@agent-native/core 0.118.0 → 0.119.0

package/src/client/transcription/use-live-transcription.ts

@@ -6,9 +6,9 @@
  * stop when the user hits stop. The accumulated transcript is available
  * immediately — no round-trip to Whisper needed.
  *
- * Higher-quality backends (Groq Whisper, OpenAI Whisper, Deepgram) can
- * refine the result afterward, but this gives users something useful
- * from second zero even without an API key.
+ * Builder can transcribe the original recording afterward if native capture
+ * produces no text, but this gives users something useful from second zero
+ * without a cloud transcription request.
  */
 
 import { useCallback, useEffect, useRef, useState } from "react";
@@ -58,12 +58,21 @@ export function useLiveTranscription(
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const recognitionRef = useRef<any>(null);
   const transcriptRef = useRef("");
+  const interimRef = useRef("");
   const stoppedManuallyRef = useRef(false);
   const stopWaiterRef = useRef<((text: string) => void) | null>(null);
   const restartTimerRef = useRef<number | null>(null);
   const networkErrorCountRef = useRef(0);
   const restartDelayRef = useRef(0);
 
+  const currentTranscript = useCallback(
+    () =>
+      [transcriptRef.current.trim(), interimRef.current.trim()]
+        .filter(Boolean)
+        .join(" "),
+    [],
+  );
+
   const supported = !!getSpeechRecognitionCtor();
 
   const start = useCallback(() => {
@@ -89,6 +98,7 @@ export function useLiveTranscription(
     recognition.lang = lang;
     recognitionRef.current = recognition;
     transcriptRef.current = "";
+    interimRef.current = "";
     stoppedManuallyRef.current = false;
     networkErrorCountRef.current = 0;
     restartDelayRef.current = 0;
@@ -107,6 +117,7 @@ export function useLiveTranscription(
           interim += text;
         }
       }
+      interimRef.current = interim;
       setInterimText(interim);
       if (event.results.length > 0) {
         networkErrorCountRef.current = 0;
@@ -167,7 +178,7 @@ export function useLiveTranscription(
       }
       setIsActive(false);
       if (stopWaiterRef.current) {
-        stopWaiterRef.current(transcriptRef.current);
+        stopWaiterRef.current(currentTranscript());
       }
     };
 
@@ -177,14 +188,16 @@ export function useLiveTranscription(
     } catch {
       /* browser may block without user gesture */
     }
-  }, [lang]);
+  }, [currentTranscript, lang]);
 
   const stop = useCallback((): string => {
+    const text = currentTranscript();
     stoppedManuallyRef.current = true;
     if (restartTimerRef.current !== null) {
       window.clearTimeout(restartTimerRef.current);
       restartTimerRef.current = null;
     }
+    interimRef.current = "";
     setInterimText("");
     if (recognitionRef.current) {
       try {
@@ -195,51 +208,57 @@ export function useLiveTranscription(
       recognitionRef.current = null;
     }
     setIsActive(false);
-    return transcriptRef.current;
-  }, []);
+    return text;
+  }, [currentTranscript]);
 
-  const stopAndWait = useCallback((timeoutMs = 1200): Promise<string> => {
-    stoppedManuallyRef.current = true;
-    if (restartTimerRef.current !== null) {
-      window.clearTimeout(restartTimerRef.current);
-      restartTimerRef.current = null;
-    }
-    setInterimText("");
-
-    const recognition = recognitionRef.current;
-    if (!recognition) {
-      setIsActive(false);
-      return Promise.resolve(transcriptRef.current);
-    }
+  const stopAndWait = useCallback(
+    (timeoutMs = 1200): Promise<string> => {
+      stoppedManuallyRef.current = true;
+      if (restartTimerRef.current !== null) {
+        window.clearTimeout(restartTimerRef.current);
+        restartTimerRef.current = null;
+      }
+      setInterimText("");
 
-    return new Promise((resolve) => {
-      let settled = false;
-      const finish = (text: string) => {
-        if (settled) return;
-        settled = true;
-        window.clearTimeout(timeout);
-        if (stopWaiterRef.current === finish) {
-          stopWaiterRef.current = null;
-        }
-        if (recognitionRef.current === recognition) {
-          recognitionRef.current = null;
-        }
+      const recognition = recognitionRef.current;
+      if (!recognition) {
+        const text = currentTranscript();
+        interimRef.current = "";
         setIsActive(false);
-        resolve(text);
-      };
+        return Promise.resolve(text);
+      }
 
-      const timeout = window.setTimeout(() => {
-        finish(transcriptRef.current);
-      }, timeoutMs);
+      return new Promise((resolve) => {
+        let settled = false;
+        const finish = (text: string) => {
+          if (settled) return;
+          settled = true;
+          window.clearTimeout(timeout);
+          if (stopWaiterRef.current === finish) {
+            stopWaiterRef.current = null;
+          }
+          if (recognitionRef.current === recognition) {
+            recognitionRef.current = null;
+          }
+          interimRef.current = "";
+          setIsActive(false);
+          resolve(text);
+        };
 
-      stopWaiterRef.current = finish;
-      try {
-        recognition.stop();
-      } catch {
-        finish(transcriptRef.current);
-      }
-    });
-  }, []);
+        const timeout = window.setTimeout(() => {
+          finish(currentTranscript());
+        }, timeoutMs);
+
+        stopWaiterRef.current = finish;
+        try {
+          recognition.stop();
+        } catch {
+          finish(currentTranscript());
+        }
+      });
+    },
+    [currentTranscript],
+  );
 
   const pause = useCallback(() => {
     if (!recognitionRef.current) return;

package/src/deploy/build.ts

@@ -1805,7 +1805,8 @@ async function buildCloudflarePages() {
   // fails: context-xray token counts fall back to char/4 estimates and the
   // OG image route falls back to SVG.
   const heavyClientExternals = CLOUDFLARE_WORKER_ESBUILD_EXTERNALS.filter(
-    (p) => !Object.hasOwn(CLOUDFLARE_WORKER_STUB_MODULES, p),
+    (p) =>
+      !Object.prototype.hasOwnProperty.call(CLOUDFLARE_WORKER_STUB_MODULES, p),
   ).map((p) => `--external:${p}`);
 
   execFileSync(

package/src/guards/db-tool-scoping.ts

@@ -103,7 +103,7 @@ export function scanDbToolScoping(options: DbToolScopingOptions): GuardResult {
     const tables = extractTableCalls(contents);
     for (const table of tables) {
       if (hasRawDbScope(table.body)) continue;
-      if (Object.hasOwn(denylist, table.sqlName)) {
+      if (Object.prototype.hasOwnProperty.call(denylist, table.sqlName)) {
         seenAllowed.add(table.sqlName);
         continue;
       }

package/src/integrations/adapters/slack.ts

@@ -45,6 +45,17 @@ const SLACK_IDENTITY_CACHE_TTL_MS = 10 * 60 * 1_000;
 // API blip must not fail-close a sender's identity (and DMs) for 10 minutes.
 const SLACK_IDENTITY_NEGATIVE_CACHE_TTL_MS = 30 * 1_000;
 const SLACK_IDENTITY_CACHE_MAX_ENTRIES = 1_000;
+const SLACK_TOKEN_IDENTITY_CACHE_TTL_MS = 10 * 60 * 1_000;
+const SLACK_TOKEN_IDENTITY_NEGATIVE_CACHE_TTL_MS = 30 * 1_000;
+
+type SlackTokenIdentity = {
+  teamId: string | null;
+  appId: string | null;
+  valid: boolean;
+  expiresAt: number;
+};
+
+const slackTokenIdentityCache = new Map<string, SlackTokenIdentity>();
 
 interface SlackUserIdentity {
   email: string | null;
@@ -116,8 +127,7 @@ export function slackAdapter(
 ): PlatformAdapter {
   const resolveBotToken = async (incoming: IncomingMessage) =>
     (await options.resolveBotToken?.(incoming)) ??
-    (await resolveManagedSlackBotToken(incoming)) ??
-    (await resolveSecret("SLACK_BOT_TOKEN")) ??
+    (await resolveSlackBotTokenForIncoming(incoming)) ??
     undefined;
 
   return {
@@ -713,6 +723,19 @@ function parseAllowlistEnv(name: string): Set<string> | null {
   return new Set(values);
 }
 
+export async function resolveSlackBotTokenForIncoming(
+  incoming: IncomingMessage,
+): Promise<string | undefined> {
+  const managedToken = await resolveManagedSlackBotToken(incoming);
+  if (managedToken) return managedToken;
+
+  const legacyToken = await resolveSecret("SLACK_BOT_TOKEN");
+  if (!legacyToken) return undefined;
+  return (await isSlackTokenForIncoming(legacyToken, incoming))
+    ? legacyToken
+    : undefined;
+}
+
 async function resolveManagedSlackBotToken(
   incoming: IncomingMessage,
 ): Promise<string | undefined> {
@@ -736,13 +759,13 @@ async function resolveManagedSlackBotToken(
           slackInstallationKey({ teamId, enterpriseId, apiAppId }),
         )
       : null;
-    if (!installation && teamId) {
+    if (!installation && !apiAppId && teamId) {
       installation = await getActiveIntegrationInstallationForTenant(
         "slack",
         teamId,
       );
     }
-    if (!installation && enterpriseId) {
+    if (!installation && !apiAppId && enterpriseId) {
       installation = await getActiveIntegrationInstallationForTenant(
         "slack",
         enterpriseId,
@@ -757,6 +780,62 @@ async function resolveManagedSlackBotToken(
   }
 }
 
+async function isSlackTokenForIncoming(
+  token: string,
+  incoming: IncomingMessage,
+): Promise<boolean> {
+  const teamId = slackIdentityValue(incoming.platformContext.teamId);
+  const apiAppId = slackIdentityValue(incoming.platformContext.apiAppId);
+  if (!teamId && !apiAppId) return true;
+
+  const cached = slackTokenIdentityCache.get(token);
+  if (cached && cached.expiresAt > Date.now()) {
+    return (
+      cached.valid &&
+      (!teamId || cached.teamId === teamId) &&
+      (!apiAppId || cached.appId === apiAppId)
+    );
+  }
+
+  const auth = await slackJson(token, "auth.test", {});
+  const authTeamId = slackIdentityValue(auth?.team_id);
+  const botId = slackIdentityValue(auth?.bot_id);
+  let appId: string | null = null;
+  let valid = !!auth;
+
+  if (valid && apiAppId) {
+    const bot = botId
+      ? await slackJson(token, "bots.info", { bot: botId })
+      : null;
+    appId = slackIdentityValue(bot?.bot?.app_id);
+    valid = !!appId;
+  }
+
+  const identity: SlackTokenIdentity = {
+    teamId: authTeamId,
+    appId,
+    valid,
+    expiresAt:
+      Date.now() +
+      (valid
+        ? SLACK_TOKEN_IDENTITY_CACHE_TTL_MS
+        : SLACK_TOKEN_IDENTITY_NEGATIVE_CACHE_TTL_MS),
+  };
+  slackTokenIdentityCache.set(token, identity);
+
+  return (
+    valid &&
+    (!teamId || identity.teamId === teamId) &&
+    (!apiAppId || identity.appId === apiAppId)
+  );
+}
+
+function slackIdentityValue(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim();
+  return normalized && normalized !== "unknown" ? normalized : null;
+}
+
 let _missingAllowlistWarned = false;
 
 /**
@@ -1079,7 +1158,7 @@ async function resolveSlackThreadPermalink(
   if (typeof channelId !== "string" || typeof threadTs !== "string") {
     return undefined;
   }
-  const token = resolvedToken ?? (await resolveSecret("SLACK_BOT_TOKEN"));
+  const token = resolvedToken;
   if (!token) return undefined;
 
   try {

package/src/integrations/index.ts

@@ -114,7 +114,11 @@ export type {
 } from "./remote-types.js";
 
 // Adapters
-export { slackAdapter, type SlackAdapterOptions } from "./adapters/slack.js";
+export {
+  resolveSlackBotTokenForIncoming,
+  slackAdapter,
+  type SlackAdapterOptions,
+} from "./adapters/slack.js";
 export { telegramAdapter } from "./adapters/telegram.js";
 export { whatsappAdapter } from "./adapters/whatsapp.js";
 export { discordAdapter } from "./adapters/discord.js";

package/src/localization/default-messages.ts

@@ -337,6 +337,12 @@ const messages = {
     configureProviderKeys: "Configure Anthropic, OpenAI, or another provider",
     checkingAiConnection: "Checking AI connection...",
     connectionUnavailable: "Unable to check AI connection. Click to retry.",
+    delegatedAgent: {
+      asking: "Asking {{name}}...",
+      asked: "Asked {{name}}",
+      error: "Error asking {{name}}",
+      elapsed: "{{duration}} elapsed",
+    },
     voiceMode: {
       entryButtonLabel: "Use microphone",
       promptTitle: "Use your voice",
@@ -806,7 +812,7 @@ const messages = {
     connected: "Connected",
     configure: "Configure",
     connect: "Connect",
-    connectWithOAuth: "Connect with OAuth",
+    connectWithOAuth: "Connect",
     useApiToken: "Use API token",
     connectSuggestion: "Connect {{name}} to use it in chat",
     connectSuggestionWithApiToken:

package/src/mcp-client/oauth-routes.ts

@@ -4,10 +4,11 @@ import type { OAuthClientInformationMixed } from "@modelcontextprotocol/sdk/shar
 import {
   deleteCookie,
   defineEventHandler,
+  getChunkedCookie,
   getCookie,
   getMethod,
   getQuery,
-  setCookie,
+  setChunkedCookie,
   setResponseStatus,
   type H3Event,
 } from "h3";
@@ -32,6 +33,9 @@ import {
 
 const FLOW_COOKIE = "an_mcp_oauth_flow";
 const FLOW_TTL_SECONDS = 10 * 60;
+const FLOW_COOKIE_CHUNK_SIZE = 2_800;
+const FLOW_COOKIE_MAX_CHUNKS = 8;
+const CHUNKED_COOKIE_PREFIX = "__chunked__";
 
 export interface McpOAuthFlow {
   name: string;
@@ -189,13 +193,7 @@ async function handleMcpOAuthStart(
       ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),
       expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
     };
-    setCookie(event, FLOW_COOKIE, encryptSecretValue(JSON.stringify(flow)), {
-      httpOnly: true,
-      secure: redirectUri.startsWith("https://"),
-      sameSite: "lax",
-      path: "/",
-      maxAge: FLOW_TTL_SECONDS,
-    });
+    setMcpOAuthFlowCookie(event, flow, redirectUri.startsWith("https://"));
     return redirectWithStagedCookies(event, started.authorizationUrl.href);
   } catch {
     setResponseStatus(event, 400);
@@ -217,8 +215,8 @@ async function handleMcpOAuthCallback(
   const code = text(query.code);
   const state = text(query.state);
   const providerError = text(query.error);
-  const flow = readFlow(event);
-  deleteCookie(event, FLOW_COOKIE, { path: "/" });
+  const flow = readMcpOAuthFlowCookie(event);
+  clearMcpOAuthFlowCookies(event);
   if (providerError || !code || !state) {
     setResponseStatus(event, 400);
     return { error: "MCP OAuth authorization was not completed." };
@@ -275,8 +273,36 @@ async function handleMcpOAuthCallback(
   }
 }
 
-function readFlow(event: H3Event): McpOAuthFlow | null {
-  const encrypted = getCookie(event, FLOW_COOKIE);
+export function setMcpOAuthFlowCookie(
+  event: H3Event,
+  flow: McpOAuthFlow,
+  secure: boolean,
+): void {
+  const encrypted = encryptSecretValue(JSON.stringify(flow));
+  const chunkCount = Math.ceil(encrypted.length / FLOW_COOKIE_CHUNK_SIZE);
+  if (chunkCount > FLOW_COOKIE_MAX_CHUNKS) {
+    throw new Error("MCP OAuth flow state exceeds the cookie size limit.");
+  }
+  setChunkedCookie(event, FLOW_COOKIE, encrypted, {
+    httpOnly: true,
+    secure,
+    sameSite: "lax",
+    path: "/",
+    maxAge: FLOW_TTL_SECONDS,
+    chunkMaxLength: FLOW_COOKIE_CHUNK_SIZE,
+  });
+}
+
+export function readMcpOAuthFlowCookie(event: H3Event): McpOAuthFlow | null {
+  const primaryCookie = getCookie(event, FLOW_COOKIE);
+  if (!primaryCookie) return null;
+  if (primaryCookie.startsWith(CHUNKED_COOKIE_PREFIX)) {
+    const rawCount = primaryCookie.slice(CHUNKED_COOKIE_PREFIX.length);
+    if (!/^\d+$/.test(rawCount)) return null;
+    const chunkCount = Number(rawCount);
+    if (chunkCount < 2 || chunkCount > FLOW_COOKIE_MAX_CHUNKS) return null;
+  }
+  const encrypted = getChunkedCookie(event, FLOW_COOKIE);
   if (!encrypted) return null;
   try {
     const parsed = JSON.parse(decryptSecretValue(encrypted)) as McpOAuthFlow;
@@ -286,6 +312,13 @@ function readFlow(event: H3Event): McpOAuthFlow | null {
   }
 }
 
+export function clearMcpOAuthFlowCookies(event: H3Event): void {
+  deleteCookie(event, FLOW_COOKIE, { path: "/" });
+  for (let index = 1; index <= FLOW_COOKIE_MAX_CHUNKS; index += 1) {
+    deleteCookie(event, `${FLOW_COOKIE}.${index}`, { path: "/" });
+  }
+}
+
 export function isValidMcpOAuthFlow(
   flow: McpOAuthFlow,
   email: string,

package/src/scripts/agent-engines/list-agent-engines.ts

@@ -15,8 +15,6 @@ import {
   normalizeModelForEngine,
 } from "../../agent/engine/index.js";
 import type { ActionTool } from "../../agent/types.js";
-import { resolveHostedDefaultModelExperiment } from "../../observability/hosted-model-experiment.js";
-import { getRequestUserEmail } from "../../server/request-context.js";
 import { getSetting } from "../../settings/index.js";
 
 export const tool: ActionTool = {
@@ -91,15 +89,6 @@ export async function run(args: Record<string, string> = {}): Promise<string> {
           currentModelCandidate ?? currentEntry.defaultModel,
         )
       : (currentModelCandidate ?? DEFAULT_MODEL);
-  const hostedExperiment = currentEntry
-    ? resolveHostedDefaultModelExperiment({
-        userId: getRequestUserEmail(),
-        engineName: currentEntry.name,
-        isDefaultModelSelection: currentModelCandidate == null,
-        supportedModels: currentEntry.supportedModels,
-      })
-    : null;
-  const effectiveCurrentModel = hostedExperiment?.model ?? currentModel;
   const result = {
     engines: engines.map((e) => ({
       name: e.name,
@@ -116,13 +105,7 @@ export async function run(args: Record<string, string> = {}): Promise<string> {
       ? null
       : {
           engine: currentEngineName,
-          model: effectiveCurrentModel,
-          ...(hostedExperiment
-            ? {
-                modelSelectionSource: "experiment",
-                experimentAssignments: [hostedExperiment.assignment],
-              }
-            : {}),
+          model: currentModel,
         },
   };
 

package/src/scripts/call-agent.ts

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 
+import { parseA2AAgentActivityPart } from "../a2a/activity.js";
 import {
   A2ATaskTimeoutError,
   callAgent,
@@ -271,8 +272,15 @@ export async function run(
       : undefined;
 
   if (action) {
+    const agentCallId = randomUUID();
+    const startedAt = Date.now();
     if (context?.send) {
-      context.send({ type: "agent_call", agent: agent.name, status: "start" });
+      context.send({
+        type: "agent_call",
+        agent: agent.name,
+        status: "start",
+        agentCallId,
+      });
     }
     try {
       const output = await invokeReadOnlyAppAction(
@@ -281,10 +289,24 @@ export async function run(
         input as Record<string, unknown>,
         buildDelegationCorrelation(context, selfAppId, randomUUID()),
       );
+      if (context?.send && output) {
+        context.send({
+          type: "agent_call_text",
+          agent: agent.name,
+          text: output,
+          agentCallId,
+        });
+      }
       return output;
     } finally {
       if (context?.send) {
-        context.send({ type: "agent_call", agent: agent.name, status: "done" });
+        context.send({
+          type: "agent_call",
+          agent: agent.name,
+          status: "done",
+          agentCallId,
+          durationMs: Date.now() - startedAt,
+        });
       }
     }
   }
@@ -363,6 +385,7 @@ export async function run(
 
       let responseText = "";
       let lastSentLength = 0;
+      const agentCallId = randomUUID();
       const existingContinuationText = taskId
         ? null
         : await formatExistingIntegrationContinuationIfRetry(agent, message);
@@ -372,6 +395,7 @@ export async function run(
         type: "agent_call",
         agent: agent.name,
         status: "start",
+        agentCallId,
       });
 
       const emitNewText = (newText: string) => {
@@ -380,6 +404,7 @@ export async function run(
             type: "agent_call_text",
             agent: agent.name,
             text: newText.slice(lastSentLength),
+            agentCallId,
           });
           lastSentLength = newText.length;
         }
@@ -395,9 +420,10 @@ export async function run(
       // time we get to the sync fallback, Lambda is dead and the second fetch
       // errors out as "fetch failed". Async+poll has its own short fetches
       // with their own budgets, so it works reliably across hosts. The
-      // trade-off is we lose progressive in-UI text streaming for cross-app
-      // A2A calls, but the receiving agent's full response still surfaces via
-      // the tool_result event below.
+      // trade-off is that cross-app activity arrives at the poll cadence rather
+      // than token-by-token. Agent Native peers attach their current reasoning,
+      // tool status, and response preview to each task checkpoint, and the
+      // receiver's full response still surfaces below.
       //
       // That trade-off has a second-order cost: callAgent()'s poll (see
       // A2AClient.sendAndWait in a2a/client.ts) can legitimately run for
@@ -450,8 +476,22 @@ export async function run(
       ]);
       const callStartedAt = Date.now();
       let lastProgressEmitAt = callStartedAt;
+      let lastActivitySequence = -1;
       const onRemotePollUpdate = (task: Task) => {
         const state = task?.status?.state;
+        const parts = task.status?.message?.parts;
+        const snapshot = Array.isArray(parts)
+          ? parts.map(parseA2AAgentActivityPart).find((value) => value !== null)
+          : undefined;
+        if (snapshot && snapshot.sequence > lastActivitySequence) {
+          lastActivitySequence = snapshot.sequence;
+          context.send!({
+            type: "agent_call_activity",
+            agent: agent.name,
+            agentCallId,
+            snapshot,
+          });
+        }
         if (!state || !ACTIVELY_WORKING_STATES.has(state)) return;
         const now = Date.now();
         if (now - lastProgressEmitAt < PROGRESS_MIN_INTERVAL_MS) return;
@@ -462,6 +502,7 @@ export async function run(
           agent: agent.name,
           state,
           elapsedSeconds: Math.round((now - callStartedAt) / 1000),
+          agentCallId,
           ...(detail ? { detail } : {}),
         });
       };
@@ -549,6 +590,8 @@ export async function run(
         type: "agent_call",
         agent: agent.name,
         status: "done",
+        agentCallId,
+        durationMs: Date.now() - callStartedAt,
       });
 
       return responseText || "(empty response)";
@@ -718,7 +761,7 @@ async function enqueueIntegrationContinuationIfPossible(
 const MAX_PROGRESS_DETAIL_CHARS = 200;
 function extractRemoteProgressDetail(task: Task): string | undefined {
   const parts = task.status?.message?.parts;
-  if (!parts) return undefined;
+  if (!Array.isArray(parts)) return undefined;
   const text = parts
     .filter((p): p is { type: "text"; text: string } => p.type === "text")
     .map((p) => p.text)