@agent-native/core 0.107.2 → 0.109.0

package/corpus/core/src/a2a/client.ts

@@ -3,6 +3,7 @@ import * as jose from "jose";
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import type {
   A2AApprovedAction,
+  A2AReadOnlyActionResult,
   AgentCard,
   JsonRpcRequest,
   JsonRpcResponse,
@@ -188,9 +189,19 @@ export class A2AClient {
         );
 
         if (res.ok) {
+          const text = await res.text();
+          if (
+            i < this.apiKeyAttempts.length - 1 &&
+            isA2AAuthRejectionResponse(res.status, text)
+          ) {
+            lastError = new Error(
+              `A2A request failed (${res.status}): ${text}`,
+            );
+            continue;
+          }
           this.endpointCandidates = [url];
           this.markApiKeySucceeded(this.apiKeyAttempts[i]);
-          return res.json() as Promise<JsonRpcResponse>;
+          return JSON.parse(text) as JsonRpcResponse;
         }
 
         const text = await res.text();
@@ -272,6 +283,24 @@ export class A2AClient {
     return response.result as Task;
   }
 
+  /**
+   * Execute one receiver-approved read-only action without starting the
+   * receiver's agent loop. The receiver still owns validation, credentials,
+   * request scoping, and the explicit action exposure decision.
+   */
+  async invokeAction(
+    action: string,
+    input: Record<string, unknown> = {},
+  ): Promise<A2AReadOnlyActionResult> {
+    const response = await this.rpc("actions/invoke", { action, input });
+    if (response.error) {
+      throw new Error(
+        `A2A error (${response.error.code}): ${response.error.message}`,
+      );
+    }
+    return response.result as A2AReadOnlyActionResult;
+  }
+
   /**
    * Send a message in async mode and poll until the task reaches a terminal
    * state. This is the recommended path on serverless hosts with short
@@ -304,6 +333,38 @@ export class A2AClient {
       async: true,
     });
 
+    return this.pollTask(submitted, opts);
+  }
+
+  /**
+   * Continue waiting for an existing async task without submitting a second
+   * message. Use this after a bounded caller-side wait expires but the remote
+   * task is still working.
+   */
+  async waitForTask(
+    taskId: string,
+    opts?: {
+      /** Total time to wait for completion. Default 5 min. */
+      timeoutMs?: number;
+      /** Poll interval. Default 2s. */
+      pollIntervalMs?: number;
+      /** Called with each successfully polled task. */
+      onUpdate?: (task: Task) => void;
+    },
+  ): Promise<Task> {
+    const current = await this.getTask(taskId);
+    opts?.onUpdate?.(current);
+    return this.pollTask(current, opts);
+  }
+
+  private async pollTask(
+    submitted: Task,
+    opts?: {
+      timeoutMs?: number;
+      pollIntervalMs?: number;
+      onUpdate?: (task: Task) => void;
+    },
+  ): Promise<Task> {
     const terminalStates = new Set([
       "completed",
       "failed",
@@ -532,6 +593,7 @@ function uniqueAuthTokens(
 function isA2AAuthRejectionResponse(status: number, text: string): boolean {
   return (
     status === 401 ||
+    /verified, audience-bound user identity/i.test(text) ||
     /A2A error \(-32001\): (?:Invalid or expired A2A token|Invalid API key|Authentication required)|Invalid or expired A2A token|Invalid API key|Authentication required/i.test(
       text,
     )
@@ -566,6 +628,11 @@ export async function callAgent(
     async?: boolean;
     /** Total time to wait for the polled task (default 5 min). */
     timeoutMs?: number;
+    /**
+     * Existing async task to keep polling. When set, no new message is sent.
+     * This prevents a caller-side timeout from duplicating downstream work.
+     */
+    taskId?: string;
     /** Poll interval for async calls. Primarily useful for tests/retries. */
     pollIntervalMs?: number;
     /**
@@ -615,17 +682,26 @@ export async function callAgent(
       });
       let task: Task;
       if (useAsync) {
-        task = await client.sendAndWait(message, {
-          contextId: opts?.contextId,
-          metadata,
-          ...(opts?.approvedActions?.length
-            ? { approvedActions: opts.approvedActions }
-            : {}),
-          timeoutMs: opts?.timeoutMs,
-          pollIntervalMs: opts?.pollIntervalMs,
-          onUpdate: opts?.onUpdate,
-        });
+        task = opts?.taskId
+          ? await client.waitForTask(opts.taskId, {
+              timeoutMs: opts.timeoutMs,
+              pollIntervalMs: opts.pollIntervalMs,
+              onUpdate: opts.onUpdate,
+            })
+          : await client.sendAndWait(message, {
+              contextId: opts?.contextId,
+              metadata,
+              ...(opts?.approvedActions?.length
+                ? { approvedActions: opts.approvedActions }
+                : {}),
+              timeoutMs: opts?.timeoutMs,
+              pollIntervalMs: opts?.pollIntervalMs,
+              onUpdate: opts?.onUpdate,
+            });
       } else {
+        if (opts?.taskId) {
+          throw new Error("Polling an existing A2A task requires async mode");
+        }
         task = await client.send(message, {
           contextId: opts?.contextId,
           metadata,
@@ -665,12 +741,52 @@ export async function callAgent(
   return "";
 }
 
-async function buildA2AApiKeyAttempts(opts?: {
-  apiKey?: string;
-  userEmail?: string;
-  orgDomain?: string;
-  orgSecret?: string;
-}): Promise<Array<string | undefined>> {
+/**
+ * Invoke one receiver-approved read-only action with an audience-bound user
+ * token. Unlike conversational delegation, this never starts the receiver's
+ * model loop.
+ */
+export async function callAction(
+  url: string,
+  action: string,
+  input: Record<string, unknown> = {},
+  opts?: {
+    apiKey?: string;
+    userEmail?: string;
+    orgDomain?: string;
+    orgSecret?: string;
+    requestTimeoutMs?: number;
+  },
+): Promise<A2AReadOnlyActionResult> {
+  const actionName = action.trim();
+  if (!actionName) throw new Error("A2A action name is required");
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new Error("A2A action input must be an object");
+  }
+
+  const apiKeyAttempts = await buildA2AApiKeyAttempts(
+    opts,
+    normalizeA2AAudience(url),
+  );
+  const fallbackApiKeys = apiKeyAttempts
+    .slice(1)
+    .filter((token): token is string => token !== undefined);
+  const client = new A2AClient(url, apiKeyAttempts[0], {
+    fallbackApiKeys,
+    requestTimeoutMs: opts?.requestTimeoutMs,
+  });
+  return client.invokeAction(actionName, input);
+}
+
+async function buildA2AApiKeyAttempts(
+  opts?: {
+    apiKey?: string;
+    userEmail?: string;
+    orgDomain?: string;
+    orgSecret?: string;
+  },
+  audience?: string,
+): Promise<Array<string | undefined>> {
   const attempts: Array<string | undefined> = [];
   const add = (token: string | undefined) => {
     if (token === undefined || attempts.includes(token)) return;
@@ -685,6 +801,7 @@ async function buildA2AApiKeyAttempts(opts?: {
         add(
           await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {
             preferGlobalSecret: true,
+            audience,
           }),
         );
       } catch {
@@ -697,6 +814,7 @@ async function buildA2AApiKeyAttempts(opts?: {
         add(
           await signA2AToken(opts.userEmail, opts.orgDomain, opts.orgSecret, {
             preferGlobalSecret: false,
+            audience,
           }),
         );
       } catch {
@@ -709,6 +827,11 @@ async function buildA2AApiKeyAttempts(opts?: {
   return attempts;
 }
 
+function normalizeA2AAudience(url: string): string {
+  const explicit = splitExplicitA2AEndpoint(url.replace(/\/$/, ""));
+  return (explicit?.baseUrl ?? url).replace(/\/$/, "");
+}
+
 function isA2AAuthRejection(err: unknown): boolean {
   const message = err instanceof Error ? err.message : String(err ?? "");
   return /A2A request failed \(401\)|A2A error \(-32001\): (?:Invalid or expired A2A token|Invalid API key|Authentication required)|Invalid or expired A2A token|Invalid API key|Authentication required/i.test(

package/corpus/core/src/a2a/handlers.ts

@@ -49,6 +49,8 @@ const A2A_QUEUED_DISPATCH_STUCK_AFTER_MS = 10_000;
 const A2A_PROCESSING_STUCK_AFTER_MS = 5 * 60 * 1000;
 const A2A_PROCESSING_HEARTBEAT_MS = 30_000;
 const MAX_A2A_APPROVED_ACTIONS = 10;
+const MAX_A2A_DIRECT_ACTION_NAME_CHARS = 200;
+const MAX_A2A_DIRECT_ACTION_INPUT_BYTES = 64 * 1024;
 
 function trustedApprovedActions(
   value: unknown,
@@ -1047,6 +1049,60 @@ async function handleCancel(
   return jsonRpcResult(0, sanitizeTaskForResponse(task));
 }
 
+async function handleInvokeReadOnlyAction(
+  params: Record<string, unknown>,
+  event: any,
+  config: A2AConfig,
+): Promise<JsonRpcResponse> {
+  const action = typeof params.action === "string" ? params.action.trim() : "";
+  const input = params.input ?? {};
+
+  if (!action) {
+    return jsonRpcError(0, -32602, "Invalid params: action required");
+  }
+  if (action.length > MAX_A2A_DIRECT_ACTION_NAME_CHARS) {
+    return jsonRpcError(0, -32602, "Invalid params: action is too long");
+  }
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    return jsonRpcError(0, -32602, "Invalid params: input must be an object");
+  }
+  let inputBytes: number;
+  try {
+    inputBytes = Buffer.byteLength(JSON.stringify(input), "utf8");
+  } catch {
+    return jsonRpcError(0, -32602, "Invalid params: input must be JSON-safe");
+  }
+  if (inputBytes > MAX_A2A_DIRECT_ACTION_INPUT_BYTES) {
+    return jsonRpcError(0, -32602, "Invalid params: input is too large");
+  }
+  if (
+    !event?.context?.__a2aVerifiedEmail ||
+    event?.context?.__a2aAudienceVerified !== true
+  ) {
+    return jsonRpcError(
+      0,
+      -32001,
+      "A verified, audience-bound user identity is required for direct action invocation",
+    );
+  }
+  if (!config.executeReadOnlyAction) {
+    return jsonRpcError(0, -32601, "Direct action invocation not supported");
+  }
+
+  try {
+    const result = await withA2ARequestContext(undefined, event, () =>
+      config.executeReadOnlyAction!({
+        action,
+        input: input as Record<string, unknown>,
+      }),
+    );
+    return jsonRpcResult(0, { action, ...result });
+  } catch (error) {
+    console.error(`[a2a] Direct action ${action} failed:`, error);
+    return jsonRpcError(0, -32000, "Direct action invocation failed");
+  }
+}
+
 /**
  * H3-compatible JSON-RPC handler. Returns JSON directly (H3 serializes it).
  * Streaming is handled via H3's node response when needed.
@@ -1093,6 +1149,10 @@ export async function handleJsonRpcH3(
       const result = await handleCancel(params, event, config);
       return { ...result, id } as JsonRpcResponse;
     }
+    case "actions/invoke": {
+      const result = await handleInvokeReadOnlyAction(params, event, config);
+      return { ...result, id } as JsonRpcResponse;
+    }
     default:
       return jsonRpcError(id, -32601, `Method not found: ${body.method}`);
   }

package/corpus/core/src/a2a/index.ts

@@ -4,11 +4,12 @@ export type { A2ATokenPayload } from "./server.js";
 export { generateAgentCard } from "./agent-card.js";
 
 // Client
-export { A2AClient, callAgent, signA2AToken } from "./client.js";
+export { A2AClient, callAction, callAgent, signA2AToken } from "./client.js";
 export {
   AgentInvocationError,
   buildAgentInvocationPrompt,
   invokeAgent,
+  invokeAgentAction,
   looksLikeAgentUrl,
   resolveAgentInvocationTarget,
 } from "./invoke.js";
@@ -33,11 +34,15 @@ export type {
   Artifact,
   JsonRpcRequest,
   JsonRpcResponse,
+  A2AReadOnlyActionInvocation,
+  A2AReadOnlyActionResult,
 } from "./types.js";
 export type {
   AgentInvocationErrorCode,
+  AgentActionInvocationResult,
   AgentInvocationResult,
   AgentInvocationRuntime,
+  InvokeAgentActionOptions,
   InvokeAgentOptions,
   ResolveAgentInvocationTargetOptions,
   ResolvedAgentInvocationTarget,

package/corpus/core/src/a2a/invoke.ts

@@ -3,11 +3,17 @@ import {
   findAgent as defaultFindAgent,
   type DiscoveredAgent,
 } from "../server/agent-discovery.js";
-import { callAgent as defaultCallAgent } from "./client.js";
+import {
+  callAction as defaultCallAction,
+  callAgent as defaultCallAgent,
+} from "./client.js";
+import type { A2AReadOnlyActionResult } from "./types.js";
 
 export type AgentInvocationErrorCode =
   | "missing-target"
   | "missing-prompt"
+  | "missing-action"
+  | "invalid-input"
   | "invalid-url"
   | "self-call"
   | "not-found";
@@ -45,10 +51,17 @@ export interface AgentInvocationResult {
   responseText: string;
 }
 
+export interface AgentActionInvocationResult {
+  target: ResolvedAgentInvocationTarget;
+  action: string;
+  result: A2AReadOnlyActionResult;
+}
+
 export interface AgentInvocationRuntime {
   findAgent: typeof defaultFindAgent;
   discoverAgents: typeof defaultDiscoverAgents;
   callAgent: typeof defaultCallAgent;
+  callAction: typeof defaultCallAction;
 }
 
 export interface ResolveAgentInvocationTargetOptions {
@@ -72,6 +85,18 @@ export interface InvokeAgentOptions extends ResolveAgentInvocationTargetOptions
   runtime?: Partial<AgentInvocationRuntime>;
 }
 
+export interface InvokeAgentActionOptions extends ResolveAgentInvocationTargetOptions {
+  target: string;
+  action: string;
+  input?: Record<string, unknown>;
+  apiKey?: string;
+  userEmail?: string;
+  orgDomain?: string;
+  orgSecret?: string;
+  requestTimeoutMs?: number;
+  runtime?: Partial<AgentInvocationRuntime>;
+}
+
 /**
  * Resolve an A2A invocation target from a direct URL or from the connected app
  * registry. ID/name resolution deliberately uses the same discovery path as
@@ -181,6 +206,48 @@ export async function invokeAgent(
   };
 }
 
+/**
+ * Resolve another app and execute one explicitly exposed read-only action on
+ * it. This is the fast A2A path for bounded data operations that do not need a
+ * second model to plan or synthesize.
+ */
+export async function invokeAgentAction(
+  options: InvokeAgentActionOptions,
+): Promise<AgentActionInvocationResult> {
+  const action = options.action.trim();
+  if (!action) {
+    throw new AgentInvocationError(
+      "missing-action",
+      "Error: action is required",
+      { target: options.target },
+    );
+  }
+  const input = options.input ?? {};
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    throw new AgentInvocationError(
+      "invalid-input",
+      "Error: action input must be an object",
+      { target: options.target },
+    );
+  }
+
+  const target = await resolveAgentInvocationTarget(options.target, {
+    selfAppId: options.selfAppId,
+    selfUrl: options.selfUrl,
+    runtime: options.runtime,
+  });
+  const callAction = options.runtime?.callAction ?? defaultCallAction;
+  const result = await callAction(target.url, action, input, {
+    apiKey: options.apiKey,
+    userEmail: options.userEmail,
+    orgDomain: options.orgDomain,
+    orgSecret: options.orgSecret,
+    requestTimeoutMs: options.requestTimeoutMs,
+  });
+
+  return { target, action, result };
+}
+
 export function buildAgentInvocationPrompt(
   prompt: string,
   agentUrl: string,

package/corpus/core/src/a2a/server.ts

@@ -79,7 +79,7 @@ function expectedJwtAudience(event: any | undefined): string | undefined {
     process.env.URL ||
     process.env.DEPLOY_URL ||
     process.env.BETTER_AUTH_URL;
-  if (fromEnv) return String(fromEnv);
+  if (fromEnv) return String(fromEnv).replace(/\/$/, "");
   // Best-effort: derive from the inbound request host. This is forgeable
   // (Host-header attack), but only useful as a hint when env-derived URL
   // is unset; the rest of the JWT verification still uses the secret.
@@ -440,6 +440,7 @@ export function mountA2A(
       const bearerToken = extractBearerToken(authHeader);
       let verifiedCallerEmail: string | null = null;
       let verifiedOrgDomain: string | null = null;
+      let verifiedAudienceBound = false;
       let legacyApiKeyAuthenticated = false;
       let bearerTokenRejectedByJwt = false;
 
@@ -456,6 +457,14 @@ export function mountA2A(
         const tokenPayload = await verifyA2AToken(bearerToken, event);
         verifiedCallerEmail = tokenPayload.email;
         verifiedOrgDomain = tokenPayload.orgDomain;
+        if (verifiedCallerEmail) {
+          try {
+            verifiedAudienceBound =
+              typeof jose.decodeJwt(bearerToken).aud !== "undefined";
+          } catch {
+            verifiedAudienceBound = false;
+          }
+        }
         bearerTokenRejectedByJwt = !verifiedCallerEmail;
       }
 
@@ -532,6 +541,9 @@ export function mountA2A(
       if (verifiedCallerEmail) {
         event.context.__a2aVerifiedEmail = verifiedCallerEmail;
       }
+      if (verifiedAudienceBound) {
+        event.context.__a2aAudienceVerified = true;
+      }
       if (verifiedOrgDomain) {
         event.context.__a2aOrgDomain = verifiedOrgDomain;
       }

package/corpus/core/src/a2a/types.ts

@@ -164,6 +164,18 @@ export interface A2AApprovalExecution {
   callId: string;
 }
 
+/** One explicitly exposed read-only app action invoked without an agent loop. */
+export interface A2AReadOnlyActionInvocation {
+  action: string;
+  input: Record<string, unknown>;
+}
+
+export interface A2AReadOnlyActionResult {
+  action: string;
+  status: "completed" | "failed";
+  output: string;
+}
+
 export type A2AHandler = (
   message: Message,
   context: A2AHandlerContext,
@@ -186,4 +198,8 @@ export interface A2AConfig {
     status: "completed" | "failed";
     output: string;
   }>;
+  /** Execute an explicitly exposed read-only action without starting a model. */
+  executeReadOnlyAction?: (
+    invocation: A2AReadOnlyActionInvocation,
+  ) => Promise<Pick<A2AReadOnlyActionResult, "status" | "output">>;
 }

package/corpus/core/src/a2a-claims.ts

@@ -0,0 +1,52 @@
+import * as jose from "jose";
+
+import { verifyA2AToken } from "./a2a/server.js";
+
+export interface VerifiedA2AClaims {
+  email: string;
+  orgId: string;
+  jti: string;
+  issuer?: string;
+  scope: string[];
+}
+
+/** Typed opt-in claims check; legacy A2A verification remains unchanged. */
+export async function verifyA2ATokenWithClaims(
+  token: string,
+  event?: any,
+): Promise<VerifiedA2AClaims | null> {
+  const identity = await verifyA2AToken(token, event);
+  if (!identity.email) return null;
+  try {
+    const raw = jose.decodeJwt(token);
+    const audiences = Array.isArray(raw.aud)
+      ? raw.aud.filter((value): value is string => typeof value === "string")
+      : typeof raw.aud === "string"
+        ? [raw.aud]
+        : [];
+    // Legacy A2A callers may omit `aud`, but privileged fleet-management
+    // delegation never may. verifyA2AToken already proves a declared audience
+    // matches this receiver; this opt-in claims layer makes its presence
+    // mandatory before exposing administrative scopes.
+    if (audiences.length === 0 || audiences.some((value) => !value.trim()))
+      return null;
+    const orgId = typeof raw.org_id === "string" ? raw.org_id.trim() : "";
+    const jti = typeof raw.jti === "string" ? raw.jti.trim() : "";
+    const scopes =
+      typeof raw.scope === "string"
+        ? raw.scope.split(/\s+/).filter(Boolean)
+        : [];
+    const issuer = typeof raw.iss === "string" ? raw.iss.trim() : "";
+    return orgId && jti
+      ? {
+          email: identity.email,
+          orgId,
+          jti,
+          ...(issuer ? { issuer } : {}),
+          scope: scopes,
+        }
+      : null;
+  } catch {
+    return null;
+  }
+}

package/corpus/core/src/action.ts

@@ -24,8 +24,9 @@ import type { ActionAuditConfig } from "./audit/types.js";
  *   `callAction` (tagged with the `X-Request-Source` header).
  * - `"cli"` — `pnpm action <name>` (the CLI runner).
  * - `"mcp"` — an external agent over the MCP `tools/call` endpoint.
- * - `"a2a"` — a direct A2A action dispatch (currently unused: A2A runs through
- *   the agent loop, so those calls are `"tool"`). Reserved for completeness.
+ * - `"a2a"` — a direct, explicitly exposed read-only A2A action dispatch.
+ *   Natural-language A2A delegation still runs through the agent loop and its
+ *   selected actions are attributed as `"tool"`.
  */
 export type ActionCaller = "tool" | "http" | "frontend" | "cli" | "mcp" | "a2a";
 
@@ -55,6 +56,10 @@ export interface ActionRunContext {
   orgId?: string | null;
   /** How this action was invoked. */
   caller: ActionCaller;
+  /** Verified network lineage for direct delegated action calls. */
+  networkProtocol?: "a2a" | "mcp" | "provider-api";
+  networkId?: string;
+  networkPeer?: string;
   /**
    * Attachments submitted with the current agent turn (pasted text blocks,
    * uploaded files, images), exactly as the server received them — with full,

package/corpus/core/src/agent/production-agent.ts

@@ -8,7 +8,7 @@ import {
 } from "h3";
 import type { EventHandler as H3EventHandler } from "h3";
 
-import { isAgentActionStopError } from "../action.js";
+import { isAgentActionStopError, type ActionCaller } from "../action.js";
 import { readAppState } from "../application-state/script-helpers.js";
 import { isReadOnlyShellCommand } from "../coding-tools/index.js";
 import { extensionIdFromPathname } from "../extensions/path.js";
@@ -2479,6 +2479,8 @@ export interface ExecuteAgentToolCallOptions {
   signal?: AbortSignal;
   ownerEmail?: string | null;
   orgId?: string | null;
+  /** Audit/action attribution for this externally selected call. */
+  caller?: ActionCaller;
   threadId?: string;
   turnId?: string;
   approvedToolCalls?: string[];
@@ -2573,6 +2575,7 @@ export async function executeAgentToolCall(
       signal,
       ownerEmail: options.ownerEmail,
       orgId: options.orgId,
+      actionCaller: options.caller,
       executionMode: "act",
       maxIterations: 2,
       threadId: options.threadId,
@@ -3152,6 +3155,8 @@ export async function runAgentLoop(opts: {
   signal: AbortSignal;
   ownerEmail?: string | null;
   orgId?: string | null;
+  /** Action invocation attribution. Defaults to the normal agent tool loop. */
+  actionCaller?: ActionCaller;
   /**
    * Attachments submitted with this turn (pasted text, files, images), passed
    * through to each tool's `ActionRunContext.attachments` so actions can
@@ -4102,6 +4107,7 @@ export async function runAgentLoop(opts: {
         requestedActionStop ??= {
           message:
             `Stopped because ${toolCall.name} failed ${count} times with the same arguments and error. ` +
+            `Last error: ${sanitizedResult} ` +
             "Fix the underlying issue or change the arguments before retrying.",
           errorCode: "repeated_identical_tool_error",
         };
@@ -4208,7 +4214,7 @@ export async function runAgentLoop(opts: {
                   await actionEntry.needsApproval(toolCall.input, {
                     userEmail: getRequestUserEmail(),
                     orgId: getRequestOrgId() ?? null,
-                    caller: "tool",
+                    caller: opts.actionCaller ?? "tool",
                   }),
                 )
               : actionEntry.needsApproval === true;
@@ -4242,7 +4248,7 @@ export async function runAgentLoop(opts: {
               args: toolCall.input,
               ctx: {
                 actionName: toolCall.name,
-                caller: "tool",
+                caller: opts.actionCaller ?? "tool",
                 userEmail: getRequestUserEmail(),
                 orgId: getRequestOrgId() ?? null,
                 ...(opts.threadId ? { threadId: opts.threadId } : {}),
@@ -4638,7 +4644,7 @@ export async function runAgentLoop(opts: {
           send,
           userEmail: actionUserEmail ?? undefined,
           orgId: actionOrgId,
-          caller: "tool" as const,
+          caller: opts.actionCaller ?? "tool",
           attachments: opts.attachments,
           signal,
           // Audit attribution: the action name + the agent thread/turn that

package/corpus/core/src/audit/record.ts

@@ -31,6 +31,9 @@ export interface AuditRunContextLike {
   orgId?: string | null;
   threadId?: string;
   turnId?: string;
+  networkProtocol?: "a2a" | "mcp" | "provider-api";
+  networkId?: string;
+  networkPeer?: string;
 }
 
 export interface RecordActionAuditInput {
@@ -134,6 +137,9 @@ export async function recordActionAudit(
       // otherwise to the actor (the common self-mutation case).
       ownerEmail: target?.ownerEmail ?? actorEmail,
       visibility: target?.visibility ?? "private",
+      networkProtocol: ctx?.networkProtocol ?? null,
+      networkId: ctx?.networkId ?? null,
+      networkPeer: ctx?.networkPeer ?? null,
     };
     const lineage = getIntegrationRequestContext()?.lineage;
     const integration = getIntegrationRequestContext();