@agent-native/core 0.161.14 → 0.161.16

package/corpus/README.md

@@ -31,4 +31,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- template files: 8309
+- template files: 8310

package/corpus/templates/clips/app/hooks/use-recording-leave-guard.ts

@@ -0,0 +1,70 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { useBlocker } from "react-router";
+
+/**
+ * Blocks in-app route navigation while `hasRecordingAtRisk()` is true, using
+ * React Router's `useBlocker` — the same check the recorder's `beforeunload`
+ * handler already uses for tab close/reload. Without this, an in-app link
+ * (e.g. Library) unmounts the recorder route with no warning at all, since
+ * the browser never fires `beforeunload` for client-side navigation.
+ *
+ * Exposes a tiny state machine for a confirm dialog rather than a boolean,
+ * because confirming has to navigate away only after the dialog has actually
+ * finished closing — see the `onCloseAutoFocus` deferral below.
+ */
+export function useRecordingLeaveGuard(hasRecordingAtRisk: () => boolean) {
+  const blocker = useBlocker(
+    useCallback(
+      ({ currentLocation, nextLocation }) =>
+        currentLocation.pathname !== nextLocation.pathname &&
+        hasRecordingAtRisk(),
+      [hasRecordingAtRisk],
+    ),
+  );
+
+  const [leavePromptOpen, setLeavePromptOpen] = useState(false);
+  // See delete-recording-menu.tsx's `deletedWhileOpenRef`: navigating away
+  // while Radix is still tearing down the AlertDialog portal can leave its
+  // body pointer-events lock behind. Close the dialog first and defer
+  // `blocker.proceed()` to `onCloseAutoFocus`, once Radix has actually
+  // finished closing it, instead of calling it straight from the click
+  // handler.
+  const proceedBlockerRef = useRef<() => void>(() => {});
+  proceedBlockerRef.current =
+    blocker.state === "blocked" ? blocker.proceed : () => {};
+  const leaveConfirmedRef = useRef(false);
+
+  useEffect(() => {
+    if (blocker.state === "blocked") setLeavePromptOpen(true);
+  }, [blocker.state]);
+
+  const confirmLeave = useCallback(() => {
+    leaveConfirmedRef.current = true;
+    setLeavePromptOpen(false);
+  }, []);
+
+  const onDialogOpenChange = useCallback(
+    (open: boolean) => {
+      if (open) return;
+      setLeavePromptOpen(false);
+      if (!leaveConfirmedRef.current && blocker.state === "blocked") {
+        blocker.reset();
+      }
+    },
+    [blocker],
+  );
+
+  const onCloseAutoFocus = useCallback((event: { preventDefault(): void }) => {
+    if (!leaveConfirmedRef.current) return;
+    leaveConfirmedRef.current = false;
+    event.preventDefault();
+    setTimeout(() => proceedBlockerRef.current(), 0);
+  }, []);
+
+  return {
+    leavePromptOpen,
+    onDialogOpenChange,
+    onCloseAutoFocus,
+    confirmLeave,
+  };
+}

package/corpus/templates/clips/app/i18n/en-US.ts

@@ -1413,6 +1413,10 @@ All notable user-facing changes to Clips are documented here. Open it any time f
       "Connect storage on the next screen: Builder.io (free tier storage + AI) or S3-compatible storage. Clips will finish saving it.",
     connectStorageToRetryLoom:
       "Connect storage on the next screen: Builder.io (free tier storage + AI) or S3-compatible storage. Clips will retry the import.",
+    leaveConfirmTitle: "Leave and discard this recording?",
+    leaveConfirmDescription:
+      "Your in-progress recording hasn't finished saving. Leaving this page now will discard it.",
+    leaveAndDiscard: "Leave and discard",
   },
   importRoute: {
     pageTitle: "Import Loom — Clips",

package/corpus/templates/clips/app/routes/record.tsx

@@ -35,6 +35,7 @@ import { Link, useLocation, useNavigate } from "react-router";
 
 import { Skeleton } from "@/components/ui/skeleton";
 import { useDesktopPromo } from "@/hooks/use-desktop-promo";
+import { useRecordingLeaveGuard } from "@/hooks/use-recording-leave-guard";
 import {
   fetchVideoStorageStatus,
   useVideoStorageStatus,
@@ -2518,6 +2519,22 @@ export default function RecordRoute() {
     };
   }, [extensionCapture, stopLiveTranscription]);
 
+  // In-app navigation (e.g. a Library link) unmounts this route the same way
+  // a tab close does, but the browser never fires `beforeunload` for it — so
+  // without this, the cleanup effect above ran `releaseCapture()`
+  // unconditionally and silently killed an at-risk recording. Route every
+  // in-app navigation attempt through the same `hasRecordingAtRisk()` check
+  // `warnBeforeDiscard` uses, so both exits are gated by one check instead of
+  // two divergent ones.
+  const {
+    leavePromptOpen,
+    onDialogOpenChange,
+    onCloseAutoFocus,
+    confirmLeave,
+  } = useRecordingLeaveGuard(
+    useCallback(() => !!engineRef.current?.hasRecordingAtRisk(), []),
+  );
+
   // -------------------------------------------------------------------------
   // Render.
   // -------------------------------------------------------------------------
@@ -2740,6 +2757,31 @@ export default function RecordRoute() {
         </AlertDialogContent>
       </AlertDialog>
 
+      <AlertDialog open={leavePromptOpen} onOpenChange={onDialogOpenChange}>
+        <AlertDialogContent onCloseAutoFocus={onCloseAutoFocus}>
+          <AlertDialogHeader>
+            <AlertDialogTitle>
+              {t("recordRoute.leaveConfirmTitle")}
+            </AlertDialogTitle>
+            <AlertDialogDescription>
+              {t("recordRoute.leaveConfirmDescription")}
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>{t("common.cancel")}</AlertDialogCancel>
+            <AlertDialogAction
+              onClick={(event) => {
+                event.preventDefault();
+                confirmLeave();
+              }}
+              className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
+            >
+              {t("recordRoute.leaveAndDiscard")}
+            </AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
+
       {/* Uploading overlay (also covers the compressing pass which can run
           for several minutes on long recordings — without a distinct copy
           users wonder if the app froze). */}

package/corpus/templates/slides/app/root.tsx

@@ -66,6 +66,26 @@ const BARE_ROUTES = new Set(["/slide"]);
 /** Route prefixes that render without the app shell */
 const BARE_PREFIXES = ["/share/", "/p/"];
 
+/**
+ * Routes that serve deck content to any visitor — owner, teammate, or an
+ * anonymous recipient of a shared link — rather than an app-management
+ * surface. `/deck/:id` renders the full editor shell (so it's not "bare"
+ * above: viewers still get chrome, just read-only), but it must never force
+ * sign-in or gate on first-run onboarding, or a shared link flashes the deck
+ * and then buries it under "create your first deck" (the onboarding gate has
+ * no route awareness of its own — see `sessionBypass` below). `/present` is
+ * the full-screen presentation view and `/slide` is the agent-embed preview;
+ * both are shown to viewers the same way.
+ */
+export function isShareableContentPath(pathname: string): boolean {
+  return (
+    BARE_ROUTES.has(pathname) ||
+    BARE_PREFIXES.some((p) => pathname.startsWith(p)) ||
+    pathname.startsWith("/deck/") ||
+    pathname.endsWith("/present")
+  );
+}
+
 export const links: LinksFunction = () => [
   { rel: "stylesheet", href: stylesheet },
 ];
@@ -311,6 +331,7 @@ export default function Root() {
         queryClient={queryClient}
         defaultTheme="dark"
         i18n={{ catalog: i18nCatalog }}
+        sessionBypass={isShareableContentPath(location.pathname)}
       >
         <AppContent />
       </AppProviders>

package/corpus/templates/slides/server/handlers/decks.ts

@@ -1,7 +1,7 @@
 import { recordChange } from "@agent-native/core/server/poll";
 import { defineEventHandler, setResponseStatus, createEventStream } from "h3";
 
-import { resolveSlidesRequestAuthContext } from "./request-auth-context.js";
+import { resolveSlidesRequestAuth } from "./request-auth-context.js";
 
 // --- SSE for change notifications ---
 type SSEPush = (data: string) => void;
@@ -91,8 +91,12 @@ export function notifyClients(
 // callers can't tail the stream. (The agent path runs server-side and is
 // not affected.)
 export const deckEvents = defineEventHandler(async (event) => {
-  const session = await resolveSlidesRequestAuthContext(event);
-  if (!session.email) {
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { error: auth.error };
+  }
+  if (!auth.context.email) {
     setResponseStatus(event, 401);
     return { error: "Unauthorized" };
   }

package/corpus/templates/slides/server/handlers/request-auth-context.ts

@@ -7,10 +7,36 @@ export interface SlidesRequestAuthContext {
   orgId?: string;
 }
 
+/**
+ * A session lookup that failed outright (DB blip, cookie race) — distinct
+ * from `getSession` resolving to `null`, which means "no session" and is a
+ * legitimate outcome for anonymous callers (public share/deck viewers).
+ * `getSession` only throws on a real backend failure, never merely because a
+ * request carries no session cookie, so this never fires for genuine
+ * anonymous access. Previously this was swallowed into the same
+ * `email: undefined` an anonymous visitor gets, so a transient failure
+ * presented as "unauthorized" on the upload path and as an untraceable error
+ * on deck creation — see `resolveSlidesRequestAuth` for the caller-facing
+ * shape.
+ */
+export class SlidesSessionLookupError extends Error {
+  readonly statusCode = 503;
+  constructor(cause: unknown) {
+    super("Could not verify your session. Please try again.");
+    this.name = "SlidesSessionLookupError";
+    this.cause = cause;
+  }
+}
+
 export async function resolveSlidesRequestAuthContext(
   event: H3Event,
 ): Promise<SlidesRequestAuthContext> {
-  const session = await getSession(event).catch(() => null);
+  let session: Awaited<ReturnType<typeof getSession>>;
+  try {
+    session = await getSession(event);
+  } catch (err) {
+    throw new SlidesSessionLookupError(err);
+  }
 
   // Prefer the live active org context over `session.orgId`. Better Auth's
   // session.orgId is set at sign-in and not refreshed when the user switches
@@ -39,6 +65,37 @@ export async function resolveSlidesRequestAuthContext(
   };
 }
 
+/** Discriminated result for route handlers that must fail closed on a
+ * session-lookup error rather than treat it as "logged out". */
+export type SlidesRequestAuthResolution =
+  | { ok: true; context: SlidesRequestAuthContext }
+  | { ok: false; statusCode: number; error: string };
+
+/**
+ * Like `resolveSlidesRequestAuthContext`, but turns a `SlidesSessionLookupError`
+ * into a response the caller can return directly instead of a 401 — so a
+ * route handler that gates on `!context.email` never mistakes "the session
+ * lookup failed" for "this visitor is signed out". A route with legitimate
+ * anonymous access (e.g. a public deck view) still gets `email: undefined`
+ * for real anonymous callers via `ok: true`; only a genuine lookup failure
+ * takes the `ok: false` branch.
+ */
+export async function resolveSlidesRequestAuth(
+  event: H3Event,
+): Promise<SlidesRequestAuthResolution> {
+  try {
+    return { ok: true, context: await resolveSlidesRequestAuthContext(event) };
+  } catch (err) {
+    return {
+      ok: false,
+      statusCode:
+        err instanceof SlidesSessionLookupError ? err.statusCode : 500,
+      error:
+        err instanceof Error ? err.message : "Failed to verify your session.",
+    };
+  }
+}
+
 export async function withSlidesRequestContext<T>(
   event: H3Event,
   fn: (session: SlidesRequestAuthContext) => Promise<T>,

package/corpus/templates/slides/server/handlers/share.ts

@@ -18,7 +18,7 @@ import { defineEventHandler, getRouterParam, setResponseStatus } from "h3";
 
 import { getDb, schema } from "../db";
 import {
-  resolveSlidesRequestAuthContext,
+  resolveSlidesRequestAuth,
   withSlidesRequestContext,
 } from "./request-auth-context.js";
 
@@ -47,7 +47,12 @@ export const shareDeck = defineEventHandler(async (event) => {
   // and pass the resolved context into `withSlidesRequestContext` so it
   // doesn't re-resolve session + org on the same request (which would
   // double the session/getOrgContext I/O per share).
-  const session = await resolveSlidesRequestAuthContext(event);
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { error: auth.error };
+  }
+  const session = auth.context;
   if (!session.email) {
     setResponseStatus(event, 401);
     return { error: "Unauthorized" };

package/corpus/templates/slides/server/handlers/uploads.ts

@@ -21,7 +21,7 @@ import {
 } from "../lib/uploaded-reference-storage.js";
 import { canSaveAsUploadedAsset, uploadImageAsset } from "./assets.js";
 import {
-  resolveSlidesRequestAuthContext,
+  resolveSlidesRequestAuth,
   withSlidesRequestContext,
 } from "./request-auth-context.js";
 
@@ -211,7 +211,12 @@ export async function saveUploadedReferenceFile(args: {
 
 // Upload one or more files
 export const uploadFiles = defineEventHandler(async (event) => {
-  const authContext = await resolveSlidesRequestAuthContext(event);
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { error: auth.error };
+  }
+  const authContext = auth.context;
   const email = authContext.email;
   if (!email) {
     setResponseStatus(event, 401);

package/dist/agent/engine/translate-anthropic.js

@@ -343,6 +343,11 @@ function enginePartToAnthropic(part, builderGateway) {
             };
         }
         case "thinking":
+            // A redacted block has no readable thinking or signature — only its
+            // encrypted payload, which Anthropic requires back unmodified.
+            if (part.redactedData) {
+                return { type: "redacted_thinking", data: part.redactedData };
+            }
             // Anthropic thinking blocks — pass through with signature for context window continuity
             return {
                 type: "thinking",
@@ -409,7 +414,20 @@ export function anthropicContentToEngine(content) {
                 signature: b.signature,
             };
         }
-        // Unknown block type — skip
+        if (block.type === "redacted_thinking") {
+            // Dropping this looked like "skip an unreadable block", but Anthropic
+            // requires the whole thinking sequence back verbatim within a tool-use
+            // turn: losing it makes the very next loop iteration send an assistant
+            // turn the API refuses, from a turn that streamed perfectly.
+            return {
+                type: "thinking",
+                text: "",
+                redactedData: block.data ?? "",
+            };
+        }
+        // Unknown block type. Skipping is the only safe replay, but a silent skip
+        // is how redacted_thinking went missing — say which type was dropped.
+        console.warn(`[anthropic-engine] dropping unrecognized content block type "${block.type}" from the assistant turn; it will not be replayed`);
         return { type: "text", text: "" };
     })
         .filter((p) => !(p.type === "text" && p.text === ""));

package/dist/agent/engine/types.d.ts

@@ -121,6 +121,13 @@ export interface EngineThinkingPart {
     text: string;
     /** Opaque signature for pass-through on next turn (Anthropic extended thinking) */
     signature?: string;
+    /**
+     * Encrypted payload of an Anthropic `redacted_thinking` block, which carries
+     * no readable `text` or `signature`. Anthropic requires the block back
+     * verbatim in the same tool-use turn, so it has to survive normalization —
+     * a part with this set replays as `redacted_thinking`, not as `thinking`.
+     */
+    redactedData?: string;
 }
 export type EngineContentPart = EngineTextPart | EngineImagePart | EngineFilePart | EngineToolCallPart | EngineToolResultPart | EngineThinkingPart;
 export type EngineMessage = {

package/dist/agent/production-agent.js

@@ -772,6 +772,15 @@ const RUN_BUDGET_EXHAUSTED_ERROR_CODE = "run_budget_exhausted";
 const RUN_BUDGET_EXHAUSTED_MESSAGE = "I ran out of time before finishing this step. " +
     "I stopped rather than keep retrying silently. " +
     "Check any completed tool cards above before retrying, ideally as one smaller follow-up.";
+/**
+ * Text attachments have been capped since forever; binary ones never were, so
+ * a large PDF or screenshot went to the provider as unbounded inline base64.
+ * OpenAI rejects the whole request over 1,048,576 chars in one `file_url`
+ * ("string too long", measured at 4,149,128), which kills the turn — the cap is
+ * on the encoded string, so that is what this counts rather than decoded bytes.
+ * Held under the limit to leave room for the `data:<mediaType>;base64,` prefix.
+ */
+const MAX_INLINE_ATTACHMENT_BASE64_CHARS = 1_000_000;
 const MAX_TEXT_ATTACHMENT_CHARS = 60_000;
 const MAX_TEXT_ATTACHMENTS_TOTAL_CHARS = 80_000;
 const MAX_SELECTION_CONTEXT_CHARS = 8_000;
@@ -1093,6 +1102,17 @@ export function buildUserContentWithAttachments(opts) {
                 continue;
             }
             const match = att.data.match(/^data:(image\/[^;]+);base64,(.+)$/);
+            if (match &&
+                isSupportedImageMediaType(match[1]) &&
+                match[2].length > MAX_INLINE_ATTACHMENT_BASE64_CHARS) {
+                // The upload already happened and `uploadedUrl` is the whole point of
+                // it. Inlining the bytes anyway is what made the request unsendable.
+                const label = att.name ? `"${att.name}"` : "An image";
+                textAttachments.push(uploadedUrl
+                    ? `[${label} was uploaded to ${uploadedUrl}. It was too large to send inline for vision analysis, so use the URL for embedding/reference.]`
+                    : `[${label} was too large to send inline for vision analysis and no upload URL is available. Ask the user to attach a smaller image.]`);
+                continue;
+            }
             if (match && isSupportedImageMediaType(match[1])) {
                 userContent.push({
                     type: "image",
@@ -1125,6 +1145,13 @@ export function buildUserContentWithAttachments(opts) {
         }
         const filePart = dataUrlToFilePart(att);
         if (filePart) {
+            if (filePart.data.length > MAX_INLINE_ATTACHMENT_BASE64_CHARS) {
+                const label = att.name ? `"${att.name}"` : "A file";
+                textAttachments.push(uploadedUrl
+                    ? `[${label} was uploaded to ${uploadedUrl}. It was too large to send inline, so read it from the URL if its contents are needed.]`
+                    : `[${label} was too large to send inline and no upload URL is available. Ask the user for a smaller file.]`);
+                continue;
+            }
             userContent.push(filePart);
             continue;
         }
@@ -7161,6 +7188,11 @@ export function createProductionAgentHandler(options) {
                 const { threadDataToEngineMessages } = await import("./thread-data-builder.js");
                 const priorThreadData = (await getThread(effectiveThreadId))
                     ?.threadData;
+                // `threadDataToEngineMessages` takes one argument and flattens tool
+                // calls to text by design. The second argument never existed anywhere
+                // in the repo, so this failed `tsc` and broke every production build
+                // between 16:29 and now -- it reached main only because admin merges
+                // do not wait for the typecheck that would have caught it.
                 const resumed = threadDataToEngineMessages(priorThreadData);
                 if (resumed.length > 0) {
                     const actionPreparationTool = typeof backgroundRunMarker?.actionPreparationTool === "string" &&

package/dist/agent/thread-data-builder.d.ts

@@ -62,17 +62,29 @@ export declare function buildAssistantMessage(events: RunEvent[], runId?: string
  * fail with "Parent message not found".
  */
 export declare function normalizeThreadRepository(repo: any): any;
+export interface ThreadDataToEngineMessagesOptions {
+    /**
+     * Replay the tool calls and results thread_data already stores instead of
+     * flattening each turn to its prose. Required by callers that RESUME a run
+     * (chained background continuation, agent-teams continue): a turn rebuilt as
+     * text alone tells the model what it said but not what it did, so it re-runs
+     * tools it already ran and cannot see their output. Callers that only need
+     * "what was said" — recovery floors, memory compaction — leave this off.
+     */
+    includeToolCalls?: boolean;
+}
 /**
  * Rebuild a flat `EngineMessage[]` from persisted thread_data (the
- * assistant-ui ExportedMessageRepository shape). Text-only — tool calls/results
- * are flattened to their text so a continuation run gets the conversation
- * prefix as plain context (Anthropic's prompt cache makes the resume cheap).
+ * assistant-ui ExportedMessageRepository shape). Each turn collapses to its
+ * text by default, which is all a recovery floor or a memory compaction needs.
+ * Callers resuming a run pass `includeToolCalls` to replay what the turn
+ * actually DID as well as what it said.
  *
  * Used to resume a background sub-agent in a fresh function invocation (the
  * server-side analog of the browser re-POSTing history for the main chat).
  * Originally inlined in `integrations/webhook-handler.ts`.
  */
-export declare function threadDataToEngineMessages(threadData: string | Record<string, unknown> | null | undefined): EngineMessage[];
+export declare function threadDataToEngineMessages(threadData: string | Record<string, unknown> | null | undefined, options?: ThreadDataToEngineMessagesOptions): EngineMessage[];
 /**
  * The trailing window of what was actually said in a thread, for a request that
  * arrived carrying no history of its own. The client trims history against a

package/dist/agent/thread-data-builder.js

@@ -1,6 +1,7 @@
 import { formatChatErrorText, normalizeChatError, } from "../client/error-format.js";
 import { isCredentialGapCodeAgentEvent, normalizeCodeAgentTranscript, } from "../code-agents/transcript-normalizer.js";
 import { BUILDER_GATEWAY_INTERNAL_ERROR_CODE } from "./engine/error-detail.js";
+import { stringifyToolUseInputForGateway } from "./engine/translate-anthropic.js";
 const INTERRUPTED_TOOL_RESULT = "Interrupted before this tool returned a result.";
 export const ASSISTANT_RUN_DURATION_METADATA_KEY = "agentNativeRunDurationMs";
 const MAX_STORED_ATTACHMENT_CHARS = 60_000;
@@ -653,17 +654,121 @@ export function normalizeThreadRepository(repo) {
         headId && seenIds.has(headId) ? headId : (previousId ?? null);
     return normalized;
 }
+/**
+ * A replayed tool result is evidence, not the source of truth — the resumed
+ * turn can always re-read current state. Bound each one so restoring fidelity
+ * cannot itself overflow the context window, and say so in-band when it bites.
+ */
+const MAX_REPLAYED_TOOL_RESULT_CHARS = 12_000;
+/**
+ * Total budget for replayed tool payloads across the whole thread. Per-result
+ * capping alone is not a bound: a long run has hundreds of calls, so replaying
+ * every one of them would overflow the context window and break the very
+ * continuation this replay exists to serve. The newest turns keep their tool
+ * detail; older turns fall back to prose and say so.
+ */
+const MAX_REPLAYED_TOOL_PAYLOAD_CHARS = 64_000;
+const ELIDED_TOOL_DETAIL_NOTE = "[Tool calls from this turn were elided from replayed history to fit the context. Re-read the current state with tools if their detail matters.]";
+function replayedToolResultContent(result) {
+    const body = typeof result === "string"
+        ? result
+        : result === undefined || result === null
+            ? ""
+            : (() => {
+                try {
+                    return JSON.stringify(result) ?? "";
+                }
+                catch {
+                    return String(result);
+                }
+            })();
+    if (body.length <= MAX_REPLAYED_TOOL_RESULT_CHARS)
+        return body;
+    const omitted = body.length - MAX_REPLAYED_TOOL_RESULT_CHARS;
+    return `${body.slice(0, MAX_REPLAYED_TOOL_RESULT_CHARS)}\n\n[Tool result truncated after ${MAX_REPLAYED_TOOL_RESULT_CHARS.toLocaleString()} characters; ${omitted.toLocaleString()} omitted from replayed history. Re-read the current state with tools if the exact content matters.]`;
+}
+/**
+ * Integration turns (Slack and friends) deliberately replay only what the
+ * participant saw plus a compact artifact ledger — never the raw tool results.
+ * `threadMessageTextForEngine` owns that policy, so a structured replay has to
+ * defer to it rather than reach past it into `content`.
+ */
+function hasIntegrationReplayPolicy(message) {
+    const metadata = message?.metadata;
+    if (!metadata || typeof metadata !== "object")
+        return false;
+    return (metadata.integrationDelivery !== undefined ||
+        metadata.integrationDeliveryAttempted === true ||
+        Array.isArray(metadata.integrationArtifacts));
+}
+function replayableToolCalls(message) {
+    const content = Array.isArray(message?.content) ? message.content : [];
+    return content.filter((part) => part?.type === "tool-call" &&
+        typeof part.toolCallId === "string" &&
+        part.toolCallId.trim() &&
+        typeof part.toolName === "string" &&
+        part.toolName.trim());
+}
+/** What replaying this turn's tool calls with their results would actually cost. */
+function replayedToolPayloadCost(message) {
+    let cost = 0;
+    for (const part of replayableToolCalls(message)) {
+        cost += stringifyToolUseInputForGateway(part.args ?? {}).length;
+        if (part.result !== undefined) {
+            cost += replayedToolResultContent(part.result).length;
+        }
+    }
+    return cost;
+}
+/**
+ * One persisted assistant turn spans many tool rounds. Replay it as the
+ * provider protocol wants it — one assistant message carrying every `tool-call`,
+ * then one user message carrying every matching `tool-result`. The exact
+ * round-by-round interleaving is not recoverable from thread_data and does not
+ * matter; what matters is that the calls and their outputs survive at all.
+ */
+function assistantReplayContent(message, text) {
+    const assistant = [];
+    const results = [];
+    if (text.trim())
+        assistant.push({ type: "text", text });
+    const content = Array.isArray(message?.content) ? message.content : [];
+    for (const part of content) {
+        if (part?.type !== "tool-call")
+            continue;
+        const id = typeof part.toolCallId === "string" ? part.toolCallId.trim() : "";
+        const name = typeof part.toolName === "string" ? part.toolName.trim() : "";
+        if (!id || !name)
+            continue;
+        const input = part.args && typeof part.args === "object" && !Array.isArray(part.args)
+            ? part.args
+            : {};
+        assistant.push({ type: "tool-call", id, name, input });
+        if (part.result === undefined)
+            continue;
+        results.push({
+            type: "tool-result",
+            toolCallId: id,
+            toolName: name,
+            toolInput: stringifyToolUseInputForGateway(input),
+            content: replayedToolResultContent(part.result),
+            ...(part.isError === true ? { isError: true } : {}),
+        });
+    }
+    return { assistant, results };
+}
 /**
  * Rebuild a flat `EngineMessage[]` from persisted thread_data (the
- * assistant-ui ExportedMessageRepository shape). Text-only — tool calls/results
- * are flattened to their text so a continuation run gets the conversation
- * prefix as plain context (Anthropic's prompt cache makes the resume cheap).
+ * assistant-ui ExportedMessageRepository shape). Each turn collapses to its
+ * text by default, which is all a recovery floor or a memory compaction needs.
+ * Callers resuming a run pass `includeToolCalls` to replay what the turn
+ * actually DID as well as what it said.
  *
  * Used to resume a background sub-agent in a fresh function invocation (the
  * server-side analog of the browser re-POSTing history for the main chat).
  * Originally inlined in `integrations/webhook-handler.ts`.
  */
-export function threadDataToEngineMessages(threadData) {
+export function threadDataToEngineMessages(threadData, options = {}) {
     const messages = [];
     if (!threadData)
         return messages;
@@ -676,11 +781,60 @@ export function threadDataToEngineMessages(threadData) {
     }
     if (!Array.isArray(data?.messages))
         return messages;
-    for (const entry of data.messages) {
+    const entries = data.messages;
+    const replaysTools = (m) => options.includeToolCalls === true &&
+        m?.role === "assistant" &&
+        !hasIntegrationReplayPolicy(m);
+    // Spend the tool-payload budget on the most recent turns: those are the ones
+    // a resumed run is about to build on. Decided up front so the walk below can
+    // stay in conversation order.
+    const toolPayloadAllowed = new Set();
+    if (options.includeToolCalls) {
+        let spent = 0;
+        for (let i = entries.length - 1; i >= 0; i--) {
+            const m = entries[i]?.message ?? entries[i];
+            if (!replaysTools(m))
+                continue;
+            const cost = replayedToolPayloadCost(m);
+            if (cost === 0)
+                continue;
+            if (spent + cost > MAX_REPLAYED_TOOL_PAYLOAD_CHARS)
+                continue;
+            spent += cost;
+            toolPayloadAllowed.add(i);
+        }
+    }
+    for (const [index, entry] of entries.entries()) {
         const m = entry?.message ?? entry;
         if (!m || (m.role !== "user" && m.role !== "assistant"))
             continue;
         const text = threadMessageTextForEngine(m);
+        if (replaysTools(m)) {
+            if (toolPayloadAllowed.has(index)) {
+                const { assistant, results } = assistantReplayContent(m, text);
+                if (assistant.length === 0)
+                    continue;
+                messages.push({ role: "assistant", content: assistant });
+                if (results.length > 0) {
+                    messages.push({ role: "user", content: results });
+                }
+                continue;
+            }
+            // Over budget, or nothing to replay. Prose still travels — but a turn
+            // whose tool detail was dropped must not read like a turn that never
+            // called a tool.
+            const elided = replayableToolCalls(m).length > 0;
+            const prose = elided
+                ? `${text.trim() ? `${text.trim()}\n\n` : ""}${ELIDED_TOOL_DETAIL_NOTE}`
+                : text;
+            if (!prose.trim())
+                continue;
+            messages.push({
+                role: "assistant",
+                content: [{ type: "text", text: prose }],
+            });
+            continue;
+        }
         if (!text.trim())
             continue;
         messages.push({ role: m.role, content: [{ type: "text", text }] });

package/dist/client/agent-chat-adapter.js

@@ -66,6 +66,17 @@ const MAX_HISTORY_ATTACHMENT_CHARS = 60_000;
 // visibly (not silently) capped.
 const MAX_OUTBOUND_ATTACHMENT_CHARS = 200_000;
 const MAX_HISTORY_MESSAGES = 24;
+// Every provider prompt cache matches a byte-identical PREFIX. A window that
+// ends at the newest message and starts MAX_HISTORY_MESSAGES back moves its
+// START by one message per turn, so from the first turn past the cap onward no
+// cached prefix ever matches again and the whole conversation is re-billed at
+// full write price on every turn — the cache breakpoints the engines place
+// (system prefix, last tool, last user message) cannot save a prefix whose
+// first bytes changed. Quantizing where the window starts holds those bytes
+// identical for a stride of turns, so one turn in STRIDE pays the write and the
+// rest read. The window then holds up to MAX + STRIDE - 1 messages; the char
+// budgets below, not the message count, are what bound the payload.
+const HISTORY_WINDOW_STRIDE = 8;
 const MAX_HISTORY_TOTAL_CHARS = 64_000;
 // Budget for everything actually said in the thread — every user ask and every
 // assistant conclusion. Separate from MAX_HISTORY_TOTAL_CHARS, which bounds the
@@ -788,7 +799,8 @@ function estimateHistoryMessageCost(message) {
     return Math.max(1, cost);
 }
 function limitPriorMessagesForRequest(messages) {
-    const recent = messages.slice(-MAX_HISTORY_MESSAGES);
+    const overflow = Math.max(0, messages.length - MAX_HISTORY_MESSAGES);
+    const recent = messages.slice(Math.floor(overflow / HISTORY_WINDOW_STRIDE) * HISTORY_WINDOW_STRIDE);
     const kept = [];
     let words = 0;
     let payload = 0;

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/notifications/routes.d.ts

@@ -28,6 +28,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,23 +41,23 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    ok?: undefined;
     error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
     error?: undefined;
     summary?: undefined;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/secrets/routes.d.ts

@@ -34,16 +34,16 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     ok: boolean;
     status: string;
     error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
     ok: boolean;
     removed: boolean;
@@ -54,9 +54,9 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
     ok: boolean;
     note?: undefined;

package/dist/server/agent-teams.js

@@ -1236,7 +1236,9 @@ export async function processAgentTeamRun(opts) {
             catch {
                 priorThreadData = undefined;
             }
-            messages = threadDataToEngineMessages(priorThreadData);
+            messages = threadDataToEngineMessages(priorThreadData, {
+                includeToolCalls: true,
+            });
             if (messages.length === 0) {
                 messages = [
                     {

package/dist/server/cors-origins.js

@@ -12,6 +12,26 @@ export function isTrustedNativeAppOrigin(origin) {
 export function isLocalhostOrigin(origin) {
     return LOCALHOST_ORIGIN_RE.test(origin);
 }
+/**
+ * Normalize an allowlist entry or an incoming `Origin` header for exact-match
+ * comparison. This does not widen what is admitted — it is still an exact
+ * scheme+host+port match — it only tolerates formatting slop that carries no
+ * security meaning:
+ *  - scheme/host casing (RFC 6454 origins are case-insensitive; an operator
+ *    pasting a domain from a UI that preserves entered case can end up with
+ *    e.g. "HTTPS://App.Example.com")
+ *  - a trailing slash (browsers never send one in `Origin`, but it's an easy
+ *    copy/paste mistake when configuring the allowlist)
+ *  - a bare domain with no scheme (`CORS_ALLOWED_ORIGINS` is operationally a
+ *    "domain allowlist" — operators reasonably enter "app.example.com"
+ *    instead of "https://app.example.com", which then never matches a real
+ *    Origin header and silently locks out that legitimate origin)
+ */
+function normalizeCorsOrigin(value) {
+    const trimmed = value.trim().replace(/\/+$/, "");
+    const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed);
+    return (hasScheme ? trimmed : `https://${trimmed}`).toLowerCase();
+}
 export function getAllowedCorsOrigin(origin, options = {}) {
     if (!origin)
         return null;
@@ -22,7 +42,10 @@ export function getAllowedCorsOrigin(origin, options = {}) {
         return origin;
     const allowedOrigins = options.allowedOrigins ?? readCorsAllowedOrigins();
     if (allowedOrigins.length > 0) {
-        return allowedOrigins.includes(origin) ? origin : null;
+        const normalizedOrigin = normalizeCorsOrigin(origin);
+        return allowedOrigins.some((allowed) => normalizeCorsOrigin(allowed) === normalizedOrigin)
+            ? origin
+            : null;
     }
     if (options.allowAnyOriginWhenNoAllowlist)
         return origin;

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/transcription/builder-transcription.js

@@ -1,4 +1,4 @@
-import { resolveBuilderGatewayAuth, getBuilderProxyOrigin, } from "../server/credential-provider.js";
+import { resolveBuilderGatewayAuth, getBuilderProxyOrigin, recordBuilderGatewayAuthFailure, } from "../server/credential-provider.js";
 function describeError(err) {
     if (!(err instanceof Error))
         return String(err);
@@ -64,6 +64,17 @@ export async function transcribeWithBuilder(opts) {
     }
     if (!res.ok) {
         const text = await res.text().catch(() => "");
+        // The chat path records this so a rejected credential is not retried for
+        // BUILDER_AUTH_FAILURE_TTL_MS; transcription never did, so one bad
+        // credential re-sent the same doomed request on every attempt -- prod
+        // logged 24 identical `Missing Authentication header` 401s in a day off a
+        // single unusable credential, with nothing to stop the next one.
+        if (res.status === 401 || res.status === 403) {
+            await recordBuilderGatewayAuthFailure({
+                status: res.status,
+                message: text,
+            });
+        }
         throw new Error(`Builder transcription failed (${res.status} ${res.statusText}): ${text}`);
     }
     return (await res.json());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.161.14",
+  "version": "0.161.16",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {