@agent-native/core 0.114.8 → 0.114.10

package/src/integrations/remote-commands-store.ts

@@ -368,7 +368,7 @@ export async function listRemoteCommandsForOwner(input: {
   const { rows } = await getDbExec().execute({
     sql: `SELECT * FROM integration_remote_commands
           WHERE owner_email = ?
-            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)
+            AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)
           ORDER BY updated_at DESC
           LIMIT ?`,
     args: [input.ownerEmail, input.orgId ?? null, input.orgId ?? null, limit],
@@ -435,7 +435,7 @@ export async function claimNextComputerCommand(input: {
   const { rows } = await client.execute({
     sql: `SELECT * FROM integration_remote_commands
           WHERE device_id = ? AND owner_email = ?
-            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)
+            AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)
             AND kind = 'computer-operation' AND status = 'pending'
             AND next_check_at <= ?${operationClassClause}
           ORDER BY computer_sequence ASC, created_at ASC
@@ -477,7 +477,7 @@ export async function claimNextComputerCommand(input: {
       sql: `UPDATE integration_remote_commands
             SET status = 'failed', error_message = ?, completed_at = ?, updated_at = ?
             WHERE id = ? AND device_id = ? AND owner_email = ?
-              AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)
+              AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)
               AND status = 'pending'`,
       args: [
         error instanceof Error
@@ -500,13 +500,13 @@ export async function claimNextComputerCommand(input: {
       ? `UPDATE integration_remote_commands
           SET status = 'claimed', attempts = attempts + 1, claimed_at = ?, updated_at = ?
           WHERE id = ? AND device_id = ? AND owner_email = ?
-            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)
+            AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)
             AND status = 'pending' AND lease_expires_at > ?
           RETURNING *`
       : `UPDATE integration_remote_commands
           SET status = 'claimed', attempts = attempts + 1, claimed_at = ?, updated_at = ?
           WHERE id = ? AND device_id = ? AND owner_email = ?
-            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)
+            AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)
             AND status = 'pending' AND lease_expires_at > ?`,
     args: [
       now,

package/src/integrations/remote-devices-store.ts

@@ -243,7 +243,7 @@ export async function getRemoteDeviceForOwner(input: {
     sql: `SELECT * FROM integration_remote_devices
           WHERE id = ?
             AND owner_email = ?
-            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)
+            AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)
           LIMIT 1`,
     args: [
       input.id,
@@ -287,7 +287,7 @@ export async function listRemoteDevicesForOwner(input: {
   const { rows } = await getDbExec().execute({
     sql: `SELECT * FROM integration_remote_devices
           WHERE owner_email = ?
-            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)${statusClause}
+            AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)${statusClause}
           ORDER BY COALESCE(last_seen_at, updated_at) DESC
           LIMIT ?`,
     args,
@@ -379,7 +379,7 @@ export async function revokeRemoteDeviceForOwner(input: {
               updated_at = ?
           WHERE id = ?
             AND owner_email = ?
-            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)`,
+            AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)`,
     args: [
       now,
       now,

package/src/integrations/remote-push-store.ts

@@ -330,7 +330,7 @@ export async function listRemotePushRegistrationsForOwner(input: {
   const { rows } = await getDbExec().execute({
     sql: `SELECT * FROM integration_remote_push_registrations
           WHERE owner_email = ?
-            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)${statusClause}
+            AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)${statusClause}
           ORDER BY COALESCE(last_seen_at, updated_at) DESC
           LIMIT ?`,
     args: [input.ownerEmail, input.orgId ?? null, input.orgId ?? null, limit],
@@ -352,7 +352,7 @@ export async function unregisterRemotePushRegistrationForOwner(input: {
     sql: `UPDATE integration_remote_push_registrations
           SET status = 'inactive', updated_at = ?
           WHERE owner_email = ?
-            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)
+            AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)
             AND (${input.id ? "id = ?" : "0 = 1"} OR ${
               tokenHash ? "token_hash = ?" : "0 = 1"
             })`,
@@ -432,7 +432,7 @@ export async function listRemotePushNotificationsForOwner(input: {
   const { rows } = await getDbExec().execute({
     sql: `SELECT * FROM integration_remote_push_notifications
           WHERE owner_email = ?
-            AND ((org_id IS NULL AND ? IS NULL) OR org_id = ?)${statusClause}
+            AND ((org_id IS NULL AND CAST(? AS TEXT) IS NULL) OR org_id = ?)${statusClause}
           ORDER BY created_at DESC
           LIMIT ?`,
     args,

package/src/observability/traces.ts

@@ -27,6 +27,9 @@ function costUsdFromCenticents(value: number): number {
 }
 
 const MAX_TRACKED_GENERATION_TOOL_CALLS = 50;
+const MAX_TOOL_ERROR_MESSAGE_LENGTH = 500;
+const STANDALONE_API_KEY_PATTERN =
+  /\b(?:sk-(?:proj-|ant-)?[A-Za-z0-9_-]{8,}|(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{8,}|AIza[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{16,})\b/g;
 
 type GenerationToolCall = {
   name: string;
@@ -34,8 +37,35 @@ type GenerationToolCall = {
   duration_ms: number;
   status: "success" | "error";
   error_class: "tool_error" | "legacy_inferred_error" | "interrupted" | null;
+  error_message?: string;
 };
 
+function truncateToolErrorMessage(value: string): string {
+  return value.length > MAX_TOOL_ERROR_MESSAGE_LENGTH
+    ? `${value.slice(0, MAX_TOOL_ERROR_MESSAGE_LENGTH)}…`
+    : value;
+}
+
+function redactToolErrorMessage(value: string): string {
+  const credentialName =
+    "authorization|cookie|api[_ -]?key|password|secret|token|access[_ -]?token|refresh[_ -]?token";
+  const labeledCredential = `(["']?\\b(?:${credentialName})\\b["']?\\s*[:=]\\s*["']?)`;
+  return value
+    .replace(
+      new RegExp(
+        `${labeledCredential}(?:Bearer|Basic)\\s+[^"'\\s,;)}\\]]+`,
+        "gi",
+      ),
+      "$1[REDACTED]",
+    )
+    .replace(
+      new RegExp(`${labeledCredential}[^"'\\s,;)}\\[\\]]+`, "gi"),
+      "$1[REDACTED]",
+    )
+    .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, "[REDACTED]")
+    .replace(STANDALONE_API_KEY_PATTERN, "[REDACTED]");
+}
+
 function emitLlmGenerationTrackingEvent(args: {
   runId: string;
   threadId: string | null;
@@ -439,6 +469,10 @@ export async function instrumentAgentLoop(opts: {
               : explicitError
                 ? "tool_error"
                 : "legacy_inferred_error",
+            error_message:
+              isError && config.captureToolResults
+                ? truncateToolErrorMessage(redactToolErrorMessage(event.result))
+                : undefined,
           });
         }
 
@@ -532,6 +566,7 @@ export async function instrumentAgentLoop(opts: {
       for (const [counter, pending] of pendingTools) {
         toolCallCount += 1;
         failedTools += 1;
+        const interruptedMessage = "Tool call interrupted before completion";
         if (counter < MAX_TRACKED_GENERATION_TOOL_CALLS) {
           generationToolCalls.set(counter, {
             name: pending.toolName,
@@ -539,9 +574,11 @@ export async function instrumentAgentLoop(opts: {
             duration_ms: Math.max(0, runEnd - pending.startMs),
             status: "error",
             error_class: "interrupted",
+            error_message: config.captureToolResults
+              ? interruptedMessage
+              : undefined,
           });
         }
-        const interruptedMessage = "Tool call interrupted before completion";
         if (pending.otelSpan) {
           openOtelToolSpans.delete(pending.otelSpan);
           endAgentSpan(pending.otelSpan, {

package/src/server/action-routes.ts

@@ -26,10 +26,12 @@ import {
   seedAgentRunOwnerContext,
   type AgentRunOwnerContext,
 } from "./agent-run-context.js";
+import { captureError } from "./capture-error.js";
 import {
   getAllowedCorsOrigin as resolveAllowedCorsOrigin,
   readCorsAllowedOrigins,
 } from "./cors-origins.js";
+import { getHttpRequestTelemetryId } from "./http-response-telemetry.js";
 
 declare const __AGENT_NATIVE_BUILD_ID__: string | undefined;
 declare const __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__: string | undefined;
@@ -640,7 +642,27 @@ export function mountActionRoutes(
               if (isUserFacing) {
                 return { error: msg };
               }
-              console.error(`[agent-native] action '${name}' failed:`, err);
+              const requestId = getHttpRequestTelemetryId(event);
+              const captureId = captureError(err, {
+                route: routePath,
+                method: reqMethod,
+                tags: {
+                  action: name,
+                  caller: resolvedCaller
+                    ? "a2a"
+                    : isFrontendActionRequest(event)
+                      ? "frontend"
+                      : "http",
+                  status_code: String(status),
+                },
+                ...(requestId ? { extra: { request_id: requestId } } : {}),
+              });
+              console.error(`[agent-native] action '${name}' failed:`, {
+                action: name,
+                ...(requestId ? { requestId } : {}),
+                ...(captureId ? { captureId } : {}),
+                error: err?.stack ?? String(err),
+              });
               return { error: "Internal server error" };
             }
           },

package/src/server/http-response-telemetry.ts

@@ -284,11 +284,16 @@ function emitTelemetry(
 function requestTelemetryState(
   event: H3Event,
 ): HttpRequestTelemetryState | undefined {
-  return (event.context as Record<PropertyKey, unknown>)[
+  return (event.context as Record<PropertyKey, unknown> | undefined)?.[
     REQUEST_TELEMETRY_KEY
   ] as HttpRequestTelemetryState | undefined;
 }
 
+/** Return the durable request id while a request is still being handled. */
+export function getHttpRequestTelemetryId(event: H3Event): string | undefined {
+  return requestTelemetryState(event)?.requestId;
+}
+
 function appendServerTiming(
   response: Response,
   event: H3Event,

package/src/templates/workspace-core/.agents/skills/observability/SKILL.md

@@ -32,7 +32,7 @@ await putSetting("observability-config", {
   enabled: true,
   capturePrompts: false,
   captureToolArgs: true,    // capture action input args
-  captureToolResults: false,
+  captureToolResults: false, // include failed tool error text on tracked $ai_generation tool call entries
   evalSampleRate: 0.05,     // 5% of runs get LLM-as-judge eval
   inferredSentimentEnabled: false,
   inferredSentimentSampleRate: 0,

package/src/templates/workspace-core/.agents/skills/tracking/SKILL.md

@@ -160,7 +160,7 @@ Other framework-level baseline events:
 - `signup` from Better Auth user creation, with `auth_provider`, `auth_user_id`, and first-touch referral attribution (`referral_source`, `referrer_user`, `referral_medium`, `referral_campaign`, `utm_*`, `first_touch_path`, `landing_referrer` — see "Referral / viral attribution" above)
 - `builder connect clicked` and `builder connect popup blocked` from browser Connect Builder CTAs
 - `builder connect started`, `builder connect succeeded`, `builder connect failed`, `builder disconnect succeeded`, and `builder disconnect failed` from the Builder connection routes, with LLM connection context when resolvable
-- `$ai_generation` from instrumented agent loops, with PostHog AI Observability fields such as `$ai_trace_id`, `$ai_session_id`, `$ai_model`, `$ai_provider`, `$ai_input_tokens`, `$ai_output_tokens`, `$ai_latency`, `$ai_total_cost_usd`, and mirrored Agent Native query fields such as `run_id`, `thread_id`, `cost_cents_x100`, `duration_ms`, `tool_calls`, and `status`. A bounded `tools` array contains names, start offsets, durations, statuses, and coarse error classes only; interrupted tools and failed runs remain visible, and delegated runs include protocol/task/parent-run/parent-turn correlation. Prompt, tool argument, result, and output content is excluded.
+- `$ai_generation` from instrumented agent loops, with PostHog AI Observability fields such as `$ai_trace_id`, `$ai_session_id`, `$ai_model`, `$ai_provider`, `$ai_input_tokens`, `$ai_output_tokens`, `$ai_latency`, `$ai_total_cost_usd`, and mirrored Agent Native query fields such as `run_id`, `thread_id`, `cost_cents_x100`, `duration_ms`, `tool_calls`, and `status`. A bounded `tools` array contains names, start offsets, durations, statuses, and coarse error classes only; interrupted tools and failed runs remain visible, and delegated runs include protocol/task/parent-run/parent-turn correlation. Prompt, tool argument, result, and output content is excluded unless `captureToolResults` is opted in (see the `observability` skill), in which case each failed tool call also carries a `error_message` string truncated to 500 characters and already scrubbed of bearer tokens, API keys, and key/value secret patterns.
 
 For new lifecycle events, call `track()` server-side when the server is the source of truth, and `trackEvent()` client-side only for browser interactions.