@agent-native/core 0.131.7 → 0.132.0

package/corpus/core/src/agent/production-agent.ts

@@ -5673,23 +5673,26 @@ export async function runAgentLoop(opts: {
         result = `${result}\n\n${formatAgentWarningsForToolResult(agentWarnings)}`;
       }
 
-      // Auto-refresh the UI after a successful mutating tool call. Any action
-      // that isn't explicitly read-only is assumed to mutate. The client's
-      // useDbSync listener sees a change event with source:"action" and
-      // invalidates ["action"] queries so list-* / get-* refetch. This makes
-      // refresh after agent writes reliable without the model needing to
-      // remember to call `refresh-screen` itself.
-      if (!isError && actionEntry.readOnly !== true) {
+      // Auto-refresh the UI after a successful mutating tool call. Any call
+      // that isn't read-only — by its own per-call Plan-mode effect, else the
+      // action's readOnly flag — is assumed to mutate. The client's useDbSync
+      // listener sees a change event with source:"action" and invalidates
+      // ["action"] queries so list-* / get-* refetch. This makes refresh after
+      // agent writes reliable without the model needing to remember to call
+      // `refresh-screen` itself.
+      if (!isError) {
         try {
-          const { notifyActionChange } =
+          const { actionCallIsReadOnly, notifyActionChange } =
             await import("../server/action-change.js");
-          const owner = opts.ownerEmail ?? getRequestUserEmail() ?? undefined;
-          const orgId = opts.orgId ?? getRequestOrgId() ?? undefined;
-          await notifyActionChange({
-            actionName: toolCall.name,
-            ...(owner ? { owner } : {}),
-            ...(orgId ? { orgId } : {}),
-          });
+          if (!actionCallIsReadOnly(actionEntry, toolCall.input, false)) {
+            const owner = opts.ownerEmail ?? getRequestUserEmail() ?? undefined;
+            const orgId = opts.orgId ?? getRequestOrgId() ?? undefined;
+            await notifyActionChange({
+              actionName: toolCall.name,
+              ...(owner ? { owner } : {}),
+              ...(orgId ? { orgId } : {}),
+            });
+          }
         } catch {
           // poll module may be unavailable in non-server contexts — ignore
         }

package/corpus/core/src/agent/run-store.ts

@@ -163,6 +163,46 @@ export const UNCLAIMED_BACKGROUND_RUN_REDISPATCH_BOUND_MS = 5 * 60_000;
  */
 export const UNCLAIMED_BACKGROUND_RUN_FAST_SWEEP_MS = 20_000;
 
+/**
+ * How long a negative `status='running'` probe stays trusted.
+ *
+ * MUST stay well below the tightest staleness window any sweep enforces
+ * (`RUN_STALE_MS`, 15s): the probe sees running rows of EVERY age, so a
+ * negative result proves there were zero running rows that instant, and a row
+ * inserted since — by this process or another one — cannot yet be old enough
+ * for a sweep to act on it. Widen this past a staleness window and a genuinely
+ * dead run becomes invisible for a whole extra tick.
+ */
+const NO_RUNNING_RUNS_CACHE_MS = 5_000;
+
+let _noRunningRunsUntil = 0;
+
+/** Test seam — the probe cache is module state, so suites must clear it. */
+export function __resetNoRunningRunsProbeForTests(): void {
+  _noRunningRunsUntil = 0;
+}
+
+/**
+ * `status = 'running'` is a strict superset of every sweep predicate in this
+ * file, so one probe answers all of them. The fast sweep runs `reapAllStaleRuns`
+ * and `listUnclaimedBackgroundRunRows` back to back every 20s; on an idle app
+ * both scan for rows that do not exist, which on a remote database is two
+ * round trips per tick per app, forever. The probe collapses that pair to one.
+ */
+async function hasRunningRuns(): Promise<boolean> {
+  if (Date.now() < _noRunningRunsUntil) return false;
+  const { rows } = await getDbExec().execute({
+    sql: `SELECT id FROM agent_runs WHERE status = 'running' LIMIT 1`,
+    args: [],
+  });
+  if ((rows?.length ?? 0) > 0) {
+    _noRunningRunsUntil = 0;
+    return true;
+  }
+  _noRunningRunsUntil = Date.now() + NO_RUNNING_RUNS_CACHE_MS;
+  return false;
+}
+
 /**
  * FIX 3 (durable-background incident) per-turn run-count ceiling for
  * stale-run recovery — mirrors `chainServerDrivenContinuation`'s own ledger
@@ -920,6 +960,7 @@ export async function listUnclaimedBackgroundRunRows(): Promise<
   UnclaimedBackgroundRunRow[]
 > {
   await ensureRunTables();
+  if (!(await hasRunningRuns())) return [];
   const client = getDbExec();
   const { rows } = await client.execute({
     // CAST keeps the ms-epoch param 64-bit on Postgres (see
@@ -2538,6 +2579,7 @@ export async function getCurrentTurnEventsForThread(
  */
 export async function reapAllStaleRuns(): Promise<number> {
   await ensureRunTables();
+  if (!(await hasRunningRuns())) return 0;
   const client = getDbExec();
   const now = Date.now();
   // Background-dispatched runs use the wider window; everything else 15s. The
@@ -2570,9 +2612,9 @@ export async function reapAllStaleRuns(): Promise<number> {
   // `reapSingleStaleRun` re-applies the identical staleness clause per row
   // (same as the bulk UPDATE previously did), so a row whose heartbeat
   // landed between the SELECT above and this loop is still correctly
-  // excluded. This function only runs once, at process startup (see
-  // agent-chat-plugin.ts) — the extra per-row round trips are
-  // inconsequential.
+  // excluded. The per-row round trips only ever run for rows the SELECT above
+  // already found stale; on an idle app `hasRunningRuns` returns before any of
+  // this, so the 20s fast sweep (agent-chat-plugin.ts) costs one probe.
   let reapedCount = 0;
   for (const row of stale.rows) {
     const id = (row as { id?: unknown }).id;

package/corpus/core/src/application-state/handlers.ts

@@ -3,6 +3,7 @@ import {
   defineEventHandler,
   getRouterParam,
   getHeader,
+  getQuery,
   setResponseStatus,
   type H3Event,
 } from "h3";
@@ -11,6 +12,7 @@ import { getSession } from "../server/auth.js";
 import { readBody } from "../server/h3-helpers.js";
 import {
   appStateGet,
+  appStateGetManyEntries,
   appStatePut,
   appStateDelete,
   appStateList,
@@ -45,6 +47,49 @@ export const getState = defineEventHandler(async (event: H3Event) => {
   return value ?? null;
 });
 
+/** Upper bound on one batched read, so a crafted URL can't fan out unbounded. */
+export const MAX_APP_STATE_BATCH_KEYS = 100;
+
+/**
+ * `GET /_agent-native/application-state?keys=a,b,c` — read many keys for the
+ * caller's session in one round trip.
+ *
+ * `values` carries only the keys that have a stored row; every other requested
+ * key is listed in `missing`. A key whose stored value is `null` therefore
+ * appears in `values` with a `null` value and NOT in `missing`, which is what
+ * keeps "no row" distinguishable from "row holding an empty value".
+ */
+export const getStateMany = defineEventHandler(async (event: H3Event) => {
+  const sessionId = await getSessionId(event);
+  const raw = getQuery(event).keys;
+  const requested = (Array.isArray(raw) ? raw : [raw])
+    .flatMap((entry) => String(entry ?? "").split(","))
+    .map((key) => safeKey(key.trim()))
+    .filter((key) => key.length > 0);
+  const keys = [...new Set(requested)];
+
+  if (keys.length === 0) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Query parameter `keys` is required",
+    });
+  }
+  if (keys.length > MAX_APP_STATE_BATCH_KEYS) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: `At most ${MAX_APP_STATE_BATCH_KEYS} keys may be read at once`,
+    });
+  }
+
+  const entries = await appStateGetManyEntries(sessionId, keys);
+  const values: Record<string, unknown> = {};
+  for (const entry of entries) values[entry.key] = entry.value;
+  return {
+    values,
+    missing: keys.filter((key) => !(key in values)),
+  };
+});
+
 export const putState = defineEventHandler(async (event: H3Event) => {
   const sessionId = await getSessionId(event);
   const key = safeKey(String(getRouterParam(event, "key")));

package/corpus/core/src/application-state/index.ts

@@ -2,6 +2,7 @@
 export {
   appStateGet,
   appStateGetMany,
+  appStateGetManyEntries,
   appStatePut,
   appStateDelete,
   appStateCompareAndSet,
@@ -22,6 +23,8 @@ export {
 // H3 route handlers (for templates)
 export {
   getState,
+  getStateMany,
+  MAX_APP_STATE_BATCH_KEYS,
   putState,
   deleteState,
   listComposeDrafts,

package/corpus/core/src/application-state/store.ts

@@ -2,7 +2,6 @@ import {
   getDbExec,
   getDialect,
   isLocalDatabase,
-  isConnectionError,
   isPostgres,
   intType,
   type DbExec,
@@ -102,21 +101,40 @@ export async function appStateGet(
   sessionId: string,
   key: string,
 ): Promise<Record<string, unknown> | null> {
-  try {
-    await ensureTable();
-    const client = getDbExec();
-    const { rows } = await client.execute({
-      sql: `SELECT value FROM application_state WHERE session_id = ? AND key = ?`,
-      args: [sessionId, key],
-    });
-    if (rows.length === 0) return null;
-    return JSON.parse(rows[0].value as string);
-  } catch (err) {
-    // Transient WS / connection drops (Neon serverless) — caller polls every
-    // 2s and will see the value on the next tick. Swallow rather than 500.
-    if (isConnectionError(err)) return null;
-    throw err;
-  }
+  await ensureTable();
+  const client = getDbExec();
+  const { rows } = await client.execute({
+    sql: `SELECT value FROM application_state WHERE session_id = ? AND key = ?`,
+    args: [sessionId, key],
+  });
+  if (rows.length === 0) return null;
+  return JSON.parse(rows[0].value as string);
+}
+
+/**
+ * Read several application-state keys for one session in a single SQL query,
+ * returning ONLY the rows that exist. A key absent from the result has no row;
+ * a key present with a `null` value has a row that stores `null`. Callers that
+ * must not conflate the two (the batched HTTP read) depend on that difference,
+ * so this deliberately does not pad missing keys.
+ */
+export async function appStateGetManyEntries(
+  sessionId: string,
+  keys: readonly string[],
+): Promise<Array<{ key: string; value: Record<string, unknown> | null }>> {
+  const uniqueKeys = [...new Set(keys)];
+  if (uniqueKeys.length === 0) return [];
+  await ensureTable();
+  const client = getDbExec();
+  const placeholders = uniqueKeys.map(() => "?").join(", ");
+  const { rows } = await client.execute({
+    sql: `SELECT key, value FROM application_state WHERE session_id = ? AND key IN (${placeholders})`,
+    args: [sessionId, ...uniqueKeys],
+  });
+  return rows.map((row) => ({
+    key: row.key as string,
+    value: JSON.parse(row.value as string),
+  }));
 }
 
 /**
@@ -128,27 +146,13 @@ export async function appStateGetMany(
   sessionId: string,
   keys: readonly string[],
 ): Promise<Record<string, Record<string, unknown> | null>> {
-  const uniqueKeys = [...new Set(keys)];
   const values: Record<string, Record<string, unknown> | null> = {};
-  for (const key of uniqueKeys) values[key] = null;
-  if (uniqueKeys.length === 0) return values;
+  for (const key of new Set(keys)) values[key] = null;
 
-  try {
-    await ensureTable();
-    const client = getDbExec();
-    const placeholders = uniqueKeys.map(() => "?").join(", ");
-    const { rows } = await client.execute({
-      sql: `SELECT key, value FROM application_state WHERE session_id = ? AND key IN (${placeholders})`,
-      args: [sessionId, ...uniqueKeys],
-    });
-    for (const row of rows) {
-      values[row.key as string] = JSON.parse(row.value as string);
-    }
-    return values;
-  } catch (err) {
-    if (isConnectionError(err)) return values;
-    throw err;
+  for (const entry of await appStateGetManyEntries(sessionId, keys)) {
+    values[entry.key] = entry.value;
   }
+  return values;
 }
 
 export async function appStatePut(

package/corpus/core/src/audit/redact.ts

@@ -12,7 +12,7 @@
  */
 
 const SENSITIVE_KEY =
-  /(pass(word|phrase)?|secret|token|api[_-]?key|apikey|authorization|bearer|credential|cookie|session[_-]?(id|token)|private[_-]?key|client[_-]?secret|signing[_-]?secret|access[_-]?key|refresh[_-]?token|webhook[_-]?(url|secret))/i;
+  /(?:pass(?:word|phrase)?|secret|token|api[_-]?key|apikey|authorization|bearer|credential|cookie|session[_-]?(?:id|token)|private[_-]?key|client[_-]?secret|signing[_-]?secret|access[_-]?key|refresh[_-]?token|webhook[_-]?(?:url|secret))/i;
 
 const REDACTED = "[redacted]";
 const MAX_STRING = 2000;
@@ -20,6 +20,11 @@ const MAX_DEPTH = 6;
 const MAX_KEYS = 100;
 const MAX_ARRAY = 100;
 const MAX_JSON = 8000;
+/**
+ * Head room reserved for the `…(N more chars)` marker so a truncated summary
+ * still fits its caller's cap. Callers below this cannot carry a marker at all.
+ */
+const MARKER_SLACK = 32;
 
 /** Heuristic: does a bare string value look like a secret? */
 function looksSecret(value: string): boolean {
@@ -42,21 +47,32 @@ function looksSecret(value: string): boolean {
   return false;
 }
 
-function redactString(value: string): string {
+function redactString(value: string, maxString: number): string {
   if (looksSecret(value)) return REDACTED;
-  if (value.length > MAX_STRING) {
-    return `${value.slice(0, MAX_STRING)}…(${value.length - MAX_STRING} more chars)`;
+  if (value.length > maxString) {
+    return `${value.slice(0, maxString)}…(${value.length - maxString} more chars)`;
   }
   return value;
 }
 
-function redact(value: unknown, depth: number): unknown {
+function redactEmbeddedSecrets(value: string): string {
+  const bearer = value.replace(/\b(bearer\s+)([^\s"',}]+)/gi, `$1${REDACTED}`);
+  const credentialField = new RegExp(
+    `(["']?\\b${SENSITIVE_KEY.source}\\b["']?\\s*[:=]\\s*)(["']?)(?!bearer\\b)([^"'\\s,}]+)\\2`,
+    "gi",
+  );
+  return bearer.replace(credentialField, `$1$2${REDACTED}$2`);
+}
+
+function redact(value: unknown, depth: number, maxString: number): unknown {
   if (value == null) return value;
-  if (typeof value === "string") return redactString(value);
+  if (typeof value === "string") return redactString(value, maxString);
   if (typeof value === "number" || typeof value === "boolean") return value;
   if (depth >= MAX_DEPTH) return "[…]";
   if (Array.isArray(value)) {
-    const out = value.slice(0, MAX_ARRAY).map((v) => redact(v, depth + 1));
+    const out = value
+      .slice(0, MAX_ARRAY)
+      .map((v) => redact(v, depth + 1, maxString));
     if (value.length > MAX_ARRAY)
       out.push(`…(${value.length - MAX_ARRAY} more)`);
     return out;
@@ -70,7 +86,9 @@ function redact(value: unknown, depth: number): unknown {
         break;
       }
       n += 1;
-      out[k] = SENSITIVE_KEY.test(k) ? REDACTED : redact(v, depth + 1);
+      out[k] = SENSITIVE_KEY.test(k)
+        ? REDACTED
+        : redact(v, depth + 1, maxString);
     }
     return out;
   }
@@ -78,32 +96,100 @@ function redact(value: unknown, depth: number): unknown {
   return undefined;
 }
 
+export interface RedactLimits {
+  /**
+   * Hard cap on the serialized output, INCLUDING the truncation envelope.
+   * Surfaces with their own wire budget (the A2A activity snapshot) pass a
+   * tighter cap than the audit-log default.
+   */
+  maxJson?: number;
+  /** Cap on any single string value before it gets a truncation marker. */
+  maxString?: number;
+}
+
 /**
  * Redact and serialize call arguments to a capped JSON string, or `null` when
  * there is nothing to record. Never throws.
  */
-export function redactArgsToJson(args: unknown): string | null {
+export function redactArgsToJson(
+  args: unknown,
+  limits?: RedactLimits,
+): string | null {
+  const maxJson = Math.max(MARKER_SLACK * 4, limits?.maxJson ?? MAX_JSON);
+  const maxString = limits?.maxString ?? MAX_STRING;
   try {
     if (args == null) return null;
-    const redacted = redact(args, 0);
+    const redacted = redact(args, 0, maxString);
     if (redacted === undefined) return null;
     const json = JSON.stringify(redacted);
     if (json == null) return null;
-    if (json.length > MAX_JSON) {
-      // Slicing the serialized JSON would yield an unparseable string. Wrap a
-      // preview in a valid envelope so `get-audit-event` can always JSON.parse
-      // the stored `input`.
-      return JSON.stringify({
+    if (json.length <= maxJson) return json;
+    // Slicing the serialized JSON would yield an unparseable string. Wrap a
+    // preview in a valid envelope so `get-audit-event` can always JSON.parse
+    // the stored `input`. JSON escaping makes the envelope overhead
+    // content-dependent, so shrink the preview until the whole thing measures
+    // under the cap rather than guessing at the overhead.
+    const envelope = (preview: string) =>
+      JSON.stringify({
         _auditTruncated: true,
         originalBytes: json.length,
-        preview: json.slice(0, MAX_JSON),
+        preview,
       });
+    let take = maxJson;
+    let out = envelope(json.slice(0, take));
+    while (out.length > maxJson && take > 0) {
+      take = Math.max(0, take - Math.max(1, out.length - maxJson));
+      out = envelope(json.slice(0, take));
     }
-    return json;
+    return out;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Same bounds as `redactArgsToJson`, returned as a structural value for
+ * surfaces whose consumers expect an object (transcript `metadata.input`).
+ */
+export function redactArgsToValue(
+  args: unknown,
+  limits?: RedactLimits,
+): unknown {
+  const json = redactArgsToJson(args, limits);
+  if (json == null) return null;
+  try {
+    return JSON.parse(json);
   } catch {
     return null;
   }
 }
 
+/**
+ * Bounded, redacted plain-text summary of a tool result. Oversized text keeps
+ * its head and gains an explicit `…(N more chars)` marker, so a reader can
+ * always tell a short result from a clipped one.
+ */
+export function redactTextToSummary(
+  text: string,
+  maxChars = MAX_STRING,
+): string | null {
+  if (!text) return null;
+  // Only ever walk a bounded head: a multi-megabyte tool result must not be
+  // scanned in full just to produce a preview of it.
+  const head = text.slice(0, maxChars + MARKER_SLACK);
+  const redactedHead = redactEmbeddedSecrets(head);
+  if (looksSecret(redactedHead.trim())) return REDACTED;
+  if (text.length <= maxChars && redactedHead.length <= maxChars) {
+    return redactedHead;
+  }
+  const keep = Math.max(0, maxChars - MARKER_SLACK);
+  return `${redactedHead.slice(0, keep)}…(${text.length - keep} more chars)`;
+}
+
 /** Exposed for tests. */
-export const __test = { looksSecret, redact, SENSITIVE_KEY };
+export const __test = {
+  looksSecret,
+  redact,
+  redactEmbeddedSecrets,
+  SENSITIVE_KEY,
+};