@agent-native/core 0.153.5 → 0.153.6

package/corpus/templates/analytics/actions/get-data-program.ts

@@ -22,7 +22,10 @@ export default defineAction({
   }),
   http: { method: "GET" },
   readOnly: true,
-  grounding: true,
+  // Not `grounding`: this reads the stored program plus its last-run summary,
+  // and even `includeRows` replays rows cached by an earlier run rather than
+  // querying the source. The flag means evidence retrieved at call time, which
+  // is why `get-analysis` is excluded too.
   run: async (args) => {
     const ctx = getCredentialContext();
     if (!ctx) throw new Error("No authenticated context for get-data-program.");

package/corpus/templates/analytics/server/lib/real-data-actions.ts

@@ -91,27 +91,46 @@ function isToolName(name: string, expected: string): boolean {
 let groundingActionNames: ReadonlySet<string> | null = null;
 
 /**
- * Publish the action names whose definitions declare `grounding: true`.
+ * Read the action names whose definitions declare `grounding: true`.
  *
- * The set is pushed in rather than read from `.generated/actions-registry`
- * because that registry imports every action, and `save-analysis` imports this
- * module — importing it back here would close an evaluation cycle. The
- * agent-chat plugin derives the set once at module load; nothing else may.
+ * Takes the registry as an argument rather than importing
+ * `.generated/actions-registry` because that registry imports every action, and
+ * `save-analysis` imports this module — importing it back here would close an
+ * evaluation cycle. The agent-chat plugin passes it in once at module load.
  */
+export function deriveGroundingActionNames(
+  registry: Record<string, unknown>,
+): string[] {
+  return Object.entries(registry)
+    .filter(([, module]) => {
+      // Action modules reach the registry either as the module namespace or as
+      // an already-unwrapped definition, the same two shapes
+      // `loadActionsFromStaticRegistry` normalizes.
+      const candidate = module as
+        | { grounding?: boolean; default?: { grounding?: boolean } }
+        | undefined;
+      return (
+        candidate?.grounding === true || candidate?.default?.grounding === true
+      );
+    })
+    .map(([name]) => name);
+}
+
+/** Publish the derived set for the response guard to consult. */
 export function registerGroundingActions(names: Iterable<string>): void {
-  const normalized = new Set(
+  groundingActionNames = new Set(
     [...names].map((name) => normalizeActionToolName(name)),
   );
   // An empty set is never a real deployment: it means the installed core build
-  // predates `grounding` and dropped it from every definition. Left unchecked,
-  // the guard would replace every correct grounded answer with "connect data
-  // sources" — the exact silent failure this flag replaced.
-  if (normalized.size === 0) {
-    throw new Error(
-      "no action declares grounding: true; the installed @agent-native/core cannot carry the flag",
+  // predates `grounding` and dropped it from every definition. Registration
+  // runs at plugin module scope, so throwing here would take the whole server
+  // down for a response-guard heuristic; the failure is raised at first use
+  // instead, where it costs one turn.
+  if (groundingActionNames.size === 0) {
+    console.error(
+      "[analytics] no action declares grounding: true; the installed @agent-native/core cannot carry the flag, so the response guard is unusable",
     );
   }
-  groundingActionNames = normalized;
 }
 
 function isGroundingActionName(name: string): boolean {
@@ -120,6 +139,11 @@ function isGroundingActionName(name: string): boolean {
       "grounding actions were never registered: the analytics response guard cannot tell a grounded turn from an ungrounded one",
     );
   }
+  if (groundingActionNames.size === 0) {
+    throw new Error(
+      "no action declares grounding: true; the installed @agent-native/core cannot carry the flag",
+    );
+  }
   return groundingActionNames.has(normalizeActionToolName(name));
 }
 

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -12,6 +12,7 @@ import { ANALYTICS_CONNECTOR_CATALOG } from "../lib/analytics-connector-catalog"
 import { credentialProviderConfigs } from "../lib/credential-keys";
 import { isProductionServerlessRuntime } from "../lib/production-serverless-runtime.js";
 import {
+  deriveGroundingActionNames,
   draftClaimsAnalyticsMetrics,
   failedDataQueryAttemptMessage,
   hasDashboardConstructionAttempt,
@@ -35,21 +36,7 @@ import {
 // Which actions return real data-source evidence is a fact each action states
 // on itself (`grounding: true`). Reading it off the definitions here is what
 // keeps the response guard from drifting behind a newly shipped source action.
-registerGroundingActions(
-  Object.entries(actionsRegistry)
-    .filter(([, module]) => {
-      // Action modules reach the registry either as the module namespace or as
-      // an already-unwrapped definition, the same two shapes
-      // `loadActionsFromStaticRegistry` normalizes.
-      const candidate = module as
-        | { grounding?: boolean; default?: { grounding?: boolean } }
-        | undefined;
-      return (
-        candidate?.grounding === true || candidate?.default?.grounding === true
-      );
-    })
-    .map(([name]) => name),
-);
+registerGroundingActions(deriveGroundingActionNames(actionsRegistry));
 
 const ANALYTICS_BACKGROUND_RUN_SOFT_TIMEOUT_MS = 13 * 60_000;
 // A background job may legitimately spend minutes inside a provider/tool call,

package/dist/agent/engine/tool-call-journal-seed.js

@@ -1,5 +1,22 @@
 import { getCurrentTurnEventsForThread } from "../run-store.js";
 import { classifyToolCallJournal, } from "../tool-call-journal.js";
+const LEDGER_READ_RETRY_MS = 250;
+/**
+ * `unreadable` ends the turn with a stop the user sees, so a single pool
+ * timeout or connection blip must not produce one. One retry, because the
+ * failures worth surviving are transient and the caller is holding the whole
+ * turn open while we wait.
+ */
+async function readCurrentTurnEventsWithRetry(threadId, turnId) {
+    try {
+        return await getCurrentTurnEventsForThread(threadId, turnId);
+    }
+    catch (err) {
+        console.warn(`[tool-call-journal] per-turn ledger read failed for thread ${threadId}, retrying once: ${err instanceof Error ? err.message : String(err)}`);
+        await new Promise((resolve) => setTimeout(resolve, LEDGER_READ_RETRY_MS));
+        return await getCurrentTurnEventsForThread(threadId, turnId);
+    }
+}
 /**
  * Tool-call journal hard-block (resume safety). Snapshot the per-turn journal
  * ONCE here, before any tool runs in this chunk, so it reflects only PRIOR
@@ -33,7 +50,7 @@ export async function loadPriorTurnToolCallJournal(threadId, turnId) {
     }
     let priorEvents;
     try {
-        priorEvents = await getCurrentTurnEventsForThread(threadId, turnId);
+        priorEvents = await readCurrentTurnEventsWithRetry(threadId, turnId);
     }
     catch (err) {
         const error = err instanceof Error ? err.message : String(err);

package/dist/agent/production-agent.d.ts

@@ -618,12 +618,12 @@ export declare const MAX_IDENTICAL_TOOL_CALLS = 8;
 /**
  * A stop that ends the turn from inside the tool loop.
  *
- * `message` is the last thing the user reads, so it must name the remedy and
- * must NOT quote a raw provider/tool error: both `isAutoRecoverableError`
- * (client) and `isRecoverableContinuationError` (below) sniff this string for
- * "timeout"/"connection"/"network", and a stop whose text happens to contain
- * one is auto-continued into the very spiral it was raised to end. The raw
- * error belongs in `details`, which nothing retries on.
+ * `message` is the last thing the user reads, so it names the remedy in plain
+ * words and does not quote a raw provider/tool error; the raw error goes in
+ * `details`. Both retry sniffers now honour the `recoverable: false` these
+ * stops are sent with, so a stop that happens to say "timeout" is no longer
+ * auto-continued — but the prose still has one reader who cannot ignore it,
+ * and a pasted stack trace is not a remedy.
  */
 export interface TerminalActionStop {
     message: string;
@@ -720,9 +720,15 @@ export declare function findApprovedStructuredToolCall(history: AgentChatStructu
  * which is worse than one more retry.
  */
 export declare function permanentPreconditionRemedy(message: string): string | null;
+/**
+ * Deliberately carries no running call count. This decline is recorded as a
+ * tool error, and the breakers key on that text: a message that reports its own
+ * tally ("already made 13 call(s)") mints a fresh key on every decline, so the
+ * decline that exists to stop a spiral becomes the one thing nothing can count.
+ * The fixed threshold below says the same thing without varying.
+ */
 export declare function repeatedSourceSweepGuardMessage(opts: {
     toolName: string;
-    priorCalls: number;
     threshold?: number;
     scope?: "tool" | "aggregate";
 }): string;

package/dist/agent/production-agent.js

@@ -2440,10 +2440,12 @@ async function waitForInterruptedToolLedgerEntry(opts) {
  * sentence before it, and two failures that differ ONLY in the arguments they
  * echo are the same failure.
  *
- * Numbers go the same way, for the same reason. A guard that reports its own
- * running tally ("this turn already made 13 call(s)") hands the breaker a new
- * key on every single decline, so the decline that exists to stop a spiral is
- * itself uncountable.
+ * Digits stay. Collapsing them merges failures that are genuinely different:
+ * "Record 41 not found" and "Record 42 not found" are two missing records, so a
+ * seven-item sweep where every item legitimately 404s would trip the
+ * across-arguments breaker at item six. A guard message that varies its own
+ * running tally is fixed where that message is written, not by blinding every
+ * breaker to numbers.
  */
 function normalizeToolErrorForBreaker(error) {
     return (error
@@ -2451,7 +2453,6 @@ function normalizeToolErrorForBreaker(error) {
         .replace(/Received:\s*[\s\S]*?\.\s(?=Expected:|The tool was not executed)/g, "")
         // Bare JSON payloads some providers inline instead of a Received: span.
         .replace(/\{[\s\S]{0,2000}?\}/g, "{}")
-        .replace(/\d+/g, "#")
         .replace(/\s+/g, " ")
         .trim());
 }
@@ -2494,16 +2495,27 @@ const PERMANENT_PRECONDITION_PATTERNS = [
     /\b(?:api[ -]?keys?|access tokens?|credentials?|secrets?)\b[^.]{0,60}\bnot (?:configured|set|connected|available)\b/i,
     /\bsave [A-Z][A-Z0-9_]{3,} in (?:the )?settings\b/i,
     // "Connect Builder.io before indexing a design system from Figma or code."
-    /\bconnect\b[^;]{1,40}?\b(?:before|first|in settings)\b/i,
-    // "…is only available in local Plan runtime." Excludes "only available after
-    // …", which names a condition that clears on its own.
-    /\bonly available (?:in|on|from|to)\b/i,
+    // Case-sensitive, sentence-initial, and followed by a capitalized service
+    // name, because that is the only shape that separates the imperative remedy
+    // from the retryable network failure: "failed to connect to the warehouse
+    // before the deadline" and "Connect timed out, retry first" both satisfy
+    // every looser reading of the same words.
+    /(?:^|[.:!?]\s+)Connect [A-Z][\w.-]*[^;]{0,40}?\b(?:before|first|in settings)\b/,
     // "Plan mode blocked `update-extension`. Switch to Act mode …" — cleared by
     // the user approving the plan, never by the model trying again.
     /\bplan mode blocked\b/i,
+    // The templates' most-copied throw, and always `if (!getRequestUserEmail())`:
+    // one synchronous AsyncLocalStorage read of a value fixed when the request
+    // context was established. It cannot appear and disappear between tool calls
+    // of the same chunk, so retrying inside this turn lands on it again.
     /\bno authenticated user\b/i,
     // "SSRF blocked: refusing to fetch private/internal address (…)"
     /\bssrf blocked\b/i,
+    // Deliberately absent: "only available in …". Retention windows ("only
+    // available from the last 90 days") share its wording and are fixed by
+    // narrowing the range, so it stopped turns that were one argument away from
+    // succeeding. The count-based breaker still ends a genuine runtime gate
+    // after six.
 ];
 const SOURCE_SWEEP_TOOL_NAME = /\b(?:api|calls?|deals?|docs?|events?|issues?|messages?|metrics?|provider|query|records?|request|search|source|tickets?|transcripts?)\b/i;
 const SOURCE_SWEEP_PROVIDER_TOKEN = /\b(?:amplitude|apollo|bigquery|commonroom|data-source|ga4|github|gong|grafana|hubspot|jira|mixpanel|notion|posthog|postgres|postgresql|pylon|sentry|slack|stripe)\b/i;
@@ -2610,14 +2622,20 @@ function restrictAgentTeamsAfterSourceSweep(tools) {
         };
     });
 }
+/**
+ * Deliberately carries no running call count. This decline is recorded as a
+ * tool error, and the breakers key on that text: a message that reports its own
+ * tally ("already made 13 call(s)") mints a fresh key on every decline, so the
+ * decline that exists to stop a spiral becomes the one thing nothing can count.
+ * The fixed threshold below says the same thing without varying.
+ */
 export function repeatedSourceSweepGuardMessage(opts) {
     const threshold = opts.threshold ?? SOURCE_SWEEP_TOOL_CALL_THRESHOLD;
     const target = opts.scope === "aggregate"
         ? "read-only source/search tools"
         : "the same read-only source/search tool";
-    return (`Skipped ${opts.toolName}: this turn already made ${opts.priorCalls} ` +
-        `call(s) to ${target}, which exceeds the ` +
-        `${threshold}-call convergence budget. Stop calling ${opts.toolName} ` +
+    return (`Skipped ${opts.toolName}: this turn already exhausted its ` +
+        `${threshold}-call convergence budget for ${target}. Stop calling ${opts.toolName} ` +
         `one item at a time and change strategy before answering. If a broader ` +
         `read-only bulk/source mechanism is available, use it now: provider API ` +
         `catalog/docs/request tools with pagination or staging, code execution ` +
@@ -2647,7 +2665,6 @@ export function shouldGuardRepeatedSourceSweep(opts) {
             priorCalls: priorSourceSweepCalls,
             message: repeatedSourceSweepGuardMessage({
                 toolName: opts.toolName,
-                priorCalls: priorSourceSweepCalls,
                 threshold,
                 scope: "aggregate",
             }),
@@ -2660,7 +2677,6 @@ export function shouldGuardRepeatedSourceSweep(opts) {
         priorCalls,
         message: repeatedSourceSweepGuardMessage({
             toolName: opts.toolName,
-            priorCalls,
             threshold,
             scope: "tool",
         }),
@@ -4041,7 +4057,8 @@ export async function runAgentLoop(opts) {
                 const permanentRemedy = permanentPreconditionRemedy(sanitizedResult);
                 if (permanentRemedy) {
                     requestedActionStop ??= {
-                        message: `I stopped because ${toolCall.name} cannot run until this is fixed: ${permanentRemedy} Retrying would not have changed it, and anything completed before this is saved.`,
+                        message: `I stopped because ${toolCall.name} needs a setup step outside this turn — a credential, a role, a connected account, or an approval — before it can run. ` +
+                            "Retrying would not have changed it, and anything completed before this is saved.",
                         errorCode: "permanent_precondition",
                         details: sanitizedResult,
                     };
@@ -5056,6 +5073,13 @@ function isRecoverableContinuationError(event) {
     const message = event.error.toLowerCase();
     if (code === "builder_gateway_error")
         return false;
+    // An explicit flag outranks the message sniff below, which exists for events
+    // that carry no flag at all. Every guard stop sets `recoverable: false`, and
+    // sniffing its prose is how a stop that merely NAMES a connection or a
+    // timeout gets continued into the spiral it was raised to end. The client
+    // applies the same precedence in `isAutoRecoverableError`.
+    if (event.recoverable === false)
+        return false;
     return (event.recoverable === true ||
         code === "builder_gateway_timeout" ||
         code === "builder_gateway_network_error" ||

package/dist/agent/run-manager.js

@@ -937,12 +937,15 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
     // false-stale-reap zombie scenario where the reaper flipped the row while
     // this isolate was briefly unable to heartbeat (DB latency / GC pause).
     let lastAbortCheck = Date.now() - 3000;
-    // A read failure here used to be indistinguishable from "not aborted" —
-    // exactly the coerced-to-false pattern that lets a real Stop go unseen for
-    // the rest of the run. Count consecutive failures like the heartbeat-write
-    // handler above; past the same threshold, fail closed (self-abort with a
-    // reason outside TURN_ENDING_ABORT_REASONS/RECOVERABLE_ABORT_REASONS, so it
-    // surfaces as a typed error) instead of silently retrying forever.
+    // A read failure here is not "not aborted" — but it is not grounds to kill
+    // the run either. This check is only a cross-isolate backstop: the outage
+    // that hides a Stop from us hides it from every other reader too, so
+    // self-aborting delivers nobody's Stop any sooner while destroying in-flight
+    // work in the far more common case where nobody pressed Stop at all. Fail
+    // open and stay bounded by the soft timeout, no-progress backstop, and
+    // iteration/token limits — none of which touch the DB. Report the outage to
+    // Sentry (once at the threshold, then ~once a minute) so a long unreadable
+    // window is visible and its duration is queryable instead of silent.
     let consecutiveAbortCheckFailures = 0;
     const checkSqlAbort = () => {
         const now = Date.now();
@@ -970,7 +973,9 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
         })
             .catch((error) => {
             consecutiveAbortCheckFailures += 1;
-            if (consecutiveAbortCheckFailures >= 3) {
+            // 3 ticks ≈ 9s of unreadability, then every 20 ticks ≈ 60s.
+            if (consecutiveAbortCheckFailures === 3 ||
+                consecutiveAbortCheckFailures % 20 === 0) {
                 captureError(error, {
                     route: "/_agent-native/agent-chat",
                     tags: {
@@ -979,11 +984,12 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
                         consecutiveFailures: String(consecutiveAbortCheckFailures),
                     },
                     aiTraceId: runId,
-                    extra: { runId, threadId },
+                    extra: {
+                        runId,
+                        threadId,
+                        unreadableForMs: consecutiveAbortCheckFailures * 3000,
+                    },
                 });
-                if (!abort.signal.aborted) {
-                    abortInMemoryRun(run, "abort_check_unavailable");
-                }
             }
         });
     };

package/dist/agent/run-store.d.ts

@@ -44,6 +44,22 @@ export declare const STALE_RUN_ERROR_EVENT: {
     readonly recoverable: true;
     readonly details: "The run heartbeat stopped while the run was still marked running. Partial output and tool calls were preserved when available.";
 };
+/**
+ * `agent_runs.terminal_reason` recorded by the stale reapers.
+ *
+ * Every other error path records `error:<code>` (`terminalReasonForEvent`), and
+ * `reconcileTerminalRunFromEvents` writes that form for THIS failure too when it
+ * replays the terminal event a reaper itself appended. The reapers used to write
+ * the bare code, which split one outcome across two permanent
+ * `agent_run_outcome_daily` buckets (prod: 612 `stale_run` + 604
+ * `error:stale_run`) purely by whether anything happened to read the row after
+ * the reap — and made the reconciliation convergence guard, which compares
+ * `terminal_reason` for equality, rewrite the row on every read forever.
+ *
+ * Rows reaped before this change keep the bare `stale_run`, so anything matching
+ * on the value must accept both forms for one retention window.
+ */
+export declare const STALE_RUN_TERMINAL_REASON: string;
 /**
  * Terminal error for a background-dispatched run whose worker NEVER claimed it
  * (the foreground fired the self-dispatch, Netlify acked it async with a 202,

package/dist/agent/run-store.js

@@ -50,6 +50,22 @@ export const STALE_RUN_ERROR_EVENT = {
     recoverable: true,
     details: "The run heartbeat stopped while the run was still marked running. Partial output and tool calls were preserved when available.",
 };
+/**
+ * `agent_runs.terminal_reason` recorded by the stale reapers.
+ *
+ * Every other error path records `error:<code>` (`terminalReasonForEvent`), and
+ * `reconcileTerminalRunFromEvents` writes that form for THIS failure too when it
+ * replays the terminal event a reaper itself appended. The reapers used to write
+ * the bare code, which split one outcome across two permanent
+ * `agent_run_outcome_daily` buckets (prod: 612 `stale_run` + 604
+ * `error:stale_run`) purely by whether anything happened to read the row after
+ * the reap — and made the reconciliation convergence guard, which compares
+ * `terminal_reason` for equality, rewrite the row on every read forever.
+ *
+ * Rows reaped before this change keep the bare `stale_run`, so anything matching
+ * on the value must accept both forms for one retention window.
+ */
+export const STALE_RUN_TERMINAL_REASON = `error:${STALE_RUN_ERROR_EVENT.errorCode}`;
 /**
  * Terminal error for a background-dispatched run whose worker NEVER claimed it
  * (the foreground fired the self-dispatch, Netlify acked it async with a 202,
@@ -1306,6 +1322,22 @@ export async function recordRunDiagnostic(runId, stage, detail) {
         // Diagnostics are best-effort; never let them break the run or the route.
     }
 }
+/**
+ * Wall-clock budget for ONE heartbeat write.
+ *
+ * The default `DbExec` budget is `dbOpTimeoutMs()` (8s on serverless) across 3
+ * connection attempts, so a single heartbeat can occupy up to 24s — against a
+ * 15s `RUN_STALE_MS`. The run-manager single-flights the write, so that one
+ * attempt suppresses every 1.5s tick behind it: a live foreground run in a quiet
+ * phase becomes reapable while its own heartbeat is still in flight. The same
+ * attempt also pins a pooler connection for those 24s, feeding the saturation
+ * that starves heartbeats in the first place.
+ *
+ * A heartbeat that cannot land promptly has no value — the 1.5s tick IS the
+ * retry — so it gets ONE attempt inside a third of the stale window, leaving
+ * room for two more to land before the reap cutoff.
+ */
+const HEARTBEAT_WRITE_TIMEOUT_MS = Math.floor(RUN_STALE_MS / 3);
 /** Update the run's liveness heartbeat. Called periodically by run-manager. */
 export async function updateRunHeartbeat(runId) {
     await ensureRunTables();
@@ -1324,6 +1356,8 @@ export async function updateRunHeartbeat(runId) {
               END
           WHERE id = ? AND status = 'running'`,
         args: [Date.now(), currentRssMb(), currentRssMb(), runId],
+        timeoutMs: HEARTBEAT_WRITE_TIMEOUT_MS,
+        maxAttempts: 1,
     });
 }
 /**
@@ -1612,9 +1646,15 @@ async function reapSingleStaleRun(runId, maxStaleMs) {
         : // First `?` is backgroundAwareStaleCutoffSql's CAST param, the next two
             // are inFlightGraceSql's — all bound to the same "now".
             [completedAt, completedAt, completedAt];
+    // `completed_at` is when the run DIED, not when a reaper noticed. Stamping
+    // reap time made every stale row report its own detection latency as run
+    // duration (prod: 30-59 minute "runs" against a 15s window), which is the
+    // measurement used to judge whether reaping is timely at all. The liveness
+    // basis is the last proof the producer was alive, and it is what
+    // `reconcileTerminalRunFromEvents` already records for the same failure.
     const updateSql = `UPDATE agent_runs
           SET status = 'errored',
-              completed_at = ?,
+              completed_at = COALESCE(completed_at, ${livenessBasisSql()}),
               error_code = ?,
               error_detail = ?,
               terminal_reason = ?
@@ -1623,10 +1663,9 @@ async function reapSingleStaleRun(runId, maxStaleMs) {
             AND ${terminalRunEventExclusionSql()}
             AND ${staleClause}`;
     const updateArgs = [
-        completedAt,
         STALE_RUN_ERROR_EVENT.errorCode,
         STALE_RUN_ERROR_EVENT.details,
-        STALE_RUN_ERROR_EVENT.errorCode,
+        STALE_RUN_TERMINAL_REASON,
         runId,
         ...staleArgs,
     ];
@@ -2433,11 +2472,16 @@ export async function cleanupOldRuns(olderThanMs, erroredOlderThanMs) {
             await reconcileTerminalRunFromEvents(id);
         }
     }
+    // Both UPDATEs below backdate `completed_at` to the liveness basis for the
+    // reason given on `reapSingleStaleRun`'s UPDATE: this pass can fire a DAY
+    // after the producer died, and stamping now would file that whole gap as run
+    // duration. On the absolute-age branch the basis degrades to `started_at`,
+    // which is still the truest thing known about a row that never heartbeat.
     const completedAt = Date.now();
     await client.execute({
         sql: `UPDATE agent_runs
           SET status = 'errored',
-              completed_at = ?,
+              completed_at = COALESCE(completed_at, ${livenessBasisSql()}),
               error_code = ?,
               error_detail = ?,
               terminal_reason = ?
@@ -2445,10 +2489,9 @@ export async function cleanupOldRuns(olderThanMs, erroredOlderThanMs) {
             AND ${terminalRunEventExclusionSql()}
             AND started_at < ?`,
         args: [
-            completedAt,
             STALE_RUN_ERROR_EVENT.errorCode,
             STALE_RUN_ERROR_EVENT.details,
-            STALE_RUN_ERROR_EVENT.errorCode,
+            STALE_RUN_TERMINAL_REASON,
             cutoff,
         ],
     });
@@ -2463,7 +2506,7 @@ export async function cleanupOldRuns(olderThanMs, erroredOlderThanMs) {
     await client.execute({
         sql: `UPDATE agent_runs
           SET status = 'errored',
-              completed_at = ?,
+              completed_at = COALESCE(completed_at, ${livenessBasisSql()}),
               error_code = ?,
               error_detail = ?,
               terminal_reason = ?
@@ -2472,10 +2515,9 @@ export async function cleanupOldRuns(olderThanMs, erroredOlderThanMs) {
             AND ${livenessBasisSql()} < ${backgroundAwareStaleCutoffSql()}
             AND ${inFlightGraceSql()}`,
         args: [
-            completedAt,
             STALE_RUN_ERROR_EVENT.errorCode,
             STALE_RUN_ERROR_EVENT.details,
-            STALE_RUN_ERROR_EVENT.errorCode,
+            STALE_RUN_TERMINAL_REASON,
             completedAt,
             completedAt,
             completedAt,

package/dist/agent/thread-data-builder.d.ts

@@ -17,6 +17,7 @@ interface ContentPart {
     completedSideEffect?: boolean;
     mcpApp?: AgentMcpAppPayload;
     chatUI?: ActionChatUIConfig;
+    activity?: boolean;
     approval?: {
         approvalKey: string;
         dismissed?: boolean;

package/dist/agent/thread-data-builder.js

@@ -243,18 +243,31 @@ export function buildAssistantMessage(events, runId, options = {}) {
         metadata,
     };
 }
+/**
+ * The rebuild half of the live client's `clearAssistantDraftContent`
+ * (client/sse-event-processor.ts). The two bodies are asserted identical by
+ * `keeps clearAssistantDraftContent identical to the live client copy` in
+ * thread-data-builder.spec.ts — a rebuild that clears more than the live stream
+ * did makes narration vanish on reload, which is worse than clearing nothing.
+ */
 function clearAssistantDraftContent(content) {
     for (let index = content.length - 1; index >= 0; index--) {
         const part = content[index];
         if (!part)
             continue;
+        if (part.type === "tool-call" &&
+            part.activity !== true &&
+            part.result !== undefined) {
+            return;
+        }
         if (part.type === "text" || part.type === "reasoning") {
             content.splice(index, 1);
             continue;
         }
         if (part.type === "tool-call" && part.result === undefined) {
-            // Keep materialized in-flight tool cards across retry clears so persisted
-            // thread rebuilds match the live SSE processor and avoid hide→show flicker.
+            // Only drop ephemeral placeholders. Materialized in-flight tool cards
+            // (real args from tool_start) stay mounted so a retry/auto-continue clear
+            // does not hide→show the same call when the next chunk re-emits it.
             const isEphemeral = part.activity === true ||
                 part.argsText === "" ||
                 Object.keys(part.args ?? {}).length === 0;

package/dist/client/RouteTransitionIndicator.js

@@ -37,5 +37,5 @@ export function RouteTransitionIndicator() {
     }, [destination]);
     if (!destination || visibleDestination !== destination)
         return null;
-    return (_jsx("div", { "aria-label": "Loading the next page", "aria-live": "polite", className: "pointer-events-none fixed inset-x-0 top-0 z-50 h-0.5 overflow-hidden bg-primary/15", "data-route-transition-indicator": "true", "data-route-transition-target": destination, role: "status", children: _jsx("div", { className: "route-transition-indicator-bar h-full w-full bg-primary" }) }));
+    return (_jsx("div", { "aria-label": "Loading page...", "aria-live": "polite", className: "pointer-events-none fixed inset-x-0 top-0 z-50 h-0.5 overflow-hidden bg-primary/15", "data-route-transition-indicator": "true", "data-route-transition-target": destination, role: "status", children: _jsx("div", { className: "route-transition-indicator-bar h-full w-full bg-primary" }) }));
 }

package/dist/client/agent-chat-adapter.js

@@ -24,20 +24,29 @@ const AUTO_CONTINUE_COMPLETION_GUARD = "Before doing more work, inspect the prio
 const MAX_RECONNECT_ATTEMPTS = 5;
 const MAX_STARTUP_RECOVERY_ATTEMPTS = 8;
 const MAX_QUEUED_CONFLICT_RETRIES = 120;
-// How many consecutive continuations that did not advance the turn (see
-// `describeContinuationAdvance`) we tolerate before giving up. This replaced
-// five separate budgets — stale-run, stalled, empty, repeated-narration and
-// repeated-action-preparation — each of which existed because the rung above
+// The consecutive non-advancing continuation (see `describeContinuationAdvance`)
+// that ends the turn: the third one stops it, so two are tolerated. This
+// replaced five separate budgets — stale-run, stalled, empty, repeated-narration
+// and repeated-action-preparation — each of which existed because the rung above
 // it had a hole the next one patched. One question answers all five: a round
 // that produced nothing, or produced exactly what the round before it
 // produced, did not advance.
 const MAX_NON_ADVANCING_CONTINUATIONS = 3;
-// Ceiling across the whole turn. Every attempt re-POSTs the full history plus
-// attachments, so a high ceiling only burns tokens and wall time. Non-advancing
-// turns are already stopped far earlier by the budget above; this one only ever
-// binds turns that keep making real progress, so it stays just above the
-// longest recovery we deliberately support.
+// Ceiling across the whole turn for TRANSIENT continuations — rounds that
+// followed a failure (timeout, dropped stream, stale run). Every attempt
+// re-POSTs the full history plus attachments, so a high ceiling only burns
+// tokens and wall time on a connection that keeps breaking.
 const MAX_TOTAL_TRANSIENT_CONTINUATIONS = 12;
+// Ceiling across the whole turn for WORK-boundary continuations. A `loop_limit`
+// round is not a failure — the server spent a full iteration budget on real
+// tool work and handed the turn back — so counting it against the transient
+// ceiling killed progressing turns at round 13 that had never failed once.
+// Sized against the server's own limits: at its default budget of 400
+// iterations per run this is ~10,000 tool calls, two orders past the deepest
+// legitimate production turn (117 tool calls) that sized that budget. It still
+// has to exist, because the server's per-turn token backstop rides the request
+// body between server-chained chunks and resets on every client re-POST.
+const MAX_LOOP_LIMIT_CONTINUATIONS = 25;
 const RETRY_BASE_DELAY_MS = 500;
 const RETRY_MAX_DELAY_MS = 8_000;
 const MAX_HISTORY_ATTACHMENT_CHARS = 60_000;
@@ -742,7 +751,11 @@ function estimateHistoryMessageCost(message) {
         const argsText = tool.argsText ?? stableJson(tool.args ?? {});
         cost += Math.min(argsText.length, argsCap);
         if (tool.result !== undefined) {
-            cost += Math.min(String(tool.result).length, MAX_HISTORY_TOOL_RESULT_CHARS);
+            cost += Math.min(
+            // Price the string the request actually carries. `String(result)` is
+            // 15 chars ("[object Object]") for every object result, which is most
+            // of them.
+            toolResultContent(tool.result, tool.toolName).length, MAX_HISTORY_TOOL_RESULT_CHARS);
         }
     }
     return Math.max(1, cost);
@@ -1634,6 +1647,9 @@ export function createAgentChatAdapter(options) {
             let startupRecoveryAttempts = 0;
             let queuedConflictRetries = 0;
             let totalTransientContinuationAttempts = 0;
+            // Work-boundary continuations (`loop_limit`), counted apart from the
+            // transient ones — see MAX_LOOP_LIMIT_CONTINUATIONS.
+            let loopLimitContinuations = 0;
             // Consecutive continuations whose advance signature matched the previous
             // round's (or was empty). Reset by any real advance.
             let nonAdvancingContinuations = 0;
@@ -1647,12 +1663,13 @@ export function createAgentChatAdapter(options) {
             // continuation history; the advance check needs the per-round delta for
             // every reason code, `loop_limit` included.
             let advanceCheckPrefix = [];
-            // Set when the turn is stopped by MAX_TOTAL_TRANSIENT_CONTINUATIONS —
-            // the whole-turn continuation ceiling, not a dropped connection. This
-            // can trip on a turn that was making real progress the entire time, so
-            // it needs its own honest message instead of falling through to the
-            // generic "connection kept failing" copy below.
-            let recoveryGaveUpOnTransientBudget = false;
+            // Set when the turn is stopped by a whole-turn continuation ceiling
+            // (MAX_TOTAL_TRANSIENT_CONTINUATIONS or MAX_LOOP_LIMIT_CONTINUATIONS)
+            // rather than by a dropped connection. Either can trip on a turn that was
+            // making real progress the entire time, so it needs its own honest
+            // message instead of falling through to the generic "connection kept
+            // failing" copy below.
+            let recoveryGaveUpOnContinuationBudget = false;
             const continuationHistoryFragments = [];
             const structuredContinuationFragments = [];
             let visibleContinuationPrefix = [];
@@ -1708,6 +1725,7 @@ export function createAgentChatAdapter(options) {
                         ? `activity_trail: ${formatActivityTrail(lastActivityTrail)}`
                         : "",
                     `total_transient_continuations: ${totalTransientContinuationAttempts}`,
+                    `loop_limit_continuations: ${loopLimitContinuations}`,
                     `background_follow_no_progress_detaches: ${backgroundFollowNoProgressDetaches}`,
                     `background_follow_consecutive_no_progress_detaches: ${backgroundFollowConsecutiveNoProgressDetaches}`,
                     backgroundFollowLastDetachReason
@@ -1738,7 +1756,7 @@ export function createAgentChatAdapter(options) {
                         : " the same action";
                     return `The agent got stuck preparing${tool} input and never started the tool, so I stopped the automatic retries. Try a smaller first step or a more compact version of the request.`;
                 }
-                if (recoveryGaveUpOnTransientBudget) {
+                if (recoveryGaveUpOnContinuationBudget) {
                     return "This turn reached the limit on how many times it can be automatically continued, so I stopped it here. It may have still been making progress — retry as a single, narrower request so it can finish within fewer continuations.";
                 }
                 if (content.length === 0 &&
@@ -2815,15 +2833,6 @@ export function createAgentChatAdapter(options) {
                     const visibleContent = visibleContentForContinuation();
                     let currentPartialHistory = contentToContinuationHistory(visibleContent);
                     const madeContentProgress = hasContinuationProgress(visibleContent);
-                    // An action was streamed but has not returned yet (a tool_start with
-                    // no tool_done). Only a run_timeout in that window means the SERVER
-                    // is still executing it and a reconnect can still deliver the result;
-                    // every other reason means the stream is dead and nothing will
-                    // complete the tool.
-                    const hasInFlightTool = hasInFlightToolCall(visibleContent);
-                    const completedTool = lastCompletedTimeoutCandidateTool(content);
-                    const currentPreparingToolName = lastUnresolvedToolActivity(visibleContent) ??
-                        lastPreparingActionTool(signal.activityTrail);
                     // THE boundary. One question — did this continuation advance the
                     // turn? — decides every reason code, `loop_limit` included. It used
                     // to skip this block entirely AND reset two of the budgets, so a
@@ -2832,6 +2841,20 @@ export function createAgentChatAdapter(options) {
                     // no answer). The durable per-turn ledger lives server-side inside
                     // one run and never sees a client re-POST, so nothing else bounds it.
                     const advanceDelta = contentAfterContinuationPrefix(content, advanceCheckPrefix);
+                    // Everything that asks "what did THIS round do" reads the delta.
+                    // `visibleContent` accumulates across a `loop_limit` chain — its
+                    // prefix deliberately does not advance there — so one unresolved
+                    // "Preparing X" card from an earlier round would otherwise stall
+                    // every later round on the same name and kill a turn that was
+                    // streaming new prose the whole time.
+                    // An action streamed but not returned yet (a tool_start with no
+                    // tool_done) means the SERVER is still executing it, so a run_timeout
+                    // in that window can still deliver the result on reconnect; every
+                    // other reason means the stream is dead and nothing will complete it.
+                    const hasInFlightTool = hasInFlightToolCall(advanceDelta);
+                    const completedTool = lastCompletedTimeoutCandidateTool(content);
+                    const currentPreparingToolName = lastUnresolvedToolActivity(advanceDelta) ??
+                        lastPreparingActionTool(signal.activityTrail);
                     const advance = describeContinuationAdvance(advanceDelta, currentPreparingToolName);
                     const serverStillRunningTool = signal.reason === "run_timeout" && hasInFlightTool;
                     const advanced = serverStillRunningTool ||
@@ -2844,7 +2867,12 @@ export function createAgentChatAdapter(options) {
                     nonAdvancingContinuations = advanced
                         ? 0
                         : nonAdvancingContinuations + 1;
-                    totalTransientContinuationAttempts += 1;
+                    if (isTransient) {
+                        totalTransientContinuationAttempts += 1;
+                    }
+                    else {
+                        loopLimitContinuations += 1;
+                    }
                     advanceCheckPrefix = snapshotContent(content);
                     // If a tool already completed, do not turn a missing closing
                     // sentence into a scary connection failure. Give the model one
@@ -2868,8 +2896,9 @@ export function createAgentChatAdapter(options) {
                         return { ok: false, resetVisibleContent: false };
                     }
                     if (totalTransientContinuationAttempts >
-                        MAX_TOTAL_TRANSIENT_CONTINUATIONS) {
-                        recoveryGaveUpOnTransientBudget = true;
+                        MAX_TOTAL_TRANSIENT_CONTINUATIONS ||
+                        loopLimitContinuations > MAX_LOOP_LIMIT_CONTINUATIONS) {
+                        recoveryGaveUpOnContinuationBudget = true;
                         return { ok: false, resetVisibleContent: false };
                     }
                     if (isTransient) {

package/dist/client/sse-event-processor.js

@@ -534,6 +534,13 @@ function isAutoRecoverableError(ev, errMsg) {
     }
     if (ev.recoverable === true)
         return true;
+    // An explicit flag outranks the message sniff below, which exists only for
+    // events that carry no flag at all. The repeat guards stop a turn with
+    // `recoverable: false` and a message that names the looping tool, so a stop
+    // on `list-workspace-connections` matched the "connection" sniff and
+    // auto-continued the very loop it was emitted to break.
+    if (ev.recoverable === false)
+        return false;
     if (msg.includes("daily gateway request cap"))
         return false;
     // "gateway error" intentionally absent — that's the no-detail Builder

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/db/client.js

@@ -1091,7 +1091,7 @@ const _sharedDbPoolReplacementHooks = new Map();
  * database access down with it.
  */
 export function sharedDbPool(driver, url, create) {
-    const key = `${driver}${url}`;
+    const key = `${driver}\u0000${url}`;
     const existing = _sharedDbPools.get(key);
     if (existing)
         return existing;
@@ -1105,7 +1105,7 @@ export function sharedDbPool(driver, url, create) {
  * handing out the discarded pool.
  */
 export function replaceSharedDbPool(driver, url, previous, next) {
-    const key = `${driver}${url}`;
+    const key = `${driver}\u0000${url}`;
     if (_sharedDbPools.get(key) !== previous)
         return;
     _sharedDbPools.set(key, next);

package/dist/notifications/routes.d.ts

@@ -28,6 +28,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     ok: boolean;
-    error?: undefined;
 }>>;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-chat-plugin.js

@@ -4890,18 +4890,41 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             error: "Recurring-job sweep reached the synchronous server instead of the durable background worker.",
                         };
                     }
+                    // Stale reaping runs FIRST and site-wide, before the open-ended job
+                    // sweep can spend the platform wall. It is the durable driver the
+                    // in-process fast sweep below cannot be on serverless: that timer is
+                    // off wherever `shouldDisableInProcessSweeps` is on — i.e. every
+                    // production Lambda — and nothing replaced it, so a claimed run
+                    // whose producer died was only reaped when an unrelated request path
+                    // happened to look (prod: 1,216 runs, 12% of all runs, sitting
+                    // "running" for up to 59 minutes against a 15s window).
+                    //
+                    // One reap per site-tick instead of one per warm container is also
+                    // the point: the per-container timers are what issued 237k queries
+                    // in two minutes and earned that kill switch. `reapAllStaleRuns`
+                    // short-circuits on `hasRunningRuns()` (negative-cached), so an idle
+                    // app pays one probe.
+                    //
+                    // Reported, never swallowed, and never fatal to the job sweep: a
+                    // reap failure must not take recurring jobs down with it, and
+                    // `null` must stay distinguishable from "reaped nothing".
+                    const { reapAllStaleRuns } = await import("../agent/run-store.js");
+                    const staleRunsReaped = await reapAllStaleRuns().catch((error) => {
+                        console.error("[agent-chat] durable stale-run reap failed:", error);
+                        return null;
+                    });
                     try {
                         // Jobs may request MCP tools, and `getActions` is synchronous —
                         // hydrate before the sweep so a serverless container that never
                         // eagerly initialized still resolves them.
                         await ensureMcpInitialized();
                         await processRecurringJobs(schedulerDeps);
-                        return { ok: true };
+                        return { ok: true, staleRunsReaped };
                     }
                     catch (error) {
                         console.error("[recurring-jobs] Sweep route failed:", error);
                         setResponseStatus(event, 500);
-                        return { error: "Recurring-job sweep failed" };
+                        return { error: "Recurring-job sweep failed", staleRunsReaped };
                     }
                 }));
                 if (disableRecurringJobsRuntime) {
@@ -5139,7 +5162,16 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             // against a 45s window). `reapAllStaleRuns` is per-row,
                             // idempotent, re-checks staleness at UPDATE time and honours
                             // the in-flight grace, so it is safe on this cadence.
-                            await reapAllStaleRuns().catch(() => { });
+                            //
+                            // This timer is the driver only where it actually runs — a
+                            // long-lived Node host. Wherever `sweepsDisabled` turns it off
+                            // (every production serverless function) the signed
+                            // RECURRING_JOBS_SWEEP_PATH route above owns the same reap,
+                            // driven by the platform scheduler. The two never both fire on
+                            // one host, which is why neither needs to coordinate.
+                            await reapAllStaleRuns().catch((error) => {
+                                console.error("[agent-chat] in-process stale-run reap failed:", error);
+                            });
                             let rows;
                             try {
                                 rows = await listUnclaimedBackgroundRunRows();

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.153.5",
+  "version": "0.153.6",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -421,8 +421,8 @@
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "^0.14.1",
-    "@agent-native/recap-cli": "0.5.4"
+    "@agent-native/recap-cli": "0.5.4",
+    "@agent-native/toolkit": "^0.14.1"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",