@agent-native/core 0.118.0 → 0.119.0

package/corpus/core/src/client/sse-event-processor.ts

@@ -1,5 +1,6 @@
 import type { ChatModelRunResult } from "@assistant-ui/react";
 
+import type { A2AAgentActivitySnapshot } from "../a2a/activity.js";
 import type { ActionChatUIConfig } from "../action-ui.js";
 import {
   LLM_MISSING_CREDENTIALS_ERROR_CODE,
@@ -74,6 +75,12 @@ export interface SSEEvent {
   seq?: number;
   agent?: string;
   status?: string;
+  state?: string;
+  elapsedSeconds?: number;
+  detail?: string;
+  agentCallId?: string;
+  durationMs?: number;
+  snapshot?: A2AAgentActivitySnapshot;
   reason?: string;
   // Agent task fields
   taskId?: string;
@@ -100,6 +107,12 @@ export type AgentAutoContinueReason =
 
 export type AgentActivityTrailEntry = { label: string; tool?: string };
 
+export interface AgentCallProgress {
+  state: string;
+  elapsedSeconds: number;
+  detail?: string;
+}
+
 export interface AgentAutoContinueErrorInfo {
   message: string;
   details?: string;
@@ -1365,7 +1378,7 @@ export function processEvent(
   if (ev.type === "agent_call") {
     const agentName = ev.agent ?? "agent";
     if (ev.status === "start") {
-      const toolCallId = `tc_${++toolCallCounter.value}`;
+      const toolCallId = ev.agentCallId ?? `tc_${++toolCallCounter.value}`;
       content.push({
         type: "tool-call",
         toolCallId,
@@ -1380,9 +1393,16 @@ export function processEvent(
         if (
           part.type === "tool-call" &&
           part.toolName === `agent:${agentName}` &&
+          (!ev.agentCallId || part.toolCallId === ev.agentCallId) &&
           part.result === undefined
         ) {
           part.result = ev.status === "error" ? "Error calling agent" : "Done";
+          part.structuredMeta = {
+            ...part.structuredMeta,
+            ...(ev.durationMs != null
+              ? { agentDurationMs: ev.durationMs }
+              : {}),
+          };
           break;
         }
       }
@@ -1401,6 +1421,7 @@ export function processEvent(
       if (
         part.type === "tool-call" &&
         part.toolName === `agent:${agentName}` &&
+        (!ev.agentCallId || part.toolCallId === ev.agentCallId) &&
         part.result === undefined
       ) {
         part.argsText += ev.text ?? "";
@@ -1413,6 +1434,69 @@ export function processEvent(
     };
   }
 
+  if (ev.type === "agent_call_progress") {
+    const agentName = ev.agent ?? "agent";
+    if (typeof ev.state !== "string") {
+      return { action: "continue" };
+    }
+    const elapsedSeconds =
+      typeof ev.elapsedSeconds === "number" &&
+      Number.isFinite(ev.elapsedSeconds) &&
+      ev.elapsedSeconds >= 0
+        ? ev.elapsedSeconds
+        : 0;
+    for (let i = content.length - 1; i >= 0; i--) {
+      const part = content[i];
+      if (
+        part.type === "tool-call" &&
+        part.toolName === `agent:${agentName}` &&
+        (!ev.agentCallId || part.toolCallId === ev.agentCallId) &&
+        part.result === undefined
+      ) {
+        part.structuredMeta = {
+          ...part.structuredMeta,
+          agentProgress: {
+            state: ev.state,
+            elapsedSeconds,
+            ...(ev.detail ? { detail: ev.detail } : {}),
+          } satisfies AgentCallProgress,
+        };
+        break;
+      }
+    }
+    return {
+      action: "yield",
+      result: { content: contentSnapshot(content) } as ChatModelRunResult,
+    };
+  }
+
+  if (ev.type === "agent_call_activity" && ev.snapshot) {
+    const agentName = ev.agent ?? "agent";
+    for (let i = content.length - 1; i >= 0; i--) {
+      const part = content[i];
+      if (
+        part.type === "tool-call" &&
+        part.toolName === `agent:${agentName}` &&
+        (!ev.agentCallId || part.toolCallId === ev.agentCallId)
+      ) {
+        const previous = part.structuredMeta?.agentActivity as
+          | A2AAgentActivitySnapshot
+          | undefined;
+        if (!previous || ev.snapshot.sequence >= previous.sequence) {
+          part.structuredMeta = {
+            ...part.structuredMeta,
+            agentActivity: ev.snapshot,
+          };
+        }
+        break;
+      }
+    }
+    return {
+      action: "yield",
+      result: { content: contentSnapshot(content) } as ChatModelRunResult,
+    };
+  }
+
   // ─── Agent task events (sub-agent chips) ─────────────────────────
   // These events are dispatched as CustomEvents so AgentTaskCard components
   // can listen for updates to their specific taskId.

package/corpus/core/src/client/transcription/use-live-transcription.ts

@@ -6,9 +6,9 @@
  * stop when the user hits stop. The accumulated transcript is available
  * immediately — no round-trip to Whisper needed.
  *
- * Higher-quality backends (Groq Whisper, OpenAI Whisper, Deepgram) can
- * refine the result afterward, but this gives users something useful
- * from second zero even without an API key.
+ * Builder can transcribe the original recording afterward if native capture
+ * produces no text, but this gives users something useful from second zero
+ * without a cloud transcription request.
  */
 
 import { useCallback, useEffect, useRef, useState } from "react";
@@ -58,12 +58,21 @@ export function useLiveTranscription(
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const recognitionRef = useRef<any>(null);
   const transcriptRef = useRef("");
+  const interimRef = useRef("");
   const stoppedManuallyRef = useRef(false);
   const stopWaiterRef = useRef<((text: string) => void) | null>(null);
   const restartTimerRef = useRef<number | null>(null);
   const networkErrorCountRef = useRef(0);
   const restartDelayRef = useRef(0);
 
+  const currentTranscript = useCallback(
+    () =>
+      [transcriptRef.current.trim(), interimRef.current.trim()]
+        .filter(Boolean)
+        .join(" "),
+    [],
+  );
+
   const supported = !!getSpeechRecognitionCtor();
 
   const start = useCallback(() => {
@@ -89,6 +98,7 @@ export function useLiveTranscription(
     recognition.lang = lang;
     recognitionRef.current = recognition;
     transcriptRef.current = "";
+    interimRef.current = "";
     stoppedManuallyRef.current = false;
     networkErrorCountRef.current = 0;
     restartDelayRef.current = 0;
@@ -107,6 +117,7 @@ export function useLiveTranscription(
           interim += text;
         }
       }
+      interimRef.current = interim;
       setInterimText(interim);
       if (event.results.length > 0) {
         networkErrorCountRef.current = 0;
@@ -167,7 +178,7 @@ export function useLiveTranscription(
       }
       setIsActive(false);
       if (stopWaiterRef.current) {
-        stopWaiterRef.current(transcriptRef.current);
+        stopWaiterRef.current(currentTranscript());
       }
     };
 
@@ -177,14 +188,16 @@ export function useLiveTranscription(
     } catch {
       /* browser may block without user gesture */
     }
-  }, [lang]);
+  }, [currentTranscript, lang]);
 
   const stop = useCallback((): string => {
+    const text = currentTranscript();
     stoppedManuallyRef.current = true;
     if (restartTimerRef.current !== null) {
       window.clearTimeout(restartTimerRef.current);
       restartTimerRef.current = null;
     }
+    interimRef.current = "";
     setInterimText("");
     if (recognitionRef.current) {
       try {
@@ -195,51 +208,57 @@ export function useLiveTranscription(
       recognitionRef.current = null;
     }
     setIsActive(false);
-    return transcriptRef.current;
-  }, []);
+    return text;
+  }, [currentTranscript]);
 
-  const stopAndWait = useCallback((timeoutMs = 1200): Promise<string> => {
-    stoppedManuallyRef.current = true;
-    if (restartTimerRef.current !== null) {
-      window.clearTimeout(restartTimerRef.current);
-      restartTimerRef.current = null;
-    }
-    setInterimText("");
-
-    const recognition = recognitionRef.current;
-    if (!recognition) {
-      setIsActive(false);
-      return Promise.resolve(transcriptRef.current);
-    }
+  const stopAndWait = useCallback(
+    (timeoutMs = 1200): Promise<string> => {
+      stoppedManuallyRef.current = true;
+      if (restartTimerRef.current !== null) {
+        window.clearTimeout(restartTimerRef.current);
+        restartTimerRef.current = null;
+      }
+      setInterimText("");
 
-    return new Promise((resolve) => {
-      let settled = false;
-      const finish = (text: string) => {
-        if (settled) return;
-        settled = true;
-        window.clearTimeout(timeout);
-        if (stopWaiterRef.current === finish) {
-          stopWaiterRef.current = null;
-        }
-        if (recognitionRef.current === recognition) {
-          recognitionRef.current = null;
-        }
+      const recognition = recognitionRef.current;
+      if (!recognition) {
+        const text = currentTranscript();
+        interimRef.current = "";
         setIsActive(false);
-        resolve(text);
-      };
+        return Promise.resolve(text);
+      }
 
-      const timeout = window.setTimeout(() => {
-        finish(transcriptRef.current);
-      }, timeoutMs);
+      return new Promise((resolve) => {
+        let settled = false;
+        const finish = (text: string) => {
+          if (settled) return;
+          settled = true;
+          window.clearTimeout(timeout);
+          if (stopWaiterRef.current === finish) {
+            stopWaiterRef.current = null;
+          }
+          if (recognitionRef.current === recognition) {
+            recognitionRef.current = null;
+          }
+          interimRef.current = "";
+          setIsActive(false);
+          resolve(text);
+        };
 
-      stopWaiterRef.current = finish;
-      try {
-        recognition.stop();
-      } catch {
-        finish(transcriptRef.current);
-      }
-    });
-  }, []);
+        const timeout = window.setTimeout(() => {
+          finish(currentTranscript());
+        }, timeoutMs);
+
+        stopWaiterRef.current = finish;
+        try {
+          recognition.stop();
+        } catch {
+          finish(currentTranscript());
+        }
+      });
+    },
+    [currentTranscript],
+  );
 
   const pause = useCallback(() => {
     if (!recognitionRef.current) return;

package/corpus/core/src/deploy/build.ts

@@ -1805,7 +1805,8 @@ async function buildCloudflarePages() {
   // fails: context-xray token counts fall back to char/4 estimates and the
   // OG image route falls back to SVG.
   const heavyClientExternals = CLOUDFLARE_WORKER_ESBUILD_EXTERNALS.filter(
-    (p) => !Object.hasOwn(CLOUDFLARE_WORKER_STUB_MODULES, p),
+    (p) =>
+      !Object.prototype.hasOwnProperty.call(CLOUDFLARE_WORKER_STUB_MODULES, p),
   ).map((p) => `--external:${p}`);
 
   execFileSync(

package/corpus/core/src/guards/db-tool-scoping.ts

@@ -103,7 +103,7 @@ export function scanDbToolScoping(options: DbToolScopingOptions): GuardResult {
     const tables = extractTableCalls(contents);
     for (const table of tables) {
       if (hasRawDbScope(table.body)) continue;
-      if (Object.hasOwn(denylist, table.sqlName)) {
+      if (Object.prototype.hasOwnProperty.call(denylist, table.sqlName)) {
         seenAllowed.add(table.sqlName);
         continue;
       }

package/corpus/core/src/integrations/adapters/slack.ts

@@ -45,6 +45,17 @@ const SLACK_IDENTITY_CACHE_TTL_MS = 10 * 60 * 1_000;
 // API blip must not fail-close a sender's identity (and DMs) for 10 minutes.
 const SLACK_IDENTITY_NEGATIVE_CACHE_TTL_MS = 30 * 1_000;
 const SLACK_IDENTITY_CACHE_MAX_ENTRIES = 1_000;
+const SLACK_TOKEN_IDENTITY_CACHE_TTL_MS = 10 * 60 * 1_000;
+const SLACK_TOKEN_IDENTITY_NEGATIVE_CACHE_TTL_MS = 30 * 1_000;
+
+type SlackTokenIdentity = {
+  teamId: string | null;
+  appId: string | null;
+  valid: boolean;
+  expiresAt: number;
+};
+
+const slackTokenIdentityCache = new Map<string, SlackTokenIdentity>();
 
 interface SlackUserIdentity {
   email: string | null;
@@ -116,8 +127,7 @@ export function slackAdapter(
 ): PlatformAdapter {
   const resolveBotToken = async (incoming: IncomingMessage) =>
     (await options.resolveBotToken?.(incoming)) ??
-    (await resolveManagedSlackBotToken(incoming)) ??
-    (await resolveSecret("SLACK_BOT_TOKEN")) ??
+    (await resolveSlackBotTokenForIncoming(incoming)) ??
     undefined;
 
   return {
@@ -713,6 +723,19 @@ function parseAllowlistEnv(name: string): Set<string> | null {
   return new Set(values);
 }
 
+export async function resolveSlackBotTokenForIncoming(
+  incoming: IncomingMessage,
+): Promise<string | undefined> {
+  const managedToken = await resolveManagedSlackBotToken(incoming);
+  if (managedToken) return managedToken;
+
+  const legacyToken = await resolveSecret("SLACK_BOT_TOKEN");
+  if (!legacyToken) return undefined;
+  return (await isSlackTokenForIncoming(legacyToken, incoming))
+    ? legacyToken
+    : undefined;
+}
+
 async function resolveManagedSlackBotToken(
   incoming: IncomingMessage,
 ): Promise<string | undefined> {
@@ -736,13 +759,13 @@ async function resolveManagedSlackBotToken(
           slackInstallationKey({ teamId, enterpriseId, apiAppId }),
         )
       : null;
-    if (!installation && teamId) {
+    if (!installation && !apiAppId && teamId) {
       installation = await getActiveIntegrationInstallationForTenant(
         "slack",
         teamId,
       );
     }
-    if (!installation && enterpriseId) {
+    if (!installation && !apiAppId && enterpriseId) {
       installation = await getActiveIntegrationInstallationForTenant(
         "slack",
         enterpriseId,
@@ -757,6 +780,62 @@ async function resolveManagedSlackBotToken(
   }
 }
 
+async function isSlackTokenForIncoming(
+  token: string,
+  incoming: IncomingMessage,
+): Promise<boolean> {
+  const teamId = slackIdentityValue(incoming.platformContext.teamId);
+  const apiAppId = slackIdentityValue(incoming.platformContext.apiAppId);
+  if (!teamId && !apiAppId) return true;
+
+  const cached = slackTokenIdentityCache.get(token);
+  if (cached && cached.expiresAt > Date.now()) {
+    return (
+      cached.valid &&
+      (!teamId || cached.teamId === teamId) &&
+      (!apiAppId || cached.appId === apiAppId)
+    );
+  }
+
+  const auth = await slackJson(token, "auth.test", {});
+  const authTeamId = slackIdentityValue(auth?.team_id);
+  const botId = slackIdentityValue(auth?.bot_id);
+  let appId: string | null = null;
+  let valid = !!auth;
+
+  if (valid && apiAppId) {
+    const bot = botId
+      ? await slackJson(token, "bots.info", { bot: botId })
+      : null;
+    appId = slackIdentityValue(bot?.bot?.app_id);
+    valid = !!appId;
+  }
+
+  const identity: SlackTokenIdentity = {
+    teamId: authTeamId,
+    appId,
+    valid,
+    expiresAt:
+      Date.now() +
+      (valid
+        ? SLACK_TOKEN_IDENTITY_CACHE_TTL_MS
+        : SLACK_TOKEN_IDENTITY_NEGATIVE_CACHE_TTL_MS),
+  };
+  slackTokenIdentityCache.set(token, identity);
+
+  return (
+    valid &&
+    (!teamId || identity.teamId === teamId) &&
+    (!apiAppId || identity.appId === apiAppId)
+  );
+}
+
+function slackIdentityValue(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim();
+  return normalized && normalized !== "unknown" ? normalized : null;
+}
+
 let _missingAllowlistWarned = false;
 
 /**
@@ -1079,7 +1158,7 @@ async function resolveSlackThreadPermalink(
   if (typeof channelId !== "string" || typeof threadTs !== "string") {
     return undefined;
   }
-  const token = resolvedToken ?? (await resolveSecret("SLACK_BOT_TOKEN"));
+  const token = resolvedToken;
   if (!token) return undefined;
 
   try {

package/corpus/core/src/integrations/index.ts

@@ -114,7 +114,11 @@ export type {
 } from "./remote-types.js";
 
 // Adapters
-export { slackAdapter, type SlackAdapterOptions } from "./adapters/slack.js";
+export {
+  resolveSlackBotTokenForIncoming,
+  slackAdapter,
+  type SlackAdapterOptions,
+} from "./adapters/slack.js";
 export { telegramAdapter } from "./adapters/telegram.js";
 export { whatsappAdapter } from "./adapters/whatsapp.js";
 export { discordAdapter } from "./adapters/discord.js";

package/corpus/core/src/localization/default-messages.ts

@@ -337,6 +337,12 @@ const messages = {
     configureProviderKeys: "Configure Anthropic, OpenAI, or another provider",
     checkingAiConnection: "Checking AI connection...",
     connectionUnavailable: "Unable to check AI connection. Click to retry.",
+    delegatedAgent: {
+      asking: "Asking {{name}}...",
+      asked: "Asked {{name}}",
+      error: "Error asking {{name}}",
+      elapsed: "{{duration}} elapsed",
+    },
     voiceMode: {
       entryButtonLabel: "Use microphone",
       promptTitle: "Use your voice",
@@ -806,7 +812,7 @@ const messages = {
     connected: "Connected",
     configure: "Configure",
     connect: "Connect",
-    connectWithOAuth: "Connect with OAuth",
+    connectWithOAuth: "Connect",
     useApiToken: "Use API token",
     connectSuggestion: "Connect {{name}} to use it in chat",
     connectSuggestionWithApiToken:

package/corpus/core/src/mcp-client/oauth-routes.ts

@@ -4,10 +4,11 @@ import type { OAuthClientInformationMixed } from "@modelcontextprotocol/sdk/shar
 import {
   deleteCookie,
   defineEventHandler,
+  getChunkedCookie,
   getCookie,
   getMethod,
   getQuery,
-  setCookie,
+  setChunkedCookie,
   setResponseStatus,
   type H3Event,
 } from "h3";
@@ -32,6 +33,9 @@ import {
 
 const FLOW_COOKIE = "an_mcp_oauth_flow";
 const FLOW_TTL_SECONDS = 10 * 60;
+const FLOW_COOKIE_CHUNK_SIZE = 2_800;
+const FLOW_COOKIE_MAX_CHUNKS = 8;
+const CHUNKED_COOKIE_PREFIX = "__chunked__";
 
 export interface McpOAuthFlow {
   name: string;
@@ -189,13 +193,7 @@ async function handleMcpOAuthStart(
       ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),
       expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
     };
-    setCookie(event, FLOW_COOKIE, encryptSecretValue(JSON.stringify(flow)), {
-      httpOnly: true,
-      secure: redirectUri.startsWith("https://"),
-      sameSite: "lax",
-      path: "/",
-      maxAge: FLOW_TTL_SECONDS,
-    });
+    setMcpOAuthFlowCookie(event, flow, redirectUri.startsWith("https://"));
     return redirectWithStagedCookies(event, started.authorizationUrl.href);
   } catch {
     setResponseStatus(event, 400);
@@ -217,8 +215,8 @@ async function handleMcpOAuthCallback(
   const code = text(query.code);
   const state = text(query.state);
   const providerError = text(query.error);
-  const flow = readFlow(event);
-  deleteCookie(event, FLOW_COOKIE, { path: "/" });
+  const flow = readMcpOAuthFlowCookie(event);
+  clearMcpOAuthFlowCookies(event);
   if (providerError || !code || !state) {
     setResponseStatus(event, 400);
     return { error: "MCP OAuth authorization was not completed." };
@@ -275,8 +273,36 @@ async function handleMcpOAuthCallback(
   }
 }
 
-function readFlow(event: H3Event): McpOAuthFlow | null {
-  const encrypted = getCookie(event, FLOW_COOKIE);
+export function setMcpOAuthFlowCookie(
+  event: H3Event,
+  flow: McpOAuthFlow,
+  secure: boolean,
+): void {
+  const encrypted = encryptSecretValue(JSON.stringify(flow));
+  const chunkCount = Math.ceil(encrypted.length / FLOW_COOKIE_CHUNK_SIZE);
+  if (chunkCount > FLOW_COOKIE_MAX_CHUNKS) {
+    throw new Error("MCP OAuth flow state exceeds the cookie size limit.");
+  }
+  setChunkedCookie(event, FLOW_COOKIE, encrypted, {
+    httpOnly: true,
+    secure,
+    sameSite: "lax",
+    path: "/",
+    maxAge: FLOW_TTL_SECONDS,
+    chunkMaxLength: FLOW_COOKIE_CHUNK_SIZE,
+  });
+}
+
+export function readMcpOAuthFlowCookie(event: H3Event): McpOAuthFlow | null {
+  const primaryCookie = getCookie(event, FLOW_COOKIE);
+  if (!primaryCookie) return null;
+  if (primaryCookie.startsWith(CHUNKED_COOKIE_PREFIX)) {
+    const rawCount = primaryCookie.slice(CHUNKED_COOKIE_PREFIX.length);
+    if (!/^\d+$/.test(rawCount)) return null;
+    const chunkCount = Number(rawCount);
+    if (chunkCount < 2 || chunkCount > FLOW_COOKIE_MAX_CHUNKS) return null;
+  }
+  const encrypted = getChunkedCookie(event, FLOW_COOKIE);
   if (!encrypted) return null;
   try {
     const parsed = JSON.parse(decryptSecretValue(encrypted)) as McpOAuthFlow;
@@ -286,6 +312,13 @@ function readFlow(event: H3Event): McpOAuthFlow | null {
   }
 }
 
+export function clearMcpOAuthFlowCookies(event: H3Event): void {
+  deleteCookie(event, FLOW_COOKIE, { path: "/" });
+  for (let index = 1; index <= FLOW_COOKIE_MAX_CHUNKS; index += 1) {
+    deleteCookie(event, `${FLOW_COOKIE}.${index}`, { path: "/" });
+  }
+}
+
 export function isValidMcpOAuthFlow(
   flow: McpOAuthFlow,
   email: string,

package/corpus/core/src/scripts/agent-engines/list-agent-engines.ts

@@ -15,8 +15,6 @@ import {
   normalizeModelForEngine,
 } from "../../agent/engine/index.js";
 import type { ActionTool } from "../../agent/types.js";
-import { resolveHostedDefaultModelExperiment } from "../../observability/hosted-model-experiment.js";
-import { getRequestUserEmail } from "../../server/request-context.js";
 import { getSetting } from "../../settings/index.js";
 
 export const tool: ActionTool = {
@@ -91,15 +89,6 @@ export async function run(args: Record<string, string> = {}): Promise<string> {
           currentModelCandidate ?? currentEntry.defaultModel,
         )
       : (currentModelCandidate ?? DEFAULT_MODEL);
-  const hostedExperiment = currentEntry
-    ? resolveHostedDefaultModelExperiment({
-        userId: getRequestUserEmail(),
-        engineName: currentEntry.name,
-        isDefaultModelSelection: currentModelCandidate == null,
-        supportedModels: currentEntry.supportedModels,
-      })
-    : null;
-  const effectiveCurrentModel = hostedExperiment?.model ?? currentModel;
   const result = {
     engines: engines.map((e) => ({
       name: e.name,
@@ -116,13 +105,7 @@ export async function run(args: Record<string, string> = {}): Promise<string> {
       ? null
       : {
           engine: currentEngineName,
-          model: effectiveCurrentModel,
-          ...(hostedExperiment
-            ? {
-                modelSelectionSource: "experiment",
-                experimentAssignments: [hostedExperiment.assignment],
-              }
-            : {}),
+          model: currentModel,
         },
   };