@agent-native/core 0.131.7 → 0.132.0

package/src/server/action-routes.ts

@@ -21,7 +21,7 @@ import {
   MCP_EMBED_CORS_ALLOW_HEADERS,
   shouldAllowMcpEmbedCredentials,
 } from "../shared/mcp-embed-headers.js";
-import { notifyActionChange } from "./action-change.js";
+import { actionCallIsReadOnly, notifyActionChange } from "./action-change.js";
 import {
   seedAgentRunOwnerContext,
   type AgentRunOwnerContext,
@@ -603,14 +603,16 @@ export function mountActionRoutes(
               // their action queries. The calling tab already refetches via
               // useActionMutation's onSuccess, so this is mainly cross-tab
               // sync (and parity with the agent's tool-call path).
-              // Explicit entry.readOnly (true OR false) wins over the method
-              // heuristic. defineAction already auto-infers GET → readOnly=true,
-              // so for actions registered through that path entry.readOnly is
-              // always set and the fallback just guards legacy wrap paths.
-              const isReadOnly =
-                typeof entry.readOnly === "boolean"
-                  ? entry.readOnly
-                  : method === "GET";
+              // A per-call Plan-mode effect wins over entry.readOnly, which
+              // wins (true OR false) over the method heuristic. defineAction
+              // already auto-infers GET → readOnly=true, so for actions
+              // registered through that path entry.readOnly is always set and
+              // the fallback just guards legacy wrap paths.
+              const isReadOnly = actionCallIsReadOnly(
+                entry,
+                params,
+                method === "GET",
+              );
               if (!isReadOnly) {
                 try {
                   await notifyActionChange({

package/src/server/agent-teams.ts

@@ -57,6 +57,7 @@ import {
   listAppState,
   deleteAppState,
 } from "../application-state/script-helpers.js";
+import { redactArgsToValue, redactTextToSummary } from "../audit/redact.js";
 import { createThread } from "../chat-threads/store.js";
 import type {
   BackgroundAgentRun,
@@ -1112,13 +1113,20 @@ function summarizeAgentChatEvent(event: RunEvent): {
       return {
         kind: "status",
         message: `Running ${payload.tool}`,
-        metadata: { tool: payload.tool, input: payload.input },
+        metadata: {
+          tool: payload.tool,
+          input: redactArgsToValue(payload.input),
+        },
       };
     case "tool_done":
       return {
         kind: "artifact",
         message: payload.result,
-        metadata: { tool: payload.tool },
+        metadata: {
+          tool: payload.tool,
+          input: redactArgsToValue(payload.input),
+          result: redactTextToSummary(payload.result),
+        },
       };
     case "agent_task":
       return {

package/src/server/better-auth-instance.ts

@@ -38,6 +38,9 @@ import {
   pgPoolOptions,
   neonPoolMax,
   attachNeonPoolErrorLogger,
+  sharedDbPool,
+  onSharedDbPoolsClosed,
+  onSharedDbPoolReplaced,
 } from "../db/client.js";
 import { ensureTableExists } from "../db/ddl-guard.js";
 import { saveOAuthTokens } from "../oauth-tokens/store.js";
@@ -808,15 +811,34 @@ export async function getBetterAuthInternalAdapter(
 export async function resetBetterAuth(): Promise<void> {
   _auth = undefined;
   _initPromise = undefined;
-  if (_neonAuthPool) {
-    try {
-      await _neonAuthPool.end();
-    } catch {
-      // Pool may have already closed (process exiting, etc.) — don't block reset.
-    }
+  // The Postgres pool belongs to the process (see `sharedDbPool`), not to Better
+  // Auth — ending it here would take the framework's and every store's database
+  // access down with it. `closeDbExec()` owns that.
+  _neonAuthPool = undefined;
+  await closePgliteClients();
+}
+
+// A `closeDbExec()` releases the pool this instance's adapter is bound to, so
+// the next `getAuth()` must build a fresh one. Registered from the pooled
+// branches rather than at module load: core's specs widely mock
+// `db/client.js`, and an import-time call into the mock breaks every one of
+// them that doesn't stub this export.
+let _poolCloseHookRegistered = false;
+function resetAuthOnPoolClose(driver?: string, url?: string): void {
+  if (_poolCloseHookRegistered) return;
+  _poolCloseHookRegistered = true;
+  onSharedDbPoolsClosed(() => {
+    _auth = undefined;
+    _initPromise = undefined;
     _neonAuthPool = undefined;
+  });
+  if (driver && url) {
+    onSharedDbPoolReplaced(driver, url, () => {
+      _auth = undefined;
+      _initPromise = undefined;
+      _neonAuthPool = undefined;
+    });
   }
-  await closePgliteClients();
 }
 
 // ---------------------------------------------------------------------------
@@ -1160,10 +1182,12 @@ async function buildDatabaseConfig(
       // session lookup on essentially every authenticated request, so an
       // un-capped pool here is a primary contributor to "Max client
       // connections reached" across concurrent serverless instances.
-      _neonAuthPool = new Pool({
-        connectionString: url,
-        max: neonPoolMax(),
-      });
+      resetAuthOnPoolClose("neon", url);
+      _neonAuthPool = sharedDbPool(
+        "neon",
+        url,
+        () => new Pool({ connectionString: url, max: neonPoolMax() }),
+      );
       attachNeonPoolErrorLogger(_neonAuthPool, "db/neon-auth");
       const { drizzle } = await import("drizzle-orm/neon-serverless");
       const db = drizzle(buildResilientNeonPool(_neonAuthPool), {
@@ -1182,7 +1206,10 @@ async function buildDatabaseConfig(
     // un-capped pool here is a primary contributor to "Max client connections
     // reached" across concurrent serverless instances.
     const { default: postgres } = await import("postgres");
-    const sql = postgres(url, pgPoolOptions(url));
+    resetAuthOnPoolClose("postgres-js", url);
+    const sql = sharedDbPool("postgres-js", url, () =>
+      postgres(url, pgPoolOptions(url)),
+    );
     const { drizzle } = await import("drizzle-orm/postgres-js");
     const db = drizzle(buildResilientPostgresJsClient(sql), {
       schema: pgAuthSchema,

package/src/server/core-routes-plugin.ts

@@ -46,6 +46,7 @@ import {
   putComposeDraft,
   deleteComposeDraft,
   deleteAllComposeDrafts,
+  getStateMany,
 } from "../application-state/handlers.js";
 import { mountBrowserSessionRoutes } from "../browser-sessions/routes.js";
 import { mountDbAdminRoutes } from "../db-admin/routes.js";
@@ -152,6 +153,7 @@ import {
 import type { EnvKeyConfig } from "./create-server.js";
 import {
   canUseDeployCredentialFallbackForRequest,
+  prefetchSecrets,
   readDeployCredentialEnv,
   resolveSecret,
 } from "./credential-provider.js";
@@ -1286,6 +1288,7 @@ export async function readLegacyCoreRouteInitSettings(
  *   GET    /_agent-native/health                        — DB liveness probe + scale-to-zero warmup
  *   GET    /_agent-native/env-status                    — env key configuration status (when envKeys provided)
  *   POST   /_agent-native/env-vars                      — compatibility route that saves keys to scoped DB secrets
+ *   GET    /_agent-native/application-state?keys=a,b,c  — batched read of many keys
  *   GET    /_agent-native/application-state/:key        — read application state
  *   PUT    /_agent-native/application-state/:key        — write application state
  *   DELETE /_agent-native/application-state/:key        — delete application state
@@ -3322,10 +3325,17 @@ export function createCoreRoutesPlugin(
                 /* org module not present in this template */
               }
             }
+            // One context for the whole sweep so the per-request secret memo is
+            // shared, and one batched read per scope to fill it. Without this
+            // every key pays its own four-scope waterfall.
+            const requestContext = { userEmail, orgId };
+            await runWithRequestContext(requestContext, () =>
+              prefetchSecrets(allowedEnvKeyNames),
+            );
             return Promise.all(
               envKeys.map(async (cfg) => {
                 const configured = await runWithRequestContext(
-                  { userEmail, orgId },
+                  requestContext,
                   () => resolveSecret(cfg.key).then(Boolean),
                 );
                 return {
@@ -4245,7 +4255,14 @@ export function createCoreRoutesPlugin(
               (event.url?.pathname || "").replace(/^\/+/, "").split("/")[0] ||
               "";
             // Skip — compose handler above already handled it
-            if (key === "compose" || key === "") return;
+            if (key === "compose") return;
+            // Collection root: `GET ?keys=a,b,c` batches many single-key reads
+            // into one request (and one identity resolution) — the chat rail
+            // alone reads ~6 keys on every mount.
+            if (key === "") {
+              if (getMethod(event) === "GET") return getStateMany(event);
+              return;
+            }
             if (event.context) {
               event.context.params = { ...event.context.params, key };
             }

package/src/server/credential-provider.ts

@@ -1276,11 +1276,50 @@ export async function deleteBuilderCredentials(
 // ANTHROPIC_API_KEY, but Builder identity keys keep the stricter scoped policy.
 // ---------------------------------------------------------------------------
 
+/**
+ * Warm this request's secret memo for many keys with one read per scope.
+ *
+ * `resolveSecret` walks four scopes per key, so a status endpoint asking about
+ * a dozen keys costs ~50 round trips against a remote database. Reading each
+ * scope once for the whole key set collapses that to four, and the subsequent
+ * `resolveSecret` calls answer from the per-request memo — same precedence,
+ * same identity scoping, no new cache to invalidate.
+ *
+ * Best-effort on purpose: `readAppSecrets` only memoizes keys a statement
+ * actually covered, so a failure here leaves each key's own lookup to run and
+ * report the failure. It must never turn an unreadable store into "not set".
+ */
+export async function prefetchSecrets(keys: readonly string[]): Promise<void> {
+  const email = getRequestUserEmail();
+  if (!email || keys.length === 0) return;
+  const { readAppSecrets } = await import("../secrets/storage.js");
+  const orgId =
+    getRequestOrgId() || (await resolveOrgIdForRequestEmail(email)).orgId;
+  const scopes: Array<{
+    scope: "user" | "org" | "workspace";
+    scopeId: string;
+  }> = [
+    { scope: "user", scopeId: email },
+    ...(orgId
+      ? ([
+          { scope: "org", scopeId: orgId },
+          { scope: "workspace", scopeId: orgId },
+        ] as const)
+      : []),
+    { scope: "workspace", scopeId: `solo:${email}` },
+  ];
+  await Promise.all(
+    scopes.map((s) => readAppSecrets({ keys, ...s }).catch(() => undefined)),
+  );
+}
+
 /**
  * Resolve a request-scoped secret. Reads from `app_secrets` first (current
  * user override, active org, workspace row for that org, then the solo
  * workspace row); falls back to `process.env` only when the deploy fallback
  * policy allows it.
+ *
+ * Resolving several keys in one request? Call `prefetchSecrets` first.
  */
 export async function resolveSecret(key: string): Promise<string | null> {
   const resolved = await resolveSecretDetailed(key);
@@ -1307,6 +1346,7 @@ export async function resolveSecretDetailed(
   if (email) {
     try {
       const { readAppSecret } = await import("../secrets/storage.js");
+
       // Per-user override first.
       const userSecret = await readAppSecret({
         key,
@@ -1333,14 +1373,25 @@ export async function resolveSecretDetailed(
         orgId = resolved.orgId;
       }
 
+      if (lookupFailed) {
+        return { value: null, lookupFailed: true, cause };
+      }
+
       if (orgId) {
+        // These rows are independent once the org is known, so read them in
+        // parallel while still applying precedence below in the same order.
+        const [orgRead, workspaceRead] = await Promise.allSettled([
+          readAppSecret({ key, scope: "org", scopeId: orgId }),
+          readAppSecret({ key, scope: "workspace", scopeId: orgId }),
+        ]);
+        const unwrap = <T>(settled: PromiseSettledResult<T>): T => {
+          if (settled.status === "rejected") throw settled.reason;
+          return settled.value;
+        };
+
         // Fall back to the active org's shared row, when present. Builder
         // Connect uses this first-class org scope.
-        const orgSecret = await readAppSecret({
-          key,
-          scope: "org",
-          scopeId: orgId,
-        });
+        const orgSecret = unwrap(orgRead);
         if (orgSecret?.value) {
           if (traceLookup) {
             console.log(
@@ -1353,11 +1404,7 @@ export async function resolveSecretDetailed(
         // Registered secrets historically used "workspace" scope for
         // org-shared configuration. Keep reading it so Settings status and
         // runtime resolution agree.
-        const workspaceSecret = await readAppSecret({
-          key,
-          scope: "workspace",
-          scopeId: orgId,
-        });
+        const workspaceSecret = unwrap(workspaceRead);
         if (workspaceSecret?.value) {
           if (traceLookup) {
             console.log(
@@ -1368,10 +1415,6 @@ export async function resolveSecretDetailed(
         }
       }
 
-      if (lookupFailed) {
-        return { value: null, lookupFailed: true, cause };
-      }
-
       // Solo-workspace fallback: always checked, even when an org id was found
       // above. A secret written before the user joined/created an org lives
       // here, and must not become unreachable once that org exists. It stays

package/src/server/http-response-telemetry.ts

@@ -367,6 +367,7 @@ export function installHttpResponseTelemetryHooks(nitroApp: any): void {
       );
     }
     if (state.db.operationCount > 0) {
+      appendServerTiming(response, event, "db-ops", state.db.operationCount);
       appendServerTiming(response, event, "db", state.db.operationWallMs);
       appendServerTiming(
         response,

package/src/server/poll.ts

@@ -442,6 +442,12 @@ export class AppSyncState {
   private lastExtensionsUpdatedAt: string | number | undefined;
   private lastExtensionMarkerTs = 0;
   private lastActionMarkerTs = 0;
+  /**
+   * Set by the seed when a durable action marker predates this process, so the
+   * first `doCheckExternalDbChanges` reads the marker rows even though the
+   * MAX(updated_at) probe cannot distinguish that row from the seeded max.
+   */
+  private replayActionMarkerOnce = false;
 
   /**
    * Tracks the latest updated_at seen on the `__screen_refresh__` key.
@@ -1355,6 +1361,7 @@ export class AppSyncState {
       // performed by a separate action process. Do not baseline past an existing
       // marker on cold start, or the first poll after the action will miss it.
       this.lastActionMarkerTs = 0;
+      this.replayActionMarkerOnce = actionMarkerTs > 0;
       this.lastScreenRefreshTs = refreshTs;
       this.lastScreenRefreshTsBySession.clear();
       for (const row of refreshResult.rows) {
@@ -1416,28 +1423,54 @@ export class AppSyncState {
       // concurrently to shave stacked latency; results are still processed in
       // the original sequential order, and conditional follow-up queries stay
       // sequential within their branch.
+      //
+      // `lastAppStateTs` is maintained as MAX(updated_at) over the whole
+      // `application_state` table (seeded in `seedVersionFromDb`, advanced by
+      // the scan below over every key, not just the ones that emit events).
+      // The application-state row scan and screen/extension marker reads only
+      // report rows strictly newer than a watermark that is itself <=
+      // `lastAppStateTs`, so an unadvanced MAX proves those reads are no-ops.
+      // The action marker keeps its own max probe because its watermark must
+      // remain independent under cross-process clock skew.
       const [
-        appResult,
+        appStateMaxTs,
         actionMarkerTs,
-        refreshResult,
-        extensionMarkerTs,
         settingsTs,
         extensionsMaxUpdatedAt,
       ] = await Promise.all([
-        db.execute({
-          sql: "SELECT session_id, key, updated_at FROM application_state WHERE updated_at > ? ORDER BY updated_at ASC",
-          args: [this.lastAppStateTs],
-        }),
+        readMaxUpdatedAt(db, "application_state"),
         readActionMarkerMaxUpdatedAt(db),
-        db.execute({
-          sql: "SELECT session_id, updated_at, value FROM application_state WHERE key = ?",
-          args: [SCREEN_REFRESH_KEY],
-        }),
-        readExtensionMarkerMaxUpdatedAt(db),
         readMaxUpdatedAt(db, "settings"),
         readMaxUpdatedAtRaw(db, "tools"),
       ]);
 
+      // The seed deliberately rewinds `lastActionMarkerTs` to 0 so a marker
+      // written before this process booted still reaches the first poll. That
+      // replay is invisible to the MAX probe (the row is already counted in the
+      // seeded max), so it gets one forced full read.
+      const replayActionMarker = this.replayActionMarkerOnce;
+      this.replayActionMarkerOnce = false;
+      const appStateChanged =
+        appStateMaxTs > this.lastAppStateTs || replayActionMarker;
+
+      const [appResult, refreshResult, extensionMarkerTs] = appStateChanged
+        ? await Promise.all([
+            db.execute({
+              sql: "SELECT session_id, key, updated_at FROM application_state WHERE updated_at > ? ORDER BY updated_at ASC",
+              args: [this.lastAppStateTs],
+            }),
+            db.execute({
+              sql: "SELECT session_id, updated_at, value FROM application_state WHERE key = ?",
+              args: [SCREEN_REFRESH_KEY],
+            }),
+            readExtensionMarkerMaxUpdatedAt(db),
+          ])
+        : ([
+            { rows: [] as Record<string, unknown>[] },
+            null,
+            this.lastExtensionMarkerTs,
+          ] as const);
+
       // Check application_state for external writes. Preserve the changed key so
       // clients can invalidate one-shot command queries (`navigate`, `__set_url__`)
       // only when those command rows actually change; noisy keys such as
@@ -1497,54 +1530,59 @@ export class AppSyncState {
       // tool writes to application_state under a well-known key; when its
       // updated_at bumps, emit a distinct event so the client invalidates
       // all queries (not just the ones matching its default queryKey prefix).
-      const refreshTs = refreshResult.rows.reduce(
-        (max, row) => Math.max(max, timestampValue(row.updated_at)),
-        0,
-      );
-      if (!this.screenRefreshInitialized) {
-        this.lastScreenRefreshTs = refreshTs;
-        for (const row of refreshResult.rows) {
-          if (typeof row.session_id === "string") {
-            this.lastScreenRefreshTsBySession.set(
-              row.session_id,
-              timestampValue(row.updated_at),
-            );
-          }
-        }
-        this.screenRefreshInitialized = true;
-      } else if (refreshTs > this.lastScreenRefreshTs) {
-        // Emit a per-user event only for the session(s) whose row actually
-        // advanced, scoped with `owner` so canSeeChangeForUser delivers it only
-        // to that user — not every authenticated poller.
-        for (const row of refreshResult.rows) {
-          const owner =
-            typeof row.session_id === "string" ? row.session_id : undefined;
-          if (!owner) continue;
-          const rowTs = timestampValue(row.updated_at);
-          if (rowTs <= (this.lastScreenRefreshTsBySession.get(owner) ?? 0)) {
-            continue;
+      // `refreshResult` is null exactly when the MAX probe proved no
+      // application_state row moved, which is also exactly when this block
+      // could not emit anything.
+      if (refreshResult) {
+        const refreshTs = refreshResult.rows.reduce(
+          (max, row) => Math.max(max, timestampValue(row.updated_at)),
+          0,
+        );
+        if (!this.screenRefreshInitialized) {
+          this.lastScreenRefreshTs = refreshTs;
+          for (const row of refreshResult.rows) {
+            if (typeof row.session_id === "string") {
+              this.lastScreenRefreshTsBySession.set(
+                row.session_id,
+                timestampValue(row.updated_at),
+              );
+            }
           }
-          let scope: string | undefined;
-          try {
-            const raw = row.value;
-            if (typeof raw === "string") {
-              const parsed = JSON.parse(raw);
-              if (typeof parsed?.scope === "string") scope = parsed.scope;
+          this.screenRefreshInitialized = true;
+        } else if (refreshTs > this.lastScreenRefreshTs) {
+          // Emit a per-user event only for the session(s) whose row actually
+          // advanced, scoped with `owner` so canSeeChangeForUser delivers it only
+          // to that user — not every authenticated poller.
+          for (const row of refreshResult.rows) {
+            const owner =
+              typeof row.session_id === "string" ? row.session_id : undefined;
+            if (!owner) continue;
+            const rowTs = timestampValue(row.updated_at);
+            if (rowTs <= (this.lastScreenRefreshTsBySession.get(owner) ?? 0)) {
+              continue;
             }
-          } catch {}
-          this.recordChange(
-            {
-              source: "screen-refresh",
-              type: "change",
-              key: SCREEN_REFRESH_KEY,
-              owner,
-              ...(scope ? { scope } : {}),
-            },
-            { dedupeKey: `screen-refresh|${rowTs}` },
-          );
-          this.lastScreenRefreshTsBySession.set(owner, rowTs);
+            let scope: string | undefined;
+            try {
+              const raw = row.value;
+              if (typeof raw === "string") {
+                const parsed = JSON.parse(raw);
+                if (typeof parsed?.scope === "string") scope = parsed.scope;
+              }
+            } catch {}
+            this.recordChange(
+              {
+                source: "screen-refresh",
+                type: "change",
+                key: SCREEN_REFRESH_KEY,
+                owner,
+                ...(scope ? { scope } : {}),
+              },
+              { dedupeKey: `screen-refresh|${rowTs}` },
+            );
+            this.lastScreenRefreshTsBySession.set(owner, rowTs);
+          }
+          this.lastScreenRefreshTs = refreshTs;
         }
-        this.lastScreenRefreshTs = refreshTs;
       }
 
       // Extension mutations write a durable marker row so delete and hide/unhide

package/src/server/voice-providers-status.ts

@@ -22,6 +22,7 @@ import {
 import { getOrgContext } from "../org/context.js";
 import { getSession } from "./auth.js";
 import {
+  prefetchSecrets,
   resolveHasCompleteBuilderConnection,
   resolveSecret,
 } from "./credential-provider.js";
@@ -74,10 +75,14 @@ export function createVoiceProvidersStatusHandler() {
     async function hasKey(key: string): Promise<boolean> {
       try {
         if (key === "GOOGLE_APPLICATION_CREDENTIALS") {
-          const resolved = await resolveGoogleRealtimeCredentials({
-            userEmail: session?.email,
-            orgId: orgCtx?.orgId ?? undefined,
-          });
+          // Same identity, passed explicitly — the context is here only so this
+          // scope sweep shares the prefetched per-request memo below.
+          const resolved = await withRequestContext(() =>
+            resolveGoogleRealtimeCredentials({
+              userEmail: session?.email,
+              orgId: orgCtx?.orgId ?? undefined,
+            }),
+          );
           return typeof resolved === "string" && resolved.length > 0;
         }
         const resolved = await withRequestContext(() => resolveSecret(key));
@@ -87,6 +92,16 @@ export function createVoiceProvidersStatusHandler() {
       }
     }
 
+    // One read per scope for every key below, instead of one per key per scope.
+    await withRequestContext(() =>
+      prefetchSecrets([
+        "GEMINI_API_KEY",
+        "OPENAI_API_KEY",
+        "GROQ_API_KEY",
+        "GOOGLE_APPLICATION_CREDENTIALS",
+      ]),
+    );
+
     let builder = false;
     try {
       builder =

package/src/workspace-files/tool.ts

@@ -86,13 +86,16 @@ export function createWorkspaceFilesTool(): Record<string, ActionEntry> {
                 'MIME type for new files. Default: "text/plain". Use "application/json" for JSON, "text/markdown" for Markdown.',
             },
             offset: {
-              type: "number",
+              type: "integer",
+              minimum: 0,
               description:
-                "Character offset to start reading from (for paging large files). Default: 0.",
+                "Non-negative character offset to start reading from (for paging large files). Default: 0.",
             },
             maxChars: {
-              type: "number",
-              description: `Maximum characters to return when reading. Default: ${DEFAULT_READ_CHARS}. Max: ${MAX_READ_CHARS}.`,
+              type: "integer",
+              minimum: 1,
+              maximum: MAX_READ_CHARS,
+              description: `Positive maximum characters to return when reading. Default: ${DEFAULT_READ_CHARS}. Max: ${MAX_READ_CHARS}.`,
             },
             pattern: {
               type: "string",
@@ -168,16 +171,19 @@ export function createWorkspaceFilesTool(): Record<string, ActionEntry> {
               if (!path) return "Error: path is required for read.";
               const rawOffset = Number(args.offset);
               const offset =
-                Number.isFinite(rawOffset) && rawOffset > 0 ? rawOffset : 0;
+                Number.isFinite(rawOffset) && rawOffset > 0
+                  ? Math.floor(rawOffset)
+                  : 0;
               const rawMax = Number(args.maxChars);
               const maxChars =
                 Number.isFinite(rawMax) && rawMax > 0
-                  ? Math.min(rawMax, MAX_READ_CHARS)
+                  ? Math.min(Math.max(1, Math.floor(rawMax)), MAX_READ_CHARS)
                   : DEFAULT_READ_CHARS;
 
+              // The sentinel character distinguishes an exact page from a truncated one.
               const file = await readWorkspaceFile(scope, path, {
                 offset,
-                maxChars,
+                maxChars: maxChars + 1,
               });
               if (!file) {
                 return JSON.stringify({
@@ -186,19 +192,20 @@ export function createWorkspaceFilesTool(): Record<string, ActionEntry> {
                 });
               }
 
-              const truncated = file.content.length >= maxChars;
+              const truncated = file.content.length > maxChars;
+              const content = file.content.slice(0, maxChars);
               return JSON.stringify({
                 ok: true,
                 path: file.path,
                 contentType: file.contentType,
                 sizeBytes: file.sizeBytes,
                 updatedAt: file.updatedAt,
-                content: file.content,
+                content,
                 ...(truncated
                   ? {
                       truncated: true,
-                      nextOffset: offset + file.content.length,
-                      hint: `File has more content. Call again with offset: ${offset + file.content.length}`,
+                      nextOffset: offset + content.length,
+                      hint: `File has more content. Call again with offset: ${offset + content.length}`,
                     }
                   : {}),
               });