@agent-native/core 0.204.0 → 0.204.1-nightly-20261008034100

package/dist/localization/automation-outcome-messages.d.ts

@@ -0,0 +1,22 @@
+import { type BuiltinLocaleCode } from "./shared.js";
+export declare const AUTOMATION_OUTCOME_MESSAGES: Record<BuiltinLocaleCode, {
+    noWork: string;
+    emptyDelivery: string;
+    emailNotSent: string;
+    noOpInstruction: string;
+    noOpReason: string;
+}>;
+export declare function automationOutcomeMessagesForLocale(locale: string): {
+    noWork: string;
+    emptyDelivery: string;
+    emailNotSent: string;
+    noOpInstruction: string;
+    noOpReason: string;
+};
+export declare function automationOutcomeMessagesForUser(userEmail: string | null | undefined): Promise<{
+    noWork: string;
+    emptyDelivery: string;
+    emailNotSent: string;
+    noOpInstruction: string;
+    noOpReason: string;
+}>;

package/dist/localization/automation-outcome-messages.js

@@ -0,0 +1,90 @@
+import { getUserSetting } from "../settings/user-settings.js";
+import { DEFAULT_LOCALE, isLocaleCode, LOCALIZATION_SETTING_KEY, normalizeLocalizationPreference, } from "./shared.js";
+export const AUTOMATION_OUTCOME_MESSAGES = {
+    "en-US": {
+        noOpInstruction: "If nothing needs doing, call automation-no-op with a short reason. Failed tools, sends, or missing credentials are errors, not no-ops.",
+        noOpReason: "A short reason why no action or report was needed (1–500 characters).",
+        emailNotSent: "The email was not sent by a delivery provider.",
+        noWork: "The automation ended without a confirmed action. Configure a delivery destination for read-only reports.",
+        emptyDelivery: "The automation produced no message for its configured delivery destination.",
+    },
+    "es-ES": {
+        noOpInstruction: "Si no hay nada que hacer, llama a automation-no-op con un motivo breve. Las herramientas o los envíos fallidos y las credenciales ausentes son errores, no casos sin trabajo.",
+        noOpReason: "Motivo breve por el que no se necesitaba ninguna acción ni informe (1–500 caracteres).",
+        emailNotSent: "El correo no fue enviado por un proveedor de entrega.",
+        noWork: "La automatización terminó sin una acción confirmada. Configura un destino de entrega para los informes de solo lectura.",
+        emptyDelivery: "La automatización no produjo ningún mensaje para su destino de entrega configurado.",
+    },
+    "fr-FR": {
+        noOpInstruction: "Si rien n’est à faire, appelez automation-no-op avec une courte raison. Les échecs d’outils ou d’envoi et les identifiants manquants sont des erreurs, pas une absence de travail.",
+        noOpReason: "Courte raison pour laquelle aucune action ni aucun rapport n’était nécessaire (1–500 caractères).",
+        emailNotSent: "L’e-mail n’a pas été envoyé par un fournisseur de messagerie.",
+        noWork: "L’automatisation s’est terminée sans action confirmée. Configurez une destination de livraison pour les rapports en lecture seule.",
+        emptyDelivery: "L’automatisation n’a produit aucun message pour sa destination de livraison configurée.",
+    },
+    "de-DE": {
+        noOpInstruction: "Wenn nichts zu tun ist, rufen Sie automation-no-op mit einer kurzen Begründung auf. Fehlgeschlagene Tools oder Zustellungen und fehlende Zugangsdaten sind Fehler, keine Fälle ohne Handlungsbedarf.",
+        noOpReason: "Kurze Begründung, warum keine Aktion oder kein Bericht nötig war (1–500 Zeichen).",
+        emailNotSent: "Die E-Mail wurde von keinem Zustellanbieter versendet.",
+        noWork: "Die Automatisierung endete ohne bestätigte Aktion. Konfigurieren Sie ein Zustellungsziel für schreibgeschützte Berichte.",
+        emptyDelivery: "Die Automatisierung hat keine Nachricht für ihr konfiguriertes Zustellungsziel erzeugt.",
+    },
+    "pt-BR": {
+        noOpInstruction: "Se não houver nada a fazer, chame automation-no-op com um motivo breve. Falhas de ferramentas ou envios e credenciais ausentes são erros, não ausência de trabalho.",
+        noOpReason: "Motivo breve pelo qual nenhuma ação ou relatório era necessário (1–500 caracteres).",
+        emailNotSent: "O e-mail não foi enviado por um provedor de entrega.",
+        noWork: "A automação terminou sem uma ação confirmada. Configure um destino de entrega para relatórios somente de leitura.",
+        emptyDelivery: "A automação não produziu nenhuma mensagem para seu destino de entrega configurado.",
+    },
+    "zh-CN": {
+        noOpInstruction: "如果没有需要执行的工作，请调用 automation-no-op 并提供简短原因。工具失败、发送失败或缺少凭据属于错误，不是无需操作。",
+        noOpReason: "简要说明为何无需执行操作或发送报告（1–500 个字符）。",
+        emailNotSent: "电子邮件未通过邮件服务提供商发送。",
+        noWork: "自动化结束时没有已确认的操作。请为只读报告配置发送目标。",
+        emptyDelivery: "自动化未生成要发送到已配置目标的消息。",
+    },
+    "zh-TW": {
+        noOpInstruction: "如果沒有需要執行的工作，請呼叫 automation-no-op 並提供簡短原因。工具失敗、傳送失敗或缺少憑證屬於錯誤，不是無需操作。",
+        noOpReason: "簡要說明為何無需執行操作或傳送報告（1–500 個字元）。",
+        emailNotSent: "電子郵件未透過郵件服務供應商傳送。",
+        noWork: "自動化結束時沒有已確認的操作。請為唯讀報告設定傳送目標。",
+        emptyDelivery: "自動化未產生要傳送到已設定目標的訊息。",
+    },
+    "ja-JP": {
+        noOpInstruction: "対応が不要な場合は、短い理由を添えて automation-no-op を呼び出してください。ツールや送信の失敗、認証情報の不足はエラーであり、対応不要には該当しません。",
+        noOpReason: "操作やレポートが不要だった短い理由（1～500文字）。",
+        emailNotSent: "メールは配信プロバイダーから送信されませんでした。",
+        noWork: "自動化は操作が確認されないまま終了しました。読み取り専用のレポートには配信先を設定してください。",
+        emptyDelivery: "自動化は設定された配信先へのメッセージを生成しませんでした。",
+    },
+    "ko-KR": {
+        noOpInstruction: "할 일이 없으면 짧은 이유와 함께 automation-no-op을 호출하세요. 도구 또는 전송 실패와 자격 증명 누락은 작업 없음이 아닌 오류입니다.",
+        noOpReason: "작업이나 보고서가 필요하지 않았던 짧은 이유(1–500자).",
+        emailNotSent: "이메일이 전송 제공업체를 통해 전송되지 않았습니다.",
+        noWork: "확인된 작업 없이 자동화가 종료되었습니다. 읽기 전용 보고서에는 전송 대상을 설정하세요.",
+        emptyDelivery: "자동화가 설정된 전송 대상에 보낼 메시지를 생성하지 않았습니다.",
+    },
+    "hi-IN": {
+        noOpInstruction: "यदि कुछ करने की आवश्यकता नहीं है, तो संक्षिप्त कारण के साथ automation-no-op कॉल करें। विफल टूल, विफल भेजने की कोशिश या अनुपलब्ध क्रेडेंशियल त्रुटियाँ हैं, काम न होने की स्थिति नहीं।",
+        noOpReason: "किसी कार्रवाई या रिपोर्ट की आवश्यकता न होने का संक्षिप्त कारण (1–500 अक्षर)।",
+        emailNotSent: "ईमेल किसी डिलीवरी प्रदाता द्वारा नहीं भेजा गया।",
+        noWork: "ऑटोमेशन किसी पुष्ट कार्रवाई के बिना समाप्त हो गया। केवल पढ़ने वाली रिपोर्ट के लिए डिलीवरी गंतव्य कॉन्फ़िगर करें।",
+        emptyDelivery: "ऑटोमेशन ने अपने कॉन्फ़िगर किए गए डिलीवरी गंतव्य के लिए कोई संदेश नहीं बनाया।",
+    },
+    "ar-SA": {
+        noOpInstruction: "إذا لم يكن هناك ما يجب فعله، استدعِ automation-no-op مع سبب موجز. فشل الأدوات أو الإرسال أو غياب بيانات الاعتماد أخطاء، وليس حالات لا تتطلب عملاً.",
+        noOpReason: "سبب موجز لعدم الحاجة إلى إجراء أو تقرير (1–500 حرف).",
+        emailNotSent: "لم تُرسل رسالة البريد الإلكتروني عبر مزوّد تسليم.",
+        noWork: "انتهت الأتمتة دون إجراء مؤكد. اضبط وجهة تسليم للتقارير المخصصة للقراءة فقط.",
+        emptyDelivery: "لم تنتج الأتمتة أي رسالة لوجهة التسليم المحددة.",
+    },
+};
+export function automationOutcomeMessagesForLocale(locale) {
+    return AUTOMATION_OUTCOME_MESSAGES[isLocaleCode(locale) ? locale : DEFAULT_LOCALE];
+}
+export async function automationOutcomeMessagesForUser(userEmail) {
+    const preference = normalizeLocalizationPreference(userEmail
+        ? await getUserSetting(userEmail, LOCALIZATION_SETTING_KEY)
+        : undefined);
+    return automationOutcomeMessagesForLocale(preference.locale);
+}

package/dist/localization/default-messages.d.ts

@@ -1018,9 +1018,11 @@ declare const messages: {
         scheduleUnavailableLocalTitle: string;
         scheduleUnavailableDisabled: string;
         scheduleUnavailableNoScheduler: string;
+        scheduleUnavailableMissingSecret: string;
         scheduleUnavailableLocal: string;
         scheduleUnavailableDisabledFix: string;
         scheduleUnavailableLocalFix: string;
+        scheduleUnavailableMissingSecretFix: string;
         scheduleUnavailableFixLabel: string;
         scheduleUnavailableFixLabelOpen: string;
     };

package/dist/localization/default-messages.js

@@ -940,11 +940,13 @@ const messages = {
         scheduleUnknownDetail: "The scheduler status check failed, so the next run times below are unconfirmed. Reload to check again.",
         scheduleUnavailableTitle: "Schedules won't run in this deploy",
         scheduleUnavailableLocalTitle: "Schedules don't run in local development",
-        scheduleUnavailableDisabled: "This app was built with recurring jobs turned off, so no scheduled automation will fire. Event- and webhook-triggered automations and Run now still work.",
-        scheduleUnavailableNoScheduler: "This hosting target has no durable scheduler, so no scheduled automation will fire. Event- and webhook-triggered automations and Run now still work.",
+        scheduleUnavailableDisabled: "This app was built with recurring jobs turned off, so no scheduled automation will fire. Webhook-triggered automations and Run now still work.",
+        scheduleUnavailableNoScheduler: "This deploy has no scheduler, so scheduled automations won't fire, event-triggered automations stay queued, and crashed runs aren't recovered. Webhook-triggered automations and Run now still work.",
+        scheduleUnavailableMissingSecret: "This deploy has a scheduler, but {{secret}} isn't set, so every scheduler request is rejected. Scheduled automations won't fire, event-triggered automations stay queued, and crashed runs aren't recovered. Webhook-triggered automations and Run now still work.",
         scheduleUnavailableLocal: "Schedules stay off on a dev machine unless you opt in. Event- and webhook-triggered automations and Run now still work.",
         scheduleUnavailableDisabledFix: "To enable recurring jobs, set AGENT_NATIVE_DISABLE_RECURRING_JOBS=false in the build environment.",
         scheduleUnavailableLocalFix: "Set AGENT_NATIVE_ENABLE_LOCAL_RECURRING_JOBS=true to run schedules on this machine.",
+        scheduleUnavailableMissingSecretFix: "Set {{secret}} in this deployment's environment variables, then redeploy.",
         scheduleUnavailableFixLabel: "Show more",
         scheduleUnavailableFixLabelOpen: "Show less",
     },

package/dist/notifications/routes.d.ts

@@ -16,6 +16,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/observability/metrics.d.ts

@@ -45,6 +45,9 @@ export interface AgentToolCallMetric {
 }
 /** App-defined tool names collapse to `other` so they cannot mint series. */
 export declare function recordAgentToolCall(call: AgentToolCallMetric): void;
+export type TraceWriteStage = "spans" | "summary" | "thread_org" | "write";
+/** Counted once per failed stage of a run, never per span. */
+export declare function recordTraceWriteFailure(stage: TraceWriteStage, error: unknown): void;
 /**
  * Export buffered telemetry before a serverless function can freeze. Never
  * delays a request by more than OBSERVABILITY_FLUSH_TIMEOUT_MS; each provider

package/dist/observability/metrics.js

@@ -72,6 +72,9 @@ function instruments() {
         flushFailures: meter.createCounter("agent_native.telemetry.flush_failures", {
             description: "Telemetry flushes that timed out or failed; their points were dropped.",
         }),
+        traceWriteFailures: meter.createCounter("agent_native.observability.trace_write_failures", {
+            description: "Runs whose trace spans or summary could not be persisted; their trace is incomplete or missing.",
+        }),
     };
     return cachedInstruments;
 }
@@ -154,6 +157,13 @@ export function recordAgentToolCall(call) {
         ...(call.errorType ? { "error.type": call.errorType } : {}),
     });
 }
+/** Counted once per failed stage of a run, never per span. */
+export function recordTraceWriteFailure(stage, error) {
+    instruments()?.traceWriteFailures.add(1, {
+        "agent_native.observability.stage": stage,
+        "error.type": flushErrorType(error),
+    });
+}
 function flushErrorType(error) {
     return error instanceof Error && error.name ? error.name : "unknown";
 }

package/dist/observability/migrations.js

@@ -54,4 +54,26 @@ export const OBSERVABILITY_MIGRATIONS = [
           AND summary.org_id IS NOT NULL;
     `,
     },
+    {
+        version: 3,
+        name: "observability-org-scope-legacy-threads",
+        // A thread created without a request org kept org_id NULL, so every review
+        // join (thread.org_id = trace org) hid it. Adopt the org only when all of
+        // the owner's runs on the thread name the same one.
+        sql: `
+      UPDATE chat_threads AS thread
+        SET org_id = trace_org.org_id
+        FROM (
+          SELECT thread_id, LOWER(user_id) AS owner_key, MIN(org_id) AS org_id
+          FROM agent_trace_summaries
+          WHERE thread_id IS NOT NULL AND user_id IS NOT NULL
+            AND org_id IS NOT NULL
+          GROUP BY thread_id, LOWER(user_id)
+          HAVING COUNT(DISTINCT org_id) = 1
+        ) AS trace_org
+        WHERE thread.org_id IS NULL
+          AND thread.id = trace_org.thread_id
+          AND LOWER(thread.owner_email) = trace_org.owner_key;
+    `,
+    },
 ];

package/dist/observability/routes.d.ts

@@ -27,38 +27,43 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    ok?: undefined;
     error: string;
     message: string;
     summary?: undefined;
     spans?: undefined;
-    id?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
+    ok?: undefined;
     message?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
-    id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
+    traceMissing: true;
     id: string;
+} | {
     error?: undefined;
     ok?: undefined;
+    message?: undefined;
+    summary?: undefined;
+    spans?: undefined;
+    traceMissing?: undefined;
+    id: string;
 } | {
+    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
-    id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
-    id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/observability/routes.js

@@ -1,6 +1,8 @@
 import { defineEventHandler, getHeader, getMethod, getQuery, setResponseHeader, setResponseStatus, } from "h3";
 import { isActionContractError } from "../action.js";
+import { resolveThreadAccess } from "../chat-threads/store.js";
 import { getOrgContext } from "../org/context.js";
+import { isOrgMember } from "../org/membership.js";
 import { getSession } from "../server/auth.js";
 import { readBody } from "../server/h3-helpers.js";
 import { getRequestContext } from "../server/request-context.js";
@@ -15,6 +17,16 @@ const FEEDBACK_TYPES = [
     "category",
     "text",
 ];
+const MAX_FEEDBACK_VALUE_CHARS = 20_000;
+const MAX_ID_CHARS = 200;
+// An id past the bound is recorded truncated but never looked up: no real id is
+// that long, and its prefix can name a different row.
+function idClaim(value) {
+    if (!value)
+        return null;
+    const id = String(value);
+    return { id: id.slice(0, MAX_ID_CHARS), overlong: id.length > MAX_ID_CHARS };
+}
 function isFeedbackType(value) {
     return (typeof value === "string" &&
         FEEDBACK_TYPES.includes(value));
@@ -174,33 +186,90 @@ export function createObservabilityHandler() {
                 return { error: "feedbackType is required" };
             }
             const rawValue = body.value;
-            const value = rawValue == null
+            let value = rawValue == null
                 ? ""
                 : typeof rawValue === "object"
                     ? JSON.stringify(rawValue)
                     : String(rawValue);
+            if (value.length > MAX_FEEDBACK_VALUE_CHARS) {
+                setResponseStatus(event, 413);
+                return { error: "Feedback value is too large" };
+            }
             const id = nanoid();
             const idempotencyKey = feedbackType === "text"
                 ? getHeader(event, "idempotency-key")?.trim() || null
                 : null;
             const org = await getOrgContext(event);
-            const runId = body.runId ? String(body.runId) : null;
-            let threadId = body.threadId ? String(body.threadId) : null;
+            const runClaim = idClaim(body.runId);
+            const threadClaim = idClaim(body.threadId);
+            let runId = runClaim?.id ?? null;
+            let threadId = threadClaim?.id ?? null;
             let model;
             let orgId = org.orgId;
-            if (runId) {
-                const summary = await getTraceSummary(runId, {
-                    userId: owner,
-                    ...(org.orgId ? { orgId: org.orgId } : {}),
-                });
-                if (!summary || (threadId && threadId !== summary.threadId)) {
+            let unverifiedRunId;
+            let unverifiedThreadId;
+            // A thread id is the caller's claim until one of their own runs vouches
+            // for it or they are shown to have access to the thread.
+            let threadVouched = false;
+            if (runId && runClaim?.overlong) {
+                unverifiedRunId = runId;
+                runId = null;
+            }
+            else if (runId) {
+                // Ownership is the user, not the org: a run recorded with no org, or
+                // under another of the caller's orgs, is still the caller's own.
+                const summary = await getTraceSummary(runId, { userId: owner });
+                // Trace writes are fire-and-forget, so a vote can arrive for a run
+                // that was never persisted. That is a missing trace, not a run that
+                // belongs to someone else: the latter still answers 404.
+                const traceMissing = !summary && !(await getTraceSummary(runId));
+                if (traceMissing) {
+                    unverifiedRunId = runId;
+                    runId = null;
+                }
+                else if (!summary ||
+                    (threadId && (threadClaim?.overlong || threadId !== summary.threadId))) {
                     setResponseStatus(event, 404);
                     return { error: "Trace not found" };
                 }
-                threadId = summary.threadId;
-                model = summary.model || undefined;
-                orgId = summary.orgId ?? org.orgId;
+                else {
+                    threadId = summary.threadId;
+                    threadVouched = true;
+                    model = summary.model || undefined;
+                    // The run is the caller's, but it may be recorded under an org they
+                    // have since left; that org's review data is not theirs to write to.
+                    if (summary.orgId && summary.orgId !== org.orgId) {
+                        orgId = (await isOrgMember(summary.orgId, owner))
+                            ? summary.orgId
+                            : null;
+                    }
+                }
+            }
+            if (threadId &&
+                !threadVouched &&
+                (threadClaim?.overlong ||
+                    !(await resolveThreadAccess(owner, threadId, "viewer", {
+                        orgId: org.orgId ?? undefined,
+                    })))) {
+                // The thread may live in another app (a workspace chat rail posts
+                // votes to the host for a remote app's thread), so an unverifiable id
+                // is not an error. A missing and an inaccessible thread must answer
+                // alike, or the route reveals which thread ids exist.
+                unverifiedThreadId = threadId;
+                threadId = null;
+            }
+            const traceMissing = !!(unverifiedRunId || unverifiedThreadId);
+            if (traceMissing && rawValue && typeof rawValue === "object") {
+                value = JSON.stringify({
+                    ...rawValue,
+                    traceMissing: true,
+                    ...(unverifiedRunId ? { unverifiedRunId } : {}),
+                    ...(unverifiedThreadId ? { unverifiedThreadId } : {}),
+                });
             }
+            const traceMissingResult = traceMissing
+                ? { traceMissing: true }
+                : {};
             const inserted = await insertFeedback({
                 id,
                 runId,
@@ -215,7 +284,7 @@ export function createObservabilityHandler() {
                 createdAt: Date.now(),
             });
             if (!inserted)
-                return { id };
+                return { id, ...traceMissingResult };
             {
                 const isThumb = feedbackType === "thumbs_up" || feedbackType === "thumbs_down";
                 track("$ai_feedback", {
@@ -230,6 +299,11 @@ export function createObservabilityHandler() {
                     run_id: runId,
                     thread_id: threadId,
                     model,
+                    ...(traceMissing ? { trace_missing: true } : {}),
+                    ...(unverifiedRunId ? { unverified_run_id: unverifiedRunId } : {}),
+                    ...(unverifiedThreadId
+                        ? { unverified_thread_id: unverifiedThreadId }
+                        : {}),
                     $ai_trace_id: runId ?? undefined,
                     $ai_session_id: threadId ?? undefined,
                     $ai_model: model,
@@ -255,7 +329,7 @@ export function createObservabilityHandler() {
                 }).catch(() => { }))
                     .catch(() => { });
             }
-            return { id };
+            return { id, ...traceMissingResult };
         }
         if (method === "GET" && parts.length === 1 && parts[0] === "feedback") {
             setResponseHeader(event, "Cache-Control", "private, no-store");

package/dist/observability/sentiment.d.ts

@@ -15,8 +15,13 @@ export declare function shouldInferSentimentForTurn(args: {
     hasUserText: boolean;
 }): boolean;
 export declare function parseInferredSentiment(output: string): InferredSentiment | null;
+export declare const INFERRED_SENTIMENT_FAILURE_REASONS: readonly ["engine_unavailable", "timeout", "parse_failed", "empty"];
+export type InferredSentimentFailureReason = (typeof INFERRED_SENTIMENT_FAILURE_REASONS)[number];
 export declare function inferAndTrackSentiment(args: {
+    /** Explicit engine override; wins over `runEngine`. */
     engine?: AgentEngine;
+    /** The engine that served the run being classified. */
+    runEngine?: AgentEngine;
     classifierModel: string;
     precedingResponseModel: string;
     text: string;

package/dist/observability/sentiment.js

@@ -99,19 +99,35 @@ function truncateInput(text) {
         .slice(0, INFERRED_SENTIMENT_MAX_CHARS)
         .join("");
 }
+export const INFERRED_SENTIMENT_FAILURE_REASONS = [
+    "engine_unavailable",
+    "timeout",
+    "parse_failed",
+    "empty",
+];
+function engineCanRun(engine, model) {
+    return (engine.preserveCustomModels === true ||
+        engine.supportedModels.length === 0 ||
+        engine.supportedModels.includes(model));
+}
 async function classifySentiment(args) {
-    if (!args.engine.preserveCustomModels &&
-        args.engine.supportedModels.length > 0 &&
-        !args.engine.supportedModels.includes(args.model)) {
-        return null;
+    if (!engineCanRun(args.engine, args.model)) {
+        return { failure: "engine_unavailable" };
     }
     const input = truncateInput(args.text);
     if (!input)
-        return null;
+        return { failure: "empty" };
     const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), INFERRED_SENTIMENT_TIMEOUT_MS);
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+    }, INFERRED_SENTIMENT_TIMEOUT_MS);
     let output = "";
     let finalOutput = "";
+    const interrupted = () => ({
+        failure: timedOut ? "timeout" : "engine_unavailable",
+    });
     try {
         for await (const event of args.engine.stream({
             model: args.model,
@@ -133,51 +149,85 @@ async function classifySentiment(args) {
                     .join("");
             }
             if (typedEvent.type === "stop" && typedEvent.reason === "error") {
-                return null;
+                return interrupted();
             }
         }
-        return parseInferredSentiment(finalOutput || output);
     }
     catch {
-        return null;
+        return interrupted();
     }
     finally {
         clearTimeout(timeout);
     }
+    // An aborted stream can end quietly; its partial text is not a verdict.
+    if (timedOut)
+        return { failure: "timeout" };
+    const verdict = (finalOutput || output).trim();
+    if (!verdict)
+        return { failure: "empty" };
+    const sentiment = parseInferredSentiment(verdict);
+    return sentiment ? { sentiment } : { failure: "parse_failed" };
+}
+/**
+ * The run's own engine when it can serve the classifier model, so a Builder run
+ * classifies with the credentials it already holds. Otherwise the hosted
+ * Builder engine; `null` when that cannot even be constructed.
+ */
+async function resolveClassifierEngine(args) {
+    if (args.engine)
+        return args.engine;
+    if (args.runEngine && engineCanRun(args.runEngine, args.classifierModel)) {
+        return args.runEngine;
+    }
+    try {
+        return (await import("../agent/engine/builder-engine.js")).createBuilderEngine();
+        // coercion-ok: the caller reports a null engine as `engine_unavailable`.
+    }
+    catch {
+        return null;
+    }
 }
 export async function inferAndTrackSentiment(args) {
     try {
         if (!shouldSampleInferredSentiment(args.classificationTriggerRunId, args.sampleRate)) {
             return;
         }
-        const engine = args.engine ??
-            (await import("../agent/engine/builder-engine.js")).createBuilderEngine();
-        const sentiment = await classifySentiment({
-            engine,
-            model: args.classifierModel,
-            text: args.text,
-        });
-        if (!sentiment)
-            return;
+        const engine = await resolveClassifierEngine(args);
+        const result = engine
+            ? await classifySentiment({
+                engine,
+                model: args.classifierModel,
+                text: args.text,
+            })
+            : { failure: "engine_unavailable" };
         const { track } = await import("../tracking/registry.js");
-        track("$ai_sentiment", {
+        const shared = {
             ...trackingIdentityProperties(),
             source: "agent_observability",
             method: "llm",
-            sentiment,
             model: args.precedingResponseModel,
             classifier_model: args.classifierModel,
-            classifier_engine: engine.name,
-            attribution: "user_reaction_to_preceding_model",
+            classifier_engine: engine?.name,
             run_id: args.precedingRunId,
             classification_trigger_run_id: args.classificationTriggerRunId,
             thread_id: args.threadId,
             $ai_model: args.precedingResponseModel,
             $ai_trace_id: args.precedingRunId,
             $ai_session_id: args.threadId ?? undefined,
-        }, { userId: args.userId ?? undefined });
+        };
+        // A classifier that fails must show up as a count, never as a quiet drop
+        // in `$ai_sentiment`; the reason is coarse and carries no message content.
+        track("failure" in result ? "$ai_sentiment_failed" : "$ai_sentiment", "failure" in result
+            ? { ...shared, reason: result.failure }
+            : {
+                ...shared,
+                sentiment: result.sentiment,
+                attribution: "user_reaction_to_preceding_model",
+            }, { userId: args.userId ?? undefined });
     }
-    catch {
-        // Inference and analytics are both optional and must never affect chat.
+    catch (error) {
+        // Optional inference must never affect chat, but an unexpected failure
+        // outside the classifier must not vanish either.
+        console.warn("[agent-native] observability: sentiment inference failed", error instanceof Error ? error.message : String(error));
     }
 }

package/dist/observability/store.d.ts

@@ -48,6 +48,34 @@ export declare function getTraceSummary(runId: string, opts?: {
     userId?: string;
     orgId?: string;
 }): Promise<TraceSummary | null>;
+/**
+ * A thread created on a path with no request org keeps `org_id` NULL, and every
+ * review read requires `thread.org_id` to equal the trace's org, so its runs
+ * never reach Human Review. The run that executed under an org is the proof of
+ * which org the thread belongs to: adopt it, for the thread's own owner only
+ * and only while `org_id` is NULL.
+ *
+ * A private thread's `org_id` grants nothing but that review access (owner
+ * access ignores it, shares do not read it, and `visibility = 'org'` is the only
+ * way it scopes sharing), while `thread_data` holds every run's conversation. So
+ * a private thread whose owner's runs span more than one org belongs to none of
+ * them: the second statement unassigns it. Org-visible threads keep their
+ * `org_id`, which is an explicit sharing scope.
+ *
+ * Both statements run after this run's own summary is committed
+ * (`upsertTraceSummary` is awaited first), so of two concurrent runs under
+ * different orgs the one whose statements run later always sees the other's
+ * committed org. If this run's adopt raced ahead of the other run's summary, the
+ * other run's unassign undoes it, or, when that ran before this adopt
+ * committed, this run's own unassign does, since it starts after the adopt.
+ * No lock is needed.
+ *
+ * The multi-org signal is derived from `agent_trace_summaries`, so it is only
+ * as durable as those rows: retention purges them, and a run that never wrote a
+ * summary is invisible to it. A thread unassigned for spanning orgs can
+ * therefore be re-adopted once the other org's summaries age out.
+ */
+export declare function adoptTraceOrgForThread(summary: Pick<TraceSummary, "threadId" | "userId" | "orgId">): Promise<void>;
 export declare function getOrgScopedThreadData(orgId: string, ownerEmail: string, threadIds: readonly string[]): Promise<Map<string, string | null>>;
 export declare function getOrgScopedThreadTitles(orgId: string, ownerEmail: string, threadIds: readonly string[]): Promise<Map<string, string>>;
 export declare function getOrgScopedReviewThreads(requested: readonly (ObservabilityReviewThreadScope & {