@agent-native/core 0.130.2 → 0.131.3

package/dist/agent/production-agent.js

@@ -41,7 +41,7 @@ import { buildCurrentTimeUserContext } from "./runtime-context.js";
 import { findCompletedJournalEntry, } from "./tool-call-journal.js";
 import { redactSensitiveFields, sanitizeToolErrorText, sanitizeToolErrorValue, } from "./tool-error-redaction.js";
 import { describeToolResultImages, extractAgentImagesFromActionResult, } from "./tool-result-images.js";
-import { createToolSearchEntry, TOOL_SEARCH_ACTION_NAME, } from "./tool-search.js";
+import { createToolSearchEntry, searchToolRegistry, TOOL_SEARCH_ACTION_NAME, } from "./tool-search.js";
 // Register built-in engines on first import
 registerBuiltinEngines();
 export { PROVIDER_TO_ENV };
@@ -343,7 +343,7 @@ export const PLAN_MODE_SYSTEM_PROMPT = `## Plan Mode Active
 You are in Plan mode. This turn is for research, clarification, and a proposed approach only.
 
 Hard rules:
-- Use only read-only tools. Do not edit files, write resources, run mutating bash commands, mutate SQL rows, navigate the UI, send notifications, create jobs, create tools, call external agents, or change external systems.
+- Use only read-only tools. Do not edit files, write resources, run mutating bash commands, mutate SQL rows, navigate the UI, send notifications, create jobs, create tools, send messages or tasks to external agents, or change external systems.
 - If a needed detail is unclear, ask a concise clarifying question before proposing a plan.
 - When ready, present a concrete plan with the files/tools you expect to touch, the intended changes, validation steps, and notable risks.
 - Do not treat approval as implicit while Plan mode is still active. Tell the user to switch to Act mode with the mode selector or /act before implementation.`;
@@ -352,17 +352,6 @@ const PLAN_MODE_BLOCKED_READONLY_TOOLS = new Set([
     "set-search-params",
     "set-url-path",
 ]);
-const PLAN_MODE_ALLOWED_ACTIONS = {
-    resources: ["list", "read"],
-    "chat-history": ["search"],
-    "agent-teams": ["status", "read-result", "list"],
-    "manage-jobs": ["list"],
-    "manage-automations": ["list-events", "list"],
-    "manage-notifications": ["list"],
-    "manage-progress": ["list"],
-    "manage-agent-engine": ["list"],
-};
-const PLAN_MODE_WEB_REQUEST_METHODS = new Set(["GET", "HEAD"]);
 const SOURCE_SWEEP_AGENT_TEAM_ALLOWED_ACTIONS = [
     "status",
     "read-result",
@@ -376,45 +365,62 @@ function getToolAction(name, args) {
         return "search";
     return String(raw ?? "").toLowerCase();
 }
-function getWebRequestMethod(args) {
-    const raw = args && typeof args === "object" && "method" in args
-        ? args.method
-        : undefined;
-    return String(raw ?? "GET").toUpperCase();
-}
-function restrictActionEnum(parameters, allowedActions) {
-    if (!parameters)
+function projectPlanModeParameters(parameters, planMode) {
+    if (!parameters || !planMode)
         return parameters;
-    const actionParam = parameters.properties.action;
-    if (!actionParam)
+    const allowedProperties = planMode.allowedProperties
+        ? new Set(planMode.allowedProperties)
+        : undefined;
+    const omittedProperties = new Set(planMode.omittedProperties ?? []);
+    const properties = Object.fromEntries(Object.entries(parameters.properties).filter(([key]) => (!allowedProperties || allowedProperties.has(key)) &&
+        !omittedProperties.has(key)));
+    let changed = false;
+    for (const [key, values] of Object.entries(planMode.allowedValues ?? {})) {
+        const parameter = properties[key];
+        if (!parameter)
+            continue;
+        properties[key] = { ...parameter, enum: [...values] };
+        changed = true;
+    }
+    if (!changed &&
+        !allowedProperties &&
+        omittedProperties.size === 0 &&
+        (planMode.requiredProperties?.length ?? 0) === 0) {
         return parameters;
+    }
+    const required = Array.from(new Set([
+        ...(parameters.required?.filter((key) => key in properties) ?? []),
+        ...(planMode.requiredProperties?.filter((key) => key in properties) ??
+            []),
+    ]));
     return {
         ...parameters,
-        properties: {
-            ...parameters.properties,
-            action: {
-                ...actionParam,
-                enum: [...allowedActions],
-            },
-        },
+        properties,
+        ...(required.length > 0 ? { required } : {}),
     };
 }
-function restrictWebRequestMethods(parameters) {
-    if (!parameters)
-        return parameters;
-    const methodParam = parameters.properties.method;
-    if (!methodParam)
-        return parameters;
-    return {
-        ...parameters,
-        properties: {
-            ...parameters.properties,
-            method: {
-                ...methodParam,
-                enum: [...PLAN_MODE_WEB_REQUEST_METHODS],
-            },
-        },
-    };
+function matchesPlanModeInputPolicy(input, planMode) {
+    const hasPropertyPolicy = planMode.allowedProperties !== undefined ||
+        (planMode.omittedProperties?.length ?? 0) > 0 ||
+        planMode.allowedValues !== undefined;
+    if (!hasPropertyPolicy)
+        return true;
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+        return false;
+    }
+    const values = input;
+    const allowedProperties = planMode.allowedProperties
+        ? new Set(planMode.allowedProperties)
+        : undefined;
+    const omittedProperties = new Set(planMode.omittedProperties ?? []);
+    if (Object.keys(values).some((key) => (allowedProperties && !allowedProperties.has(key)) ||
+        omittedProperties.has(key))) {
+        return false;
+    }
+    return Object.entries(planMode.allowedValues ?? {}).every(([key, allowed]) => {
+        const value = values[key];
+        return (value == null || (typeof value === "string" && allowed.includes(value)));
+    });
 }
 function planModeBlockedMessage(toolName, reason) {
     return (`Plan mode blocked \`${toolName}\`` +
@@ -426,15 +432,22 @@ export function isPlanModeToolCallAllowed(name, input, entry) {
         return false;
     if (PLAN_MODE_BLOCKED_READONLY_TOOLS.has(name))
         return false;
-    if (name === "web-request") {
-        return PLAN_MODE_WEB_REQUEST_METHODS.has(getWebRequestMethod(input));
-    }
     if (name === "bash") {
         return isPlanModeReadOnlyBashCall(input);
     }
-    const allowedActions = PLAN_MODE_ALLOWED_ACTIONS[name];
-    if (allowedActions) {
-        return allowedActions.includes(getToolAction(name, input));
+    if (entry.planMode) {
+        if (!matchesPlanModeInputPolicy(input, entry.planMode)) {
+            return false;
+        }
+        try {
+            const effect = typeof entry.planMode.effect === "function"
+                ? entry.planMode.effect(input)
+                : entry.planMode.effect;
+            return effect === "read";
+        }
+        catch {
+            return false;
+        }
     }
     return entry.readOnly === true;
 }
@@ -446,39 +459,28 @@ function isPlanModeReadOnlyBashCall(input) {
         return false;
     return isReadOnlyShellCommand(command);
 }
-function createPlanModeGuardedAction(name, entry, allowedActions) {
-    return {
-        ...entry,
-        readOnly: true,
-        tool: {
-            ...entry.tool,
-            description: `${entry.tool.description}\n\nPlan mode: only these read-only actions are available: ` +
-                allowedActions.map((action) => `"${action}"`).join(", ") +
-                ".",
-            parameters: restrictActionEnum(entry.tool.parameters, allowedActions),
-        },
-        run: async (args, context) => {
-            const action = getToolAction(name, args);
-            if (!allowedActions.includes(action)) {
-                return planModeBlockedMessage(name, `action="${action || "(missing)"}"`);
-            }
-            return entry.run(args, context);
-        },
-    };
-}
-function createPlanModeWebRequestAction(entry) {
+function createPlanModeGuardedAction(name, entry) {
+    const allowedValues = entry.planMode?.allowedValues;
+    const allowedDescription = allowedValues
+        ? Object.entries(allowedValues)
+            .map(([key, values]) => `\`${key}\`: ${values.map((value) => `"${value}"`).join(", ")}`)
+            .join("; ")
+        : "";
+    const guidance = entry.planMode?.description ??
+        (allowedDescription
+            ? `only these argument values are available: ${allowedDescription}.`
+            : "only calls classified as read-only are available.");
     return {
         ...entry,
         readOnly: true,
         tool: {
             ...entry.tool,
-            description: `${entry.tool.description}\n\nPlan mode: only GET and HEAD requests are allowed.`,
-            parameters: restrictWebRequestMethods(entry.tool.parameters),
+            description: `${entry.tool.description}\n\nPlan mode: ${guidance}`,
+            parameters: projectPlanModeParameters(entry.tool.parameters, entry.planMode),
         },
         run: async (args, context) => {
-            const method = getWebRequestMethod(args);
-            if (!PLAN_MODE_WEB_REQUEST_METHODS.has(method)) {
-                return planModeBlockedMessage("web-request", `method="${method}"`);
+            if (!isPlanModeToolCallAllowed(name, args, entry)) {
+                return planModeBlockedMessage(name, "call is not read-only");
             }
             return entry.run(args, context);
         },
@@ -525,20 +527,22 @@ export function createPlanModeActionRegistry(actions) {
             filtered[name] = createPlanModeBlockedAction(name, entry, "not available while planning");
             continue;
         }
-        const allowedActions = PLAN_MODE_ALLOWED_ACTIONS[name];
-        if (allowedActions) {
-            filtered[name] = createPlanModeGuardedAction(name, entry, allowedActions);
-            continue;
-        }
-        if (name === "web-request") {
-            filtered[name] = createPlanModeWebRequestAction(entry);
-            continue;
-        }
         if (name === "bash") {
             filtered[name] = createPlanModeBashAction(entry);
             continue;
         }
-        if (entry.readOnly === true) {
+        if (entry.planMode) {
+            if (typeof entry.planMode.effect === "function") {
+                filtered[name] = createPlanModeGuardedAction(name, entry);
+            }
+            else if (entry.planMode.effect === "read") {
+                filtered[name] = createPlanModeGuardedAction(name, entry);
+            }
+            else {
+                filtered[name] = createPlanModeBlockedAction(name, entry, "write or unknown effect");
+            }
+        }
+        else if (entry.readOnly === true) {
             filtered[name] = entry;
         }
         else {
@@ -2064,6 +2068,27 @@ export function filterInitialEngineTools(tools, initialToolNames) {
     }
     return tools.filter((tool) => names.has(tool.name));
 }
+export function preloadPlanModeEngineTools(options) {
+    const query = options.request.trim();
+    if (!query)
+        return options.initialTools;
+    const activeNames = new Set(options.initialTools.map((tool) => tool.name));
+    const preloadLimit = Math.max(0, Math.min(options.limit ?? 3, 5));
+    if (preloadLimit === 0)
+        return options.initialTools;
+    const ranked = searchToolRegistry(options.registry, { query, limit: 25, includeSchemas: true }, { defaultLimit: 25, maxLimit: 25 });
+    const preloadNames = ranked.results
+        .filter((result) => result.callable &&
+        result.planAvailability !== "act-only" &&
+        !activeNames.has(result.name))
+        .slice(0, preloadLimit)
+        .map((result) => result.name);
+    if (preloadNames.length === 0)
+        return options.initialTools;
+    for (const name of preloadNames)
+        activeNames.add(name);
+    return options.availableTools.filter((tool) => activeNames.has(tool.name));
+}
 export function buildFirstRequestPayloadDetail(input) {
     if (!input.isFirstRequest)
         return "";
@@ -2081,6 +2106,10 @@ const DEFAULT_INITIAL_TOOL_NAMES = new Set([
     "docs-search",
     "get-framework-context",
     "read-attachment",
+    // A pasted public URL is already a complete read target. Keep the generic
+    // GET/HEAD tool on the first request so agents can inspect self-describing
+    // pages without needing an app-specific connector or a tool-search turn.
+    "web-request",
     // The `<available-apps>` prompt block names these two BY NAME on the same
     // request, and "which app should I use for this?" is answered on turn one or
     // not at all. Omitting them made the model read the instruction, find no
@@ -2106,7 +2135,10 @@ function extractToolSearchResultNames(value) {
     for (const item of result.results) {
         if (!item || typeof item !== "object")
             continue;
-        const name = item.name;
+        const record = item;
+        if (record.callable === false)
+            continue;
+        const name = record.name;
         if (typeof name === "string" && name.trim())
             names.push(name);
     }
@@ -4002,6 +4034,7 @@ export async function runAgentLoop(opts) {
                     // Audit attribution: the action name + the agent thread/turn that
                     // triggered this call, so a mutation can be traced to its run.
                     actionName: toolCall.name,
+                    ...(wasApproved ? { approvedToolCallKey: approvalKey } : {}),
                     ...(opts.threadId ? { threadId: opts.threadId } : {}),
                     ...(opts.runId ? { runId: opts.runId } : {}),
                     ...(opts.turnId ? { turnId: opts.turnId } : {}),
@@ -5939,7 +5972,15 @@ export function createProductionAgentHandler(options) {
             ? createPlanModeActionRegistry(resolvedActions)
             : resolvedActions;
         const availableRequestTools = getEngineTools(requestActions);
-        const requestTools = filterInitialEngineTools(availableRequestTools, options.initialToolNames);
+        const initialRequestTools = filterInitialEngineTools(availableRequestTools, options.initialToolNames);
+        const requestTools = requestMode === "plan"
+            ? preloadPlanModeEngineTools({
+                request: requestMessage,
+                registry: requestActions,
+                initialTools: initialRequestTools,
+                availableTools: availableRequestTools,
+            })
+            : initialRequestTools;
         // System sections are emitted by the prompt builder once per request. Tool
         // schemas become known just after prompt setup, so append their measured
         // contribution here and reuse the immutable result for every loop pass.