@agent-native/core 0.109.0 → 0.109.1

package/dist/templates/workspace-core/.agents/skills/a2a-protocol/SKILL.md

@@ -144,6 +144,27 @@ message delegation for planning, synthesis, multi-step work, or mutations.
 Inside an agent loop, `call-agent` exposes the same path with `action` + `input`;
 omit `message` and `taskId` in that mode.
 
+### Retry safety and trace linkage
+
+`call-agent` automatically derives an owner-scoped idempotency key from the
+originating turn, target, and exact message. If a retry reaches the receiver
+after the caller timed out, asynchronous `message/send` returns the existing
+active or completed task instead of starting a duplicate agent run. Failed and
+canceled tasks release the key for an intentional retry; synchronous calls are
+never deduplicated. Lower-level clients may pass an
+`idempotencyKey` explicitly; keep it stable for the same logical submission and
+change it when the work changes. Dedupe is scoped to the JWT-authenticated
+owner and verified org, and keys are limited to 128 characters.
+
+The caller also forwards bounded correlation metadata (`callerApp`,
+`callerThreadId`, `parentRunId`, `parentTurnId`, and direct-read
+`invocationId`). These fields
+are telemetry hints only. Receivers must continue to derive identity,
+ownership, org scope, access, and approval from the verified request context.
+Delegated model loops emit `$ai_generation` with A2A/MCP lineage, while direct
+reads emit the content-free `$a2a_read_invoke` event; neither event includes
+action arguments or results.
+
 ### Advanced: `A2AClient` (full control)
 
 ```ts

package/dist/templates/workspace-core/.agents/skills/observability/SKILL.md

@@ -285,7 +285,13 @@ LLM generation:
 - Agent Native Analytics shape: the same event lands in `analytics_events` with
   mirrored query-friendly properties such as `run_id`, `thread_id`,
   `cost_cents_x100`, `duration_ms`, `tool_calls`, `successful_tools`,
-  `failed_tools`, and `status`.
+  `failed_tools`, and `status`. A content-free `tools` array includes at most
+  50 tool names, start offsets, durations, statuses, and coarse error classes;
+  interrupted calls are finalized as errors, and failed runs still emit with
+  zero or known usage. `tools_truncated` marks longer runs while the rollup counts remain complete.
+  Delegated runs add `delegation_protocol`, `caller_app`, `a2a_task_id`, and
+  `parent_run_id` when available. `parent_turn_id` is separate because one
+  logical turn may span multiple concrete runs.
 
 Do not build a separate LLM-observability ingestion API unless there is a clear
 reason the tracking provider registry cannot express the use case. Keep prompt,

package/dist/templates/workspace-core/.agents/skills/tracking/SKILL.md

@@ -141,7 +141,7 @@ Other framework-level baseline events:
 - `signup` from Better Auth user creation, with `auth_provider`, `auth_user_id`, and first-touch referral attribution (`referral_source`, `referrer_user`, `referral_medium`, `referral_campaign`, `utm_*`, `first_touch_path`, `landing_referrer` — see "Referral / viral attribution" above)
 - `builder connect clicked` and `builder connect popup blocked` from browser Connect Builder CTAs
 - `builder connect started`, `builder connect succeeded`, `builder connect failed`, `builder disconnect succeeded`, and `builder disconnect failed` from the Builder connection routes, with LLM connection context when resolvable
-- `$ai_generation` from instrumented agent loops, with PostHog AI Observability fields such as `$ai_trace_id`, `$ai_session_id`, `$ai_model`, `$ai_provider`, `$ai_input_tokens`, `$ai_output_tokens`, `$ai_latency`, `$ai_total_cost_usd`, and mirrored Agent Native query fields such as `run_id`, `thread_id`, `cost_cents_x100`, `duration_ms`, `tool_calls`, and `status`. Prompt, tool argument, and output content is not included by default.
+- `$ai_generation` from instrumented agent loops, with PostHog AI Observability fields such as `$ai_trace_id`, `$ai_session_id`, `$ai_model`, `$ai_provider`, `$ai_input_tokens`, `$ai_output_tokens`, `$ai_latency`, `$ai_total_cost_usd`, and mirrored Agent Native query fields such as `run_id`, `thread_id`, `cost_cents_x100`, `duration_ms`, `tool_calls`, and `status`. A bounded `tools` array contains names, start offsets, durations, statuses, and coarse error classes only; interrupted tools and failed runs remain visible, and delegated runs include protocol/task/parent-run/parent-turn correlation. Prompt, tool argument, result, and output content is excluded.
 
 For new lifecycle events, call `track()` server-side when the server is the source of truth, and `trackEvent()` client-side only for browser interactions.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.109.0",
+  "version": "0.109.1",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/src/templates/workspace-core/.agents/skills/a2a-protocol/SKILL.md

@@ -144,6 +144,27 @@ message delegation for planning, synthesis, multi-step work, or mutations.
 Inside an agent loop, `call-agent` exposes the same path with `action` + `input`;
 omit `message` and `taskId` in that mode.
 
+### Retry safety and trace linkage
+
+`call-agent` automatically derives an owner-scoped idempotency key from the
+originating turn, target, and exact message. If a retry reaches the receiver
+after the caller timed out, asynchronous `message/send` returns the existing
+active or completed task instead of starting a duplicate agent run. Failed and
+canceled tasks release the key for an intentional retry; synchronous calls are
+never deduplicated. Lower-level clients may pass an
+`idempotencyKey` explicitly; keep it stable for the same logical submission and
+change it when the work changes. Dedupe is scoped to the JWT-authenticated
+owner and verified org, and keys are limited to 128 characters.
+
+The caller also forwards bounded correlation metadata (`callerApp`,
+`callerThreadId`, `parentRunId`, `parentTurnId`, and direct-read
+`invocationId`). These fields
+are telemetry hints only. Receivers must continue to derive identity,
+ownership, org scope, access, and approval from the verified request context.
+Delegated model loops emit `$ai_generation` with A2A/MCP lineage, while direct
+reads emit the content-free `$a2a_read_invoke` event; neither event includes
+action arguments or results.
+
 ### Advanced: `A2AClient` (full control)
 
 ```ts

package/src/templates/workspace-core/.agents/skills/observability/SKILL.md

@@ -285,7 +285,13 @@ LLM generation:
 - Agent Native Analytics shape: the same event lands in `analytics_events` with
   mirrored query-friendly properties such as `run_id`, `thread_id`,
   `cost_cents_x100`, `duration_ms`, `tool_calls`, `successful_tools`,
-  `failed_tools`, and `status`.
+  `failed_tools`, and `status`. A content-free `tools` array includes at most
+  50 tool names, start offsets, durations, statuses, and coarse error classes;
+  interrupted calls are finalized as errors, and failed runs still emit with
+  zero or known usage. `tools_truncated` marks longer runs while the rollup counts remain complete.
+  Delegated runs add `delegation_protocol`, `caller_app`, `a2a_task_id`, and
+  `parent_run_id` when available. `parent_turn_id` is separate because one
+  logical turn may span multiple concrete runs.
 
 Do not build a separate LLM-observability ingestion API unless there is a clear
 reason the tracking provider registry cannot express the use case. Keep prompt,

package/src/templates/workspace-core/.agents/skills/tracking/SKILL.md

@@ -141,7 +141,7 @@ Other framework-level baseline events:
 - `signup` from Better Auth user creation, with `auth_provider`, `auth_user_id`, and first-touch referral attribution (`referral_source`, `referrer_user`, `referral_medium`, `referral_campaign`, `utm_*`, `first_touch_path`, `landing_referrer` — see "Referral / viral attribution" above)
 - `builder connect clicked` and `builder connect popup blocked` from browser Connect Builder CTAs
 - `builder connect started`, `builder connect succeeded`, `builder connect failed`, `builder disconnect succeeded`, and `builder disconnect failed` from the Builder connection routes, with LLM connection context when resolvable
-- `$ai_generation` from instrumented agent loops, with PostHog AI Observability fields such as `$ai_trace_id`, `$ai_session_id`, `$ai_model`, `$ai_provider`, `$ai_input_tokens`, `$ai_output_tokens`, `$ai_latency`, `$ai_total_cost_usd`, and mirrored Agent Native query fields such as `run_id`, `thread_id`, `cost_cents_x100`, `duration_ms`, `tool_calls`, and `status`. Prompt, tool argument, and output content is not included by default.
+- `$ai_generation` from instrumented agent loops, with PostHog AI Observability fields such as `$ai_trace_id`, `$ai_session_id`, `$ai_model`, `$ai_provider`, `$ai_input_tokens`, `$ai_output_tokens`, `$ai_latency`, `$ai_total_cost_usd`, and mirrored Agent Native query fields such as `run_id`, `thread_id`, `cost_cents_x100`, `duration_ms`, `tool_calls`, and `status`. A bounded `tools` array contains names, start offsets, durations, statuses, and coarse error classes only; interrupted tools and failed runs remain visible, and delegated runs include protocol/task/parent-run/parent-turn correlation. Prompt, tool argument, result, and output content is excluded.
 
 For new lifecycle events, call `track()` server-side when the server is the source of truth, and `trackEvent()` client-side only for browser interactions.