@agent-native/core 0.209.0 → 0.209.1-nightly-20261015005848

package/dist/agent/production-agent.d.ts

@@ -357,7 +357,12 @@ export interface ProductionAgentOptions {
     runNoProgressTimeoutMs?: number;
     durableBackgroundRuns?: boolean;
     onRunStart?: (send: (event: AgentChatEvent) => void, threadId: string, runId: string) => void | Promise<void>;
-    onEngineResolved?: (engine: AgentEngine, model: string) => void;
+    /**
+     * Called when the run's engine, model, and effort resolve, and again before
+     * each model call, because a call can run on a rate-limit fallback model or
+     * at the lower effort an empty-response retry steps down to.
+     */
+    onEngineResolved?: (engine: AgentEngine, model: string, reasoningEffort: ReasoningEffort | undefined) => void;
     resolveOwnerEmail?: (event: any) => string | Promise<string>;
     finalResponseGuard?: AgentLoopFinalResponseGuard;
     skipFilesContext?: boolean;
@@ -674,6 +679,12 @@ export declare function runAgentLoop(opts: {
     unknownWriteToolNames?: Set<string>;
     internalContinuation?: boolean;
     onModelInput?: ModelInputObserver;
+    /**
+     * The model and effort each model call uses. Either can change mid-run: a
+     * rate limit falls back to another model, and an empty response steps effort
+     * down.
+     */
+    onModelSettings?: (model: string, reasoningEffort: ReasoningEffort | undefined) => void;
     onUsage?: (usage: AgentLoopUsage) => void;
     onOutcome?: (outcome: AgentLoopOutcome) => void;
     ownerEmail?: string | null;

package/dist/agent/production-agent.js

@@ -4584,6 +4584,7 @@ export async function runAgentLoop(opts) {
                         : effectiveReasoningEffort,
                     providerOptions,
                 };
+                opts.onModelSettings?.(model, effectiveReasoningEffort);
                 usage.llmCalls = (usage.llmCalls ?? 0) + 1;
                 notifyModelInputObserver(opts.onModelInput, engineMessages);
                 const eventStream = engine.stream(streamOpts);
@@ -8539,7 +8540,7 @@ export function createProductionAgentHandler(options) {
             configuredEffort: options.reasoningEffort,
         });
         const modelSupportsVision = isAgentModelVisionCapable(effectiveModel, engine.capabilities.vision === true);
-        options.onEngineResolved?.(engine, effectiveModel);
+        options.onEngineResolved?.(engine, effectiveModel, reasoningEffort);
         console.log(`[agent-chat] resolved engine=${engine.name} model=${effectiveModel} requestModel=${requestModel ?? "(none)"} requestEngine=${requestEngine ?? "(none)"} modelSource=${modelSelectionSource} engineDefault=${engine.defaultModel} effort=${reasoningEffort ?? "unset"} turnId=${requestTurnId ?? "(none)"}`);
         if (!(await isResolvedEngineUsableForRequest(engine, {
             apiKey: effectiveApiKey,
@@ -9792,9 +9793,26 @@ export function createProductionAgentHandler(options) {
                                 : "") +
                             `\n</custom-agent-profile>`;
                         let responseText = "";
-                        const subUsage = await runAgentLoop({
+                        // A profile is its own model conversation running beside
+                        // others, so it gets its own run context: its model and effort
+                        // never stand in for another loop's, and it starts with
+                        // nothing read, since the run's reads are what the run's
+                        // model saw. New per-conversation fields reset here too.
+                        const profileRun = {
+                            ...getRequestRunContext(),
+                            model: profile.model ?? model,
+                            reasoningEffort,
+                            toolSearchReads: undefined,
+                            extensionContentReads: undefined,
+                            extensionExcerptReads: undefined,
+                        };
+                        const profileLoopOpts = {
                             engine,
                             model: profile.model ?? model,
+                            onModelSettings: (loopModel, effort) => {
+                                profileRun.model = loopModel;
+                                profileRun.reasoningEffort = effort;
+                            },
                             systemPrompt: profilePrompt,
                             tools: requestTools,
                             availableTools: availableRequestTools,
@@ -9848,7 +9866,8 @@ export function createProductionAgentHandler(options) {
                             ...(resolvedRunSoftTimeoutMs > 0
                                 ? { runSoftTimeoutMs: resolvedRunSoftTimeoutMs }
                                 : {}),
-                        });
+                        };
+                        const subUsage = await runWithRequestContext({ ...getRequestContext(), run: profileRun }, () => runAgentLoop(profileLoopOpts));
                         await control.flushEvents();
                         try {
                             const ownerEmail = options.resolveOwnerEmail
@@ -9968,6 +9987,9 @@ export function createProductionAgentHandler(options) {
             const agentLoopOpts = {
                 engine,
                 model: effectiveModel,
+                // Custom agent profile loops report into their own run context
+                // copies, so only this loop sets the run's model and effort.
+                onModelSettings: (model, effort) => options.onEngineResolved?.(engine, model, effort),
                 runId,
                 followUpSuggestions: true,
                 systemPrompt: requestSystemPrompt,

package/dist/client/agent-sidebar-state.d.ts

@@ -17,7 +17,7 @@ export declare function getAgentSidebarMaxWidth(viewportWidth?: number): number;
 export declare function clampAgentSidebarWidth(width: number, viewportWidth?: number): number;
 export declare function getAgentSidebarOpenPreferenceKey(storageKey?: string | null): string;
 export declare function dispatchAgentSidebarStateChange(detail: AgentSidebarStateChangeDetail): void;
-export declare function setAgentSidebarOpenPreference(open: boolean, storageKey?: string | null): void;
+export declare function setAgentSidebarOpenPreference(open: boolean, storageKey?: string | null): boolean;
 export declare function requestAgentSidebarOpen(): void;
 export declare function getAgentSidebarUrlOpenOverride(): boolean | null;
 export declare function consumeAgentSidebarUrlOpenOverride(storageKey?: string | null): boolean | null;

package/dist/client/agent-sidebar-state.js

@@ -34,6 +34,75 @@ export function getAgentSidebarOpenPreferenceKey(storageKey) {
     const suffix = storageKey?.trim();
     return suffix ? `agent-native.${suffix}.sidebar-open` : SIDEBAR_OPEN_KEY;
 }
+function getExplicitUrlOpenSessionKey(storageKey) {
+    return `${getAgentSidebarOpenPreferenceKey(storageKey)}.explicit-url-open`;
+}
+function getExplicitUrlOpenSessionIntent(storageKey) {
+    if (typeof window === "undefined")
+        return null;
+    try {
+        return (window.sessionStorage.getItem(getExplicitUrlOpenSessionKey(storageKey)) === "true");
+    }
+    catch {
+        // coercion-ok: null distinguishes unreadable storage from a missing false intent.
+        return null;
+    }
+}
+function setExplicitUrlOpenSessionIntent(open, storageKey) {
+    if (typeof window === "undefined")
+        return false;
+    try {
+        const key = getExplicitUrlOpenSessionKey(storageKey);
+        if (open) {
+            window.sessionStorage.setItem(key, "true");
+        }
+        else {
+            window.sessionStorage.removeItem(key);
+        }
+        return true;
+    }
+    catch {
+        // coercion-ok: false keeps the explicit URL intent available when the session write fails.
+        return false;
+    }
+}
+function writeAgentSidebarOpenPreference(open, storageKey) {
+    if (typeof window === "undefined")
+        return false;
+    try {
+        window.localStorage.setItem(getAgentSidebarOpenPreferenceKey(storageKey), String(open));
+        return true;
+    }
+    catch {
+        // coercion-ok: false keeps the URL override retryable when preference persistence fails.
+        return false;
+    }
+}
+function replaceAgentSidebarUrlOpenOverride(open) {
+    if (typeof window === "undefined")
+        return false;
+    try {
+        const url = new URL(window.location.href);
+        if (open === null) {
+            url.searchParams.delete(AGENT_SIDEBAR_QUERY_PARAM);
+        }
+        else {
+            url.searchParams.set(AGENT_SIDEBAR_QUERY_PARAM, open
+                ? AGENT_SIDEBAR_QUERY_VALUE_OPEN
+                : AGENT_SIDEBAR_QUERY_VALUE_CLOSED);
+        }
+        const nextUrl = `${url.pathname}${url.search}${url.hash}`;
+        const currentUrl = `${window.location.pathname}${window.location.search}${window.location.hash}`;
+        if (nextUrl === currentUrl)
+            return true;
+        window.history.replaceState(window.history.state, "", nextUrl);
+        return true;
+    }
+    catch {
+        // coercion-ok: false tells the caller the URL intent could not be updated.
+        return false;
+    }
+}
 export function dispatchAgentSidebarStateChange(detail) {
     if (typeof window === "undefined")
         return;
@@ -43,11 +112,21 @@ export function dispatchAgentSidebarStateChange(detail) {
 }
 export function setAgentSidebarOpenPreference(open, storageKey) {
     if (typeof window === "undefined")
-        return;
-    try {
-        localStorage.setItem(getAgentSidebarOpenPreferenceKey(storageKey), String(open));
+        return false;
+    const urlOverride = getAgentSidebarUrlOpenOverride();
+    const sessionIntentSaved = urlOverride !== null || !open
+        ? setExplicitUrlOpenSessionIntent(open, storageKey)
+        : true;
+    const preferenceSaved = writeAgentSidebarOpenPreference(open, storageKey);
+    const storageSaved = sessionIntentSaved && preferenceSaved;
+    if (urlOverride !== null || !storageSaved) {
+        let urlOverrideSaved = replaceAgentSidebarUrlOpenOverride(storageSaved ? null : open);
+        if (storageSaved && !urlOverrideSaved) {
+            urlOverrideSaved = replaceAgentSidebarUrlOpenOverride(open);
+        }
+        return storageSaved && urlOverrideSaved;
     }
-    catch { }
+    return storageSaved;
 }
 export function requestAgentSidebarOpen() {
     if (typeof window === "undefined")
@@ -72,7 +151,10 @@ export function consumeAgentSidebarUrlOpenOverride(storageKey) {
     const override = getAgentSidebarUrlOpenOverride();
     if (override === null || typeof window === "undefined")
         return override;
-    setAgentSidebarOpenPreference(override, storageKey);
+    const preferenceSaved = writeAgentSidebarOpenPreference(override, storageKey);
+    const sessionIntentSaved = setExplicitUrlOpenSessionIntent(override, storageKey);
+    if (!preferenceSaved || !sessionIntentSaved)
+        return override;
     try {
         const url = new URL(window.location.href);
         url.searchParams.delete(AGENT_SIDEBAR_QUERY_PARAM);
@@ -125,6 +207,16 @@ export function getInitialAgentSidebarOpen(defaultOpen, storageKey, { ignoreUrlO
         if (urlOverride !== null)
             return urlOverride;
     }
+    if (getExplicitUrlOpenSessionIntent(storageKey) === true) {
+        try {
+            if (window.localStorage.getItem(getAgentSidebarOpenPreferenceKey(storageKey)) !== "false") {
+                return true;
+            }
+        }
+        catch {
+            return true;
+        }
+    }
     if (hasChatThreadDeepLink())
         return true;
     if (typeof window !== "undefined" &&

package/dist/coding-tools/run-code.js

@@ -105,8 +105,8 @@ export function createRunCodeEntry(getActions, opts = {}) {
                 "    Supports stageAs/saveToFile/fetchAllPages; use cursorBodyPath for POST-body pagination.",
                 "    Example: `const data = await providerFetch('<provider-id>', '/records', { query: { limit: 100 } });`",
                 "  - `providerRequest(provider, path, init?)` — same authenticated call, but returns the full provider-api envelope with request, response status/headers, truncation, and body metadata.",
-                "  - `providerFetchAll(provider, path, init?)` — generic pagination helper for cursor, page, and offset APIs. Pass `pagination: { itemsPath, cursorPath or nextCursorPath, cursorParam or cursorBodyPath, pageParam, offsetParam, pageSize, maxPages }`. Returns `{ items, pages, pageCount, itemCount, hasMore, lastCursor, stoppedReason }`.",
-                "  - `providerSearchAll(provider, path, init?, options?)` — streaming search helper for broad provider corpora such as transcripts, messages, tickets, issues, notes, events, or documents. Use this before hand-written loops when searching many provider records for terms/phrases/regexes or proving absence. Pass the same `pagination` config as `providerFetchAll`, plus options like `{ query, queries, terms, regex, textPaths, idPaths, metadataPaths, maxHits }`. Returns structured hits with item ids, paths, snippets, page/item indexes, and coverage fields (`pageCount`, `itemCount`, `hasMore`, `stoppedReason`).",
+                "  - `providerFetchAll(provider, path, init?)` — generic pagination helper for cursor, page, and offset APIs, for a cohort already narrowed by a server-side filter (not for finding one entity or topic). Pass `pagination: { itemsPath, cursorPath or nextCursorPath, cursorParam or cursorBodyPath, pageParam, offsetParam, pageSize, maxPages }`. Returns `{ items, pages, pageCount, itemCount, hasMore, lastCursor, stoppedReason }`.",
+                "  - `providerSearchAll(provider, path, init?, options?)` — streaming search helper for broad provider corpora such as transcripts, messages, tickets, issues, notes, events, or documents. Use this before hand-written loops when a bounded cohort must be searched for terms/phrases/regexes or an absence claim needs proof; if the provider has a search or semantic tool for the question, use that first. Pass the same `pagination` config as `providerFetchAll`, plus options like `{ query, queries, terms, regex, textPaths, idPaths, metadataPaths, maxHits }`. Returns structured hits with item ids, paths, snippets, page/item indexes, and coverage fields (`pageCount`, `itemCount`, `hasMore`, `stoppedReason`).",
                 "  - `webFetch(url, init?)` — outbound HTTP request via the web-request action.",
                 "    Returns `{ status, body }` where body is the response text. Supports responseMode, extract, includeLinks, search, maxChars, and saveToFile.",
                 "    Example: `const { body } = await webFetch('https://api.example.com/data', { responseMode: 'raw' });`",
@@ -1057,6 +1057,9 @@ async function providerFetch(provider, apiPath, init = {}) {
       const detail = typeof r.text === "string" ? r.text : JSON.stringify(r.json ?? "");
       throw new Error(\`Provider request failed (\${r.status}): \${String(detail).slice(0, 500)}\`);
     }
+    if (r.truncated === true) {
+      throw new Error("Provider response was cut at the response size limit, so its body is incomplete. Request smaller pages or add a server-side filter; use providerRequest() to inspect the partial body.");
+    }
     return r.json !== undefined ? r.json : r.text;
   }
   return parsed;

package/dist/collab/routes.d.ts

@@ -13,8 +13,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
     };
 }>>;
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -1,6 +1,6 @@
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/mcp-client/oauth-routes.js

@@ -201,9 +201,28 @@ async function handleMcpOAuthStart(event) {
     if (useRootGoogleCallback && !workspaceAppId) {
         return refuse(event, 400, "Workspace MCP OAuth is missing its app callback id.");
     }
+    const requestContext = {
+        userEmail: session.email,
+        orgId: org?.orgId ?? undefined,
+    };
+    let clientInformation;
+    try {
+        clientInformation = await runWithRequestContext(requestContext, () => resolveManagedMcpOAuthClient(urlCheck.url));
+    }
+    catch (error) {
+        return mcpOAuthStartFailureResponse(event, resolveMcpOAuthStartError(error));
+    }
+    if (managedMcpOAuthClientFor(urlCheck.url)?.requireClientCredentials &&
+        !clientInformation) {
+        return refuse(event, 400, MCP_OAUTH_MANAGED_CLIENT_MISSING_MESSAGE);
+    }
+    // A pre-registered client has a fixed redirect URI on the shared workspace
+    // callback. A dynamically registered client registers whatever URI this
+    // flow sends, so keep it on this app's mount: the provider then returns the
+    // user straight to the app that owns the flow cookie.
     const redirectUri = resolveOAuthRedirectUri(event, useRootGoogleCallback
         ? "/_agent-native/google/callback"
-        : "/_agent-native/mcp/servers/oauth/callback");
+        : "/_agent-native/mcp/servers/oauth/callback", { appScopedCallback: !useRootGoogleCallback && !clientInformation });
     if (!redirectUri) {
         return refuse(event, 400, "Invalid MCP OAuth redirect URI.");
     }
@@ -218,17 +237,8 @@ async function handleMcpOAuthStart(event) {
         })
         : crypto.randomUUID();
     const safeReturnUrl = returnUrl ? safeReturnPath(returnUrl) : undefined;
-    const requestContext = {
-        userEmail: session.email,
-        orgId: org?.orgId ?? undefined,
-    };
     try {
         const started = await runWithRequestContext(requestContext, async () => {
-            const clientInformation = await resolveManagedMcpOAuthClient(urlCheck.url);
-            if (managedMcpOAuthClientFor(urlCheck.url)?.requireClientCredentials &&
-                !clientInformation) {
-                return null;
-            }
             const storedCredentials = reconnectServer?.oauthSecretKey && reconnectScopeId
                 ? await readMcpOAuthCredentials({
                     key: reconnectServer.oauthSecretKey,
@@ -259,9 +269,6 @@ async function handleMcpOAuthStart(event) {
                     : {}),
             });
         });
-        if (!started) {
-            return refuse(event, 400, MCP_OAUTH_MANAGED_CLIENT_MISSING_MESSAGE);
-        }
         const flow = {
             name,
             url: urlCheck.url.toString(),

package/dist/observability/routes.d.ts

@@ -64,6 +64,6 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/provider-api/corpus-jobs.js

@@ -663,6 +663,9 @@ async function callProvider(runtime, request) {
         const detail = response.text ?? response.json ?? response.statusText ?? "";
         throw new Error(`Provider request failed (${status}): ${stringifyBrief(detail, 500)}`);
     }
+    if (response.truncated === true) {
+        throw new Error(`Provider response was cut at the response size limit, so this page is incomplete and would be recorded as empty. Lower the page size or fields, or add a filter in the job request.`);
+    }
     return {
         body: response.json ??
             (typeof response.text === "string" ? tryParseJson(response.text) : null),

package/dist/provider-api/index.js

@@ -595,6 +595,7 @@ const PROVIDER_CONFIGS = {
             },
         ],
         notes: [
+            "To answer a question about a Gong account, deal, customer, or topic, use Gong's connected MCP tools (ask_account, ask_deal, generate_brief) when available; Gong searches the calls server-side and answers in one request. Gong's REST API has no account, company, or topic filter, so finding one account's calls or a topic through /calls or /calls/extensive means scanning the whole org, and those responses truncate at the size limit. If the Analytics app is connected, ask it with call-agent; it owns Gong search. Use the REST endpoints below only for exact counts, verbatim quotes, or proof of absence across a bounded cohort.",
             "For broad corpus work, call /calls/extensive with provider-api-request and stageAs/saveToFile. Gong returns the next cursor at records.cursor and expects the next cursor in the POST body at cursor, so use pagination { nextCursorPath: 'records.cursor', cursorBodyPath: 'cursor' } for stageAs or fetchAllPages { cursorPath: 'records.cursor', cursorBodyPath: 'cursor' } for saveToFile.",
             "The public Gong REST API does not expose an arbitrary transcript-text filter. Use configured keyword tracker results from /calls/extensive when they cover the requested term; otherwise batch transcripts with POST /calls/transcript and body { filter: { callIds: [...] } } after narrowing or staging call ids.",
         ],
@@ -1452,6 +1453,7 @@ export async function executeProviderApiRequest(args, runtime) {
                 contentType: resp.contentType,
                 status: resp.status,
                 ok: resp.ok,
+                truncated: resp.truncated,
             };
         });
         const allItemsJson = JSON.stringify(items, null, 2);
@@ -1492,6 +1494,9 @@ export async function executeProviderApiRequest(args, runtime) {
         },
     }), config);
     if (args.saveToFile) {
+        if (response.truncated) {
+            throw new Error(`The response was cut at ${effectiveMaxBytes} bytes (${response.size} available), so saving it would persist an incomplete file. Narrow the request with a server-side filter or fetch it in pages with fetchAllPages.`);
+        }
         const rawText = response.text ??
             (response.json !== undefined ? JSON.stringify(response.json) : "");
         const saved = (await handleSaveToFile(args.saveToFile, rawText, response.contentType, response.status, response.ok));
@@ -1527,13 +1532,21 @@ export async function executeProviderApiRequest(args, runtime) {
         },
         response,
         guidance: [
-            "This was a raw provider API request. Use provider docs/spec URLs to choose endpoints and include method/path/status plus relevant filters in the methodology. Prefer this escape hatch whenever canned actions are too narrow.",
+            "This was a raw provider API request. Use provider docs/spec URLs to choose endpoints and include method/path/status plus relevant filters in the methodology. A data API returns records: when the provider can filter, search, or answer the question itself, make it do that instead of pulling records to filter locally.",
+            response.truncated
+                ? truncatedResponseGuidance(response.size, effectiveMaxBytes)
+                : null,
             providerAccessErrorGuidance(config, response.status),
         ]
             .filter(Boolean)
             .join(" "),
     };
 }
+// A truncated body is incomplete, not a smaller answer. Raising maxBytes and
+// paging the whole collection is the wrong recovery, so name the right ones.
+function truncatedResponseGuidance(size, maxBytes) {
+    return `This response is incomplete: ${size} bytes came back and only the first ${maxBytes} are included. Do not raise maxBytes or page the whole collection to filter it locally. Add a server-side filter or query parameter, use the provider's own search or semantic tool, or run the scan with stageAs or provider-corpus-job. If none of those can express the question, say so or hand it to the app that owns this source.`;
+}
 const PROVIDER_ACCESS_ERROR_STATUSES = new Set([401, 403, 404]);
 function providerAccessErrorGuidance(config, status) {
     if (!PROVIDER_ACCESS_ERROR_STATUSES.has(status))
@@ -2216,6 +2229,7 @@ async function executeCustomProviderApiRequest(args, customConfig, runtime) {
                 contentType: resp.contentType,
                 status: resp.status,
                 ok: resp.ok,
+                truncated: resp.truncated,
             };
         });
         const allItemsJson = JSON.stringify(items, null, 2);
@@ -2258,6 +2272,9 @@ async function executeCustomProviderApiRequest(args, customConfig, runtime) {
         },
     });
     if (args.saveToFile) {
+        if (response.truncated) {
+            throw new Error(`The response was cut at ${effectiveMaxBytes} bytes (${response.size} available), so saving it would persist an incomplete file. Narrow the request with a server-side filter or fetch it in pages with fetchAllPages.`);
+        }
         const rawText = response.text ??
             (response.json !== undefined ? JSON.stringify(response.json) : "");
         const saved = (await handleSaveToFile(args.saveToFile, rawText, response.contentType, response.status, response.ok));
@@ -2295,7 +2312,14 @@ async function executeCustomProviderApiRequest(args, customConfig, runtime) {
             headerNames: Object.keys(headers).filter((name) => name.toLowerCase() !== "authorization"),
         },
         response,
-        guidance: "This was a raw provider API request to a custom provider. Use provider docs URLs to choose endpoints.",
+        guidance: [
+            "This was a raw provider API request to a custom provider. Use provider docs URLs to choose endpoints.",
+            response.truncated
+                ? truncatedResponseGuidance(response.size, effectiveMaxBytes)
+                : null,
+        ]
+            .filter(Boolean)
+            .join(" "),
     };
 }
 async function resolveCustomAuth(customConfig, runtime, ctx, args) {
@@ -4642,6 +4666,9 @@ async function fetchAllPages(config, executeOnePage) {
             const preview = page.text.replace(/\s+/g, " ").trim().slice(0, 500);
             throw new Error(`fetchAllPages request failed with HTTP ${page.status}${preview ? `: ${preview}` : ""}`);
         }
+        if (page.truncated) {
+            throw new Error(`fetchAllPages page ${pageCount} was cut at the response size limit, so its items and next cursor are incomplete. Request smaller pages (a lower limit or fewer fields) or add a server-side filter.`);
+        }
         let body;
         try {
             body = JSON.parse(page.text);

package/dist/provider-api/staging.js

@@ -202,6 +202,9 @@ export async function stagingExecuteRequest(args, execute, ctx) {
         if (!response?.ok) {
             fail(`Provider API returned status ${response?.status}: ${JSON.stringify(response?.json ?? response?.text).slice(0, 200)}`, { errorCode: "provider_api_rejected" });
         }
+        if (response.truncated === true) {
+            fail(`Provider response page ${pageIndex + 1} was cut at the response size limit, so staging it would drop rows. Request smaller pages (a lower limit or fewer fields) or add a server-side filter.`, { errorCode: "provider_response_truncated" });
+        }
         const body = response.json ??
             (response.text ? tryParseJson(response.text) : null);
         const pageRows = extractItemsArray(body, itemsPath);

package/dist/server/agent-chat/action-filters-a2a.js

@@ -10,6 +10,7 @@ import { getAppConfig } from "../../app-config/index.js";
 import { isFrameworkGroupedAction } from "../../framework-tools.js";
 import { isAuthenticatedReadAction, isAutoReadExcludedActionName, } from "../../mcp/build-server.js";
 import { withConfiguredAppBasePath } from "../app-base-path.js";
+import { ensureRequestRunContext } from "../request-context.js";
 export function filterReadOnlyActions(actions) {
     return Object.fromEntries(Object.entries(actions).filter(([, entry]) => entry.readOnly === true));
 }
@@ -323,6 +324,16 @@ async function runDelegatedAgentLoop(runOptions, pluginOptions, timeoutOptions,
                 : delegatedHardToolResultCap,
         },
         finalResponseGuard: pluginOptions.finalResponseGuard,
+        // Actions this run calls record the model and effort from the run
+        // context, which a rate-limit fallback or an effort step-down changes.
+        onModelSettings: (model, reasoningEffort) => {
+            runOptions.onModelSettings?.(model, reasoningEffort);
+            const runContext = ensureRequestRunContext();
+            if (runContext) {
+                runContext.model = model;
+                runContext.reasoningEffort = reasoningEffort;
+            }
+        },
     };
     const execute = (loopOptions = resolvedRunOptions) => runner(loopOptions, pluginOptions.runSoftTimeoutMs, timeoutOptions);
     if (!options.telemetry)

package/dist/server/agent-chat/framework-prompts.js

@@ -270,9 +270,13 @@ Available corpus-capable tools: ${available.join(", ")}.
 
 This workflow does not apply to ordinary structured lookups, bounded aggregates, or counts grouped over one known source. For those requests, use the single most directly authoritative source, run one bounded query, and answer as soon as it succeeds. Do not cross-check or expand into a corpus workflow unless the user asks for multiple sources, exhaustive unstructured-record coverage, or an absence claim.
 
-For broad provider searches, raw API access, multi-page cohorts, cross-source joins, classification over unstructured records, or absence-sensitive answers, do not stop at a bounded shortcut action. Use the provider's broad API/search/list surface, fetch every relevant page or an explicit bounded cohort, stage/save large responses when needed, and reduce the corpus with durable corpus jobs, staged-dataset queries, or code execution.
+Retrieval ladder. Take the first rung that answers the question:
+1. A tool shaped like the question: the provider's native search, semantic, or MCP tool, or an owning app via \`call-agent\`. It searches provider-side in one request but reports no coverage, so absence claims and exact counts start at rung 3 or carry a coverage caveat.
+2. A server-side filter or query parameter on a bounded window.
+3. A staged or durable scan (\`stageAs\`, \`provider-corpus-job\`) over an explicit cohort, only for exhaustive coverage, exact counts, absence claims, classification, or cross-source joins: fetch every relevant page or the bounded cohort, stage large responses, and reduce them with corpus jobs, staged-dataset queries, or code over the staged data.
+Pulling a collection into context or a run-code loop to filter it locally is not a rung; it means rung 1 or 2 is missing, so say so.
 
-When \`provider-corpus-job\` is available, prefer it for transcript/message/ticket/issue/document scans that may exceed one turn, need provider-side backoff, or need a defensible "not found" conclusion. Use operation="start" with mode="paginated-search" for any paginated provider endpoint, or mode="batch-search" when a prior cohort of ids/records must feed a second provider endpoint. Continue paused jobs with operation="continue" until status is completed or quota_wait, then read operation="results". In run-code, prefer providerFetchAll() for short cursor/page/offset pagination and providerRequest() when response status, headers, or truncation metadata matters. Report source, filters, row counts, pagination/truncation, failed pages, quota_wait times, and remaining gaps.`;
+When \`provider-corpus-job\` is available, prefer it for transcript/message/ticket/issue/document scans that may exceed one turn, need provider-side backoff, or need a defensible "not found" conclusion. Use operation="start" with mode="paginated-search" for any paginated provider endpoint, or mode="batch-search" when a prior cohort of ids/records must feed a second provider endpoint. Continue paused jobs with operation="continue" until status is completed or quota_wait, then read operation="results". In run-code, use providerFetchAll() only for short cursor/page/offset pagination over a cohort you already narrowed, and providerRequest() when response status, headers, or truncation metadata matters. Report source, filters, row counts, pagination/truncation, failed pages, quota_wait times, and remaining gaps.`;
 }
 export async function collectFiles(dir, prefix, depth, results) {
     if (depth > 4 || results.length >= 500)

package/dist/server/agent-chat-plugin.js

@@ -3697,11 +3697,12 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 jevContextCompact: leanPrompt || lazyContext,
                 initialToolNames: effectiveInitialToolNames,
                 ...(options?.toolLimits ? { toolLimits: options.toolLimits } : {}),
-                onEngineResolved: (engine, model) => {
+                onEngineResolved: (engine, model, reasoningEffort) => {
                     const runCtx = ensureRequestRunContext();
                     if (runCtx) {
                         runCtx.engine = engine;
                         runCtx.model = model;
+                        runCtx.reasoningEffort = reasoningEffort;
                     }
                 },
                 onRunPrepared: persistSubmittedUserMessage,
@@ -3752,11 +3753,12 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     resolveActionSurface: (details) => resolveObservabilityReviewSummaryActionSurface(details, options?.resolveActionSurface),
                     skipFilesContext: true,
                     initialToolNames: effectiveInitialToolNames,
-                    onEngineResolved: (engine, model) => {
+                    onEngineResolved: (engine, model, reasoningEffort) => {
                         const runCtx = ensureRequestRunContext();
                         if (runCtx) {
                             runCtx.engine = engine;
                             runCtx.model = model;
+                            runCtx.reasoningEffort = reasoningEffort;
                         }
                     },
                     onRunPrepared: persistSubmittedUserMessage,
@@ -3938,11 +3940,12 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     skipFilesContext,
                     initialToolNames: effectiveInitialToolNames,
                     ...(options?.toolLimits ? { toolLimits: options.toolLimits } : {}),
-                    onEngineResolved: (engine, model) => {
+                    onEngineResolved: (engine, model, reasoningEffort) => {
                         const runCtx = ensureRequestRunContext();
                         if (runCtx) {
                             runCtx.engine = engine;
                             runCtx.model = model;
+                            runCtx.reasoningEffort = reasoningEffort;
                         }
                     },
                     onRunPrepared: persistSubmittedUserMessage,

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -1,9 +1,9 @@
 export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     models?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     models: string[];
+    error?: undefined;
 }>>;

package/dist/server/google-oauth.d.ts

@@ -21,6 +21,14 @@ export declare function decodeNetlifyPreviewGoogleOAuthRelayState(value: string
 export declare function wrapNetlifyPreviewGoogleOAuthState(event: H3Event, state: string, callbackPath?: string): string;
 export type OAuthRedirectUriOptions = {
     allowRootCallback?: boolean;
+    /**
+     * Keep the callback under the app's own mount instead of the shared
+     * workspace root callback. Use for providers that register the redirect
+     * URI per flow (e.g. MCP dynamic client registration): the callback then
+     * lands on the app that started the flow without a root relay, which
+     * cannot recover the app id from an opaque state.
+     */
+    appScopedCallback?: boolean;
     useNetlifyPreviewGoogleOAuthRelay?: boolean;
 };
 /**

package/dist/server/google-oauth.js

@@ -279,10 +279,15 @@ function isRequestUnderAppBasePath(event) {
     ];
     return frameworkPrefixes.some((prefix) => requestPath === prefix || requestPath.startsWith(`${prefix}/`));
 }
+function usesRootOAuthCallback(pathname, options) {
+    return (!options.appScopedCallback &&
+        (isWorkspaceOAuthCallbackRelayEnabled() ||
+            options.allowRootCallback === true) &&
+        isFrameworkOAuthCallbackPath(pathname));
+}
 function getDefaultOAuthRedirectUrl(event, path, options = {}) {
     const cleanPath = path.startsWith("/") ? path : `/${path}`;
-    if ((isWorkspaceOAuthCallbackRelayEnabled() || options.allowRootCallback) &&
-        isFrameworkOAuthCallbackPath(cleanPath)) {
+    if (usesRootOAuthCallback(cleanPath, options)) {
         return `${getOrigin(event)}${publicFrameworkPath(cleanPath)}`;
     }
     const basePath = isRequestUnderAppBasePath(event) ? getAppBasePath() : "";
@@ -347,9 +352,7 @@ export function isAllowedOAuthRedirectUri(candidate, event, expectedOrigin = get
     const allowedPrefixes = basePath && isRequestUnderAppBasePath(event)
         ? [
             `${basePath}/_agent-native/`,
-            ...((isWorkspaceOAuthCallbackRelayEnabled() ||
-                options.allowRootCallback) &&
-                isFrameworkOAuthCallbackPath(pathname)
+            ...(usesRootOAuthCallback(pathname, options)
                 ? ["/_agent-native/"]
                 : []),
         ]

package/dist/server/realtime-token.d.ts

@@ -54,8 +54,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/dist/server/request-context.d.ts

@@ -1,6 +1,7 @@
 import type { AgentActionScope } from "../agent/types.js";
 import type { TrackingEventScope } from "../observability/tracing.js";
 import type { ContextStatus } from "../shared/context-status.js";
+import type { ReasoningEffort } from "../shared/reasoning-effort.js";
 import type { SignupAttributionContext } from "./attribution.js";
 export interface RequestRunContext {
     waitUntil?: (promise: Promise<unknown>) => void;
@@ -19,6 +20,8 @@ export interface RequestRunContext {
     systemPrompt?: string;
     engine?: import("../agent/engine/types.js").AgentEngine;
     model?: string;
+    /** The run's resolved thinking effort; unset when the model takes none. */
+    reasoningEffort?: ReasoningEffort;
     allowedActionNames?: readonly string[];
     actionScope?: Readonly<AgentActionScope>;
     appAuthorization?: {

package/dist/sharing/actions/list-resource-shares.d.ts

@@ -2,6 +2,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     resourceType: string;
     resourceId: string;
 }, {
+    role?: undefined;
     ownerEmail: any;
     visibility: any;
     shares: any[];
@@ -11,7 +12,6 @@ declare const _default: import("../../action.js").ActionDefinition<{
         supportsGroupShares?: boolean;
     };
     orgId?: undefined;
-    role?: undefined;
     agentReadable?: undefined;
 } | {
     ownerEmail: string;

package/docs/content/create-with-an-agent.mdx

@@ -0,0 +1,160 @@
+---
+title: "Create an App with an AI Agent"
+description: "Hand one prompt to Claude, ChatGPT, Codex, Cursor, or another AI agent and have it create and start a new Agent-Native app for you."
+---
+
+# Create an App with an AI Agent
+
+You can ask an AI agent to create your Agent-Native app. You paste one prompt, the agent runs the setup commands, and it shows you a running app when it is done.
+
+If you would rather type the commands yourself, follow [Getting Started](/docs/getting-started) instead.
+
+## Before you start
+
+- An AI agent that can run terminal commands, such as Claude Code, Codex, or Cursor. Agents that only chat, such as ChatGPT or Claude on the web, can still help. See [Agents that can't run commands](#chat-only-agents).
+- [Node.js](https://nodejs.org) 22.22 or later.
+- An empty folder where the new app can live.
+
+You don't need an API key to create the app. You only need one when you want the app's own agent to answer you. See [Connect an LLM](/docs/getting-started#connect-an-llm).
+
+## Paste this prompt
+
+Open your agent in the empty folder and paste the prompt below. Change `my-app` in the first line to the name you want. You only need to change it once.
+
+```markdown
+Create a new Agent-Native app in a new folder named my-app, and start
+it. Use that name wherever a step below says APP_NAME.
+
+1. Check that Node.js is version 22.22 or later and that pnpm is
+   available. If pnpm is missing, run `corepack enable`. If corepack
+   is not available either, run `npm install -g pnpm`. If Node.js is
+   too old, stop and tell me instead of installing it.
+2. Run this command:
+   npx --yes @agent-native/core@latest create APP_NAME \
+    --standalone --template chat
+3. In the new APP_NAME folder, run `pnpm install`.
+4. Read APP_NAME/AGENTS.md so you know how the app is laid out.
+5. Start the app with `pnpm dev` and keep it running in the background.
+6. Read the local URL that `pnpm dev` prints. Check that it responds,
+   for example with `curl -I <url>`. Do not open a browser and do not
+   use headless browser tools. I will open the app myself.
+7. Show me the result. Give me the local URL and the response you got
+   from it. Do not just say that setup is complete.
+
+Rules:
+
+- Do not invent or ask me to paste API keys. Connecting an LLM is
+  optional and I will do it myself.
+- Do not print secrets from any .env file.
+- If a command fails, show me the error and what you tried. Do not hide
+  it.
+```
+
+## What the agent should do
+
+A good run ends with these results, and you can check each one yourself:
+
+- A new app folder, named `my-app` unless you changed it, that contains `actions/`, `app/`, and an `AGENTS.md` file.
+- `pnpm dev` running without errors.
+- A local URL, usually `http://localhost:8080`, that the agent has checked responds.
+
+Then open the local URL in your own browser. On the Welcome screen, choose **Continue as local dev**. The Get started page appears.
+
+If anything is missing, ask the agent to show the last command it ran and its output.
+
+<Callout tone="info">
+
+If the commands fail with peer dependency errors, an old copy of a package in the npx cache may be the cause. Ask the agent to run `npx clear-npx-cache` and try again.
+
+</Callout>
+
+## Pick the right setup for your agent
+
+| Agent type              | Examples                                              | How it works                                            |
+| ----------------------- | ----------------------------------------------------- | ------------------------------------------------------- |
+| Terminal and IDE agents | Claude Code, Codex, Cursor, GitHub Copilot in VS Code | Paste the prompt. The agent runs every command for you. |
+| Chat-only agents        | ChatGPT, Claude on the web                            | Ask for the commands, then run them yourself.           |
+
+### Agents that can't run commands {#chat-only-agents}
+
+A chat-only agent can't open a terminal, so it can't create the app. Paste the prompt anyway and add this line at the top:
+
+```markdown
+You can't run commands. Give me each command to run in my terminal,
+one at a time, and wait for me to tell you what happened before moving
+on.
+```
+
+The agent walks you through the same steps and helps if something goes wrong.
+
+## Your agent and the app's agent
+
+Two agents can work on your app, and they do different jobs.
+
+- **Your own agent** is the one you pasted the prompt into, such as Claude Code, Codex, or Cursor. It lives outside the app, in your terminal or editor.
+- **The app's agent** is the chat that comes built into the app. You open it in the browser while the app runs.
+
+|                                   | Your own agent (outside the app)                                                                                                 | The app's agent (inside the app)                                                                              |
+| --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- |
+| Where you use it                  | Your terminal or editor                                                                                                          | The app's chat in the browser                                                                                 |
+| What it works on                  | Your project's files                                                                                                             | The app's data and the screen you are looking at                                                              |
+| What it can do                    | Create the project, install packages, run `pnpm dev`, write and change actions, pages, and database tables, and prepare a deploy | Call the app's actions as tools, read and update the app's data, and answer questions about what is on screen |
+| Needs an LLM connected to the app | No, it uses its own model                                                                                                        | Yes. See [Connect an LLM](/docs/getting-started#connect-an-llm)                                               |
+| Best for                          | Building and changing the app                                                                                                    | Using the app and doing its everyday work                                                                     |
+
+Your own agent builds the app. The app's agent runs it. When your own agent adds an action, the app's agent can call that action right away because both use the same action.
+
+### Help your own agent build well
+
+The generated app is set up so your own agent works well in it without extra instructions.
+
+- `AGENTS.md` in the app root tells an agent how the app is laid out and which rules to follow.
+- `.agents/skills/` holds short guides for common jobs, such as adding a feature or writing an action.
+- Docs for your exact framework version are bundled with the app. An agent can search them with `pnpm action docs-search --query "<topic>"`.
+
+When you ask for something new, you can tell your agent to read these first. For example: "Read AGENTS.md and the matching skill before you change anything."
+
+To let your own agent use a running app's tools instead of its code, see [External Agents](/docs/external-agents).
+
+## Ask for your first change
+
+With the app running, ask your agent for a small change and watch it work. Here are a few examples:
+
+```markdown
+Add an action named list-notes that returns an empty list, then show
+it on a new /notes page.
+```
+
+```markdown
+Change the hello action so it greets people with "Welcome" instead of
+"Hello", then call it for Alex to confirm.
+```
+
+```markdown
+Read the docs for deploying an app, then tell me which steps I need to
+take to put this app online.
+```
+
+The agent changes the same actions that the UI and the app's own agent use. That shared action model is why one change shows up everywhere. [Key Concepts](/docs/key-concepts) explains how it fits together.
+
+## Next steps
+
+<Cards>
+
+### [Getting Started](/docs/getting-started)
+
+Create the same app by hand and learn how an action works.
+
+### [External Agents](/docs/external-agents)
+
+Connect Claude, ChatGPT, Codex, or Cursor to an app that is already running.
+
+### [Actions](/docs/actions-overview)
+
+Define the capabilities that both your UI and your agents use.
+
+### [Deploy an app](/docs/deploy-an-app)
+
+Move from local development to a real database and a supported host.
+
+</Cards>

package/docs/content/getting-started.mdx

@@ -15,6 +15,9 @@ the UI calls from code.
 In this guide, you'll create an agent with a chat UI and call its included
 `hello` action from the agent and the UI.
 
+Prefer to have an AI agent do the setup? See
+[Create an App with an AI Agent](/docs/create-with-an-agent).
+
 ## Prerequisites
 
 - [Node.js](https://nodejs.org) 22.22 or later

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.209.0",
+  "version": "0.209.1-nightly-20261015005848",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -704,7 +704,7 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/agentkit": "^0.209.0",
+    "@agent-native/agentkit": "^0.209.1-nightly-20261015005848",
     "@agent-native/recap-cli": "^0.5.72"
   },
   "devDependencies": {
@@ -775,7 +775,7 @@
     "xlsx": "^0.18.5"
   },
   "peerDependencies": {
-    "@agent-native/core-corpus": ">=0.196.0",
+    "@agent-native/core-corpus": "0.209.1-nightly-20261015005848",
     "@ai-sdk/anthropic": ">=3",
     "@ai-sdk/cohere": ">=3",
     "@ai-sdk/google": ">=3",