@agent-native/core 0.119.3 → 0.119.5

package/dist/server/agent-chat/plugin-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-options.js","sourceRoot":"","sources":["../../../src/server/agent-chat/plugin-options.ts"],"names":[],"mappings":"","sourcesContent":["import type { ActionEntry } from \"../../agent/production-agent.js\";\nimport type { AgentLoopFinalResponseGuard } from \"../../agent/production-agent.js\";\nimport type {\n  AgentChatAttachment,\n  AgentChatReference,\n  MentionProvider,\n} from \"../../agent/types.js\";\nimport type { ExternalAgentPolicy } from \"../../mcp/external-agent-policy.js\";\nimport type { DatabaseToolsOption } from \"../../scripts/db/tool-mode.js\";\nimport type { PromptExamples } from \"../prompts/index.js\";\n\n/** Shape of a Nitro plugin function: receives the Nitro app instance at\n * startup and may register routes/hooks synchronously or asynchronously. */\nexport type NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\nexport interface AgentChatPluginOptions {\n  /** Template-specific actions (email ops, booking ops, etc.) */\n  actions?:\n    | Record<string, ActionEntry>\n    | (() =>\n        | Record<string, ActionEntry>\n        | Promise<Record<string, ActionEntry>>);\n  /** @deprecated Use `actions` instead */\n  scripts?:\n    | Record<string, ActionEntry>\n    | (() =>\n        | Record<string, ActionEntry>\n        | Promise<Record<string, ActionEntry>>);\n  /** System prompt for the agent. A sensible default is provided. */\n  systemPrompt?: string;\n  /** Additional system prompt prepended in dev mode */\n  devSystemPrompt?: string;\n  /** Model to use. Defaults to the resolved engine's default model. */\n  model?: string;\n  /** Optional per-app agent run chunk budget in milliseconds. Defaults to\n   * AGENT_RUN_SOFT_TIMEOUT_MS when set, otherwise no framework-imposed\n   * timeout. When reached, long runs continue through the hidden continuation\n   * path instead of surfacing a timeout warning. */\n  runSoftTimeoutMs?: number;\n  /** Optional per-app run-manager no-progress watchdog in milliseconds. */\n  runNoProgressTimeoutMs?: number;\n  /**\n   * Opt this app into Netlify durable background-function agent-chat runs. This\n   * gives hosted agent turns the 15-minute async-function budget when the app's\n   * Netlify build also emits the background function. Set this to `false` to\n   * explicitly disable a stale deploy-wide `AGENT_CHAT_DURABLE_BACKGROUND`\n   * flag for this app.\n   */\n  durableBackgroundRuns?: boolean;\n  /** Anthropic API key. Falls back to ANTHROPIC_API_KEY env var */\n  apiKey?: string;\n  /**\n   * Agent engine to use. Can be a pre-constructed AgentEngine, a registered\n   * engine name (e.g. \"anthropic\", \"ai-sdk:openai\"), or an object with name\n   * and config. Defaults to the \"anthropic\" engine using ANTHROPIC_API_KEY.\n   */\n  engine?:\n    | import(\"../../agent/engine/types.js\").AgentEngine\n    | string\n    | { name: string; config: Record<string, unknown> };\n  /** Route path. Default: /_agent-native/agent-chat */\n  path?: string;\n  /** Custom mention providers for @-tagging template entities */\n  mentionProviders?:\n    | Record<string, MentionProvider>\n    | (() =>\n        | Record<string, MentionProvider>\n        | Promise<Record<string, MentionProvider>>);\n  /** App ID used to exclude self from agent discovery (e.g., \"mail\", \"calendar\") */\n  appId?: string;\n  /** Optional MCP server branding surfaced during the initialize handshake. */\n  mcpServerInfo?: {\n    /** Human-facing title. Defaults to the capitalized app id/name. */\n    title?: string;\n    /** Host-facing description. Defaults to \"Agent-native <app> agent\". */\n    description?: string;\n    /** Canonical app URL. Relative URLs are resolved against the request origin. */\n    websiteUrl?: string;\n    /** App icons. Relative `src` values are resolved against the request origin. */\n    icons?: Array<{\n      src: string;\n      mimeType?: string;\n      sizes?: string[];\n      theme?: \"light\" | \"dark\";\n    }>;\n  };\n  /**\n   * Optional callback to resolve the org ID for the current request.\n   * When provided, the resolved value is set as AGENT_ORG_ID env var so\n   * that db-query/db-exec automatically scope by org_id in addition to\n   * owner_email.\n   *\n   * If not provided, the framework automatically uses `session.orgId` from\n   * Better Auth's active organization. Only provide this callback when you\n   * need custom org resolution logic (e.g., Atlassian org mapping).\n   */\n  resolveOrgId?: (event: any) => string | null | Promise<string | null>;\n  /**\n   * Optional owner resolver for public/anonymous chat surfaces. When the\n   * normal app session is missing, this callback may return a synthetic\n   * owner id for a narrowly-scoped public request (for example, a public\n   * shared document page). Anonymous requests use a read-only tool set by\n   * default so public viewers cannot mutate app data through the agent.\n   */\n  anonymousOwner?: (event: any) => string | null | Promise<string | null>;\n  /**\n   * Keep anonymous-owner requests on read-only template actions. Defaults to\n   * true. Only disable for single-tenant apps that intentionally allow public\n   * agent mutations.\n   */\n  anonymousReadOnly?: boolean;\n  /**\n   * Optional auth adapter for the HTTP action route\n   * (`/_agent-native/actions/*`). Its `resolveCaller` runs before the\n   * cookie/bearer `getSession` chain, letting an app accept caller identities\n   * `getSession` doesn't understand (e.g. an A2A JWT verified with\n   * `verifyA2AToken`) declaratively, instead of pre-seeding request context\n   * from a Nitro `request` hook.\n   *\n   * Returning `null` defers to the normal chain; THROWING hard-rejects with a\n   * 401 (an invalid/forged credential must not fall through to a same-origin\n   * session cookie). A resolved caller's org comes exclusively from the\n   * verified credential — the returned `orgId` or the owner-email membership\n   * lookup — never from the request's session cookie.\n   * See {@link import(\"../action-routes.js\").ActionRouteAuthAdapter}.\n   */\n  actionRouteAuth?: import(\"../action-routes.js\").ActionRouteAuthAdapter;\n  /**\n   * Optional callback to append template-specific context to the system\n   * prompt on each request. Runs after AGENTS.md / skills / memory are\n   * loaded and before the schema block — use it to inject dynamic SQL\n   * context like a data dictionary, active feature flags, or whatever\n   * the agent should know about *right now* for this user/org.\n   *\n   * Return `null` or an empty string to skip. The string you return is\n   * appended verbatim, so wrap it in your own XML tags (e.g.\n   * `<data-dictionary>…</data-dictionary>`) to keep the prompt scannable.\n   *\n   * Called on every request in every prompt variant (lean, lazy, full).\n   * Templates that want to suppress it in a particular mode should return\n   * `null` from the callback based on their own logic.\n   */\n  extraContext?: (\n    event: any,\n    owner: string,\n  ) => string | null | Promise<string | null>;\n  /**\n   * Optional final-answer guard. Templates can use this to require a\n   * corrective retry before accepting a text-only final answer, e.g. forcing\n   * real data-source tool calls for analytics requests.\n   */\n  finalResponseGuard?: AgentLoopFinalResponseGuard;\n  /**\n   * Optional per-template request normalizer. Runs after authentication and\n   * before the model sees the message, so apps can translate chat attachments\n   * into template-native file handles while preserving the user's visible text.\n   */\n  prepareRequest?: (details: {\n    event: any;\n    ownerEmail: string | null;\n    message: string;\n    displayMessage?: string;\n    attachments: AgentChatAttachment[];\n    references: AgentChatReference[];\n    threadId?: string;\n    internalContinuation?: boolean;\n    mode: \"act\" | \"plan\";\n  }) =>\n    | void\n    | {\n        message?: string;\n        displayMessage?: string;\n        attachments?: AgentChatAttachment[];\n      }\n    | Promise<void | {\n        message?: string;\n        displayMessage?: string;\n        attachments?: AgentChatAttachment[];\n      }>;\n  /**\n   * Use ONLY the template's `systemPrompt` and the actions list — skip the\n   * framework prompt wrapper, resource loading (AGENTS.md/LEARNINGS.md/\n   * memory), the SQL schema block, and the workspace files/skills/agents\n   * inventory. Intended for minimal or voice-first apps where a long,\n   * generic preamble adds latency and iteration noise without adding value.\n   *\n   * When set, the same lean prompt is used in both dev and prod modes. In\n   * dev mode the tool registry is ALSO swapped to the template's actions\n   * (same set as prod) — the dev-only bash/db-exec/file-system tools\n   * and the resource/docs/chat/team/job/browser scripts are dropped. The\n   * lean system prompt has no bash-usage guidance, so routing actions\n   * through bash would break. If you need the full dev tool surface,\n   * leave this off.\n   */\n  leanPrompt?: boolean;\n  /**\n   * Skip auto-injecting the workspace files/skills/agents inventory on the\n   * first message of a conversation while keeping the normal prompt, resources,\n   * and tool surface. Use this for domain-focused apps where broad workspace\n   * inventory is mostly latency/noise unless the user explicitly references it.\n   *\n   * `leanPrompt: true` and the default `lazyContext` mode imply this because\n   * those catalogs are already discoverable through resources, docs-search,\n   * tool-search, and the compact resource indexes. Set `false` explicitly only\n   * when a workspace-wide inventory is central to the app's first-turn job.\n   */\n  skipFilesContext?: boolean;\n  /**\n   * Initial native tool schemas to send to the LLM provider. When set, the\n   * agent starts with only these tools plus `tool-search`; the live registry\n   * remains searchable, and matching schemas from `tool-search` results are\n   * loaded into the next model request. Use this for domain-focused apps that\n   * have a few common actions and many rare framework utilities. Common\n   * discovery and resource-reading tools are promoted automatically when\n   * present. Provider, MCP, extension, and code-execution schemas stay behind\n   * tool-search unless the app explicitly includes them in this list.\n   */\n  initialToolNames?: string[];\n  /**\n   * Use a compact system prompt with on-demand context loading. The system\n   * prompt includes essential behavioral rules and action signatures, but\n   * defers verbose framework details, SQL schema, skills, learnings, and\n   * memory behind tools (`get-framework-context`, `db-schema`,\n   * `resources` (action: read)). The agent fetches these on-demand when needed.\n   *\n   * This reduces the system prompt by ~60-70%, significantly improving\n   * time-to-first-token and reducing \"thinking\" time. The agent retains\n   * all capabilities — it just loads context lazily instead of upfront.\n   *\n   * Defaults to `true`. Set to `false` to use the original full prompt.\n   * Ignored when `leanPrompt` is set (lean mode is even more minimal).\n   */\n  lazyContext?: boolean;\n  /**\n   * In dev mode, register the template's actions as native tools the agent\n   * can call directly with structured JSON args — skipping the default\n   * `bash(command=\"pnpm action <name> ...\")` indirection.\n   *\n   * The default dev behavior shells out because it \"mirrors how Claude Code\n   * works locally\" and reduces empty-object tool calls for templates with\n   * simple string args. But templates whose actions take structured data\n   * (objects, arrays, nested JSON) can't round-trip those cleanly through\n   * the CLI parser — stringified JSON on the way in, loss of type fidelity\n   * on the way out.\n   *\n   * Set to `true` to get the same tool surface in dev that production uses.\n   * `leanPrompt: true` implies this already (lean mode has no bash-usage\n   * guidance, so actions must be native). Set this flag without\n   * `leanPrompt` when you want native actions AND the full system prompt.\n   *\n   * Defaults to `false`.\n   */\n  nativeActionsInDev?: boolean;\n  /**\n   * Expose raw SQL/native database tools to the app agent.\n   *\n   * Defaults to `\"read\"`: `db-schema`/`db-query` are available for inspection,\n   * while writes route through typed app actions. Set to `\"write\"` (also\n   * `true`) to expose `db-exec`/`db-patch` for scoped raw SQL maintenance.\n   * Set to `\"off\"` (also `false`) for chat-first apps that want agents to use\n   * typed actions only.\n   */\n  databaseTools?: DatabaseToolsOption;\n  /**\n   * Expose framework extension management actions (`create-extension`,\n   * `update-extension`, `list-extensions`, etc.) to the app agent. Defaults to\n   * true. Set to false for apps that do not want the LLM to create or manage\n   * sandboxed extension mini-apps, even though the core extension routes may\n   * still be mounted for other surfaces.\n   */\n  extensionTools?: boolean;\n  /**\n   * Optional A2A-only deterministic response path. Runs after inbound A2A text\n   * and user context are resolved, but before an agent engine/model is loaded.\n   * Return a message to complete the A2A task without invoking the LLM, or\n   * null/undefined to continue through the normal agent loop.\n   */\n  a2aMessageFallback?: (details: {\n    message: import(\"../../a2a/types.js\").Message;\n    text: string;\n    context: import(\"../../a2a/types.js\").A2AHandlerContext;\n    userEmail: string | undefined;\n  }) =>\n    | import(\"../../a2a/types.js\").Message\n    | string\n    | null\n    | undefined\n    | Promise<import(\"../../a2a/types.js\").Message | string | null | undefined>;\n  /**\n   * Optional injectable prompt examples for core rules (rule 5 auto-refresh\n   * examples and rule 8 external provider names). When absent, generic\n   * placeholders are used so no template-specific names appear in the core\n   * prompt by default.\n   *\n   * - `providerActions`: external provider action names this template exposes\n   *   (e.g. `[\"warehouse-query\", \"crm-records\"]` for a template).\n   * - `appActions`: representative template action names for rule 5's refresh\n   *   examples (e.g. `[\"log-meal\", \"update-form\"]` for a forms template).\n   */\n  promptExamples?: PromptExamples;\n  /**\n   * Curated allow-list of action names to serve external **connector** clients\n   * on a hosted multi-tenant deployment.\n   *\n   * Whenever this list is non-empty it is active by default for **every**\n   * caller (hosted connectors, code/stdio clients, and the local CLI): external\n   * MCP clients see (and can call) only these actions plus the builtin\n   * cross-app tools (`list_apps`, `open_app`, `ask_app`, `create_embed_session`).\n   * Calls to any tool outside the list are rejected with \"Unknown tool\".\n   * This prevents the full ~105-tool catalog from bloating external-agent\n   * context windows and removes footguns (db-exec, seed-*, extension suite,\n   * browser-session tools) from connectors. It is no longer gated behind an\n   * environment variable, and the catalog is never inferred from the client.\n   *\n   * `tool-search` stays available for discovery; a trimmed action still needs\n   * the connector catalog, authenticated-read policy, or full-catalog opt-in\n   * before an external caller can execute it.\n   * Callers who need the full surface up front opt in explicitly with\n   * `agent-native connect --full-catalog` (embeds a `catalog_scope: \"full\"`\n   * claim in their connect-minted JWT) or the deployment-wide\n   * `AGENT_NATIVE_MCP_FULL_CATALOG=1` env override.\n   *\n   * Declare here rather than in MCPConfig directly; the plugin copies it through.\n   */\n  connectorCatalog?: string[];\n\n  /**\n   * Default authenticated external-agent policy. In `auto` read mode, every\n   * action explicitly marked as GET + readOnly + publicAgent.requiresAuth is\n   * added to the connector surface automatically. Writes remain ask_app-only\n   * unless `writes: \"allowlisted\"` is explicitly selected.\n   */\n  externalAgents?: ExternalAgentPolicy;\n\n  /**\n   * Skip mounting the remote MCP protocol route.\n   *\n   * Most apps should leave this off so agent chat, A2A, and MCP share one\n   * runtime. Hosted apps with a dedicated early MCP plugin can set this to\n   * true so their external connector does not depend on the heavier chat\n   * plugin initialization path.\n   */\n  disableMcp?: boolean;\n\n  /**\n   * Code-execution capability for the production agent.\n   *\n   * - `\"off\"` (default) — no code-execution tools in production.\n   * - `\"sandboxed\"` — registers the `run-code` tool (isolated Node.js sandbox\n   *   with a bridge to allowlisted registered tools). Safe for shared or\n   *   hosted deployments.\n   * - `\"trusted\"` — registers both the full coding tool registry\n   *   (bash / read / edit / write) and the `run-code` sandbox. Only use in\n   *   single-tenant or operator-controlled deployments where full shell access\n   *   to the host machine is intentional.\n   *\n   * The `AGENT_PROD_CODE_EXECUTION` environment variable (`\"trusted\"`,\n   * `\"sandboxed\"`, or `\"off\"`) takes precedence over this option, allowing\n   * per-deployment overrides without code changes.\n   *\n   * Dev-mode behavior is unchanged — both the coding tools and `run-code` are\n   * always available when the environment allows toggling.\n   */\n  codeExecution?: {\n    production?: \"off\" | \"sandboxed\" | \"trusted\";\n    /**\n     * Extra registered-tool names the sandbox bridge may forward (beyond the\n     * default allowlist: provider-api-request, provider-api-docs,\n     * provider-api-catalog, web-request).\n     */\n    bridgeTools?: string[];\n  };\n\n  /**\n   * App-level default tool-call limits. Individual actions override these with\n   * their own `timeoutMs` / `maxResultChars` declarations.\n   */\n  toolLimits?: { timeoutMs?: number; maxResultChars?: number };\n}\n"]}
+{"version":3,"file":"plugin-options.js","sourceRoot":"","sources":["../../../src/server/agent-chat/plugin-options.ts"],"names":[],"mappings":"","sourcesContent":["import type { ActionEntry } from \"../../agent/production-agent.js\";\nimport type { AgentLoopFinalResponseGuard } from \"../../agent/production-agent.js\";\nimport type {\n  AgentChatAttachment,\n  AgentChatReference,\n  MentionProvider,\n} from \"../../agent/types.js\";\nimport type { ExternalAgentPolicy } from \"../../mcp/external-agent-policy.js\";\nimport type { DatabaseToolsOption } from \"../../scripts/db/tool-mode.js\";\nimport type { PromptExamples } from \"../prompts/index.js\";\n\n/** Shape of a Nitro plugin function: receives the Nitro app instance at\n * startup and may register routes/hooks synchronously or asynchronously. */\nexport type NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\nexport interface AgentChatPluginOptions {\n  /** Template-specific actions (email ops, booking ops, etc.) */\n  actions?:\n    | Record<string, ActionEntry>\n    | (() =>\n        | Record<string, ActionEntry>\n        | Promise<Record<string, ActionEntry>>);\n  /** @deprecated Use `actions` instead */\n  scripts?:\n    | Record<string, ActionEntry>\n    | (() =>\n        | Record<string, ActionEntry>\n        | Promise<Record<string, ActionEntry>>);\n  /** System prompt for the agent. A sensible default is provided. */\n  systemPrompt?: string;\n  /** Additional system prompt prepended in dev mode */\n  devSystemPrompt?: string;\n  /** Model to use. Defaults to the resolved engine's default model. */\n  model?: string;\n  /** Optional per-app agent run chunk budget in milliseconds. Defaults to\n   * AGENT_RUN_SOFT_TIMEOUT_MS when set, otherwise no framework-imposed\n   * timeout. When reached, long runs continue through the hidden continuation\n   * path instead of surfacing a timeout warning. */\n  runSoftTimeoutMs?: number;\n  /** Optional per-app run-manager no-progress watchdog in milliseconds. */\n  runNoProgressTimeoutMs?: number;\n  /**\n   * Opt this app into Netlify durable background-function agent-chat runs. This\n   * gives hosted agent turns the 15-minute async-function budget when the app's\n   * Netlify build also emits the background function. Set this to `false` to\n   * explicitly disable a stale deploy-wide `AGENT_CHAT_DURABLE_BACKGROUND`\n   * flag for this app.\n   */\n  durableBackgroundRuns?: boolean;\n  /** Anthropic API key. Falls back to ANTHROPIC_API_KEY env var */\n  apiKey?: string;\n  /**\n   * Agent engine to use. Can be a pre-constructed AgentEngine, a registered\n   * engine name (e.g. \"anthropic\", \"ai-sdk:openai\"), or an object with name\n   * and config. Defaults to the \"anthropic\" engine using ANTHROPIC_API_KEY.\n   */\n  engine?:\n    | import(\"../../agent/engine/types.js\").AgentEngine\n    | string\n    | { name: string; config: Record<string, unknown> };\n  /** Route path. Default: /_agent-native/agent-chat */\n  path?: string;\n  /** Custom mention providers for @-tagging template entities */\n  mentionProviders?:\n    | Record<string, MentionProvider>\n    | (() =>\n        | Record<string, MentionProvider>\n        | Promise<Record<string, MentionProvider>>);\n  /** App ID used to exclude self from agent discovery (e.g., \"mail\", \"calendar\") */\n  appId?: string;\n  /** Optional MCP server branding surfaced during the initialize handshake. */\n  mcpServerInfo?: {\n    /** Human-facing title. Defaults to the capitalized app id/name. */\n    title?: string;\n    /** Host-facing description. Defaults to \"Agent-native <app> agent\". */\n    description?: string;\n    /** Canonical app URL. Relative URLs are resolved against the request origin. */\n    websiteUrl?: string;\n    /** App icons. Relative `src` values are resolved against the request origin. */\n    icons?: Array<{\n      src: string;\n      mimeType?: string;\n      sizes?: string[];\n      theme?: \"light\" | \"dark\";\n    }>;\n  };\n  /**\n   * Optional callback to resolve the org ID for the current request.\n   * When provided, the resolved value is set as AGENT_ORG_ID env var so\n   * that db-query/db-exec automatically scope by org_id in addition to\n   * owner_email.\n   *\n   * If not provided, the framework automatically uses `session.orgId` from\n   * Better Auth's active organization. Only provide this callback when you\n   * need custom org resolution logic (e.g., Atlassian org mapping).\n   */\n  resolveOrgId?: (event: any) => string | null | Promise<string | null>;\n  /**\n   * Optional owner resolver for public/anonymous chat surfaces. When the\n   * normal app session is missing, this callback may return a synthetic\n   * owner id for a narrowly-scoped public request (for example, a public\n   * shared document page). Anonymous requests use a read-only tool set by\n   * default so public viewers cannot mutate app data through the agent.\n   */\n  anonymousOwner?: (event: any) => string | null | Promise<string | null>;\n  /**\n   * Keep anonymous-owner requests on read-only template actions. Defaults to\n   * true. Only disable for single-tenant apps that intentionally allow public\n   * agent mutations.\n   */\n  anonymousReadOnly?: boolean;\n  /**\n   * Optional auth adapter for the HTTP action route\n   * (`/_agent-native/actions/*`). Its `resolveCaller` runs before the\n   * cookie/bearer `getSession` chain, letting an app accept caller identities\n   * `getSession` doesn't understand (e.g. an A2A JWT verified with\n   * `verifyA2AToken`) declaratively, instead of pre-seeding request context\n   * from a Nitro `request` hook.\n   *\n   * Returning `null` defers to the normal chain; THROWING hard-rejects with a\n   * 401 (an invalid/forged credential must not fall through to a same-origin\n   * session cookie). A resolved caller's org comes exclusively from the\n   * verified credential — the returned `orgId` or the owner-email membership\n   * lookup — never from the request's session cookie.\n   * See {@link import(\"../action-routes.js\").ActionRouteAuthAdapter}.\n   */\n  actionRouteAuth?: import(\"../action-routes.js\").ActionRouteAuthAdapter;\n  /**\n   * Optional callback to append template-specific context to the system\n   * prompt on each request. Runs after AGENTS.md / skills / memory are\n   * loaded and before the schema block — use it to inject dynamic SQL\n   * context like a data dictionary, active feature flags, or whatever\n   * the agent should know about *right now* for this user/org.\n   *\n   * Return `null` or an empty string to skip. The string you return is\n   * appended verbatim, so wrap it in your own XML tags (e.g.\n   * `<data-dictionary>…</data-dictionary>`) to keep the prompt scannable.\n   *\n   * Called on every request in every prompt variant (lean, lazy, full).\n   * Templates that want to suppress it in a particular mode should return\n   * `null` from the callback based on their own logic.\n   */\n  extraContext?: (\n    event: any,\n    owner: string,\n  ) => string | null | Promise<string | null>;\n  /**\n   * Optional final-answer guard. Templates can use this to require a\n   * corrective retry before accepting a text-only final answer, e.g. forcing\n   * real data-source tool calls for analytics requests.\n   */\n  finalResponseGuard?: AgentLoopFinalResponseGuard;\n  /**\n   * Optional per-template request normalizer. Runs after authentication and\n   * before the model sees the message, so apps can translate chat attachments\n   * into template-native file handles while preserving the user's visible text.\n   */\n  prepareRequest?: (details: {\n    event: any;\n    ownerEmail: string | null;\n    message: string;\n    displayMessage?: string;\n    attachments: AgentChatAttachment[];\n    references: AgentChatReference[];\n    threadId?: string;\n    internalContinuation?: boolean;\n    mode: \"act\" | \"plan\";\n  }) =>\n    | void\n    | {\n        message?: string;\n        displayMessage?: string;\n        attachments?: AgentChatAttachment[];\n      }\n    | Promise<void | {\n        message?: string;\n        displayMessage?: string;\n        attachments?: AgentChatAttachment[];\n      }>;\n  /**\n   * Use ONLY the template's `systemPrompt` and the actions list — skip the\n   * framework prompt wrapper, resource loading (AGENTS.md/LEARNINGS.md/\n   * memory), the SQL schema block, and the workspace files/skills/agents\n   * inventory. Intended for minimal or voice-first apps where a long,\n   * generic preamble adds latency and iteration noise without adding value.\n   *\n   * When set, the same lean prompt is used in both dev and prod modes. In\n   * dev mode the tool registry is ALSO swapped to the template's actions\n   * (same set as prod) — the dev-only bash/db-exec/file-system tools\n   * and the resource/docs/chat/team/job/browser scripts are dropped. The\n   * lean system prompt has no bash-usage guidance, so routing actions\n   * through bash would break. If you need the full dev tool surface,\n   * leave this off.\n   */\n  leanPrompt?: boolean;\n  /**\n   * Skip auto-injecting the workspace files/skills/agents inventory on the\n   * first message of a conversation while keeping the normal prompt, resources,\n   * and tool surface. Use this for domain-focused apps where broad workspace\n   * inventory is mostly latency/noise unless the user explicitly references it.\n   *\n   * `leanPrompt: true` and the default `lazyContext` mode imply this because\n   * those catalogs are already discoverable through resources, docs-search,\n   * tool-search, and the compact resource indexes. Set `false` explicitly only\n   * when a workspace-wide inventory is central to the app's first-turn job.\n   */\n  skipFilesContext?: boolean;\n  /**\n   * Initial native tool schemas to send to the LLM provider. When set, the\n   * agent starts with only these tools plus `tool-search`; the live registry\n   * remains searchable, and matching schemas from `tool-search` results are\n   * loaded into the next model request. Use this for domain-focused apps that\n   * have a few common actions and many rare framework utilities. Common\n   * discovery and resource-reading tools are promoted automatically when\n   * present. Provider, MCP, extension, and code-execution schemas stay behind\n   * tool-search unless the app explicitly includes them in this list.\n   */\n  initialToolNames?: string[];\n  /**\n   * Controls whether broad provider/corpus tools and their workflow prompt are\n   * loaded into the first model request. Use `\"lazy\"` for apps that can answer\n   * ordinary lookups from a compact curated tool set; corpus tools remain\n   * discoverable through tool-search and the full retry surface.\n   *\n   * @default \"initial\"\n   */\n  corpusTools?: \"initial\" | \"lazy\";\n  /**\n   * Use a compact system prompt with on-demand context loading. The system\n   * prompt includes essential behavioral rules and action signatures, but\n   * defers verbose framework details, SQL schema, skills, learnings, and\n   * memory behind tools (`get-framework-context`, `db-schema`,\n   * `resources` (action: read)). The agent fetches these on-demand when needed.\n   *\n   * This reduces the system prompt by ~60-70%, significantly improving\n   * time-to-first-token and reducing \"thinking\" time. The agent retains\n   * all capabilities — it just loads context lazily instead of upfront.\n   *\n   * Defaults to `true`. Set to `false` to use the original full prompt.\n   * Ignored when `leanPrompt` is set (lean mode is even more minimal).\n   */\n  lazyContext?: boolean;\n  /**\n   * In dev mode, register the template's actions as native tools the agent\n   * can call directly with structured JSON args — skipping the default\n   * `bash(command=\"pnpm action <name> ...\")` indirection.\n   *\n   * The default dev behavior shells out because it \"mirrors how Claude Code\n   * works locally\" and reduces empty-object tool calls for templates with\n   * simple string args. But templates whose actions take structured data\n   * (objects, arrays, nested JSON) can't round-trip those cleanly through\n   * the CLI parser — stringified JSON on the way in, loss of type fidelity\n   * on the way out.\n   *\n   * Set to `true` to get the same tool surface in dev that production uses.\n   * `leanPrompt: true` implies this already (lean mode has no bash-usage\n   * guidance, so actions must be native). Set this flag without\n   * `leanPrompt` when you want native actions AND the full system prompt.\n   *\n   * Defaults to `false`.\n   */\n  nativeActionsInDev?: boolean;\n  /**\n   * Expose raw SQL/native database tools to the app agent.\n   *\n   * Defaults to `\"read\"`: `db-schema`/`db-query` are available for inspection,\n   * while writes route through typed app actions. Set to `\"write\"` (also\n   * `true`) to expose `db-exec`/`db-patch` for scoped raw SQL maintenance.\n   * Set to `\"off\"` (also `false`) for chat-first apps that want agents to use\n   * typed actions only.\n   */\n  databaseTools?: DatabaseToolsOption;\n  /**\n   * Expose framework extension management actions (`create-extension`,\n   * `update-extension`, `list-extensions`, etc.) to the app agent. Defaults to\n   * true. Set to false for apps that do not want the LLM to create or manage\n   * sandboxed extension mini-apps, even though the core extension routes may\n   * still be mounted for other surfaces.\n   */\n  extensionTools?: boolean;\n  /**\n   * Optional A2A-only deterministic response path. Runs after inbound A2A text\n   * and user context are resolved, but before an agent engine/model is loaded.\n   * Return a message to complete the A2A task without invoking the LLM, or\n   * null/undefined to continue through the normal agent loop.\n   */\n  a2aMessageFallback?: (details: {\n    message: import(\"../../a2a/types.js\").Message;\n    text: string;\n    context: import(\"../../a2a/types.js\").A2AHandlerContext;\n    userEmail: string | undefined;\n  }) =>\n    | import(\"../../a2a/types.js\").Message\n    | string\n    | null\n    | undefined\n    | Promise<import(\"../../a2a/types.js\").Message | string | null | undefined>;\n  /**\n   * Optional injectable prompt examples for core rules (rule 5 auto-refresh\n   * examples and rule 8 external provider names). When absent, generic\n   * placeholders are used so no template-specific names appear in the core\n   * prompt by default.\n   *\n   * - `providerActions`: external provider action names this template exposes\n   *   (e.g. `[\"warehouse-query\", \"crm-records\"]` for a template).\n   * - `appActions`: representative template action names for rule 5's refresh\n   *   examples (e.g. `[\"log-meal\", \"update-form\"]` for a forms template).\n   */\n  promptExamples?: PromptExamples;\n  /**\n   * Curated allow-list of action names to serve external **connector** clients\n   * on a hosted multi-tenant deployment.\n   *\n   * Whenever this list is non-empty it is active by default for **every**\n   * caller (hosted connectors, code/stdio clients, and the local CLI): external\n   * MCP clients see (and can call) only these actions plus the builtin\n   * cross-app tools (`list_apps`, `open_app`, `ask_app`, `create_embed_session`).\n   * Calls to any tool outside the list are rejected with \"Unknown tool\".\n   * This prevents the full ~105-tool catalog from bloating external-agent\n   * context windows and removes footguns (db-exec, seed-*, extension suite,\n   * browser-session tools) from connectors. It is no longer gated behind an\n   * environment variable, and the catalog is never inferred from the client.\n   *\n   * `tool-search` stays available for discovery; a trimmed action still needs\n   * the connector catalog, authenticated-read policy, or full-catalog opt-in\n   * before an external caller can execute it.\n   * Callers who need the full surface up front opt in explicitly with\n   * `agent-native connect --full-catalog` (embeds a `catalog_scope: \"full\"`\n   * claim in their connect-minted JWT) or the deployment-wide\n   * `AGENT_NATIVE_MCP_FULL_CATALOG=1` env override.\n   *\n   * Declare here rather than in MCPConfig directly; the plugin copies it through.\n   */\n  connectorCatalog?: string[];\n\n  /**\n   * Default authenticated external-agent policy. In `auto` read mode, every\n   * action explicitly marked as GET + readOnly + publicAgent.requiresAuth is\n   * added to the connector surface automatically. Writes remain ask_app-only\n   * unless `writes: \"allowlisted\"` is explicitly selected.\n   */\n  externalAgents?: ExternalAgentPolicy;\n\n  /**\n   * Skip mounting the remote MCP protocol route.\n   *\n   * Most apps should leave this off so agent chat, A2A, and MCP share one\n   * runtime. Hosted apps with a dedicated early MCP plugin can set this to\n   * true so their external connector does not depend on the heavier chat\n   * plugin initialization path.\n   */\n  disableMcp?: boolean;\n\n  /**\n   * Code-execution capability for the production agent.\n   *\n   * - `\"off\"` (default) — no code-execution tools in production.\n   * - `\"sandboxed\"` — registers the `run-code` tool (isolated Node.js sandbox\n   *   with a bridge to allowlisted registered tools). Safe for shared or\n   *   hosted deployments.\n   * - `\"trusted\"` — registers both the full coding tool registry\n   *   (bash / read / edit / write) and the `run-code` sandbox. Only use in\n   *   single-tenant or operator-controlled deployments where full shell access\n   *   to the host machine is intentional.\n   *\n   * The `AGENT_PROD_CODE_EXECUTION` environment variable (`\"trusted\"`,\n   * `\"sandboxed\"`, or `\"off\"`) takes precedence over this option, allowing\n   * per-deployment overrides without code changes.\n   *\n   * Dev-mode behavior is unchanged — both the coding tools and `run-code` are\n   * always available when the environment allows toggling.\n   */\n  codeExecution?: {\n    production?: \"off\" | \"sandboxed\" | \"trusted\";\n    /**\n     * Extra registered-tool names the sandbox bridge may forward (beyond the\n     * default allowlist: provider-api-request, provider-api-docs,\n     * provider-api-catalog, web-request).\n     */\n    bridgeTools?: string[];\n  };\n\n  /**\n   * App-level default tool-call limits. Individual actions override these with\n   * their own `timeoutMs` / `maxResultChars` declarations.\n   */\n  toolLimits?: { timeoutMs?: number; maxResultChars?: number };\n}\n"]}

package/dist/server/agent-chat-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-chat-plugin.d.ts","sourceRoot":"","sources":["../../src/server/agent-chat-plugin.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAqH7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,EACL,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,+BAA+B,CAAC;AAkCvC,OAAO,EAAE,yBAAyB,EAAE,CAAC;AACrC,YAAY,EAAE,6BAA6B,EAAE,CAAC;AAwE9C,OAAO,EACL,0BAA0B,EAM1B,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EAE1B,MAAM,oCAAoC,CAAC;AAW5C,OAAO,EACL,gCAAgC,EAOjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EACL,sBAAsB,EAGvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAEL,sCAAsC,EACvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,OAAO,EAAE,gCAAgC,EAAE,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,CAAC;AACpC,YAAY,EAAE,sBAAsB,EAAE,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACtC,OAAO,EAAE,sCAAsC,EAAE,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,OAAO,EAAE,iCAAiC,EAAE,CAAC;AAC7C,OAAO,EAAE,yCAAyC,EAAE,CAAC;AAErD,wBAAgB,iCAAiC,CAC/C,OAAO,CAAC,EAAE,IAAI,CACZ,sBAAsB,EACtB,kBAAkB,GAAG,wBAAwB,GAAG,uBAAuB,CACxE;IAGC,gBAAgB;IAChB,sBAAsB;IACtB,qBAAqB;EAExB;AAED,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,EACd,WAAW,GAAE,CACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,KAChB,OAAO,CAAC,IAAI,CAA2B,EAC5C,OAAO,GAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAK5B,GACA;IACD,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAqCA;AAID,wBAAsB,mCAAmC,CACvD,KAAK,GAAE,MAAM,GAAG,IAAI,GAAG,SAA6B,GACnD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED,wBAAgB,wBAAwB,CACtC,6BAA6B,EAAE,MAAM,EACrC,sBAAsB,EAAE,MAAM,GAC7B,MAAM,CAER;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,oBAAoB,EAAE,GAAG,SAAS,EAChD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,eAAe,EAAE,CACf,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9B,uBAAuB,EAAE,CACvB,GAAG,EAAE,oBAAoB,KACtB,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;CAC/B,GACA,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAI1B;AAED,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CA43KhB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC;AAE9E,OAAO,EAEL,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"agent-chat-plugin.d.ts","sourceRoot":"","sources":["../../src/server/agent-chat-plugin.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAqH7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,EACL,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,+BAA+B,CAAC;AAkCvC,OAAO,EAAE,yBAAyB,EAAE,CAAC;AACrC,YAAY,EAAE,6BAA6B,EAAE,CAAC;AAwE9C,OAAO,EACL,0BAA0B,EAM1B,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EAE1B,MAAM,oCAAoC,CAAC;AAW5C,OAAO,EACL,gCAAgC,EAOjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EACL,sBAAsB,EAGvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAEL,sCAAsC,EACvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,OAAO,EAAE,gCAAgC,EAAE,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,CAAC;AACpC,YAAY,EAAE,sBAAsB,EAAE,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACtC,OAAO,EAAE,sCAAsC,EAAE,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,OAAO,EAAE,iCAAiC,EAAE,CAAC;AAC7C,OAAO,EAAE,yCAAyC,EAAE,CAAC;AAErD,wBAAgB,iCAAiC,CAC/C,OAAO,CAAC,EAAE,IAAI,CACZ,sBAAsB,EACtB,kBAAkB,GAAG,wBAAwB,GAAG,uBAAuB,CACxE;IAGC,gBAAgB;IAChB,sBAAsB;IACtB,qBAAqB;EAExB;AAED,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,EACd,WAAW,GAAE,CACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,UAAU,KAChB,OAAO,CAAC,IAAI,CAA2B,EAC5C,OAAO,GAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAK5B,GACA;IACD,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAC;IACvC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B,CAqCA;AAID,wBAAsB,mCAAmC,CACvD,KAAK,GAAE,MAAM,GAAG,IAAI,GAAG,SAA6B,GACnD,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED,wBAAgB,wBAAwB,CACtC,6BAA6B,EAAE,MAAM,EACrC,sBAAsB,EAAE,MAAM,GAC7B,MAAM,CAER;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,oBAAoB,EAAE,GAAG,SAAS,EAChD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,eAAe,EAAE,CACf,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9B,uBAAuB,EAAE,CACvB,GAAG,EAAE,oBAAoB,KACtB,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;CAC/B,GACA,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAI1B;AAED,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CAq4KhB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC;AAE9E,OAAO,EAEL,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/server/agent-chat-plugin.js

@@ -825,7 +825,10 @@ export function createAgentChatPlugin(options) {
             // that never emit the corpus prompt (no provider/run-code tools
             // registered), so this never silently expands the initial set for
             // apps that don't teach these tools by name.
-            const corpusToolNames = corpusToolNamesTaughtByPrompt(corpusPromptRegistry);
+            const loadCorpusToolsInitially = options?.corpusTools !== "lazy";
+            const corpusToolNames = loadCorpusToolsInitially
+                ? corpusToolNamesTaughtByPrompt(corpusPromptRegistry)
+                : [];
             const effectiveInitialToolNames = corpusToolNames.length > 0
                 ? [...new Set([...templateInitialToolNames, ...corpusToolNames])]
                 : templateInitialToolNames;
@@ -1462,7 +1465,9 @@ export function createAgentChatPlugin(options) {
             // Dev: actions are invoked via bash — emit `pnpm action name --arg <type>`
             //      and include discoveredActions too, since those are also missing
             //      from the dev tool registry.
-            const corpusToolsPrompt = generateCorpusToolsPrompt(corpusPromptRegistry);
+            const corpusToolsPrompt = loadCorpusToolsInitially
+                ? generateCorpusToolsPrompt(corpusPromptRegistry)
+                : "";
             const prodActionsPrompt = generateActionsPrompt(templateScripts, "tool", lazyContext ? effectiveInitialToolNames : undefined) + corpusToolsPrompt;
             const devActionsPrompt = generateActionsPrompt({ ...discoveredActions, ...templateScripts }, "cli") + corpusToolsPrompt;
             // Build system prompts — dynamic functions that pre-load resources per-request.
@@ -1745,6 +1750,10 @@ export function createAgentChatPlugin(options) {
                             turnId: typeof run.turnId === "string" && run.turnId
                                 ? run.turnId
                                 : undefined,
+                            runDurationMs: typeof run.startedAt === "number" &&
+                                Number.isFinite(run.startedAt)
+                                ? Math.max(0, Date.now() - run.startedAt)
+                                : undefined,
                         });
                         if (!assistantMsg) {
                             // No content produced — just bump timestamp