@agent-native/core 0.131.9 → 0.132.0

package/dist/server/voice-providers-status.js.map

@@ -1 +1 @@
-{"version":3,"file":"voice-providers-status.js","sourceRoot":"","sources":["../../src/server/voice-providers-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EACL,mCAAmC,EACnC,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAyB7D,MAAM,UAAU,iCAAiC;IAC/C,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK;YAC3B,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,cAAc,GAAG;YACrB,SAAS,EAAE,OAAO,EAAE,KAAK;YACzB,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,SAAS;SAClC,CAAC;QACF,MAAM,kBAAkB,GAAG,KAAK,EAAK,EAAoB,EAAc,EAAE,CACvE,cAAc,CAAC,SAAS;YACtB,CAAC,CAAC,qBAAqB,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3C,CAAC,CAAC,EAAE,EAAE,CAAC;QAEX,KAAK,UAAU,MAAM,CAAC,GAAW;YAC/B,IAAI,CAAC;gBACH,IAAI,GAAG,KAAK,gCAAgC,EAAE,CAAC;oBAC7C,MAAM,QAAQ,GAAG,MAAM,gCAAgC,CAAC;wBACtD,SAAS,EAAE,OAAO,EAAE,KAAK;wBACzB,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,SAAS;qBAClC,CAAC,CAAC;oBACH,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;gBACpE,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO;gBACL,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC7B,mCAAmC,EAAE,CACtC,CAAC,KAAK,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/D,MAAM,CAAC,gBAAgB,CAAC;YACxB,MAAM,CAAC,gBAAgB,CAAC;YACxB,MAAM,CAAC,cAAc,CAAC;YACtB,MAAM,CAAC,gCAAgC,CAAC;SACzC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAyB;YACnC,OAAO;YACP,MAAM;YACN,MAAM;YACN,IAAI;YACJ,cAAc;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI;SACb,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * GET /_agent-native/voice-providers/status\n *\n * Reports which voice transcription providers are configured for the\n * current user. The desktop Settings UI uses this to show \"Connect\" vs\n * \"Connected\" status pills next to each provider option.\n *\n * Resolution mirrors `transcribe-voice.ts`: we read request-scoped encrypted\n * secrets (user, org, workspace), with env fallback only outside authenticated\n * request contexts. Each lookup is wrapped in try/catch — one provider's\n * failure must never break the whole response.\n *\n * Returns booleans only — never the actual key material.\n */\nimport {\n  defineEventHandler,\n  getMethod,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport { getOrgContext } from \"../org/context.js\";\nimport { getSession } from \"./auth.js\";\nimport {\n  resolveHasCompleteBuilderConnection,\n  resolveSecret,\n} from \"./credential-provider.js\";\nimport { resolveGoogleRealtimeCredentials } from \"./google-realtime-session.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nexport interface VoiceProvidersStatus {\n  builder: boolean;\n  gemini: boolean;\n  openai: boolean;\n  groq: boolean;\n  /**\n   * Google Speech-to-Text realtime streaming is BYOK-only for v1. This reports\n   * whether a service-account credential is configured; the actual stream runs\n   * through the dedicated WebSocket -> StreamingRecognize path, not the batch\n   * transcribe route.\n   */\n  googleRealtime: boolean;\n  /** Always true — the Web Speech API is available in WebKit-based clients. */\n  browser: true;\n  /**\n   * Apple's SFSpeechRecognizer + AVAudioEngine, exposed by the Tauri\n   * desktop client. Always reported as `true` from the server — the\n   * desktop client gates this on macOS at the Tauri-command boundary, so\n   * non-macOS hosts return a clear error instead of attempting to use it.\n   */\n  native: true;\n}\n\nexport function createVoiceProvidersStatusHandler() {\n  return defineEventHandler(async (event: H3Event) => {\n    if (getMethod(event) !== \"GET\") {\n      setResponseStatus(event, 405);\n      return { error: \"Method not allowed\" };\n    }\n\n    const session = await getSession(event).catch(() => null);\n    const orgCtx = session?.email\n      ? await getOrgContext(event).catch(() => null)\n      : null;\n    const requestContext = {\n      userEmail: session?.email,\n      orgId: orgCtx?.orgId ?? undefined,\n    };\n    const withRequestContext = async <T>(fn: () => Promise<T>): Promise<T> =>\n      requestContext.userEmail\n        ? runWithRequestContext(requestContext, fn)\n        : fn();\n\n    async function hasKey(key: string): Promise<boolean> {\n      try {\n        if (key === \"GOOGLE_APPLICATION_CREDENTIALS\") {\n          const resolved = await resolveGoogleRealtimeCredentials({\n            userEmail: session?.email,\n            orgId: orgCtx?.orgId ?? undefined,\n          });\n          return typeof resolved === \"string\" && resolved.length > 0;\n        }\n        const resolved = await withRequestContext(() => resolveSecret(key));\n        return typeof resolved === \"string\" && resolved.length > 0;\n      } catch {\n        return false;\n      }\n    }\n\n    let builder = false;\n    try {\n      builder =\n        (await withRequestContext(() =>\n          resolveHasCompleteBuilderConnection(),\n        )) === true;\n    } catch {\n      builder = false;\n    }\n\n    const [gemini, openai, groq, googleRealtime] = await Promise.all([\n      hasKey(\"GEMINI_API_KEY\"),\n      hasKey(\"OPENAI_API_KEY\"),\n      hasKey(\"GROQ_API_KEY\"),\n      hasKey(\"GOOGLE_APPLICATION_CREDENTIALS\"),\n    ]);\n\n    const status: VoiceProvidersStatus = {\n      builder,\n      gemini,\n      openai,\n      groq,\n      googleRealtime,\n      browser: true,\n      native: true,\n    };\n    return status;\n  });\n}\n"]}
+{"version":3,"file":"voice-providers-status.js","sourceRoot":"","sources":["../../src/server/voice-providers-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EACL,eAAe,EACf,mCAAmC,EACnC,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAyB7D,MAAM,UAAU,iCAAiC;IAC/C,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK;YAC3B,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,cAAc,GAAG;YACrB,SAAS,EAAE,OAAO,EAAE,KAAK;YACzB,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,SAAS;SAClC,CAAC;QACF,MAAM,kBAAkB,GAAG,KAAK,EAAK,EAAoB,EAAc,EAAE,CACvE,cAAc,CAAC,SAAS;YACtB,CAAC,CAAC,qBAAqB,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3C,CAAC,CAAC,EAAE,EAAE,CAAC;QAEX,KAAK,UAAU,MAAM,CAAC,GAAW;YAC/B,IAAI,CAAC;gBACH,IAAI,GAAG,KAAK,gCAAgC,EAAE,CAAC;oBAC7C,sEAAsE;oBACtE,4DAA4D;oBAC5D,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC7C,gCAAgC,CAAC;wBAC/B,SAAS,EAAE,OAAO,EAAE,KAAK;wBACzB,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,SAAS;qBAClC,CAAC,CACH,CAAC;oBACF,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC7D,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;gBACpE,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC5B,eAAe,CAAC;YACd,gBAAgB;YAChB,gBAAgB;YAChB,cAAc;YACd,gCAAgC;SACjC,CAAC,CACH,CAAC;QAEF,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO;gBACL,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAC7B,mCAAmC,EAAE,CACtC,CAAC,KAAK,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QAED,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC/D,MAAM,CAAC,gBAAgB,CAAC;YACxB,MAAM,CAAC,gBAAgB,CAAC;YACxB,MAAM,CAAC,cAAc,CAAC;YACtB,MAAM,CAAC,gCAAgC,CAAC;SACzC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAyB;YACnC,OAAO;YACP,MAAM;YACN,MAAM;YACN,IAAI;YACJ,cAAc;YACd,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI;SACb,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * GET /_agent-native/voice-providers/status\n *\n * Reports which voice transcription providers are configured for the\n * current user. The desktop Settings UI uses this to show \"Connect\" vs\n * \"Connected\" status pills next to each provider option.\n *\n * Resolution mirrors `transcribe-voice.ts`: we read request-scoped encrypted\n * secrets (user, org, workspace), with env fallback only outside authenticated\n * request contexts. Each lookup is wrapped in try/catch — one provider's\n * failure must never break the whole response.\n *\n * Returns booleans only — never the actual key material.\n */\nimport {\n  defineEventHandler,\n  getMethod,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\n\nimport { getOrgContext } from \"../org/context.js\";\nimport { getSession } from \"./auth.js\";\nimport {\n  prefetchSecrets,\n  resolveHasCompleteBuilderConnection,\n  resolveSecret,\n} from \"./credential-provider.js\";\nimport { resolveGoogleRealtimeCredentials } from \"./google-realtime-session.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nexport interface VoiceProvidersStatus {\n  builder: boolean;\n  gemini: boolean;\n  openai: boolean;\n  groq: boolean;\n  /**\n   * Google Speech-to-Text realtime streaming is BYOK-only for v1. This reports\n   * whether a service-account credential is configured; the actual stream runs\n   * through the dedicated WebSocket -> StreamingRecognize path, not the batch\n   * transcribe route.\n   */\n  googleRealtime: boolean;\n  /** Always true — the Web Speech API is available in WebKit-based clients. */\n  browser: true;\n  /**\n   * Apple's SFSpeechRecognizer + AVAudioEngine, exposed by the Tauri\n   * desktop client. Always reported as `true` from the server — the\n   * desktop client gates this on macOS at the Tauri-command boundary, so\n   * non-macOS hosts return a clear error instead of attempting to use it.\n   */\n  native: true;\n}\n\nexport function createVoiceProvidersStatusHandler() {\n  return defineEventHandler(async (event: H3Event) => {\n    if (getMethod(event) !== \"GET\") {\n      setResponseStatus(event, 405);\n      return { error: \"Method not allowed\" };\n    }\n\n    const session = await getSession(event).catch(() => null);\n    const orgCtx = session?.email\n      ? await getOrgContext(event).catch(() => null)\n      : null;\n    const requestContext = {\n      userEmail: session?.email,\n      orgId: orgCtx?.orgId ?? undefined,\n    };\n    const withRequestContext = async <T>(fn: () => Promise<T>): Promise<T> =>\n      requestContext.userEmail\n        ? runWithRequestContext(requestContext, fn)\n        : fn();\n\n    async function hasKey(key: string): Promise<boolean> {\n      try {\n        if (key === \"GOOGLE_APPLICATION_CREDENTIALS\") {\n          // Same identity, passed explicitly — the context is here only so this\n          // scope sweep shares the prefetched per-request memo below.\n          const resolved = await withRequestContext(() =>\n            resolveGoogleRealtimeCredentials({\n              userEmail: session?.email,\n              orgId: orgCtx?.orgId ?? undefined,\n            }),\n          );\n          return typeof resolved === \"string\" && resolved.length > 0;\n        }\n        const resolved = await withRequestContext(() => resolveSecret(key));\n        return typeof resolved === \"string\" && resolved.length > 0;\n      } catch {\n        return false;\n      }\n    }\n\n    // One read per scope for every key below, instead of one per key per scope.\n    await withRequestContext(() =>\n      prefetchSecrets([\n        \"GEMINI_API_KEY\",\n        \"OPENAI_API_KEY\",\n        \"GROQ_API_KEY\",\n        \"GOOGLE_APPLICATION_CREDENTIALS\",\n      ]),\n    );\n\n    let builder = false;\n    try {\n      builder =\n        (await withRequestContext(() =>\n          resolveHasCompleteBuilderConnection(),\n        )) === true;\n    } catch {\n      builder = false;\n    }\n\n    const [gemini, openai, groq, googleRealtime] = await Promise.all([\n      hasKey(\"GEMINI_API_KEY\"),\n      hasKey(\"OPENAI_API_KEY\"),\n      hasKey(\"GROQ_API_KEY\"),\n      hasKey(\"GOOGLE_APPLICATION_CREDENTIALS\"),\n    ]);\n\n    const status: VoiceProvidersStatus = {\n      builder,\n      gemini,\n      openai,\n      groq,\n      googleRealtime,\n      browser: true,\n      native: true,\n    };\n    return status;\n  });\n}\n"]}

package/docs/content/durable-background-runs.mdx

@@ -1,6 +1,6 @@
 ---
 title: "Durable Background Runs"
-description: "Long agent-chat turns can run on a separate 15-minute Netlify background function instead of the synchronous request, so multi-step work finishes server-side without the client babysitting continuations. Opt-in per app; a foreground circuit-breaker keeps chat working even if the worker never starts."
+description: "Long agent-chat turns can run on a separate 15-minute Netlify background function instead of the synchronous request, so multi-step work finishes server-side without the client babysitting continuations. Enabled by default on deployed Netlify apps with an explicit opt-out; a foreground circuit-breaker keeps chat working even if the worker never starts."
 ---
 
 # Durable Background Runs
@@ -10,7 +10,8 @@ description: "Long agent-chat turns can run on a separate 15-minute Netlify back
 **Who is this for:** anyone deploying an agent-native app who wants long,
 multi-step agent turns to complete server-side, and anyone wondering what the
 `AGENT_CHAT_DURABLE_BACKGROUND` flag and the second Netlify function do. This
-is opt-in and entirely inside the framework — there is no app code to write.
+is enabled by default on deployed Netlify apps and entirely inside the
+framework — there is no app code to write.
 
 </Callout>
 
@@ -108,14 +109,17 @@ normal API calls always run synchronously on `server`.
 The foreground chat POST decides **per turn**. It dispatches to the background
 function only when all three hold:
 
-- `AGENT_CHAT_DURABLE_BACKGROUND` is truthy (`true` / `1` / `yes` / `on`),
+- the app is deployed on Netlify and `AGENT_CHAT_DURABLE_BACKGROUND` is not
+  explicitly falsy (`false` / `0` / `no` / `off`), or a non-Netlify hosted app
+  explicitly opts in with a truthy value (`true` / `1` / `yes` / `on`),
 - the app is running hosted (on the platform, not local dev), and
 - `A2A_SECRET` is set (the dispatch is an HMAC-signed self-call; without the
   secret it cannot be signed, so the turn stays inline).
 
-If any is missing, the turn runs inline exactly as before. The flag is read at
+If the app is local, `A2A_SECRET` is missing, or the flag is explicitly
+disabled, the turn runs inline exactly as before. The setting is read at
 **both build time** (to decide whether to emit the background function) and
-**runtime** (to decide whether to dispatch), so enabling it requires a redeploy.
+**runtime** (to decide whether to dispatch), so changing it requires a redeploy.
 
 ## The lifecycle and the circuit-breaker {#lifecycle}
 
@@ -190,7 +194,12 @@ one long invocation, not purely additive.
 
 <Callout id="doc-block-gjoj2d" tone="info">
 
-Durable runs are opt-in per app and default OFF. Enable with AGENT_CHAT_DURABLE_BACKGROUND=true (plus A2A_SECRET) and redeploy. Verify a turn actually used the worker by checking that its run reaches dispatch_mode=background-processing rather than falling back to inline recovery.
+Durable runs are enabled by default for deployed Netlify apps. Set
+`AGENT_CHAT_DURABLE_BACKGROUND=false` to opt out, or set it to `true` on another
+host. `A2A_SECRET` is still required. Redeploy after changing the setting, and
+verify a turn actually used the worker by checking that its run reaches
+`dispatch_mode=background-processing` rather than falling back to inline
+recovery.
 
 </Callout>
 

package/docs/design/durable-agent-runs.md

@@ -200,7 +200,8 @@ itself checkpoint).
 
 > Status: **Phase 0 shipped. Phase 1 + Phase 2 implemented** (the host-agnostic
 > durable-background worker and the Netlify 15-min `-background` optimization),
-> behind `AGENT_CHAT_DURABLE_BACKGROUND`, off by default. Internal per-step
+> default-on for deployed Netlify apps with an explicit opt-out via
+> `AGENT_CHAT_DURABLE_BACKGROUND=false`. Internal per-step
 > checkpointing (the Option A core of Phase 1) is recommended-not-yet-built; the
 > worker today gets its durability from the long single invocation plus
 > server-chained continuations rather than per-step idempotent checkpoints. See
@@ -251,13 +252,14 @@ checkpointed and durable runs remove the ceiling itself.
 
 # Final layered architecture
 
-Status: implemented (flagged, off by default)
+Status: implemented (default-on for deployed Netlify, explicit opt-out)
 Owner: core / run-manager + deploy
 
-Durable background runs ship as **two layers**. Both are gated behind
-`AGENT_CHAT_DURABLE_BACKGROUND` and default off; when off, the agent-chat run
-path and the deploy output are byte-for-byte the pre-existing synchronous
-behavior.
+Durable background runs ship as **two layers**. Deployed Netlify apps enable the
+path by default and can opt out with an explicit falsy
+`AGENT_CHAT_DURABLE_BACKGROUND` value. Other hosted platforms retain explicit
+opt-in. When off, the agent-chat run path and deploy output are byte-for-byte
+the pre-existing synchronous behavior.
 
 ### Layer 1 (portable baseline) — host-agnostic durable execution
 
@@ -600,8 +602,9 @@ Already strong; make the new claim match:
 
 > Status: \*\*Slices 0–1 implemented and the Slice-3 background-aware stale window
 >
-> - background→background continuation chaining are implemented\*\*, all behind
->   `AGENT_CHAT_DURABLE_BACKGROUND` (off by default). The host-agnostic baseline
+> - background→background continuation chaining are implemented\*\*, default-on
+>   for deployed Netlify apps with `AGENT_CHAT_DURABLE_BACKGROUND=false` as the
+>   opt-out. The host-agnostic baseline
 >   (Layer 1) carries the run on any host; the Netlify `-background` emit (Layer 2)
 >   is the deploy-time optimization. Slice 2's richer reconnect-first client UX and
 >   the internal per-step checkpointing (Option A) remain follow-ups; Slice 4
@@ -618,9 +621,10 @@ just writes a run event. Dispatch to it from a temporary test route via
 stub writes an event to `agent_run_events` from the background function, visible
 via `GET /runs/:id/events`. This de-risks the only genuinely new infra.
 
-**Slice 1 — route the real chat loop through the background function (flagged).**
-Behind `AGENT_CHAT_DURABLE_BACKGROUND` (off by default; hosted + `A2A_SECRET`
-only): foreground handler inserts the run row, dispatches, returns the SSE
+**Slice 1 — route the real chat loop through the background function.** On
+deployed Netlify it is enabled by default; `AGENT_CHAT_DURABLE_BACKGROUND=false`
+opts out. Other hosted platforms require explicit opt-in, and all hosts require
+`A2A_SECRET`: the foreground handler inserts the run row, dispatches, returns the SSE
 stream from `subscribeToRun`. The background `_process-run` claims the run and
 calls the same `startRun` + `runAgentLoop` the inline path uses, with
 `softTimeoutMs ≈ 13min` (new `backgroundFunction` option in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.131.9",
+  "version": "0.132.0",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -396,7 +396,7 @@
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
     "@agent-native/recap-cli": "0.5.1",
-    "@agent-native/toolkit": "^0.12.0"
+    "@agent-native/toolkit": "^0.12.1"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",

package/src/a2a/activity.ts

@@ -1,16 +1,27 @@
 import { sanitizeToolErrorText } from "../agent/tool-error-redaction.js";
 import type { AgentChatEvent } from "../agent/types.js";
+import { redactArgsToJson, redactTextToSummary } from "../audit/redact.js";
 import type { DataPart, Part } from "./types.js";
 
 export const A2A_AGENT_ACTIVITY_KIND = "agent-native/agent-activity";
 export const A2A_AGENT_ACTIVITY_VERSION = 1;
 export const MAX_A2A_ACTIVITY_REASONING_CHARS = 32_768;
 export const MAX_A2A_ACTIVITY_RESPONSE_CHARS = 32_768;
-export const MAX_A2A_ACTIVITY_TOTAL_CHARS = 98_304;
 export const MAX_A2A_ACTIVITY_REASONING_SEGMENTS = 128;
 export const MAX_A2A_ACTIVITY_TOOL_CALLS = 64;
 export const MAX_A2A_ACTIVITY_TOOL_NAME_CHARS = 96;
 export const MAX_A2A_ACTIVITY_TOOL_ID_CHARS = 128;
+export const MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS = 1024;
+export const MAX_A2A_ACTIVITY_TOOL_RESULT_CHARS = 512;
+/**
+ * Shared ceiling for every recorded tool input/result across the snapshot. The
+ * per-call caps alone allow 64 × 1536 chars, which would push a busy run past
+ * `MAX_A2A_ACTIVITY_TOTAL_CHARS` and make `parseA2AAgentActivityPart` reject
+ * the whole snapshot — trading missing arguments for a missing trace.
+ */
+export const MAX_A2A_ACTIVITY_TOOL_PAYLOAD_CHARS = 16_384;
+export const MAX_A2A_ACTIVITY_TOTAL_CHARS =
+  98_304 + MAX_A2A_ACTIVITY_TOOL_PAYLOAD_CHARS;
 
 export type A2AAgentActivityPhase =
   | "reasoning"
@@ -25,6 +36,13 @@ export interface A2AAgentActivityToolCall {
   name: string;
   id?: string;
   status: A2AAgentActivityToolStatus;
+  /**
+   * Redacted, size-capped JSON of the call's arguments. Absent when the call
+   * had none, or when the snapshot's shared payload budget was already spent.
+   */
+  input?: string;
+  /** Redacted, size-capped head of the tool result (`tool_done` only). */
+  result?: string;
 }
 
 export interface A2AAgentActivitySnapshot extends Record<string, unknown> {
@@ -68,9 +86,11 @@ export function createA2AAgentActivityState(
 }
 
 /**
- * Converts internal loop events into a bounded activity snapshot. It carries
- * only reasoning text already emitted to the local chat, never tool inputs or
- * results.
+ * Converts internal loop events into a bounded activity snapshot. Reasoning
+ * text is carried verbatim (it was already emitted to the local chat); tool
+ * arguments and results are carried only in redacted, size-capped form so the
+ * delegated run stays diagnosable without the snapshot becoming a secondary
+ * store of secrets or payloads.
  */
 export function applyA2AAgentActivityEvent(
   state: A2AAgentActivityState,
@@ -91,14 +111,26 @@ export function applyA2AAgentActivityEvent(
       );
       changed = true;
       break;
-    case "tool_start":
+    case "tool_start": {
       next.activePhase = "tool";
-      next.toolCalls = appendToolCall(next.toolCalls, toolFromEvent(event));
+      const input = captureToolInput(
+        event.input,
+        remainingPayloadBudget(next.toolCalls),
+      );
+      next.toolCalls = appendToolCall(next.toolCalls, {
+        ...toolFromEvent(event),
+        ...(input ? { input } : {}),
+      });
       changed = true;
       break;
+    }
     case "tool_done":
       next.activePhase = "tool";
-      next.toolCalls = settleToolCall(next.toolCalls, toolFromEvent(event));
+      next.toolCalls = settleToolCall(
+        next.toolCalls,
+        toolFromEvent(event),
+        event,
+      );
       changed = true;
       break;
     case "text":
@@ -203,6 +235,49 @@ function toolFromEvent(
   };
 }
 
+function payloadChars(tool: A2AAgentActivityToolCall): number {
+  return (tool.input?.length ?? 0) + (tool.result?.length ?? 0);
+}
+
+function remainingPayloadBudget(
+  current: A2AAgentActivityToolCall[],
+  excludeIndex = -1,
+): number {
+  const used = current.reduce(
+    (total, tool, index) =>
+      index === excludeIndex ? total : total + payloadChars(tool),
+    0,
+  );
+  return Math.max(0, MAX_A2A_ACTIVITY_TOOL_PAYLOAD_CHARS - used);
+}
+
+/**
+ * Redacted, capped JSON of the arguments, or `undefined` when there is nothing
+ * to record or the shared budget cannot fit a whole (still-parseable) capture.
+ * A partial JSON string would be worse than none — the reader could not tell a
+ * clipped object from a different one.
+ */
+function captureToolInput(input: unknown, budget: number): string | undefined {
+  const cap = Math.min(MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS, budget);
+  if (cap < MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS / 8) return undefined;
+  const json = redactArgsToJson(input, { maxJson: cap, maxString: 256 });
+  // JSON.stringify escapes control characters, so the result is already safe
+  // for the snapshot without a `sanitizeText` pass — which would rewrite
+  // `"token":"[redacted]"` into unparseable JSON.
+  if (!json || json === "{}" || json.length > cap) return undefined;
+  return json;
+}
+
+function captureToolResult(
+  result: string | undefined,
+  budget: number,
+): string | undefined {
+  const cap = Math.min(MAX_A2A_ACTIVITY_TOOL_RESULT_CHARS, budget);
+  if (!result || cap <= 0) return undefined;
+  const summary = redactTextToSummary(result, cap);
+  return summary ? sanitizeText(summary, cap) || undefined : undefined;
+}
+
 function appendBoundedSegment(
   current: string[],
   addition: string,
@@ -244,6 +319,7 @@ function appendToolCall(
 function settleToolCall(
   current: A2AAgentActivityToolCall[],
   tool: A2AAgentActivityToolCall,
+  event: Extract<AgentChatEvent, { type: "tool_done" }>,
 ): A2AAgentActivityToolCall[] {
   for (let index = current.length - 1; index >= 0; index -= 1) {
     const existing = current[index];
@@ -251,12 +327,32 @@ function settleToolCall(
       (tool.id && tool.id === existing.id) ||
       (!tool.id && tool.name === existing.name)
     ) {
+      // The matching `tool_start` already paid for its input; reuse it rather
+      // than re-capturing (and re-charging) the same arguments.
+      let budget = remainingPayloadBudget(current, index);
+      const input =
+        existing.input ?? captureToolInput(event.input, budget) ?? undefined;
+      budget -= input?.length ?? 0;
+      const result = captureToolResult(event.result, budget);
+      const settled: A2AAgentActivityToolCall = {
+        ...tool,
+        ...(input ? { input } : {}),
+        ...(result ? { result } : {}),
+      };
       return current.map((value, itemIndex) =>
-        itemIndex === index ? tool : value,
+        itemIndex === index ? settled : value,
       );
     }
   }
-  return appendToolCall(current, tool);
+  let budget = remainingPayloadBudget(current);
+  const input = captureToolInput(event.input, budget);
+  budget -= input?.length ?? 0;
+  const result = captureToolResult(event.result, budget);
+  return appendToolCall(current, {
+    ...tool,
+    ...(input ? { input } : {}),
+    ...(result ? { result } : {}),
+  });
 }
 
 function sanitizeText(value: string, maxChars: number): string {
@@ -320,12 +416,31 @@ function isSafeToolCall(value: unknown): value is A2AAgentActivityToolCall {
   if (!isRecord(value) || !isSafeToolName(value.name)) return false;
   return (
     (value.id === undefined || isSafeToolId(value.id)) &&
+    (value.input === undefined ||
+      isSafeCapturedText(value.input, MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS)) &&
+    (value.result === undefined ||
+      isSafeCapturedText(value.result, MAX_A2A_ACTIVITY_TOOL_RESULT_CHARS)) &&
     (value.status === "running" ||
       value.status === "completed" ||
       value.status === "failed")
   );
 }
 
+/**
+ * Captured input/result are producer-side redacted strings. Unlike reasoning
+ * text they are NOT re-sanitized on read: `sanitizeToolErrorText` rewrites
+ * `"token":"…"` into unparseable JSON, so a round-trip equality check would
+ * reject every legitimate capture. Bound the length and reject raw control
+ * characters instead.
+ */
+function isSafeCapturedText(value: unknown, maxChars: number): value is string {
+  return (
+    typeof value === "string" &&
+    value.length <= maxChars &&
+    !/[\u0000-\u0008\u000b-\u001f\u007f]/.test(value)
+  );
+}
+
 function isSafeText(value: unknown, maxChars: number): value is string {
   return (
     typeof value === "string" &&
@@ -365,7 +480,9 @@ function activityCharacterCount(data: Record<string, unknown>): number {
         return (
           total +
           (typeof tool.name === "string" ? tool.name.length : 0) +
-          (typeof tool.id === "string" ? tool.id.length : 0)
+          (typeof tool.id === "string" ? tool.id.length : 0) +
+          (typeof tool.input === "string" ? tool.input.length : 0) +
+          (typeof tool.result === "string" ? tool.result.length : 0)
         );
       }, 0)
     : 0;

package/src/a2a/index.ts

@@ -11,7 +11,10 @@ export {
   MAX_A2A_ACTIVITY_TOOL_CALLS,
   MAX_A2A_ACTIVITY_TOTAL_CHARS,
   MAX_A2A_ACTIVITY_TOOL_ID_CHARS,
+  MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS,
   MAX_A2A_ACTIVITY_TOOL_NAME_CHARS,
+  MAX_A2A_ACTIVITY_TOOL_PAYLOAD_CHARS,
+  MAX_A2A_ACTIVITY_TOOL_RESULT_CHARS,
   applyA2AAgentActivityEvent,
   buildA2AAgentActivityPart,
   buildA2AAgentActivitySnapshot,

package/src/agent/durable-background.ts

@@ -1,7 +1,8 @@
 /**
  * Durable background agent-chat runs (Netlify background functions).
  *
- * Off by default. When enabled, a long in-app agent-chat turn is dispatched
+ * Enabled by default on deployed Netlify apps. When enabled, a long in-app
+ * agent-chat turn is dispatched
  * into a Netlify *background* function (15-min budget) instead of completing
  * synchronously under the ~40s soft-timeout. The foreground POST claims the
  * run slot, inserts the run row, fires an HMAC-signed self-dispatch to
@@ -18,18 +19,17 @@
  * GUARDRAIL: when `isAgentChatDurableBackgroundEnabled()` returns false, the
  * agent-chat handler must behave byte-for-byte like the current synchronous
  * path. The gate is true only when ALL of these hold:
- *   1. `AGENT_CHAT_DURABLE_BACKGROUND` env is explicitly enabled, or a
- *      workspace app's agent-chat plugin opts in with `durableBackgroundRuns`
- *      where the workspace deploy emits a per-app background function by
- *      default. Single-template Netlify deploys must set the env flag because
- *      that same flag controls whether `server-agent-background` is emitted.
+ *   1. The runtime is a deployed Netlify app and
+ *      `AGENT_CHAT_DURABLE_BACKGROUND` is not explicitly disabled, or the
+ *      existing env/app opt-in path is used on another hosted platform. Netlify
+ *      deploys emit the background function by default; `false`, `0`, `no`, or
+ *      `off` disables it.
  *   2. The runtime is hosted/serverless (local dev keeps the inline path so SSE
  *      stays a single live stream and no second function is needed).
  *   3. `A2A_SECRET` is configured (the HMAC handoff is required to authenticate
  *      the background dispatch; without it the dispatch can't be trusted).
  *
- * Opt-in keeps the blast radius small while the worker path is still being
- * proven. And even when enabled, a *dispatch failure degrades to an inline run*:
+ * Even when enabled, a *dispatch failure degrades to an inline run*:
  * if the self-dispatch self-POST can't be delivered (fast connection error or
  * fast non-2xx), the foreground handler runs the turn synchronously instead of
  * erroring (see `production-agent.ts` — the inline fallback claims the run row
@@ -120,7 +120,7 @@ function isNetlifyHostedRuntimeForDispatch(): boolean {
   // exposes AWS runtime variables, so keep the function-name fallback for older
   // deploys. Without either check a modern Netlify Function silently selects the
   // portable framework route even though the emitted background function exists.
-  if (process.env.SITE_ID) return true; // guard:allow-env-credential -- Netlify's read-only public site identifier is a runtime host marker, not a user credential.
+  if (process.env.SITE_ID) return true; // guard:allow-env-credential - Netlify's read-only public site identifier is a runtime host marker, not a user credential.
   // Non-Netlify AWS falls back inline if the /.netlify/functions dispatch
   // fast-fails.
   return Boolean(process.env.AWS_LAMBDA_FUNCTION_NAME);
@@ -186,8 +186,9 @@ export function dispatchPathTargetsNetlifyBackgroundFunction(
 }
 
 /**
- * Env flag for durable background runs. DEFAULT-OFF (opt-in): unset means
- * disabled; an app opts IN with an explicit truthy value (`true`/`1`/`yes`/`on`).
+ * Env flag for durable background runs. On Netlify, unset means enabled and an
+ * explicit falsy value opts out. On other hosted platforms, apps still opt in
+ * with an explicit truthy value (`true`/`1`/`yes`/`on`).
  */
 export const AGENT_CHAT_DURABLE_BACKGROUND_ENV =
   "AGENT_CHAT_DURABLE_BACKGROUND";
@@ -233,6 +234,20 @@ export function isHostedRuntimeForDurableBackground(): boolean {
   );
 }
 
+/**
+ * Netlify is the only host with the emitted 15-minute background function.
+ * Keep the framework-wide default scoped to deployed Netlify rather than
+ * silently enabling it on other hosted runtimes that may not have that worker.
+ */
+export function isNetlifyHostedRuntimeForDurableBackground(): boolean {
+  if (process.env.NETLIFY_LOCAL === "true") return false;
+  if (process.env.NETLIFY === "false") return false;
+  return Boolean(
+    (process.env.NETLIFY && process.env.NETLIFY !== "false") ||
+    process.env.SITE_ID, // guard:allow-env-credential - Netlify's read-only public site identifier is a runtime host marker, not a user credential.
+  );
+}
+
 /**
  * True when THIS process is actually executing inside a Netlify *background*
  * function (the long, 15-min-budget async function whose deployed name ends in
@@ -353,16 +368,10 @@ export function isDurableBackgroundFlagEnabled(): boolean {
   // can statically verify it against the allowlisted `AGENT_*` prefix. Keep this
   // in sync with AGENT_CHAT_DURABLE_BACKGROUND_ENV.
   //
-  // DEFAULT-OFF (opt-in): durable background runs are still being hardened. A
-  // premature fleet-wide default-on caused real-user incidents (Assets/Analytics
-  // hit "Failed to dispatch" + stalls, 2026-06-24) because the async background
-  // worker path is not yet proven end-to-end and the deploy-time env opt-out is
-  // not reliably baked into a given deploy. So an unset/empty/unknown flag means
-  // OFF; an app opts IN only with an explicit truthy value
-  // (AGENT_CHAT_DURABLE_BACKGROUND=true). This still composes with the hosted +
-  // A2A_SECRET gates below. Flip back to default-on only after the 15-min
-  // background-function worker is verified live in production (see the
-  // project_durable_bg_prod_verified memory).
+  // This parses only the explicit opt-in signal. Netlify's default-on behavior
+  // is composed separately in isAgentChatDurableBackgroundEnabled, while other
+  // hosted runtimes still require this truthy value. Empty and unknown values
+  // remain false so an explicit host opt-in cannot be inferred accidentally.
   const raw = process.env.AGENT_CHAT_DURABLE_BACKGROUND;
   if (raw == null) return false;
   const normalized = raw.trim().toLowerCase();
@@ -387,12 +396,10 @@ export function isDurableBackgroundFlagExplicitlyDisabled(): boolean {
 }
 
 /**
- * The single gate. True when the env flag is explicitly enabled, or a workspace
- * app opted in and has a per-app background-function target, AND the runtime is
- * hosted AND A2A_SECRET is configured. False otherwise — and false means the
- * current synchronous behavior is used unchanged. Single-template Netlify app
- * opt-ins deliberately require the env flag too because that flag controls
- * whether the `server-agent-background` function exists in the deploy output.
+ * The single gate. On deployed Netlify, durable runs are enabled unless the env
+ * flag is explicitly falsy. Other hosted runtimes retain the explicit env/app
+ * opt-in path. In every case the runtime must be hosted and have A2A_SECRET.
+ * False means the current synchronous behavior is used unchanged.
  */
 export function isAgentChatDurableBackgroundEnabled(options?: {
   appOptIn?: boolean;
@@ -404,12 +411,15 @@ export function isAgentChatDurableBackgroundEnabled(options?: {
   // prevent.
   if (options?.appOptIn === false) return false;
   const envOptIn = isDurableBackgroundFlagEnabled();
+  const netlifyDefaultOptIn =
+    isNetlifyHostedRuntimeForDurableBackground() &&
+    !isDurableBackgroundFlagExplicitlyDisabled();
   const workspaceAppOptIn =
     options?.appOptIn === true &&
     !isDurableBackgroundFlagExplicitlyDisabled() &&
     resolveWorkspaceBackgroundFunctionUrlPath() !== null;
   return (
-    (envOptIn || workspaceAppOptIn) &&
+    (envOptIn || netlifyDefaultOptIn || workspaceAppOptIn) &&
     isHostedRuntimeForDurableBackground() &&
     hasConfiguredA2ASecret()
   );

package/src/agent/harness/background.ts

@@ -1,3 +1,4 @@
+import { redactArgsToValue, redactTextToSummary } from "../../audit/redact.js";
 import type {
   BackgroundAgentControlInput,
   BackgroundAgentControlResult,
@@ -233,13 +234,22 @@ function summarizeAgentChatEvent(event: AgentChatEvent): {
       return {
         kind: "status",
         message: `Running ${event.tool}`,
-        metadata: { type: "tool_start", tool: event.tool, input: event.input },
+        metadata: {
+          type: "tool_start",
+          tool: event.tool,
+          input: redactArgsToValue(event.input),
+        },
       };
     case "tool_done":
       return {
         kind: "artifact",
         message: event.result,
-        metadata: { type: "tool_done", tool: event.tool },
+        metadata: {
+          type: "tool_done",
+          tool: event.tool,
+          input: redactArgsToValue(event.input),
+          result: redactTextToSummary(event.result),
+        },
       };
     case "error":
       return {

package/src/agent/production-agent.ts

@@ -5673,23 +5673,26 @@ export async function runAgentLoop(opts: {
         result = `${result}\n\n${formatAgentWarningsForToolResult(agentWarnings)}`;
       }
 
-      // Auto-refresh the UI after a successful mutating tool call. Any action
-      // that isn't explicitly read-only is assumed to mutate. The client's
-      // useDbSync listener sees a change event with source:"action" and
-      // invalidates ["action"] queries so list-* / get-* refetch. This makes
-      // refresh after agent writes reliable without the model needing to
-      // remember to call `refresh-screen` itself.
-      if (!isError && actionEntry.readOnly !== true) {
+      // Auto-refresh the UI after a successful mutating tool call. Any call
+      // that isn't read-only — by its own per-call Plan-mode effect, else the
+      // action's readOnly flag — is assumed to mutate. The client's useDbSync
+      // listener sees a change event with source:"action" and invalidates
+      // ["action"] queries so list-* / get-* refetch. This makes refresh after
+      // agent writes reliable without the model needing to remember to call
+      // `refresh-screen` itself.
+      if (!isError) {
         try {
-          const { notifyActionChange } =
+          const { actionCallIsReadOnly, notifyActionChange } =
             await import("../server/action-change.js");
-          const owner = opts.ownerEmail ?? getRequestUserEmail() ?? undefined;
-          const orgId = opts.orgId ?? getRequestOrgId() ?? undefined;
-          await notifyActionChange({
-            actionName: toolCall.name,
-            ...(owner ? { owner } : {}),
-            ...(orgId ? { orgId } : {}),
-          });
+          if (!actionCallIsReadOnly(actionEntry, toolCall.input, false)) {
+            const owner = opts.ownerEmail ?? getRequestUserEmail() ?? undefined;
+            const orgId = opts.orgId ?? getRequestOrgId() ?? undefined;
+            await notifyActionChange({
+              actionName: toolCall.name,
+              ...(owner ? { owner } : {}),
+              ...(orgId ? { orgId } : {}),
+            });
+          }
         } catch {
           // poll module may be unavailable in non-server contexts — ignore
         }