@agent-native/core 0.209.0-nightly-20261014153330 → 0.209.0

package/dist/agent/production-agent.d.ts

@@ -241,6 +241,14 @@ export type PersistedActionSurface = {
     mode: "default";
 };
 export declare function readPersistedActionSurface(value: unknown, propertyName: string): PersistedActionSurface | undefined;
+/**
+ * A durable continuation re-resolves the caller's additional actions, which
+ * may have changed since the turn started. Keep the turn's names: drop entries
+ * that appeared since, and keep a vanished name as an entry that fails loudly
+ * when called, so a persisted action allowlist that names it still resolves.
+ * A name that has since become a registered action is left to that action.
+ */
+export declare function pinAdditionalActionsToTurn(resolved: Record<string, ActionEntry>, turnNames: readonly string[], registered: Record<string, ActionEntry>): Record<string, ActionEntry>;
 export declare function filterActionsByAllowedNames(actions: Record<string, ActionEntry>, allowedActionNames: readonly string[]): Record<string, ActionEntry>;
 export declare const PLAN_MODE_SYSTEM_PROMPT = "## Plan Mode Active\n\nYou are in Plan mode. This turn is for research, clarification, and a proposed approach only.\n\nHard rules:\n- Use only read-only tools. Do not edit files, write resources, run mutating bash commands, mutate SQL rows, navigate the UI, send notifications, create jobs, create tools, send messages or tasks to external agents, or change external systems.\n- If a needed detail is unclear, ask a concise clarifying question before proposing a plan.\n- When ready, present a concrete plan with the files/tools you expect to touch, the intended changes, validation steps, and notable risks.\n- Do not treat approval as implicit while Plan mode is still active. Tell the user to switch to Act mode with the mode selector or /act before implementation.";
 export declare function isPlanModeToolCallAllowed(name: string, input: unknown, entry: ActionEntry): boolean;

package/dist/agent/production-agent.js

@@ -82,6 +82,7 @@ import { startRun, subscribeToRun, replayCompletedTurn, getActiveRunForThread, g
 import { writeLedgerEntry, readLedgerEntry, clearLedgerForThread, AgentTurnInitiatorMismatchError, AgentTurnInitiatorUnavailableError, insertRun, insertRunEvent, isTurnAborted, markRunAborted, updateRunHeartbeat, updateRunStatusIfRunning, setRunError, setRunTerminalReason, claimBackgroundRun, readBackgroundRunClaim, recordRunDiagnostic, countRunsForTurn, RUN_DIAG_STAGE, UNCLAIMED_BACKGROUND_RUN_GRACE_MS, turnRunLedgerExhausted, } from "./run-store.js";
 import { buildCurrentTimeUserContext } from "./runtime-context.js";
 import { claimSetupResume, setupResumeRefusedRunId, } from "./setup-resume-claim.js";
+import { getStrictToolInputValidator } from "./strict-tool-input.js";
 import { consumeAgentToolApproval, createAgentToolApproval, isAgentToolAlwaysAllowed, resolveAgentToolApprovalTurnId, } from "./tool-approval-store.js";
 import { findCompletedJournalEntry, isUnavailableToolCallInput, } from "./tool-call-journal.js";
 import { redactSensitiveFields, sanitizeToolErrorText, sanitizeToolErrorValue, } from "./tool-error-redaction.js";
@@ -748,6 +749,42 @@ export function readPersistedActionSurface(value, propertyName) {
         return { orgId: null, allowedActionNames: [] };
     }
 }
+function readPersistedAdditionalActionNames(body) {
+    const names = body.__resolvedAdditionalActionNames;
+    if (names === undefined)
+        return undefined;
+    if (!Array.isArray(names) || names.some((name) => typeof name !== "string")) {
+        throw new Error("Persisted additional action names are malformed");
+    }
+    return names;
+}
+/**
+ * A durable continuation re-resolves the caller's additional actions, which
+ * may have changed since the turn started. Keep the turn's names: drop entries
+ * that appeared since, and keep a vanished name as an entry that fails loudly
+ * when called, so a persisted action allowlist that names it still resolves.
+ * A name that has since become a registered action is left to that action.
+ */
+export function pinAdditionalActionsToTurn(resolved, turnNames, registered) {
+    const pinned = {};
+    for (const name of turnNames) {
+        if (Object.hasOwn(registered, name))
+            continue;
+        pinned[name] = Object.hasOwn(resolved, name)
+            ? resolved[name]
+            : {
+                tool: {
+                    description: `${name} is no longer available to this caller.`,
+                    parameters: { type: "object", properties: {} },
+                },
+                readOnly: true,
+                run: () => {
+                    throw new Error(`${name} is no longer available to this caller; it was removed after this turn started.`);
+                },
+            };
+    }
+    return pinned;
+}
 export function filterActionsByAllowedNames(actions, allowedActionNames) {
     const allowedNames = [...new Set(allowedActionNames)];
     const unknownNames = allowedNames.filter((name) => !Object.prototype.hasOwnProperty.call(actions, name));
@@ -4030,6 +4067,9 @@ function narrowUnionBranchErrors(errors) {
     return kept.length ? kept : errors;
 }
 function validateRawToolInput(entry, input) {
+    const strict = getStrictToolInputValidator(entry);
+    if (strict)
+        return strict(input);
     if (!shouldValidateRawToolParameters(entry))
         return null;
     const parameters = entry.tool.parameters;
@@ -4470,6 +4510,7 @@ export async function runAgentLoop(opts) {
         let streamedAssistantText = "";
         const streamedAssistantToolCalls = [];
         let terminalStopReason;
+        let terminalStopErrorCode;
         const toolCallErrors = new Map();
         let contextMessages = completingFollowUpSuggestions
             ? followUpCompletionContext
@@ -4508,6 +4549,7 @@ export async function runAgentLoop(opts) {
             streamedAssistantText = "";
             streamedAssistantToolCalls.length = 0;
             terminalStopReason = undefined;
+            terminalStopErrorCode = undefined;
             toolCallErrors.clear();
             try {
                 let providerOptions = opts.providerOptions;
@@ -4566,6 +4608,9 @@ export async function runAgentLoop(opts) {
                         type: "model_stream",
                         status: "end",
                         ...(terminalStopReason ? { reason: terminalStopReason } : {}),
+                        ...(terminalStopErrorCode
+                            ? { errorCode: terminalStopErrorCode }
+                            : {}),
                     });
                 };
                 let lastModelStreamProgressAt = Date.now();
@@ -4813,6 +4858,7 @@ export async function runAgentLoop(opts) {
                         else if (event.type === "stop") {
                             terminalStopReason = event.reason;
                             if (event.reason === "error") {
+                                terminalStopErrorCode = event.errorCode;
                                 throw engineStopError(event, engineMessages);
                             }
                         }
@@ -4822,6 +4868,14 @@ export async function runAgentLoop(opts) {
                         }
                     }
                 }
+                catch (err) {
+                    // A thrown engine error skips the `stop` event, so its code must
+                    // reach the bracket end here or the failed attempt goes unlabeled.
+                    const thrownCode = err?.errorCode;
+                    if (typeof thrownCode === "string")
+                        terminalStopErrorCode ??= thrownCode;
+                    throw err;
+                }
                 finally {
                     closeModelStreamBracket();
                     if (!eventIteratorDone) {
@@ -5252,13 +5306,14 @@ export async function runAgentLoop(opts) {
         const runToolCall = async (toolCall) => {
             noteToolNeeded(toolCall.name);
             const actionEntry = actions[toolCall.name];
-            const placeholderNormalization = actionEntry
+            const strictToolInput = getStrictToolInputValidator(actionEntry);
+            const placeholderNormalization = actionEntry && !strictToolInput
                 ? normalizeOptionalToolPlaceholders(actionEntry.tool.parameters, toolCall.input)
                 : { input: toolCall.input, changed: false };
             if (placeholderNormalization.changed) {
                 toolCall = { ...toolCall, input: placeholderNormalization.input };
             }
-            const jsonStringCoercion = actionEntry
+            const jsonStringCoercion = actionEntry && !strictToolInput
                 ? coerceStringifiedJsonToolValues(actionEntry.tool.parameters, toolCall.input)
                 : { input: toolCall.input, changed: false };
             if (jsonStringCoercion.changed) {
@@ -7802,6 +7857,7 @@ export function createProductionAgentHandler(options) {
             delete body[AGENT_CHAT_BACKGROUND_RUN_FIELD];
             delete body[AGENT_CHAT_RECOVERY_OF_RUN_FIELD];
             delete body.__resolvedActionSurface;
+            delete body.__resolvedAdditionalActionNames;
         }
         let requestedActionScope;
         if (hasOwn(body, "actionScope")) {
@@ -8258,11 +8314,20 @@ export function createProductionAgentHandler(options) {
         if (options.resolveAdditionalActions &&
             ownerEmail &&
             getRequestContext()?.agentRunAnonymous !== true) {
-            const additionalActions = await options.resolveAdditionalActions({
+            const resolvedAdditionalActions = await options.resolveAdditionalActions({
                 event,
                 ownerEmail,
                 orgId: getRequestOrgId() ?? null,
             });
+            const turnAdditionalActionNames = isBackgroundWorker
+                ? readPersistedAdditionalActionNames(body)
+                : undefined;
+            const additionalActions = turnAdditionalActionNames
+                ? pinAdditionalActionsToTurn(resolvedAdditionalActions, turnAdditionalActionNames, resolvedActions)
+                : resolvedAdditionalActions;
+            if (!isBackgroundWorker) {
+                body.__resolvedAdditionalActionNames = Object.keys(additionalActions);
+            }
             const requestActions = { ...resolvedActions, ...additionalActions };
             if (requestActions[TOOL_SEARCH_ACTION_NAME]) {
                 requestActions[TOOL_SEARCH_ACTION_NAME] = createToolSearchEntry(() => getRequestActions(requestActions));

package/dist/agent/strict-tool-input.d.ts

@@ -0,0 +1,4 @@
+type StrictToolInputValidator = (input: unknown) => string | null;
+export declare function registerStrictToolInput(entry: object, validate: StrictToolInputValidator): void;
+export declare function getStrictToolInputValidator(entry: object | undefined): StrictToolInputValidator | undefined;
+export {};

package/dist/agent/strict-tool-input.js

@@ -0,0 +1,26 @@
+/**
+ * Validators for action entries that must receive their arguments exactly as
+ * the model sent them. The agent loop normally repairs model input (filling
+ * placeholders, parsing stringified JSON, coercing types) before validating;
+ * an entry registered here skips that repair and is validated with its own
+ * validator instead, which returns an error message or null.
+ *
+ * The validator lives on the entry under a symbol rather than in a side table:
+ * registries copy entries with object spread as they filter them, and spread
+ * keeps own symbol properties, so the copy reaching the loop stays strict.
+ */
+const STRICT_TOOL_INPUT = Symbol("agent-native.strictToolInput");
+export function registerStrictToolInput(entry, validate) {
+    Object.defineProperty(entry, STRICT_TOOL_INPUT, {
+        value: validate,
+        enumerable: true,
+    });
+}
+export function getStrictToolInputValidator(entry) {
+    const validate = entry
+        ? entry[STRICT_TOOL_INPUT]
+        : undefined;
+    return typeof validate === "function"
+        ? validate
+        : undefined;
+}

package/dist/agent/types.d.ts

@@ -206,6 +206,12 @@ export interface AgentChatRequest {
         orgId: string | null;
         mode: "default";
     };
+    /**
+     * Names of the request-scoped additional actions the turn started with,
+     * carried across authenticated durable background dispatches so a
+     * continuation keeps the same tool set. Deleted from client requests.
+     */
+    __resolvedAdditionalActionNames?: string[];
     turnId?: string;
     /** Turn metadata the client forwards; read only for the keys it names. */
     metadata?: Record<string, unknown>;
@@ -274,6 +280,7 @@ export type AgentChatEvent = {
     type: "model_stream";
     status: "start" | "end";
     reason?: "end_turn" | "tool_use" | "max_tokens" | "stop_sequence" | "error";
+    errorCode?: string;
 } | {
     type: "tool_start";
     tool: string;

package/dist/automation/index.d.ts

@@ -139,8 +139,8 @@ export declare function createAutomationCallbackHandler(runtime: AutomationRunti
     duplicate?: undefined;
     eventId?: undefined;
 } | {
-    error?: undefined;
     accepted: boolean;
     duplicate: boolean;
     eventId: string;
+    error?: undefined;
 }>;

package/dist/cli/skills-content/turn-into-app-attachments.d.ts

@@ -1 +1 @@
-export declare const TURN_INTO_APP_ATTACHMENTS_REFERENCE_MD = "# Dispatch Handoff Attachments\n\nWhen calling `start-workspace-app-creation`, pass source files in the `attachments` argument rather than embedding their bytes in `prompt`.\n\n## Uploaded files\n\nImages and PDFs use an upload attachment with a matching base64 data URL:\n\n```ts\n{\n  type: \"upload\",\n  contentType: \"image/webp\" | \"image/png\" | \"image/jpeg\" | \"image/gif\" | \"application/pdf\",\n  name: string,\n  dataUrl: \"data:<contentType>;base64,<BASE64_CONTENT>\",\n  size: number,\n  id: string\n}\n```\n\nText and JSON files provide decoded contents instead of a data URL:\n\n```ts\n{\n  type: \"upload\",\n  contentType: \"text/plain\" | \"application/json\",\n  name: string,\n  dataUrl: \"\",\n  text: string,\n  size: number,\n  id: string\n}\n```\n\nSet `size` to the UTF-8 byte length of `text`. Use a stable or unique `id` for each attachment.\n\n## Public URLs\n\nFor an existing public file that Builder can fetch, use:\n\n```ts\n{\n  type: \"url\",\n  value: \"https://...\"\n}\n```\n\nDo not pass private, localhost, or internal-network URLs.\n\n## Handoff behavior\n\nKeep the original task in `prompt` and tell the Builder agent how each attachment should be used. Put multiple attachments in the same `attachments` array. Attachments are model context only and are not copied into the generated app's workspace.\n";
+export declare const TURN_INTO_APP_ATTACHMENTS_REFERENCE_MD = "# Dispatch Handoff Attachments\n\nWhen calling `start-workspace-app-creation`, pass source files in the `attachments` argument rather than embedding their bytes in `prompt`.\n\n## Uploaded files\n\nImages and PDFs use an upload attachment with a matching base64 data URL:\n\n```ts\n{\n  type: \"upload\",\n  contentType: \"image/webp\" | \"image/png\" | \"image/jpeg\" | \"image/gif\" | \"application/pdf\",\n  name: string,\n  dataUrl: \"data:<contentType>;base64,<BASE64_CONTENT>\",\n  id: string\n}\n```\n\nText and JSON files provide decoded contents instead of a data URL:\n\n```ts\n{\n  type: \"upload\",\n  contentType: \"text/plain\" | \"application/json\",\n  name: string,\n  dataUrl: \"\",\n  text: string,\n  id: string\n}\n```\n\nSend any other text-based file (Markdown, CSV, source code, plain text) as `text/plain` with its real file name, for example `notes.md`. Use a stable or unique `id` for each attachment. A malformed attachment is rejected with `invalid_attachment` and a message naming the problem; fix that attachment and retry, because an unchanged retry fails the same way.\n\n## Public URLs\n\nFor an existing public file that Builder can fetch, use:\n\n```ts\n{\n  type: \"url\",\n  value: \"https://...\"\n}\n```\n\nDo not pass private, localhost, or internal-network URLs.\n\n## Handoff behavior\n\nKeep the original task in `prompt` and tell the Builder agent how each attachment should be used. Put multiple attachments in the same `attachments` array. Attachments are model context only and are not copied into the generated app's workspace.\n";

package/dist/cli/skills-content/turn-into-app-attachments.js

@@ -12,7 +12,6 @@ Images and PDFs use an upload attachment with a matching base64 data URL:
   contentType: "image/webp" | "image/png" | "image/jpeg" | "image/gif" | "application/pdf",
   name: string,
   dataUrl: "data:<contentType>;base64,<BASE64_CONTENT>",
-  size: number,
   id: string
 }
 \`\`\`
@@ -26,12 +25,11 @@ Text and JSON files provide decoded contents instead of a data URL:
   name: string,
   dataUrl: "",
   text: string,
-  size: number,
   id: string
 }
 \`\`\`
 
-Set \`size\` to the UTF-8 byte length of \`text\`. Use a stable or unique \`id\` for each attachment.
+Send any other text-based file (Markdown, CSV, source code, plain text) as \`text/plain\` with its real file name, for example \`notes.md\`. Use a stable or unique \`id\` for each attachment. A malformed attachment is rejected with \`invalid_attachment\` and a message naming the problem; fix that attachment and retry, because an unchanged retry fails the same way.
 
 ## Public URLs