@agent-native/core 0.131.7 → 0.132.0

package/corpus/README.md

@@ -28,6 +28,6 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- core files: 1644
+- core files: 1645
 - toolkit files: 168
-- template files: 7222
+- template files: 7235

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,128 @@
 # @agent-native/core
 
+## 0.132.0
+
+### Minor Changes
+
+- 89e5910: Enable durable agent-chat background runs by default for deployed Netlify apps, with an explicit opt-out.
+
+### Patch Changes
+
+- 89e5910: Batch application-state reads. `GET /_agent-native/application-state?keys=a,b,c`
+  returns many keys in one request, and `readClientAppState` coalesces reads
+  issued in the same tick into that single call, so a page load no longer pays one
+  HTTP round trip and one full identity resolution per key. The response reports
+  absent keys in `missing` rather than as `null` values, keeping "never written"
+  distinguishable from "written as null or empty"; the single-key routes are
+  unchanged.
+- 89e5910: Cut database round trips on the status endpoints a page load hits repeatedly.
+  - Added `prefetchSecrets(keys)`, which warms the per-request secret memo with
+    one batched read per scope instead of one read per key per scope, and used it
+    in `/_agent-native/env-status` (48 single-key `app_secrets` selects per request
+    → 4 batched) and `/_agent-native/voice-providers/status` (19 → 4).
+  - The change marker after an action now honours a per-call Plan-mode `effect`
+    before the action-level `readOnly` flag. A status poll shaped as a mutating
+    action — `manage-agent-engine` with `action: "list"`, polled every few seconds
+    — no longer bumps the `"action"` change version, so queries keyed on it stop
+    refetching on an idle page.
+  - The default database schema health probe runs its table checks in parallel and
+    memoizes a clean result for a few seconds. A probe reporting a missing table or
+    an unreadable database is never memoized.
+
+- 89e5910: Record tool arguments and result summaries in delegated-run traces. The A2A
+  agent-activity snapshot and the agent-team / harness background transcripts now
+  carry each tool call's arguments and a result preview in redacted, size-capped
+  form, so a delegated run that loops on the same tool is diagnosable from what
+  was recorded instead of needing a fresh repro. Captures reuse the audit
+  redaction helper (credential-looking keys and values become `[redacted]`),
+  oversized values keep an explicit `…(N more chars)` / `_auditTruncated` marker,
+  and a shared per-snapshot payload budget keeps the activity part inside its
+  wire limit.
+- 89e5910: Share one Postgres connection pool per URL across the whole process instead of
+  building a separate one for the `getDbExec` singleton, Better Auth, and every
+  `createGetDb` store. Against a remote database that removed five redundant
+  first-connect round trips per process, and it let the pool cap rise so a
+  request's concurrent reads no longer serialize behind a single connection.
+  Secret reads are now memoized per request, keyed on scope and scope id, so the
+  user/org/workspace credential waterfall is not re-walked on every lookup.
+  Onboarding step status, resource inheritance layers, and feature-flag rules now
+  resolve their independent reads concurrently.
+- 89e5910: Give delegated agent turns their app's actions as native tools in dev, so asking
+  a sibling app a question actually returns an answer.
+
+  In dev the interactive surface deliberately omits template actions from the tool
+  registry and lets the agent reach them through `bash`, which sidesteps the
+  degenerate empty-object tool call some models emit for complex schemas. That is
+  a reasonable trade for a person, who sees the bad call and rephrases. It is the
+  wrong trade for a delegated turn. An A2A caller, or an external host calling
+  `ask_app` over MCP, has nobody to intervene: with no native action the receiving
+  agent shells out, the call runs long, and the caller records "Interrupted before
+  this tool returned a result" — after which callers commonly fall back to
+  composing their own queries against a schema they do not own.
+
+  Both delegated surfaces now keep template actions native even in dev. A rejected
+  `{}` call returns a schema error the model can correct on its next step, which
+  is strictly better than a shell loop no caller can see or recover from.
+
+- 89e5910: Stop paying for background sweeps and no-change polls that find nothing.
+
+  A workspace runs one server per app, so every recurring sweep multiplies by app
+  count. Several of them queried unconditionally: the 20-second unclaimed-run
+  sweep issued two `agent_runs` scans back to back, the A2A continuation retry ran
+  two blind `UPDATE`s before ever checking whether anything was due, the MCP config
+  refresh scanned the whole settings table every minute to diff a signature that
+  had not moved since boot, and the Google Docs poller re-read its config every 30
+  seconds even on deployments where the integration was never enabled. On local
+  SQLite that was free; on a remote or metered database each one is a network round
+  trip, forever, per app.
+
+  Each of those now leads with a cheap existence probe or an in-process change
+  signal, so the idle case costs one round trip instead of several and the work
+  still runs the moment there is any. The poll route gets the same treatment: its
+  legacy watermark scan read `application_state` four separate times per check,
+  and now reads `MAX(updated_at)` once and only fans out when that advances — a
+  cost that repeated per app per connected client.
+
+  Detection latency is unchanged: every probe is a strict superset of the predicate
+  it guards, and the negative caches are all narrower than the staleness window
+  they sit in front of.
+
+- 89e5910: Cut one database round trip from every authenticated request. The membership
+  and `active-org-id` reads behind org resolution now overlap instead of queueing,
+  and `resolveOrgIdForEmail` memoizes its `org_members` read per request (keyed on
+  the AsyncLocalStorage request context and the email) so credential lookups,
+  agent runs, A2A, MCP, and adapter-authenticated action calls — none of which
+  carry an h3 event — stop each paying their own lookup.
+- 89e5910: Refresh derived database consumers after pool recycling, redact embedded
+  credentials from captured tool results, preserve multiline A2A previews, and
+  retry MCP configuration refreshes after transient failures.
+- Updated dependencies [89e5910]
+  - @agent-native/toolkit@0.12.1
+
+## 0.131.9
+
+### Patch Changes
+
+- d80a9c9: Report workspace files as truncated only when more content exists beyond the requested read page, and normalize paging arguments to integer boundaries.
+- 3c538e4: Preserve application-state database read failures and distinguish explicit stops or exhausted reconnect failures from recoverable chat handoffs.
+
+## 0.131.8
+
+### Patch Changes
+
+- c7ec59d: `create .` now scaffolds into the current directory and takes the project name
+  from the folder's basename, matching `create-react-app` / `npm init`. Previously
+  `.` was rejected as an invalid name. The current directory must be empty apart
+  from benign VCS/editor files (`.git`, `.gitignore`, `LICENSE`, `README.md`, …)
+  so an existing project is never merged over.
+
+  The scaffold is built in a private staging directory and only the files that
+  don't already exist are copied in, so a mid-scaffold failure can never delete
+  the current directory (including `.git`) and pre-existing files like
+  `README.md` and `.gitignore` are preserved. When the current directory is
+  already a git repo, `create .` skips `git init`/commit so it never writes an
+  unexpected commit into the user's history.
+
 ## 0.131.7
 
 ### Patch Changes

package/corpus/core/docs/content/durable-background-runs.mdx

@@ -1,6 +1,6 @@
 ---
 title: "Durable Background Runs"
-description: "Long agent-chat turns can run on a separate 15-minute Netlify background function instead of the synchronous request, so multi-step work finishes server-side without the client babysitting continuations. Opt-in per app; a foreground circuit-breaker keeps chat working even if the worker never starts."
+description: "Long agent-chat turns can run on a separate 15-minute Netlify background function instead of the synchronous request, so multi-step work finishes server-side without the client babysitting continuations. Enabled by default on deployed Netlify apps with an explicit opt-out; a foreground circuit-breaker keeps chat working even if the worker never starts."
 ---
 
 # Durable Background Runs
@@ -10,7 +10,8 @@ description: "Long agent-chat turns can run on a separate 15-minute Netlify back
 **Who is this for:** anyone deploying an agent-native app who wants long,
 multi-step agent turns to complete server-side, and anyone wondering what the
 `AGENT_CHAT_DURABLE_BACKGROUND` flag and the second Netlify function do. This
-is opt-in and entirely inside the framework — there is no app code to write.
+is enabled by default on deployed Netlify apps and entirely inside the
+framework — there is no app code to write.
 
 </Callout>
 
@@ -108,14 +109,17 @@ normal API calls always run synchronously on `server`.
 The foreground chat POST decides **per turn**. It dispatches to the background
 function only when all three hold:
 
-- `AGENT_CHAT_DURABLE_BACKGROUND` is truthy (`true` / `1` / `yes` / `on`),
+- the app is deployed on Netlify and `AGENT_CHAT_DURABLE_BACKGROUND` is not
+  explicitly falsy (`false` / `0` / `no` / `off`), or a non-Netlify hosted app
+  explicitly opts in with a truthy value (`true` / `1` / `yes` / `on`),
 - the app is running hosted (on the platform, not local dev), and
 - `A2A_SECRET` is set (the dispatch is an HMAC-signed self-call; without the
   secret it cannot be signed, so the turn stays inline).
 
-If any is missing, the turn runs inline exactly as before. The flag is read at
+If the app is local, `A2A_SECRET` is missing, or the flag is explicitly
+disabled, the turn runs inline exactly as before. The setting is read at
 **both build time** (to decide whether to emit the background function) and
-**runtime** (to decide whether to dispatch), so enabling it requires a redeploy.
+**runtime** (to decide whether to dispatch), so changing it requires a redeploy.
 
 ## The lifecycle and the circuit-breaker {#lifecycle}
 
@@ -190,7 +194,12 @@ one long invocation, not purely additive.
 
 <Callout id="doc-block-gjoj2d" tone="info">
 
-Durable runs are opt-in per app and default OFF. Enable with AGENT_CHAT_DURABLE_BACKGROUND=true (plus A2A_SECRET) and redeploy. Verify a turn actually used the worker by checking that its run reaches dispatch_mode=background-processing rather than falling back to inline recovery.
+Durable runs are enabled by default for deployed Netlify apps. Set
+`AGENT_CHAT_DURABLE_BACKGROUND=false` to opt out, or set it to `true` on another
+host. `A2A_SECRET` is still required. Redeploy after changing the setting, and
+verify a turn actually used the worker by checking that its run reaches
+`dispatch_mode=background-processing` rather than falling back to inline
+recovery.
 
 </Callout>
 

package/corpus/core/docs/design/durable-agent-runs.md

@@ -200,7 +200,8 @@ itself checkpoint).
 
 > Status: **Phase 0 shipped. Phase 1 + Phase 2 implemented** (the host-agnostic
 > durable-background worker and the Netlify 15-min `-background` optimization),
-> behind `AGENT_CHAT_DURABLE_BACKGROUND`, off by default. Internal per-step
+> default-on for deployed Netlify apps with an explicit opt-out via
+> `AGENT_CHAT_DURABLE_BACKGROUND=false`. Internal per-step
 > checkpointing (the Option A core of Phase 1) is recommended-not-yet-built; the
 > worker today gets its durability from the long single invocation plus
 > server-chained continuations rather than per-step idempotent checkpoints. See
@@ -251,13 +252,14 @@ checkpointed and durable runs remove the ceiling itself.
 
 # Final layered architecture
 
-Status: implemented (flagged, off by default)
+Status: implemented (default-on for deployed Netlify, explicit opt-out)
 Owner: core / run-manager + deploy
 
-Durable background runs ship as **two layers**. Both are gated behind
-`AGENT_CHAT_DURABLE_BACKGROUND` and default off; when off, the agent-chat run
-path and the deploy output are byte-for-byte the pre-existing synchronous
-behavior.
+Durable background runs ship as **two layers**. Deployed Netlify apps enable the
+path by default and can opt out with an explicit falsy
+`AGENT_CHAT_DURABLE_BACKGROUND` value. Other hosted platforms retain explicit
+opt-in. When off, the agent-chat run path and deploy output are byte-for-byte
+the pre-existing synchronous behavior.
 
 ### Layer 1 (portable baseline) — host-agnostic durable execution
 
@@ -600,8 +602,9 @@ Already strong; make the new claim match:
 
 > Status: \*\*Slices 0–1 implemented and the Slice-3 background-aware stale window
 >
-> - background→background continuation chaining are implemented\*\*, all behind
->   `AGENT_CHAT_DURABLE_BACKGROUND` (off by default). The host-agnostic baseline
+> - background→background continuation chaining are implemented\*\*, default-on
+>   for deployed Netlify apps with `AGENT_CHAT_DURABLE_BACKGROUND=false` as the
+>   opt-out. The host-agnostic baseline
 >   (Layer 1) carries the run on any host; the Netlify `-background` emit (Layer 2)
 >   is the deploy-time optimization. Slice 2's richer reconnect-first client UX and
 >   the internal per-step checkpointing (Option A) remain follow-ups; Slice 4
@@ -618,9 +621,10 @@ just writes a run event. Dispatch to it from a temporary test route via
 stub writes an event to `agent_run_events` from the background function, visible
 via `GET /runs/:id/events`. This de-risks the only genuinely new infra.
 
-**Slice 1 — route the real chat loop through the background function (flagged).**
-Behind `AGENT_CHAT_DURABLE_BACKGROUND` (off by default; hosted + `A2A_SECRET`
-only): foreground handler inserts the run row, dispatches, returns the SSE
+**Slice 1 — route the real chat loop through the background function.** On
+deployed Netlify it is enabled by default; `AGENT_CHAT_DURABLE_BACKGROUND=false`
+opts out. Other hosted platforms require explicit opt-in, and all hosts require
+`A2A_SECRET`: the foreground handler inserts the run row, dispatches, returns the SSE
 stream from `subscribeToRun`. The background `_process-run` claims the run and
 calls the same `startRun` + `runAgentLoop` the inline path uses, with
 `softTimeoutMs ≈ 13min` (new `backgroundFunction` option in

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.131.7",
+  "version": "0.132.0",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/a2a/activity.ts

@@ -1,16 +1,27 @@
 import { sanitizeToolErrorText } from "../agent/tool-error-redaction.js";
 import type { AgentChatEvent } from "../agent/types.js";
+import { redactArgsToJson, redactTextToSummary } from "../audit/redact.js";
 import type { DataPart, Part } from "./types.js";
 
 export const A2A_AGENT_ACTIVITY_KIND = "agent-native/agent-activity";
 export const A2A_AGENT_ACTIVITY_VERSION = 1;
 export const MAX_A2A_ACTIVITY_REASONING_CHARS = 32_768;
 export const MAX_A2A_ACTIVITY_RESPONSE_CHARS = 32_768;
-export const MAX_A2A_ACTIVITY_TOTAL_CHARS = 98_304;
 export const MAX_A2A_ACTIVITY_REASONING_SEGMENTS = 128;
 export const MAX_A2A_ACTIVITY_TOOL_CALLS = 64;
 export const MAX_A2A_ACTIVITY_TOOL_NAME_CHARS = 96;
 export const MAX_A2A_ACTIVITY_TOOL_ID_CHARS = 128;
+export const MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS = 1024;
+export const MAX_A2A_ACTIVITY_TOOL_RESULT_CHARS = 512;
+/**
+ * Shared ceiling for every recorded tool input/result across the snapshot. The
+ * per-call caps alone allow 64 × 1536 chars, which would push a busy run past
+ * `MAX_A2A_ACTIVITY_TOTAL_CHARS` and make `parseA2AAgentActivityPart` reject
+ * the whole snapshot — trading missing arguments for a missing trace.
+ */
+export const MAX_A2A_ACTIVITY_TOOL_PAYLOAD_CHARS = 16_384;
+export const MAX_A2A_ACTIVITY_TOTAL_CHARS =
+  98_304 + MAX_A2A_ACTIVITY_TOOL_PAYLOAD_CHARS;
 
 export type A2AAgentActivityPhase =
   | "reasoning"
@@ -25,6 +36,13 @@ export interface A2AAgentActivityToolCall {
   name: string;
   id?: string;
   status: A2AAgentActivityToolStatus;
+  /**
+   * Redacted, size-capped JSON of the call's arguments. Absent when the call
+   * had none, or when the snapshot's shared payload budget was already spent.
+   */
+  input?: string;
+  /** Redacted, size-capped head of the tool result (`tool_done` only). */
+  result?: string;
 }
 
 export interface A2AAgentActivitySnapshot extends Record<string, unknown> {
@@ -68,9 +86,11 @@ export function createA2AAgentActivityState(
 }
 
 /**
- * Converts internal loop events into a bounded activity snapshot. It carries
- * only reasoning text already emitted to the local chat, never tool inputs or
- * results.
+ * Converts internal loop events into a bounded activity snapshot. Reasoning
+ * text is carried verbatim (it was already emitted to the local chat); tool
+ * arguments and results are carried only in redacted, size-capped form so the
+ * delegated run stays diagnosable without the snapshot becoming a secondary
+ * store of secrets or payloads.
  */
 export function applyA2AAgentActivityEvent(
   state: A2AAgentActivityState,
@@ -91,14 +111,26 @@ export function applyA2AAgentActivityEvent(
       );
       changed = true;
       break;
-    case "tool_start":
+    case "tool_start": {
       next.activePhase = "tool";
-      next.toolCalls = appendToolCall(next.toolCalls, toolFromEvent(event));
+      const input = captureToolInput(
+        event.input,
+        remainingPayloadBudget(next.toolCalls),
+      );
+      next.toolCalls = appendToolCall(next.toolCalls, {
+        ...toolFromEvent(event),
+        ...(input ? { input } : {}),
+      });
       changed = true;
       break;
+    }
     case "tool_done":
       next.activePhase = "tool";
-      next.toolCalls = settleToolCall(next.toolCalls, toolFromEvent(event));
+      next.toolCalls = settleToolCall(
+        next.toolCalls,
+        toolFromEvent(event),
+        event,
+      );
       changed = true;
       break;
     case "text":
@@ -203,6 +235,49 @@ function toolFromEvent(
   };
 }
 
+function payloadChars(tool: A2AAgentActivityToolCall): number {
+  return (tool.input?.length ?? 0) + (tool.result?.length ?? 0);
+}
+
+function remainingPayloadBudget(
+  current: A2AAgentActivityToolCall[],
+  excludeIndex = -1,
+): number {
+  const used = current.reduce(
+    (total, tool, index) =>
+      index === excludeIndex ? total : total + payloadChars(tool),
+    0,
+  );
+  return Math.max(0, MAX_A2A_ACTIVITY_TOOL_PAYLOAD_CHARS - used);
+}
+
+/**
+ * Redacted, capped JSON of the arguments, or `undefined` when there is nothing
+ * to record or the shared budget cannot fit a whole (still-parseable) capture.
+ * A partial JSON string would be worse than none — the reader could not tell a
+ * clipped object from a different one.
+ */
+function captureToolInput(input: unknown, budget: number): string | undefined {
+  const cap = Math.min(MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS, budget);
+  if (cap < MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS / 8) return undefined;
+  const json = redactArgsToJson(input, { maxJson: cap, maxString: 256 });
+  // JSON.stringify escapes control characters, so the result is already safe
+  // for the snapshot without a `sanitizeText` pass — which would rewrite
+  // `"token":"[redacted]"` into unparseable JSON.
+  if (!json || json === "{}" || json.length > cap) return undefined;
+  return json;
+}
+
+function captureToolResult(
+  result: string | undefined,
+  budget: number,
+): string | undefined {
+  const cap = Math.min(MAX_A2A_ACTIVITY_TOOL_RESULT_CHARS, budget);
+  if (!result || cap <= 0) return undefined;
+  const summary = redactTextToSummary(result, cap);
+  return summary ? sanitizeText(summary, cap) || undefined : undefined;
+}
+
 function appendBoundedSegment(
   current: string[],
   addition: string,
@@ -244,6 +319,7 @@ function appendToolCall(
 function settleToolCall(
   current: A2AAgentActivityToolCall[],
   tool: A2AAgentActivityToolCall,
+  event: Extract<AgentChatEvent, { type: "tool_done" }>,
 ): A2AAgentActivityToolCall[] {
   for (let index = current.length - 1; index >= 0; index -= 1) {
     const existing = current[index];
@@ -251,12 +327,32 @@ function settleToolCall(
       (tool.id && tool.id === existing.id) ||
       (!tool.id && tool.name === existing.name)
     ) {
+      // The matching `tool_start` already paid for its input; reuse it rather
+      // than re-capturing (and re-charging) the same arguments.
+      let budget = remainingPayloadBudget(current, index);
+      const input =
+        existing.input ?? captureToolInput(event.input, budget) ?? undefined;
+      budget -= input?.length ?? 0;
+      const result = captureToolResult(event.result, budget);
+      const settled: A2AAgentActivityToolCall = {
+        ...tool,
+        ...(input ? { input } : {}),
+        ...(result ? { result } : {}),
+      };
       return current.map((value, itemIndex) =>
-        itemIndex === index ? tool : value,
+        itemIndex === index ? settled : value,
       );
     }
   }
-  return appendToolCall(current, tool);
+  let budget = remainingPayloadBudget(current);
+  const input = captureToolInput(event.input, budget);
+  budget -= input?.length ?? 0;
+  const result = captureToolResult(event.result, budget);
+  return appendToolCall(current, {
+    ...tool,
+    ...(input ? { input } : {}),
+    ...(result ? { result } : {}),
+  });
 }
 
 function sanitizeText(value: string, maxChars: number): string {
@@ -320,12 +416,31 @@ function isSafeToolCall(value: unknown): value is A2AAgentActivityToolCall {
   if (!isRecord(value) || !isSafeToolName(value.name)) return false;
   return (
     (value.id === undefined || isSafeToolId(value.id)) &&
+    (value.input === undefined ||
+      isSafeCapturedText(value.input, MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS)) &&
+    (value.result === undefined ||
+      isSafeCapturedText(value.result, MAX_A2A_ACTIVITY_TOOL_RESULT_CHARS)) &&
     (value.status === "running" ||
       value.status === "completed" ||
       value.status === "failed")
   );
 }
 
+/**
+ * Captured input/result are producer-side redacted strings. Unlike reasoning
+ * text they are NOT re-sanitized on read: `sanitizeToolErrorText` rewrites
+ * `"token":"…"` into unparseable JSON, so a round-trip equality check would
+ * reject every legitimate capture. Bound the length and reject raw control
+ * characters instead.
+ */
+function isSafeCapturedText(value: unknown, maxChars: number): value is string {
+  return (
+    typeof value === "string" &&
+    value.length <= maxChars &&
+    !/[\u0000-\u0008\u000b-\u001f\u007f]/.test(value)
+  );
+}
+
 function isSafeText(value: unknown, maxChars: number): value is string {
   return (
     typeof value === "string" &&
@@ -365,7 +480,9 @@ function activityCharacterCount(data: Record<string, unknown>): number {
         return (
           total +
           (typeof tool.name === "string" ? tool.name.length : 0) +
-          (typeof tool.id === "string" ? tool.id.length : 0)
+          (typeof tool.id === "string" ? tool.id.length : 0) +
+          (typeof tool.input === "string" ? tool.input.length : 0) +
+          (typeof tool.result === "string" ? tool.result.length : 0)
         );
       }, 0)
     : 0;

package/corpus/core/src/a2a/index.ts

@@ -11,7 +11,10 @@ export {
   MAX_A2A_ACTIVITY_TOOL_CALLS,
   MAX_A2A_ACTIVITY_TOTAL_CHARS,
   MAX_A2A_ACTIVITY_TOOL_ID_CHARS,
+  MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS,
   MAX_A2A_ACTIVITY_TOOL_NAME_CHARS,
+  MAX_A2A_ACTIVITY_TOOL_PAYLOAD_CHARS,
+  MAX_A2A_ACTIVITY_TOOL_RESULT_CHARS,
   applyA2AAgentActivityEvent,
   buildA2AAgentActivityPart,
   buildA2AAgentActivitySnapshot,

package/corpus/core/src/agent/durable-background.ts

@@ -1,7 +1,8 @@
 /**
  * Durable background agent-chat runs (Netlify background functions).
  *
- * Off by default. When enabled, a long in-app agent-chat turn is dispatched
+ * Enabled by default on deployed Netlify apps. When enabled, a long in-app
+ * agent-chat turn is dispatched
  * into a Netlify *background* function (15-min budget) instead of completing
  * synchronously under the ~40s soft-timeout. The foreground POST claims the
  * run slot, inserts the run row, fires an HMAC-signed self-dispatch to
@@ -18,18 +19,17 @@
  * GUARDRAIL: when `isAgentChatDurableBackgroundEnabled()` returns false, the
  * agent-chat handler must behave byte-for-byte like the current synchronous
  * path. The gate is true only when ALL of these hold:
- *   1. `AGENT_CHAT_DURABLE_BACKGROUND` env is explicitly enabled, or a
- *      workspace app's agent-chat plugin opts in with `durableBackgroundRuns`
- *      where the workspace deploy emits a per-app background function by
- *      default. Single-template Netlify deploys must set the env flag because
- *      that same flag controls whether `server-agent-background` is emitted.
+ *   1. The runtime is a deployed Netlify app and
+ *      `AGENT_CHAT_DURABLE_BACKGROUND` is not explicitly disabled, or the
+ *      existing env/app opt-in path is used on another hosted platform. Netlify
+ *      deploys emit the background function by default; `false`, `0`, `no`, or
+ *      `off` disables it.
  *   2. The runtime is hosted/serverless (local dev keeps the inline path so SSE
  *      stays a single live stream and no second function is needed).
  *   3. `A2A_SECRET` is configured (the HMAC handoff is required to authenticate
  *      the background dispatch; without it the dispatch can't be trusted).
  *
- * Opt-in keeps the blast radius small while the worker path is still being
- * proven. And even when enabled, a *dispatch failure degrades to an inline run*:
+ * Even when enabled, a *dispatch failure degrades to an inline run*:
  * if the self-dispatch self-POST can't be delivered (fast connection error or
  * fast non-2xx), the foreground handler runs the turn synchronously instead of
  * erroring (see `production-agent.ts` — the inline fallback claims the run row
@@ -120,7 +120,7 @@ function isNetlifyHostedRuntimeForDispatch(): boolean {
   // exposes AWS runtime variables, so keep the function-name fallback for older
   // deploys. Without either check a modern Netlify Function silently selects the
   // portable framework route even though the emitted background function exists.
-  if (process.env.SITE_ID) return true; // guard:allow-env-credential -- Netlify's read-only public site identifier is a runtime host marker, not a user credential.
+  if (process.env.SITE_ID) return true; // guard:allow-env-credential - Netlify's read-only public site identifier is a runtime host marker, not a user credential.
   // Non-Netlify AWS falls back inline if the /.netlify/functions dispatch
   // fast-fails.
   return Boolean(process.env.AWS_LAMBDA_FUNCTION_NAME);
@@ -186,8 +186,9 @@ export function dispatchPathTargetsNetlifyBackgroundFunction(
 }
 
 /**
- * Env flag for durable background runs. DEFAULT-OFF (opt-in): unset means
- * disabled; an app opts IN with an explicit truthy value (`true`/`1`/`yes`/`on`).
+ * Env flag for durable background runs. On Netlify, unset means enabled and an
+ * explicit falsy value opts out. On other hosted platforms, apps still opt in
+ * with an explicit truthy value (`true`/`1`/`yes`/`on`).
  */
 export const AGENT_CHAT_DURABLE_BACKGROUND_ENV =
   "AGENT_CHAT_DURABLE_BACKGROUND";
@@ -233,6 +234,20 @@ export function isHostedRuntimeForDurableBackground(): boolean {
   );
 }
 
+/**
+ * Netlify is the only host with the emitted 15-minute background function.
+ * Keep the framework-wide default scoped to deployed Netlify rather than
+ * silently enabling it on other hosted runtimes that may not have that worker.
+ */
+export function isNetlifyHostedRuntimeForDurableBackground(): boolean {
+  if (process.env.NETLIFY_LOCAL === "true") return false;
+  if (process.env.NETLIFY === "false") return false;
+  return Boolean(
+    (process.env.NETLIFY && process.env.NETLIFY !== "false") ||
+    process.env.SITE_ID, // guard:allow-env-credential - Netlify's read-only public site identifier is a runtime host marker, not a user credential.
+  );
+}
+
 /**
  * True when THIS process is actually executing inside a Netlify *background*
  * function (the long, 15-min-budget async function whose deployed name ends in
@@ -353,16 +368,10 @@ export function isDurableBackgroundFlagEnabled(): boolean {
   // can statically verify it against the allowlisted `AGENT_*` prefix. Keep this
   // in sync with AGENT_CHAT_DURABLE_BACKGROUND_ENV.
   //
-  // DEFAULT-OFF (opt-in): durable background runs are still being hardened. A
-  // premature fleet-wide default-on caused real-user incidents (Assets/Analytics
-  // hit "Failed to dispatch" + stalls, 2026-06-24) because the async background
-  // worker path is not yet proven end-to-end and the deploy-time env opt-out is
-  // not reliably baked into a given deploy. So an unset/empty/unknown flag means
-  // OFF; an app opts IN only with an explicit truthy value
-  // (AGENT_CHAT_DURABLE_BACKGROUND=true). This still composes with the hosted +
-  // A2A_SECRET gates below. Flip back to default-on only after the 15-min
-  // background-function worker is verified live in production (see the
-  // project_durable_bg_prod_verified memory).
+  // This parses only the explicit opt-in signal. Netlify's default-on behavior
+  // is composed separately in isAgentChatDurableBackgroundEnabled, while other
+  // hosted runtimes still require this truthy value. Empty and unknown values
+  // remain false so an explicit host opt-in cannot be inferred accidentally.
   const raw = process.env.AGENT_CHAT_DURABLE_BACKGROUND;
   if (raw == null) return false;
   const normalized = raw.trim().toLowerCase();
@@ -387,12 +396,10 @@ export function isDurableBackgroundFlagExplicitlyDisabled(): boolean {
 }
 
 /**
- * The single gate. True when the env flag is explicitly enabled, or a workspace
- * app opted in and has a per-app background-function target, AND the runtime is
- * hosted AND A2A_SECRET is configured. False otherwise — and false means the
- * current synchronous behavior is used unchanged. Single-template Netlify app
- * opt-ins deliberately require the env flag too because that flag controls
- * whether the `server-agent-background` function exists in the deploy output.
+ * The single gate. On deployed Netlify, durable runs are enabled unless the env
+ * flag is explicitly falsy. Other hosted runtimes retain the explicit env/app
+ * opt-in path. In every case the runtime must be hosted and have A2A_SECRET.
+ * False means the current synchronous behavior is used unchanged.
  */
 export function isAgentChatDurableBackgroundEnabled(options?: {
   appOptIn?: boolean;
@@ -404,12 +411,15 @@ export function isAgentChatDurableBackgroundEnabled(options?: {
   // prevent.
   if (options?.appOptIn === false) return false;
   const envOptIn = isDurableBackgroundFlagEnabled();
+  const netlifyDefaultOptIn =
+    isNetlifyHostedRuntimeForDurableBackground() &&
+    !isDurableBackgroundFlagExplicitlyDisabled();
   const workspaceAppOptIn =
     options?.appOptIn === true &&
     !isDurableBackgroundFlagExplicitlyDisabled() &&
     resolveWorkspaceBackgroundFunctionUrlPath() !== null;
   return (
-    (envOptIn || workspaceAppOptIn) &&
+    (envOptIn || netlifyDefaultOptIn || workspaceAppOptIn) &&
     isHostedRuntimeForDurableBackground() &&
     hasConfiguredA2ASecret()
   );

package/corpus/core/src/agent/harness/background.ts

@@ -1,3 +1,4 @@
+import { redactArgsToValue, redactTextToSummary } from "../../audit/redact.js";
 import type {
   BackgroundAgentControlInput,
   BackgroundAgentControlResult,
@@ -233,13 +234,22 @@ function summarizeAgentChatEvent(event: AgentChatEvent): {
       return {
         kind: "status",
         message: `Running ${event.tool}`,
-        metadata: { type: "tool_start", tool: event.tool, input: event.input },
+        metadata: {
+          type: "tool_start",
+          tool: event.tool,
+          input: redactArgsToValue(event.input),
+        },
       };
     case "tool_done":
       return {
         kind: "artifact",
         message: event.result,
-        metadata: { type: "tool_done", tool: event.tool },
+        metadata: {
+          type: "tool_done",
+          tool: event.tool,
+          input: redactArgsToValue(event.input),
+          result: redactTextToSummary(event.result),
+        },
       };
     case "error":
       return {