@agent-native/core 0.204.1-nightly-20261008153353 → 0.205.0

package/dist/a2a/caller-auth.d.ts

@@ -11,4 +11,5 @@ export declare function resolveA2ACallerAuth(options?: {
     expiresIn?: string | number;
     includeGoogleToken?: boolean;
     audience?: string | string[];
+    userIdentityOnly?: boolean;
 }): Promise<A2ACallerAuth>;

package/dist/a2a/caller-auth.js

@@ -26,14 +26,20 @@ export async function resolveA2ACallerAuth(options) {
     if (userEmail &&
         options?.audience &&
         globalSecret &&
-        (!orgId || orgDomain?.trim())) {
-        addApiKeyAttempt(await signA2AToken(userEmail, orgDomain, undefined, {
+        (options?.userIdentityOnly || !orgId || orgDomain?.trim())) {
+        addApiKeyAttempt(await signA2AToken(userEmail, options?.userIdentityOnly ? undefined : orgDomain, undefined, {
             expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
             preferGlobalSecret: true,
             audience: options?.audience,
+            ...(options?.userIdentityOnly && orgId
+                ? { extraClaims: { org_id: orgId } }
+                : {}),
         }));
     }
-    if (orgDomain && options?.audience && (orgSecret || globalSecret)) {
+    if (!options?.userIdentityOnly &&
+        orgDomain &&
+        options?.audience &&
+        (orgSecret || globalSecret)) {
         addApiKeyAttempt(await signA2AOrganizationToken(orgDomain, orgSecret, undefined, {
             expiresIn: options?.expiresIn ?? DEFAULT_A2A_CALLER_TOKEN_TTL,
             audience: options?.audience,

package/dist/a2a/client.d.ts

@@ -135,6 +135,7 @@ export declare class A2AClient {
     private postJson;
     private transportHeadersFor;
 }
+export declare function assertCredentialedA2AUrl(url: string, credentialed: boolean): void;
 export declare function callAgent(url: string, text: string, opts?: {
     apiKey?: string;
     apiKeyFallbacks?: string[];

package/dist/a2a/client.js

@@ -842,7 +842,7 @@ function hasA2ACredentials(apiKeys, headers) {
     }
     return Object.keys(headers ?? {}).some((name) => /^(authorization|api[-_]key|x-api[-_]key|x-api[-_]token)$/i.test(name));
 }
-function assertCredentialedA2AUrl(url, credentialed) {
+export function assertCredentialedA2AUrl(url, credentialed) {
     if (!credentialed)
         return;
     let parsed;

package/dist/a2a/index.d.ts

@@ -2,8 +2,9 @@ export { mountA2A, verifyA2AToken } from "./server.js";
 export type { A2ATokenPayload } from "./server.js";
 export { generateAgentCard } from "./agent-card.js";
 export { A2A_AGENT_ACTIVITY_KIND, A2A_AGENT_ACTIVITY_VERSION, MAX_A2A_ACTIVITY_REASONING_CHARS, MAX_A2A_ACTIVITY_REASONING_SEGMENTS, MAX_A2A_ACTIVITY_RESPONSE_CHARS, MAX_A2A_ACTIVITY_TOOL_CALLS, MAX_A2A_ACTIVITY_TOTAL_CHARS, MAX_A2A_ACTIVITY_TOOL_ID_CHARS, MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS, MAX_A2A_ACTIVITY_TOOL_NAME_CHARS, MAX_A2A_ACTIVITY_TOOL_PAYLOAD_CHARS, MAX_A2A_ACTIVITY_TOOL_RESULT_CHARS, applyA2AAgentActivityEvent, buildA2AAgentActivityPart, buildA2AAgentActivitySnapshot, createA2AAgentActivityState, parseA2AAgentActivityPart, } from "./activity.js";
-export { A2AClient, A2AJsonRpcResponseError, A2AMissingJsonRpcResponseError, A2ANoJsonRpcInterfaceError, A2AProtocolError, callAction, callAgent, clearA2ACardCache, getGlobalA2ASecret, signA2AOrganizationToken, signA2AToken, } from "./client.js";
+export { A2AClient, A2AJsonRpcResponseError, A2AMissingJsonRpcResponseError, A2ANoJsonRpcInterfaceError, A2AProtocolError, assertCredentialedA2AUrl, callAction, callAgent, clearA2ACardCache, getGlobalA2ASecret, signA2AOrganizationToken, signA2AToken, } from "./client.js";
 export type { A2AProtocolErrorCode } from "./client.js";
+export { workspacePrivateOrigins } from "./workspace-private-origins.js";
 export { clearRemoteAgentTokenCache, RemoteAgentAuthError, RemoteAgentCredentialRejectedError, resolveRemoteAgentToken, } from "./remote-agent-auth.js";
 export type { RemoteAgentAuthErrorCode, RemoteAgentCredentialContext, } from "./remote-agent-auth.js";
 export { canonicalA2AAudience } from "./audience.js";

package/dist/a2a/index.js

@@ -1,7 +1,8 @@
 export { mountA2A, verifyA2AToken } from "./server.js";
 export { generateAgentCard } from "./agent-card.js";
 export { A2A_AGENT_ACTIVITY_KIND, A2A_AGENT_ACTIVITY_VERSION, MAX_A2A_ACTIVITY_REASONING_CHARS, MAX_A2A_ACTIVITY_REASONING_SEGMENTS, MAX_A2A_ACTIVITY_RESPONSE_CHARS, MAX_A2A_ACTIVITY_TOOL_CALLS, MAX_A2A_ACTIVITY_TOTAL_CHARS, MAX_A2A_ACTIVITY_TOOL_ID_CHARS, MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS, MAX_A2A_ACTIVITY_TOOL_NAME_CHARS, MAX_A2A_ACTIVITY_TOOL_PAYLOAD_CHARS, MAX_A2A_ACTIVITY_TOOL_RESULT_CHARS, applyA2AAgentActivityEvent, buildA2AAgentActivityPart, buildA2AAgentActivitySnapshot, createA2AAgentActivityState, parseA2AAgentActivityPart, } from "./activity.js";
-export { A2AClient, A2AJsonRpcResponseError, A2AMissingJsonRpcResponseError, A2ANoJsonRpcInterfaceError, A2AProtocolError, callAction, callAgent, clearA2ACardCache, getGlobalA2ASecret, signA2AOrganizationToken, signA2AToken, } from "./client.js";
+export { A2AClient, A2AJsonRpcResponseError, A2AMissingJsonRpcResponseError, A2ANoJsonRpcInterfaceError, A2AProtocolError, assertCredentialedA2AUrl, callAction, callAgent, clearA2ACardCache, getGlobalA2ASecret, signA2AOrganizationToken, signA2AToken, } from "./client.js";
+export { workspacePrivateOrigins } from "./workspace-private-origins.js";
 export { clearRemoteAgentTokenCache, RemoteAgentAuthError, RemoteAgentCredentialRejectedError, resolveRemoteAgentToken, } from "./remote-agent-auth.js";
 export { canonicalA2AAudience } from "./audience.js";
 export { resolveA2ACallerAuth } from "./caller-auth.js";

package/dist/agent/engine/ai-sdk-engine.js

@@ -8,6 +8,7 @@ import { classifyProviderError, describeErrorWithCauses, } from "./error-detail.
 import { createFirstEventAbortController } from "./first-event-timeout.js";
 import { limitProviderTools } from "./limit-provider-tools.js";
 import { isCustomOpenAiBaseUrl } from "./openai-compatible-endpoint.js";
+import { createOpenRouterToolFetch } from "./openrouter-tool-fetch.js";
 import { clampThinkingBudgetTokens, resolveMaxOutputTokensForEngine, } from "./output-tokens.js";
 import { createProviderToolNameMap } from "./tool-name.js";
 import { engineToolsToAISDK, engineMessagesToAISDK, aiSdkPartToEngineEvents, aiSdkStepToAssistantContent, } from "./translate-ai-sdk.js";
@@ -279,15 +280,8 @@ class AISDKEngine {
         }
         const toolNameMap = createProviderToolNameMap(opts.tools, opts.messages);
         const providerTools = limitProviderTools(opts.tools);
-        // The Responses API treats an omitted `strict` as strict mode and rewrites
-        // every optional parameter as required, so the model must invent a value
-        // ("" or a guessed id) for each one. Action schemas use omission to mean
-        // "not this mode", so those fillers turn a valid call into a mixed one
-        // that validation rejects on every retry.
-        const usesResponsesApi = this.provider === "openai" &&
-            (this.forceResponses || !isCustomOpenAiBaseUrl(this.baseUrl));
         const aiSdkTools = providerTools.length > 0
-            ? engineToolsToAISDK(providerTools, jsonSchema, toolNameMap, usesResponsesApi ? false : undefined)
+            ? engineToolsToAISDK(providerTools, jsonSchema, toolNameMap)
             : undefined;
         const messages = engineMessagesToAISDK(opts.messages, {
             toolResultImages: this.capabilities.vision,
@@ -510,6 +504,7 @@ class AISDKEngine {
         if (this.requestFetch)
             config.fetch = this.requestFetch;
         if (this.provider === "openrouter") {
+            config.fetch = createOpenRouterToolFetch(this.requestFetch);
             if (this.appName)
                 config.appName = this.appName;
             if (this.appUrl)

package/dist/agent/engine/builder-engine.d.ts

@@ -1,7 +1,7 @@
 import { type BuilderGatewayLane } from "../../server/credential-provider.js";
 import type { AgentEngine, EngineCapabilities } from "./types.js";
 export declare const BUILDER_CAPABILITIES: EngineCapabilities;
-export declare const BUILDER_SUPPORTED_MODELS: readonly ["auto", "claude-haiku-4-5", "claude-sonnet-5", "claude-opus-5-5", "gpt-5-4", "gpt-5-5", "gpt-5-4-mini", "gpt-5-1-codex-mini", "gpt-6.1-sol", "gpt-5-6-terra", "gpt-6-luna", "gemini-3-1-pro", "gemini-3-8-flash", "gemini-3-5-flash-lite", "gemini-3-1-flash-lite", "qwen3-coder", "kimi-k2-5", "deepseek-v3-1", "z-ai-glm-4-5", "z-ai-glm-5-1"];
+export declare const BUILDER_SUPPORTED_MODELS: readonly ["auto", "claude-haiku-4-5", "claude-sonnet-5", "claude-opus-5-5", "gpt-5-4", "gpt-5-5", "gpt-5-4-mini", "gpt-5-1-codex-mini", "gpt-6.1-sol", "gpt-5-6-terra", "gpt-6-luna", "gemini-3-1-pro", "gemini-3-8-flash", "gemini-3-5-flash-lite", "gemini-3-1-flash-lite", "qwen3-coder", "kimi-k2-5", "deepseek-v3-1", "deepseek-v4-1-flash", "z-ai-glm-4-5", "z-ai-glm-5-1", "z-ai-glm-5-3-flash"];
 export declare const BUILDER_MODEL_UNAUTHORIZED_ERROR_CODE = "builder_model_unauthorized";
 /**
  * A truncated stream, not a rejected request: the client continues the partial

package/dist/agent/engine/openrouter-tool-fetch.d.ts

@@ -0,0 +1 @@
+export declare function createOpenRouterToolFetch(requestFetch?: typeof fetch): typeof fetch;

package/dist/agent/engine/openrouter-tool-fetch.js

@@ -0,0 +1,20 @@
+export function createOpenRouterToolFetch(requestFetch = globalThis.fetch) {
+    return (input, init) => {
+        if (typeof init?.body !== "string")
+            return requestFetch(input, init);
+        const body = JSON.parse(init.body);
+        if (!body.tools?.length)
+            return requestFetch(input, init);
+        // Temporary adapter until OpenRouter's SDK forwards the standard tool.strict
+        // flag (still dropped in v3.1.0). Keep the wire regression when removing this.
+        return requestFetch(input, {
+            ...init,
+            body: JSON.stringify({
+                ...body,
+                tools: body.tools.map((tool) => tool.type === "function" && tool.function
+                    ? { ...tool, function: { ...tool.function, strict: false } }
+                    : tool),
+            }),
+        });
+    };
+}

package/dist/agent/engine/translate-ai-sdk.d.ts

@@ -1,6 +1,6 @@
 import { type ProviderToolNameMap } from "./tool-name.js";
 import type { EngineTool, EngineMessage, EngineContentPart, EngineEvent } from "./types.js";
-export declare function engineToolsToAISDK(tools: EngineTool[], jsonSchema?: (schema: Record<string, unknown>) => unknown, toolNameMap?: ProviderToolNameMap, strict?: boolean): Record<string, any>;
+export declare function engineToolsToAISDK(tools: EngineTool[], jsonSchema?: (schema: Record<string, unknown>) => unknown, toolNameMap?: ProviderToolNameMap): Record<string, any>;
 export interface EngineToAISDKOptions {
     toolResultImages?: boolean;
     toolNameMap?: ProviderToolNameMap;

package/dist/agent/engine/translate-ai-sdk.js

@@ -2,7 +2,7 @@ import { classifyProviderError, describeErrorWithCauses, } from "./error-detail.
 import { flattenComposedRootSchema } from "./flatten-composed-root-schema.js";
 import { createProviderToolNameMap, toEngineToolName, toProviderToolName, } from "./tool-name.js";
 import { backfillEngineMessagesToolResults } from "./translate-anthropic.js";
-export function engineToolsToAISDK(tools, jsonSchema, toolNameMap = createProviderToolNameMap(tools), strict) {
+export function engineToolsToAISDK(tools, jsonSchema, toolNameMap = createProviderToolNameMap(tools)) {
     const result = {};
     for (const tool of tools) {
         const inputSchema = flattenComposedRootSchema(tool.inputSchema);
@@ -16,7 +16,8 @@ export function engineToolsToAISDK(tools, jsonSchema, toolNameMap = createProvid
         result[providerName] = {
             description: tool.description,
             inputSchema: jsonSchema ? jsonSchema(rawSchema) : rawSchema,
-            ...(strict === undefined ? {} : { strict }),
+            // Gateways may normalize an omitted flag into required optional fields.
+            strict: false,
         };
     }
     return result;

package/dist/agent/model-config.d.ts

@@ -21,7 +21,7 @@ export declare const BUILDER_CLAUDE_SONNET_MODEL_LABEL = "Claude Sonnet 5";
 export declare const AGENT_MODEL_CONFIG: {
     readonly builder: {
         readonly defaultModel: "gpt-6-luna";
-        readonly supportedModels: readonly ["auto", "claude-haiku-4-5", "claude-sonnet-5", "claude-opus-5-5", "gpt-5-4", "gpt-5-5", "gpt-5-4-mini", "gpt-5-1-codex-mini", "gpt-6.1-sol", "gpt-5-6-terra", "gpt-6-luna", "gemini-3-1-pro", "gemini-3-8-flash", "gemini-3-5-flash-lite", "gemini-3-1-flash-lite", "qwen3-coder", "kimi-k2-5", "deepseek-v3-1", "z-ai-glm-4-5", "z-ai-glm-5-1"];
+        readonly supportedModels: readonly ["auto", "claude-haiku-4-5", "claude-sonnet-5", "claude-opus-5-5", "gpt-5-4", "gpt-5-5", "gpt-5-4-mini", "gpt-5-1-codex-mini", "gpt-6.1-sol", "gpt-5-6-terra", "gpt-6-luna", "gemini-3-1-pro", "gemini-3-8-flash", "gemini-3-5-flash-lite", "gemini-3-1-flash-lite", "qwen3-coder", "kimi-k2-5", "deepseek-v3-1", "deepseek-v4-1-flash", "z-ai-glm-4-5", "z-ai-glm-5-1", "z-ai-glm-5-3-flash"];
     };
     readonly anthropic: {
         readonly defaultModel: "claude-sonnet-5-5";
@@ -64,7 +64,7 @@ export declare const AGENT_MODEL_CONFIG: {
 };
 export declare const BUILDER_MODEL_CONFIG: {
     readonly defaultModel: "gpt-6-luna";
-    readonly supportedModels: readonly ["auto", "claude-haiku-4-5", "claude-sonnet-5", "claude-opus-5-5", "gpt-5-4", "gpt-5-5", "gpt-5-4-mini", "gpt-5-1-codex-mini", "gpt-6.1-sol", "gpt-5-6-terra", "gpt-6-luna", "gemini-3-1-pro", "gemini-3-8-flash", "gemini-3-5-flash-lite", "gemini-3-1-flash-lite", "qwen3-coder", "kimi-k2-5", "deepseek-v3-1", "z-ai-glm-4-5", "z-ai-glm-5-1"];
+    readonly supportedModels: readonly ["auto", "claude-haiku-4-5", "claude-sonnet-5", "claude-opus-5-5", "gpt-5-4", "gpt-5-5", "gpt-5-4-mini", "gpt-5-1-codex-mini", "gpt-6.1-sol", "gpt-5-6-terra", "gpt-6-luna", "gemini-3-1-pro", "gemini-3-8-flash", "gemini-3-5-flash-lite", "gemini-3-1-flash-lite", "qwen3-coder", "kimi-k2-5", "deepseek-v3-1", "deepseek-v4-1-flash", "z-ai-glm-4-5", "z-ai-glm-5-1", "z-ai-glm-5-3-flash"];
 };
 export declare const ANTHROPIC_MODEL_CONFIG: {
     readonly defaultModel: "claude-sonnet-5-5";

package/dist/agent/model-config.js

@@ -177,8 +177,10 @@ export const AGENT_MODEL_CONFIG = {
             "qwen3-coder",
             "kimi-k2-5",
             "deepseek-v3-1",
+            "deepseek-v4-1-flash",
             "z-ai-glm-4-5",
             "z-ai-glm-5-1",
+            "z-ai-glm-5-3-flash",
         ],
     },
     anthropic: {

package/dist/app-config/observability.js

@@ -1,4 +1,7 @@
 import { z } from "zod";
+// Typed against the Builder catalog: the classifier runs on the gateway, so a
+// retired id must break the build instead of every classification.
+const DEFAULT_INFERRED_SENTIMENT_MODEL = "gpt-6-luna";
 export const observabilityConfig = z.object({
     release: z
         .string()
@@ -101,7 +104,11 @@ export const observabilityConfig = z.object({
     inferredSentimentSampleRate: z.number().min(0).max(1).optional().meta({
         doc: "Deterministic fraction of eligible user messages to classify, 0 to 1.",
     }),
-    inferredSentimentModel: z.string().min(1).default("gpt-5-6-luna").meta({
+    inferredSentimentModel: z
+        .string()
+        .min(1)
+        .default(DEFAULT_INFERRED_SENTIMENT_MODEL)
+        .meta({
         doc: "Model used by the managed sentiment classifier.",
     }),
 });

package/dist/client/analytics-session.js

@@ -1,11 +1,10 @@
 import { serializeAnalyticsAnonymousIdCookie } from "../shared/analytics-anonymous-id.js";
+import { ANALYTICS_SESSION_ID_COOKIE_NAME, ANALYTICS_SESSION_ID_MAX_LENGTH, normalizeAnalyticsSessionId, serializeAnalyticsSessionIdCookie, } from "../shared/analytics-session-id.js";
 const ANONYMOUS_ID_STORAGE_KEY = "agent-native.anonymous_id";
 const SESSION_ID_STORAGE_KEY = "agent-native.session_id";
 const SESSION_ID_PIN_STORAGE_KEY = "agent-native.session_id_pin";
 const SESSION_LAST_ACTIVITY_STORAGE_KEY = "agent-native.session_last_activity";
 const SESSION_IDLE_TIMEOUT_MS = 30 * 60 * 1000;
-const MAX_SESSION_ID_LENGTH = 127;
-const SAFE_SESSION_ID = /^[!-~]+$/;
 function generateVisitorId() {
     try {
         if (typeof crypto !== "undefined" &&
@@ -56,6 +55,17 @@ function syncAnalyticsAnonymousIdCookie(id) {
         // remains the browser-side source of truth in that case.
     }
 }
+function syncAnalyticsSessionIdCookie(id) {
+    try {
+        const cookie = serializeAnalyticsSessionIdCookie(id);
+        if (cookie)
+            document.cookie = cookie;
+    }
+    catch {
+        // coercion-ok: cookie access is optional and cannot block analytics.
+        // Local storage remains the browser-side source of truth when cookies are unavailable.
+    }
+}
 let pageLoadId;
 /** One id for this page load, shared by every pageview until it reloads. */
 export function getAnalyticsPageLoadId() {
@@ -74,17 +84,16 @@ export function getOrCreateAnalyticsAnonymousId() {
     return id;
 }
 export function setAnalyticsSessionId(sessionId) {
-    const trimmed = typeof sessionId === "string" ? sessionId.trim() : "";
-    if (!trimmed ||
-        trimmed.length > MAX_SESSION_ID_LENGTH ||
-        !SAFE_SESSION_ID.test(trimmed)) {
-        throw new Error(`Invalid analytics session id: expected 1-${MAX_SESSION_ID_LENGTH} printable ASCII characters with no whitespace`);
+    const trimmed = normalizeAnalyticsSessionId(sessionId);
+    if (!trimmed) {
+        throw new Error(`Invalid analytics session id: expected 1-${ANALYTICS_SESSION_ID_MAX_LENGTH} printable ASCII characters with no whitespace`);
     }
     if (typeof window === "undefined")
         return undefined;
     safeStorageSet(SESSION_ID_PIN_STORAGE_KEY, trimmed);
     safeStorageSet(SESSION_ID_STORAGE_KEY, trimmed);
     safeStorageSet(SESSION_LAST_ACTIVITY_STORAGE_KEY, String(Date.now()));
+    syncAnalyticsSessionIdCookie(trimmed);
     return trimmed;
 }
 export function clearAnalyticsSessionId() {
@@ -93,6 +102,13 @@ export function clearAnalyticsSessionId() {
     safeStorageRemove(SESSION_ID_PIN_STORAGE_KEY);
     safeStorageRemove(SESSION_ID_STORAGE_KEY);
     safeStorageRemove(SESSION_LAST_ACTIVITY_STORAGE_KEY);
+    try {
+        document.cookie = `${ANALYTICS_SESSION_ID_COOKIE_NAME}=; path=/; max-age=0; SameSite=Lax`;
+    }
+    catch {
+        // coercion-ok: cookie access is optional and cannot block analytics.
+        // Local storage remains the browser-side source of truth when cookies are unavailable.
+    }
 }
 export function getOrCreateAnalyticsSessionId() {
     if (typeof window === "undefined")
@@ -102,6 +118,7 @@ export function getOrCreateAnalyticsSessionId() {
     if (pinned) {
         safeStorageSet(SESSION_ID_STORAGE_KEY, pinned);
         safeStorageSet(SESSION_LAST_ACTIVITY_STORAGE_KEY, String(now));
+        syncAnalyticsSessionIdCookie(pinned);
         return pinned;
     }
     const lastActivityRaw = safeStorageGet(SESSION_LAST_ACTIVITY_STORAGE_KEY);
@@ -117,5 +134,6 @@ export function getOrCreateAnalyticsSessionId() {
         safeStorageSet(SESSION_ID_STORAGE_KEY, id);
     }
     safeStorageSet(SESSION_LAST_ACTIVITY_STORAGE_KEY, String(now));
+    syncAnalyticsSessionIdCookie(id);
     return id;
 }

package/dist/client/chat/agentkit-protocol.js

@@ -166,6 +166,15 @@ function setRuntimeRunIdMetadata(metadata, runtimeRunId) {
     else
         observability.runtimeRunId = runtimeRunId;
 }
+function setRuntimeTurnIdMetadata(metadata, runtimeTurnId) {
+    const observability = agentNativeMetadata(metadata)?.observability;
+    if (!observability)
+        return;
+    if (runtimeTurnId === undefined)
+        delete observability.turnId;
+    else
+        observability.turnId = runtimeTurnId;
+}
 function objectReference(value) {
     const object = asRecord(value);
     if (!object ||
@@ -1215,13 +1224,14 @@ export function createAgentKitProtocolAdapter(runtime, options = {}) {
                     ...(turn.runId === undefined ? {} : { runtimeRunId: turn.runId }),
                     runtimeId: runtime.id,
                     sessionId: session.id,
-                    turnId: turn.id,
+                    ...(turn.id === undefined ? {} : { turnId: turn.id }),
                     threadId,
                     ...observability,
                 },
             },
         });
         setRuntimeRunIdMetadata(runMetadata, turn.runId);
+        setRuntimeTurnIdMetadata(runMetadata, turn.id);
         const run = {
             runId,
             threadId,
@@ -3056,13 +3066,14 @@ export function createAgentKitProtocolAdapter(runtime, options = {}) {
                                 : { runtimeRunId: nextTurn.runId }),
                             runtimeId: runtime.id,
                             sessionId: run.session.id,
-                            turnId: nextTurn.id,
+                            ...(nextTurn.id === undefined ? {} : { turnId: nextTurn.id }),
                             threadId: input.threadId,
                             interruptedRunId: run.runId,
                         },
                     },
                 });
                 setRuntimeRunIdMetadata(replacementMetadata, nextTurn.runId);
+                setRuntimeTurnIdMetadata(replacementMetadata, nextTurn.id);
                 const replacementRun = {
                     runId: nextRunId,
                     threadId: input.threadId,

package/dist/client/url-scrub.js

@@ -1,8 +1,10 @@
+import { AGENT_ACCESS_PARAM } from "../shared/agent-access.js";
 /**
  * Query parameters that may carry sensitive values in the URL bar. Browser
  * telemetry and feedback integrations must not copy OAuth codes, share tokens,
- * password params, email-confirm tokens, or similar secrets into downstream
- * systems. Callers may opt into additional app-specific query parameters.
+ * password params, email-confirm tokens, signed agent-access links, or similar
+ * secrets into downstream systems. Callers may opt into additional
+ * app-specific query parameters.
  */
 const SENSITIVE_QUERY_PARAMS = new Set([
     "password",
@@ -13,6 +15,7 @@ const SENSITIVE_QUERY_PARAMS = new Set([
     "share",
     "share_token",
     "bridge",
+    AGENT_ACCESS_PARAM,
 ]);
 export function scrubUrl(url, additionalSensitiveParams = []) {
     if (!url || typeof url !== "string")

package/dist/deploy/build.js

@@ -26,6 +26,7 @@ import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_CACHE_BUSTER,
 import { workspaceAppAudienceFromEnv, workspaceAppAudienceFromPackageJson, workspaceAppRouteAccessFromEnv, workspaceAppRouteAccessFromPackageJson, } from "../shared/workspace-app-audience.js";
 import { generateActionRegistryForProject } from "../vite/action-types-plugin.js";
 import { createAgentNativeConfigContext, loadResolvedAgentNativeConfig, readAgentNativeBuildConfigMarker, resolveFirstRunOnboardingBuildReplacement, resolveHarnessBuildReplacement, } from "../vite/agent-native-config-loader.js";
+import { createSentryServerSourceMapUploadPlugins } from "../vite/sentry-source-maps.js";
 import { cloneServerBundleForFunction, copyDir, pruneSsrIslandFromRewritingClone, readPackageManifest, SERVERLESS_BROWSER_RUNTIME_PACKAGES, } from "./function-bundle.js";
 import { collectImmutableAssetPaths, IMMUTABLE_ASSET_CACHE_CONTROL, IMMUTABLE_ASSET_CACHE_HEADERS, prefixAssetPath, } from "./immutable-assets.js";
 import { writeNetlifyStaticHeaders } from "./netlify-static-headers.js";
@@ -4240,6 +4241,7 @@ export default bundle;
     const providedPluginsNitroPlugin = await writeProvidedPluginsNitroPlugin();
     const awsLambdaStreaming = isAwsLambdaStreamingBuild(preset, nitroEnvironment);
     const nitroServerCodeSplittingConfig = nitroServerCodeSplittingConfigForPreset(preset);
+    const sentryServerSourceMapPlugins = await createSentryServerSourceMapUploadPlugins(nitroEnvironment);
     const nitroVirtual = {
         "virtual:agents-bundle": agentsBundleModuleSource,
     };
@@ -4260,6 +4262,14 @@ export default bundle;
         ...(isAwsLambdaPreset(preset) ? { awsLambda: { streaming: false } } : {}),
         baseURL: appBasePath || "/",
         minify: true,
+        ...(sentryServerSourceMapPlugins.length > 0
+            ? {
+                sourcemap: "hidden",
+                // Nitro strips sourcesContent by default; the maps never ship, so
+                // keep it for Sentry to show source context.
+                experimental: { sourcemapMinify: false },
+            }
+            : {}),
         serverDir: "./server",
         ignore: NITRO_RUNTIME_IGNORE_PATTERNS,
         alias: {
@@ -4286,6 +4296,7 @@ export default bundle;
                     ? [createCloudflareModuleStubPlugin()]
                     : []),
                 createBrowserOnlyServerStubPlugin(),
+                ...sentryServerSourceMapPlugins,
                 ...(enterpriseAuthAdaptersEnabled
                     ? []
                     : [createEnterpriseAuthAdapterStubPlugin(false)]),

package/dist/file-upload/actions/upload-image.d.ts

@@ -33,20 +33,20 @@ declare const _default: import("../../action.js").ActionDefinition<{
     idempotencyKey: string;
     deleted: boolean;
 } | {
+    id?: undefined;
     error: string;
     url?: undefined;
-    id?: undefined;
     provider?: undefined;
     configured?: undefined;
 } | {
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
     configured?: undefined;
+    error?: undefined;
 } | {
-    url?: undefined;
     id?: undefined;
+    url?: undefined;
     provider?: undefined;
     error: string;
     configured: boolean;

package/dist/jobs/background-automation-runner.js

@@ -6,6 +6,7 @@ import { actionsToEngineTools, filterInitialEngineTools, resolveOwnerEngineApiKe
 import { runAgentLoopDirectWithSoftTimeout } from "../agent/run-loop-with-resume.js";
 import { abortRun, resolveBackgroundAutomationSoftTimeoutMs, resolveBackgroundRunHardTimeoutMs, startRun, } from "../agent/run-manager.js";
 import { claimBackgroundRun, insertRun } from "../agent/run-store.js";
+import { buildCurrentTimeUserContext, buildRuntimeContextPrompt, } from "../agent/runtime-context.js";
 import { buildAssistantMessage, buildUserMessage, extractThreadMeta, foldAssistantTurn, upsertUserMessage, } from "../agent/thread-data-builder.js";
 import { attachToolSearch } from "../agent/tool-search.js";
 import { lookupOwnerAccount, resolveAutomationExecutionIdentity, } from "../automations/service.js";
@@ -19,6 +20,7 @@ import { runWithRequestContext, } from "../server/request-context.js";
 import { normalizeReasoningEffortForRequest } from "../shared/reasoning-effort.js";
 import automationNoOpAction, { AUTOMATION_NO_OP_TOOL, automationNoOpSchema, } from "./actions/automation-no-op.js";
 import { applyAutomationFailure, automationOwnerKind, classifyAutomationFailure, CONFIG_INVALID_ERROR_CODE, MISSING_TOOLS_ERROR_CODE, OWNER_MISSING_ERROR_CODE, pausedMessage, withDeliveryNote, } from "./automation-outcome.js";
+import { effectiveTimezone } from "./cron.js";
 import { recoveredFactoryOwnerOrgId, } from "./frontmatter.js";
 import { attachAutomationRunThread, finishAutomationRun, startAutomationRun, } from "./run-history.js";
 export const BACKGROUND_RUN_HARD_TIMEOUT_MS = 10 * 60_000;
@@ -645,16 +647,25 @@ async function executeBackgroundAutomation(options, deps, historyId, runIdRef) {
             : Math.max(1, options.hardDeadlineAt - Date.now()));
         await new Promise((resolve, reject) => {
             const activeRun = startRun(runId, thread.id, async (send, signal, control) => {
+                const runtimeContext = {
+                    now: new Date(),
+                    timezone: effectiveTimezone(automation.meta.timezone),
+                };
                 const loopOpts = {
                     engine,
                     model,
-                    systemPrompt,
+                    systemPrompt: systemPrompt + buildRuntimeContextPrompt(runtimeContext),
                     tools,
                     availableTools,
                     messages: [
                         {
                             role: "user",
-                            content: [{ type: "text", text: prompt }],
+                            content: [
+                                {
+                                    type: "text",
+                                    text: prompt + buildCurrentTimeUserContext(runtimeContext),
+                                },
+                            ],
                         },
                     ],
                     actions,

package/dist/mcp/build-server.js

@@ -2584,6 +2584,9 @@ async function verifyA2AJwtForMcp(token, resourceUrl) {
     if (globalSecret) {
         const payload = await verifyWithSecret(globalSecret);
         if (payload) {
+            const tokenScope = typeof payload.scope === "string" ? payload.scope : undefined;
+            const firstPartyMcp = payload.agent_native_first_party_mcp === true;
+            const locallyIssuedConnectToken = tokenScope === MCP_CONNECT_SCOPE && !firstPartyMcp;
             if (orgDomain) {
                 let organization;
                 try {
@@ -2594,17 +2597,17 @@ async function verifyA2AJwtForMcp(token, resourceUrl) {
                 catch (error) {
                     throw new McpIdentityVerificationUnavailableError(error);
                 }
-                if (organization?.secret.trim() === globalSecret) {
+                // Locally issued connect identities are admitted below only after
+                // their active JTI row confirms the stored owner and organization.
+                if (organization?.secret.trim() === globalSecret &&
+                    !locallyIssuedConnectToken) {
                     return organizationPrincipalClaims(payload, organization);
                 }
             }
-            const tokenScope = typeof payload.scope === "string" ? payload.scope : undefined;
-            const firstPartyMcp = payload.agent_native_first_party_mcp === true;
             const hasOrganizationClaim = Object.prototype.hasOwnProperty.call(payload, "org_id") &&
                 payload.org_id !== null;
             const hasOrganizationDomainClaim = Object.prototype.hasOwnProperty.call(payload, "org_domain") &&
                 payload.org_domain !== null;
-            const locallyIssuedConnectToken = tokenScope === MCP_CONNECT_SCOPE && !firstPartyMcp;
             const unclaimedFirstPartyToken = firstPartyMcp && !hasOrganizationClaim && !hasOrganizationDomainClaim;
             if (locallyIssuedConnectToken || unclaimedFirstPartyToken) {
                 return payload;

package/dist/mcp/connect-route.js

@@ -533,9 +533,9 @@ function renderConnectPage(params) {
   .advanced { margin: 0 0 1rem; }
   .advanced > summary {
     list-style: none; cursor: pointer; user-select: none;
-    display: flex; align-items: center; justify-content: center; gap: 0.35rem;
+    display: flex; align-items: center; justify-content: space-between; gap: 0.35rem;
     color: var(--subtle); font-size: 0.8rem; font-weight: 500;
-    padding: 0.5rem 0; text-align: center;
+    padding: 0.65rem 0; text-align: left;
   }
   .advanced > summary::-webkit-details-marker { display: none; }
   .advanced > summary:hover { color: var(--muted); }
@@ -544,7 +544,8 @@ function renderConnectPage(params) {
   .advanced > summary .chev {
     width: 7px; height: 7px; border-right: 1.5px solid currentColor;
     border-bottom: 1.5px solid currentColor; transform: rotate(45deg);
-    transition: transform 0.15s ease; margin-top: -3px;
+    transition: transform 0.15s ease; margin: -3px 0.25rem 0 auto;
+    flex: 0 0 auto;
   }
   .advanced[open] > summary .chev { transform: rotate(225deg); margin-top: 2px; }
   .advanced-body {
@@ -577,13 +578,13 @@ function renderConnectPage(params) {
     box-shadow: 0 0 0 3px rgba(250,250,250,0.12);
   }
   .connections {
-    margin-top: 1.1rem; border-top: 1px solid var(--border);
-    padding-top: 0.35rem;
+    margin-top: 0; border-top: 1px solid var(--border);
   }
   .connections > summary {
     list-style: none; cursor: pointer; user-select: none;
     display: flex; align-items: center; gap: 0.55rem;
-    min-height: 2.2rem; color: var(--muted); font-size: 0.82rem;
+    min-height: 2.75rem; padding: 0.65rem 0;
+    color: var(--muted); font-size: 0.82rem;
   }
   .connections > summary::-webkit-details-marker { display: none; }
   .connections > summary:focus-visible {
@@ -597,8 +598,12 @@ function renderConnectPage(params) {
   .connections .chev {
     width: 7px; height: 7px; border-right: 1.5px solid currentColor;
     border-bottom: 1.5px solid currentColor; transform: rotate(45deg);
-    transition: transform 0.15s ease; margin: -3px 0 0 0.15rem;
+    transition: transform 0.15s ease; margin: -3px 0 0 auto;
   }
+  .connections > summary > .connections-state:not(.hidden) + .chev {
+    margin-left: 0.15rem;
+  }
+  .connections > summary > .chev { margin-right: 0.25rem; }
   .connections[open] .chev { transform: rotate(225deg); margin-top: 2px; }
   .token-list { padding-top: 0.4rem; }
   .tok { display: flex; align-items: center; justify-content: space-between;
@@ -663,13 +668,13 @@ function renderConnectPage(params) {
   }
   .url-row .ghost { flex: 0 0 auto; }
   .hosts {
-    margin: 0 0 1rem; border-top: 1px solid var(--border);
-    border-bottom: 1px solid var(--border); padding: 0.35rem 0;
+    margin: 0; border-top: 1px solid var(--border);
   }
   .hosts > summary {
     list-style: none; cursor: pointer; user-select: none;
     display: flex; align-items: center; gap: 0.55rem;
-    min-height: 2.2rem; color: var(--muted); font-size: 0.82rem;
+    min-height: 2.75rem; padding: 0.65rem 0;
+    color: var(--muted); font-size: 0.82rem;
   }
   .hosts > summary::-webkit-details-marker { display: none; }
   .hosts > summary:focus-visible {
@@ -678,7 +683,7 @@ function renderConnectPage(params) {
   .hosts > summary .chev {
     width: 7px; height: 7px; border-right: 1.5px solid currentColor;
     border-bottom: 1.5px solid currentColor; transform: rotate(45deg);
-    transition: transform 0.15s ease; margin: -3px 0 0 0.15rem;
+    transition: transform 0.15s ease; margin: -3px 0.25rem 0 0.15rem;
   }
   .hosts[open] > summary .chev { transform: rotate(225deg); margin-top: 2px; }
   .hosts-body { padding: 0.15rem 0 0.25rem; }

package/dist/notifications/routes.d.ts

@@ -1,13 +1,13 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
     updated?: undefined;
-    error?: undefined;
     ok?: undefined;
+    error?: undefined;
 } | {
     count?: undefined;
     updated: number;
-    error?: undefined;
     ok?: undefined;
+    error?: undefined;
 } | {
     count?: undefined;
     updated?: undefined;