@agent-native/core 0.136.0 → 0.136.3

package/dist/mcp/oauth-store.d.ts

@@ -26,6 +26,7 @@ export interface OAuthClientRow {
     grantTypes: string[];
     responseTypes: string[];
     tokenEndpointAuthMethod: string;
+    applicationType: "native" | "web";
     createdAt: number | null;
 }
 export interface OAuthCodeRow {
@@ -66,6 +67,7 @@ export declare function registerOAuthClient(params: {
     grantTypes?: string[];
     responseTypes?: string[];
     tokenEndpointAuthMethod?: string;
+    applicationType?: "native" | "web";
 }): Promise<OAuthClientRow>;
 export declare function getOAuthClient(clientId: string): Promise<OAuthClientRow | null>;
 export declare function createOAuthCode(params: {

package/dist/mcp/oauth-store.js

@@ -7,7 +7,8 @@
  */
 import { randomBytes, randomUUID, createHash } from "node:crypto";
 import { getDbExec, isConnectionError, intType, isPostgres, } from "../db/client.js";
-import { ensureTableExists } from "../db/ddl-guard.js";
+import { ensureColumnExists, ensureTableExists } from "../db/ddl-guard.js";
+import { applicationTypeForRedirectUris } from "./oauth-client-metadata.js";
 let _initPromise;
 export const MCP_OAUTH_CODE_TTL_MS = 10 * 60_000;
 /**
@@ -76,6 +77,7 @@ async function ensureTable() {
           grant_types TEXT,
           response_types TEXT,
           token_endpoint_auth_method TEXT,
+          application_type TEXT,
           created_at ${intType()}
         )
       `;
@@ -118,6 +120,7 @@ async function ensureTable() {
                 // DDL when the table is actually missing, wrapped in a
                 // transaction-scoped lock_timeout so a contended lock fails fast.
                 await ensureTableExists("mcp_oauth_clients", createClientsSql);
+                await ensureColumnExists("mcp_oauth_clients", "application_type", `ALTER TABLE mcp_oauth_clients ADD COLUMN IF NOT EXISTS application_type TEXT`);
                 await ensureTableExists("mcp_oauth_codes", createCodesSql);
                 await ensureTableExists("mcp_oauth_refresh_tokens", createRefreshTokensSql);
                 return;
@@ -125,6 +128,17 @@ async function ensureTable() {
             // SQLite (local dev): no ACCESS EXCLUSIVE lock problem — keep existing
             // create-then-execute behaviour.
             await client.execute(createClientsSql);
+            try {
+                await client.execute(`ALTER TABLE mcp_oauth_clients ADD COLUMN IF NOT EXISTS application_type TEXT`);
+            }
+            catch {
+                try {
+                    await client.execute(`ALTER TABLE mcp_oauth_clients ADD COLUMN application_type TEXT`);
+                }
+                catch {
+                    // Fresh and previously migrated databases already have the column.
+                }
+            }
             await client.execute(createCodesSql);
             await client.execute(createRefreshTokensSql);
         })().catch((err) => {
@@ -160,16 +174,21 @@ function numOrNull(v) {
     return Number.isFinite(n) ? n : null;
 }
 function mapClientRow(row) {
+    const redirectUris = parseJsonStringArray(row.redirect_uris ?? row.redirectUris);
+    const storedApplicationType = row.application_type ?? row.applicationType;
     return {
         clientId: row.client_id ?? row.clientId,
         clientName: row.client_name ?? row.clientName ?? null,
-        redirectUris: parseJsonStringArray(row.redirect_uris ?? row.redirectUris),
+        redirectUris,
         grantTypes: parseJsonStringArray(row.grant_types ?? row.grantTypes, [
             "authorization_code",
             "refresh_token",
         ]),
         responseTypes: parseJsonStringArray(row.response_types ?? row.responseTypes, ["code"]),
         tokenEndpointAuthMethod: row.token_endpoint_auth_method ?? row.tokenEndpointAuthMethod ?? "none",
+        applicationType: storedApplicationType === "native" || storedApplicationType === "web"
+            ? storedApplicationType
+            : applicationTypeForRedirectUris(redirectUris),
         createdAt: numOrNull(row.created_at ?? row.createdAt),
     };
 }
@@ -235,8 +254,9 @@ export async function registerOAuthClient(params) {
         ? params.responseTypes
         : ["code"];
     const tokenEndpointAuthMethod = params.tokenEndpointAuthMethod || "none";
+    const applicationType = params.applicationType ?? "web";
     await client.execute({
-        sql: `INSERT INTO mcp_oauth_clients (client_id, client_name, redirect_uris, grant_types, response_types, token_endpoint_auth_method, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)`,
+        sql: `INSERT INTO mcp_oauth_clients (client_id, client_name, redirect_uris, grant_types, response_types, token_endpoint_auth_method, application_type, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
         args: [
             clientId,
             params.clientName ?? null,
@@ -244,6 +264,7 @@ export async function registerOAuthClient(params) {
             JSON.stringify(grantTypes),
             JSON.stringify(responseTypes),
             tokenEndpointAuthMethod,
+            applicationType,
             now,
         ],
     });
@@ -254,6 +275,7 @@ export async function registerOAuthClient(params) {
         grantTypes,
         responseTypes,
         tokenEndpointAuthMethod,
+        applicationType,
         createdAt: now,
     };
 }

package/dist/notifications/routes.d.ts

@@ -28,7 +28,7 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,10 +59,10 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/observability/traces.d.ts

@@ -51,7 +51,7 @@ export declare function instrumentAgentLoop(opts: {
     }>;
     modelSelectionSource?: string;
     delegation?: {
-        protocol: "a2a" | "mcp";
+        protocol: "a2a" | "mcp" | "agent-team";
         callerApp?: string;
         taskId?: string;
         parentRunId?: string;

package/dist/observability/traces.js

@@ -87,7 +87,8 @@ function emitLlmGenerationTrackingEvent(args) {
         delegated: args.delegation ? true : undefined,
         delegation_protocol: args.delegation?.protocol,
         caller_app: args.delegation?.callerApp,
-        a2a_task_id: args.delegation?.taskId,
+        delegation_task_id: args.delegation?.taskId,
+        a2a_task_id: args.delegation?.protocol === "a2a" ? args.delegation.taskId : undefined,
         parent_run_id: args.delegation?.parentRunId,
         parent_turn_id: args.delegation?.parentTurnId,
         model_selection_source: args.modelSelectionSource,

package/dist/progress/routes.d.ts

@@ -15,7 +15,7 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/provider-api/index.js

@@ -462,9 +462,37 @@ const PROVIDER_CONFIGS = {
         ],
         notes: [
             "For broad corpus work, call /calls/extensive with provider-api-request and stageAs/saveToFile. Gong returns the next cursor at records.cursor and expects the next cursor in the POST body at cursor, so use pagination { nextCursorPath: 'records.cursor', cursorBodyPath: 'cursor' } for stageAs or fetchAllPages { cursorPath: 'records.cursor', cursorBodyPath: 'cursor' } for saveToFile.",
-            "Batch transcripts with POST /calls/transcript and body { filter: { callIds: [...] } } after narrowing or staging call ids.",
+            "The public Gong REST API does not expose an arbitrary transcript-text filter. Use configured keyword tracker results from /calls/extensive when they cover the requested term; otherwise batch transcripts with POST /calls/transcript and body { filter: { callIds: [...] } } after narrowing or staging call ids.",
         ],
         corpusRecipes: [
+            {
+                label: "Stage Gong calls with configured keyword tracker hits",
+                useWhen: "Use when the requested term or phrase already exists as a Gong keyword tracker and the answer can use tracker matches instead of arbitrary transcript-text search.",
+                workflow: [
+                    "Call /calls/extensive with the narrowest date, workspace, or owner filters available and contentSelector.exposedFields.content.trackers = true.",
+                    "Stage the calls pages with provider-api-request stageAs or saveToFile; use the POST-body cursor at records.cursor for complete pagination.",
+                    "Use query-staged-dataset or a Data Program to flatten content.trackers, filter by tracker id/name/phrase, and aggregate counts or occurrences.",
+                    "Tracker results are provider-indexed evidence for configured trackers, not an arbitrary transcript search. For an unconfigured term, use Gong native Search when connected or the transcript batch recipe below.",
+                ],
+                request: {
+                    method: "POST",
+                    path: "/calls/extensive",
+                    body: {
+                        filter: { fromDateTime: "<iso-date-time>" },
+                        contentSelector: {
+                            exposedFields: {
+                                content: { trackers: true, trackerOccurrences: true },
+                            },
+                        },
+                    },
+                },
+                pagination: {
+                    itemsPath: "calls",
+                    nextCursorPath: "records.cursor",
+                    cursorBodyPath: "cursor",
+                    maxPages: 200,
+                },
+            },
             {
                 label: "Batch-search Gong call transcripts from staged call ids",
                 useWhen: "Use when the user asks to search, count, or prove absence across Gong transcript text for a bounded cohort of call ids.",

package/dist/secrets/routes.d.ts

@@ -37,17 +37,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     status?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     error: string;
     removed?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — re-run the validator against the
@@ -58,13 +58,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     note?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,12 +95,12 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/server/agent-access.d.ts

@@ -3,6 +3,8 @@ import { type VerifyResult } from "./short-lived-token.js";
 export { AGENT_ACCESS_PARAM, DEFAULT_AGENT_ACCESS_TTL_SECONDS, appendAgentAccessParam, buildAgentAccessApiUrl, buildAgentAccessUrl, normalizeAgentAccessBasePath, normalizeAgentAccessOrigin, scopedAgentAccessResourceId, toAgentAccessUrl, type AgentAccessApiUrlOptions, type AgentAccessResourceScope, type AgentAccessUrlOptions, } from "../shared/agent-access.js";
 export interface ScopedAgentAccessTokenOptions extends AgentAccessResourceScope {
     viewerEmail?: string;
+    /** Display name of the agent the link is for. Signed, but display-only. */
+    agentLabel?: string;
     ttlSeconds?: number;
 }
 export interface ScopedAgentAccessGrant {
@@ -10,7 +12,7 @@ export interface ScopedAgentAccessGrant {
     expiresAt: string;
     ttlSeconds: number;
 }
-export declare function signScopedAgentAccessToken({ resourceKind, resourceId, viewerEmail, ttlSeconds, }: ScopedAgentAccessTokenOptions): string;
+export declare function signScopedAgentAccessToken({ resourceKind, resourceId, viewerEmail, agentLabel, ttlSeconds, }: ScopedAgentAccessTokenOptions): string;
 export declare function verifyScopedAgentAccessToken(token: string, scope: AgentAccessResourceScope): VerifyResult;
 export declare function createScopedAgentAccessGrant(options: ScopedAgentAccessTokenOptions): ScopedAgentAccessGrant;
 //# sourceMappingURL=agent-access.d.ts.map

package/dist/server/agent-access.js

@@ -1,10 +1,11 @@
 import { DEFAULT_AGENT_ACCESS_TTL_SECONDS, scopedAgentAccessResourceId, } from "../shared/agent-access.js";
 import { signShortLivedToken, verifyShortLivedToken, } from "./short-lived-token.js";
 export { AGENT_ACCESS_PARAM, DEFAULT_AGENT_ACCESS_TTL_SECONDS, appendAgentAccessParam, buildAgentAccessApiUrl, buildAgentAccessUrl, normalizeAgentAccessBasePath, normalizeAgentAccessOrigin, scopedAgentAccessResourceId, toAgentAccessUrl, } from "../shared/agent-access.js";
-export function signScopedAgentAccessToken({ resourceKind, resourceId, viewerEmail, ttlSeconds = DEFAULT_AGENT_ACCESS_TTL_SECONDS, }) {
+export function signScopedAgentAccessToken({ resourceKind, resourceId, viewerEmail, agentLabel, ttlSeconds = DEFAULT_AGENT_ACCESS_TTL_SECONDS, }) {
     return signShortLivedToken({
         resourceId: scopedAgentAccessResourceId(resourceKind, resourceId),
         viewerEmail,
+        agentLabel,
         ttlSeconds,
     });
 }

package/dist/server/agent-chat/browser-team-tools.d.ts

@@ -16,6 +16,7 @@ export declare function createTeamTools(deps: {
     getEngine: () => AgentEngine;
     getModel: () => string;
     getParentThreadId: () => string;
+    getParentRunId?: () => string;
     getSend: () => ((event: import("../../agent/types.js").AgentChatEvent) => void) | null;
 }): Record<string, ActionEntry>;
 //# sourceMappingURL=browser-team-tools.d.ts.map

package/dist/server/agent-chat/browser-team-tools.js

@@ -316,7 +316,7 @@ export function createTeamTools(deps) {
     return {
         "agent-teams": {
             tool: {
-                description: "Manage background sub-agent tasks. Use action 'spawn' to start a new sub-agent, 'status' to check progress, 'read-result' to get a finished task's output, 'send' to message a running sub-agent, or 'list' to see all tasks. A successful spawn only means the task started and is running; do not report it as finished until status/read-result shows a terminal status.",
+                description: "Manage background tasks that run in their own task thread. Use action 'spawn' to start one, 'status' to check progress, 'read-result' to get a finished task's output, 'send' to message a running task, or 'list' to see all tasks. A successful spawn only means the task started and is running; do not report it as finished until status/read-result shows a terminal status. This is a background task, not a source-control branch.",
                 parameters: {
                     type: "object",
                     properties: {
@@ -335,7 +335,7 @@ export function createTeamTools(deps) {
                         },
                         name: {
                             type: "string",
-                            description: "(spawn) Short name for the sub-agent tab (e.g. 'Research', 'Draft email'). If omitted, derived from the task.",
+                            description: "(spawn) Short name for the background task (e.g. 'Research', 'Draft email'). If omitted, derived from the task.",
                         },
                         agent: {
                             type: "string",
@@ -402,6 +402,7 @@ export function createTeamTools(deps) {
                         model: selectedModel,
                         name: selectedName || undefined,
                         parentThreadId: deps.getParentThreadId(),
+                        parentRunId: deps.getParentRunId?.(),
                         parentSend: (event) => {
                             if (capturedSend)
                                 capturedSend(event);
@@ -414,7 +415,7 @@ export function createTeamTools(deps) {
                         status: task.status,
                         parentThreadId: task.parentThreadId,
                         state: "launched_pending_completion",
-                        message: "Sub-agent launched and is still running. Use status or read-result later; do not describe this task as completed from the spawn response alone.",
+                        message: "Background task launched in its own task thread and is still running. Use status or read-result later; do not describe this task as completed from the spawn response alone.",
                         description: task.description,
                         name: task.name ?? selectedName,
                     });
@@ -483,7 +484,7 @@ export function createTeamTools(deps) {
                     const { listTasks } = await import("../agent-teams.js");
                     const tasks = await listTasks();
                     if (tasks.length === 0) {
-                        return "No sub-agent tasks.";
+                        return "No background tasks.";
                     }
                     return JSON.stringify(tasks.map((t) => ({
                         taskId: t.taskId,

package/dist/server/agent-chat/context-tools.js

@@ -44,8 +44,8 @@ You can search and restore previous chat conversations using \`chat-history\`:
 When the user asks to find a previous conversation, use \`chat-history\` with action "search" first to find matching threads, then action "open" to restore the one they want.`,
     "agent-teams": `### Agent Teams — Orchestration
 
-You can delegate to background sub-agents with the \`agent-teams\` tool:
-- \`agent-teams\` (action: "spawn") — Launch a sub-agent on a task. It runs in its own thread with a clean context while you stay available; a live preview card appears in the chat. The spawn result confirms launch only, not completion. Optionally pass a custom agent profile from \`agents/*.md\` via the \`agent\` parameter.
+You can delegate to background tasks with the \`agent-teams\` tool. Call them background tasks or sub-agent tasks, never branches; reserve "branch" for source-control or Builder code handoffs:
+- \`agent-teams\` (action: "spawn") — Launch a background task on a self-contained job. It runs in its own task thread with a clean context while you stay available; a live preview card appears in the chat. The spawn result confirms launch only, not completion. Optionally pass a custom agent profile from \`agents/*.md\` via the \`agent\` parameter.
 - \`agent-teams\` (action: "status") — Check a running sub-agent's progress.
 - \`agent-teams\` (action: "read-result") — Read a finished sub-agent's output.
 - \`agent-teams\` (action: "send") — Message a running sub-agent.

package/dist/server/agent-chat-plugin.js

@@ -2086,6 +2086,7 @@ export function createAgentChatPlugin(options) {
                 },
                 getModel: () => getRequestRunContext()?.model ?? resolvedModel,
                 getParentThreadId: () => getRequestRunContext()?.threadId ?? "",
+                getParentRunId: () => getRequestRunContext()?.runId ?? "",
                 getSend: () => {
                     // Return the send for the current run's thread
                     const threadId = getRequestRunContext()?.threadId ?? "";
@@ -2517,12 +2518,14 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     }
                 },
                 onRunPrepared: persistSubmittedUserMessage,
-                onRunStart: async (send, threadId) => {
+                onRunStart: async (send, threadId, runId) => {
                     await recordPreRunGitStatus(threadId);
                     _runSendByThread.set(threadId, send);
                     const runCtx = ensureRequestRunContext();
-                    if (runCtx)
+                    if (runCtx) {
                         runCtx.threadId = threadId;
+                        runCtx.runId = runId;
+                    }
                 },
                 onRunComplete: async (run, threadId) => {
                     if (threadId)
@@ -2562,12 +2565,14 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         }
                     },
                     onRunPrepared: persistSubmittedUserMessage,
-                    onRunStart: async (send, threadId) => {
+                    onRunStart: async (send, threadId, runId) => {
                         await recordPreRunGitStatus(threadId);
                         _runSendByThread.set(threadId, send);
                         const runCtx = ensureRequestRunContext();
-                        if (runCtx)
+                        if (runCtx) {
                             runCtx.threadId = threadId;
+                            runCtx.runId = runId;
+                        }
                     },
                     onRunComplete: async (run, threadId) => {
                         if (threadId)
@@ -2710,12 +2715,14 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         }
                     },
                     onRunPrepared: persistSubmittedUserMessage,
-                    onRunStart: async (send, threadId) => {
+                    onRunStart: async (send, threadId, runId) => {
                         await recordPreRunGitStatus(threadId);
                         _runSendByThread.set(threadId, send);
                         const runCtx = ensureRequestRunContext();
-                        if (runCtx)
+                        if (runCtx) {
                             runCtx.threadId = threadId;
+                            runCtx.runId = runId;
+                        }
                     },
                     onRunComplete: async (run, threadId) => {
                         if (threadId)

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,11 +27,11 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};
 //# sourceMappingURL=agent-engine-api-key-route.d.ts.map

package/dist/server/agent-teams-run-queue.d.ts

@@ -27,6 +27,8 @@ export interface AgentTeamRunPayload {
     agentRef?: string;
     /** Parent thread to post a completion recap to. */
     parentThreadId?: string;
+    /** Parent run that launched this durable background task. */
+    parentRunId?: string;
     /** Display name for the sub-agent tab. */
     name?: string;
     /** Logical-turn id, stable across continuation chunks so durable assistant

package/dist/server/agent-teams.d.ts

@@ -194,6 +194,8 @@ export interface SpawnTaskOptions {
     parentSend: (event: AgentChatEvent) => void;
     /** Parent thread ID — used to auto-respond when the sub-agent finishes */
     parentThreadId?: string;
+    /** Parent run ID used to correlate child telemetry after durable handoff. */
+    parentRunId?: string;
     /** Display name for the sub-agent tab (carried into the dispatch payload). */
     name?: string;
     /**

package/dist/server/agent-teams.js

@@ -982,6 +982,7 @@ export async function spawnTask(opts) {
         instructions: opts.instructions,
         model: opts.model,
         ...(opts.parentThreadId ? { parentThreadId: opts.parentThreadId } : {}),
+        ...(opts.parentRunId ? { parentRunId: opts.parentRunId } : {}),
         ...(opts.name ? { name: opts.name } : {}),
         // Stable across continuation chunks so the durable assistant message folds.
         turnId: runId,
@@ -1309,7 +1310,7 @@ export async function processAgentTeamRun(opts) {
                 // cap is hit. Fall back to depth 1 for legacy tasks persisted
                 // before delegationDepth was tracked.
                 () => runWithDelegationDepth(task.delegationDepth ?? 1, async () => {
-                    chunkUsage = await runAgentLoop({
+                    const agentLoopOpts = {
                         engine: config.engine,
                         model: config.model,
                         // Agent-team runs are delegated turns too. Keep their
@@ -1328,7 +1329,49 @@ export async function processAgentTeamRun(opts) {
                         send: wrappedSend,
                         signal,
                         finalResponseGuard: createTaskMessageFinalGuard(opts.taskId),
-                    });
+                    };
+                    let instrumented = false;
+                    try {
+                        const { getObservabilityConfig, instrumentAgentLoop } = await import("../observability/traces.js");
+                        const observabilityConfig = await getObservabilityConfig();
+                        if (observabilityConfig.enabled) {
+                            instrumented = true;
+                            chunkUsage = await instrumentAgentLoop({
+                                runAgentLoop,
+                                loopOpts: agentLoopOpts,
+                                runId,
+                                threadId: task.threadId,
+                                userId: ownerEmail || null,
+                                config: observabilityConfig,
+                                metadata: {
+                                    source: "agent_team",
+                                    agent_team_task_id: opts.taskId,
+                                    continuation_count: claimed.continuationCount,
+                                    ...(payload.parentThreadId
+                                        ? { parent_thread_id: payload.parentThreadId }
+                                        : {}),
+                                },
+                                delegation: {
+                                    protocol: "agent-team",
+                                    callerApp: "agent-teams",
+                                    taskId: opts.taskId,
+                                    ...(payload.parentRunId
+                                        ? { parentRunId: payload.parentRunId }
+                                        : {}),
+                                },
+                            });
+                        }
+                    }
+                    catch (error) {
+                        // Configuration is best effort. Once the wrapper starts,
+                        // preserve its errors so a failed child is not reported
+                        // as a successful run with missing telemetry.
+                        if (instrumented)
+                            throw error;
+                    }
+                    if (!instrumented) {
+                        chunkUsage = await runAgentLoop(agentLoopOpts);
+                    }
                 }));
             }, async (run) => {
                 clearInterval(heartbeat);

package/dist/server/request-context.d.ts

@@ -45,6 +45,8 @@ export interface RequestRunContext {
     userApiKey?: string;
     /** Thread ID for the current run (set by onRunStart). */
     threadId?: string;
+    /** Run ID for the current run (set by onRunStart). */
+    runId?: string;
     /** System prompt actually sent to the model for this run. */
     systemPrompt?: string;
     /** Engine instance for this run (set by onEngineResolved). */

package/dist/server/short-lived-token.d.ts

@@ -26,6 +26,12 @@ export interface ShortLivedTokenClaims {
     resourceId: string;
     /** Optional viewer email for audit / analytics — not used for authorisation. */
     viewerEmail?: string;
+    /**
+     * Optional display name of the agent the token was minted for. Signed so a
+     * reader cannot rename itself, but audit/display-only like `viewerEmail` —
+     * never consult it for authorisation.
+     */
+    agentLabel?: string;
     /** Override default TTL (seconds). */
     ttlSeconds?: number;
 }
@@ -36,6 +42,7 @@ export interface ShortLivedTokenClaims {
 export type VerifyResult = {
     ok: true;
     viewerEmail?: string;
+    agentLabel?: string;
 } | {
     ok: false;
     reason: string;

package/dist/server/short-lived-token.js

@@ -65,6 +65,8 @@ export function signShortLivedToken(claims) {
     };
     if (claims.viewerEmail)
         payload.viewerEmail = claims.viewerEmail;
+    if (claims.agentLabel)
+        payload.agentLabel = claims.agentLabel;
     const payloadStr = base64UrlEncode(JSON.stringify(payload));
     const sig = base64UrlEncode(crypto.createHmac("sha256", getSigningKey()).update(payloadStr).digest());
     return `${payloadStr}.${sig}`;
@@ -117,7 +119,11 @@ export function verifyShortLivedToken(token, expectedResourceId) {
     if (claims.resourceId !== expectedResourceId) {
         return { ok: false, reason: "wrong_resource" };
     }
-    return { ok: true, viewerEmail: claims.viewerEmail };
+    return {
+        ok: true,
+        viewerEmail: claims.viewerEmail,
+        agentLabel: claims.agentLabel,
+    };
 }
 // ── Realtime subscribe tokens ────────────────────────────────────────────────
 //

package/dist/server/ssr-handler.js

@@ -257,6 +257,24 @@ function removeDocumentCsp(headers) {
     headers.delete("content-security-policy");
     headers.delete("content-security-policy-report-only");
 }
+/**
+ * Render an error message safely as a `text/plain` body.
+ *
+ * Vite ids its virtual modules with a leading NUL (`\0virtual:react-router/…`),
+ * and those ids travel verbatim inside module-resolution error messages. One raw
+ * NUL is enough for curl to refuse to print the response as text, hiding the only
+ * line that says what broke. Escape the control bytes rather than deleting them:
+ * the NUL is part of the real resolved id, so a reader who greps for it or pastes
+ * it into a bug report must be able to see that it is there.
+ */
+function textSafeErrorMessage(err) {
+    const message = String(err?.message ?? err);
+    // C0 controls except tab, newline, and carriage return, which are real formatting.
+    return message.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f]/g, (char) => {
+        const code = char.codePointAt(0) ?? 0;
+        return code === 0 ? "\\0" : `\\x${code.toString(16).padStart(2, "0")}`;
+    });
+}
 function isFrameworkOrAssetPath(pathname) {
     return (isMcpPublicPath(pathname) ||
         pathname.startsWith("/.well-known/") ||
@@ -368,7 +386,7 @@ export function createH3SSRHandler(getBuild) {
             const isProd = process.env.NODE_ENV === "production";
             const body = isProd
                 ? "Internal Server Error"
-                : `Internal Server Error: ${err?.message ?? err}`;
+                : `Internal Server Error: ${textSafeErrorMessage(err)}`;
             return new Response(body, {
                 status: 500,
                 headers: { "content-type": "text/plain" },

package/dist/server/transcribe-voice.d.ts

@@ -20,7 +20,7 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;
 //# sourceMappingURL=transcribe-voice.d.ts.map