snapshot.title}`;
 
   for (const to of sub.recipients) {