@agent-native/core 0.210.0-nightly-20261019153056 → 0.210.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Builder.io, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/agent/action-error-details.d.ts

@@ -0,0 +1,26 @@
+/** Longest serialized `details` an agent sees with a failed action. */
+export declare const MAX_AGENT_ERROR_DETAILS_CHARS = 2000;
+export interface AgentErrorDetails {
+    /** The `details` a `fail()` attached, as the browser receives them, redacted and bounded. */
+    details: Record<string, unknown>;
+    /**
+     * Top-level keys left out to stay within the bound, or because they don't
+     * serialize: up to ten names, each clipped, with the full count beside them.
+     */
+    omittedKeys?: string[];
+    omittedKeyCount?: number;
+    /** The line a text-only tool result carries, so text clients see the same data. */
+    line: string;
+}
+/**
+ * The structured `details` of a failed action, in the form an agent reads.
+ *
+ * Only a contract error (`fail()`) carries details meant for the caller; the
+ * HTTP action route already returns them to the browser, so an agent acting
+ * for the same user gets the same object. Values go through a JSON round trip
+ * first, so a `Date` reads as the browser would see it rather than as `{}`.
+ * When the whole object is too long, small top-level entries are kept in
+ * order and the rest are named in `omittedKeys`: a retry id must survive next
+ * to a large payload, and a cut must never read as a complete object.
+ */
+export declare function agentErrorDetails(error: unknown): AgentErrorDetails | undefined;

package/dist/agent/action-error-details.js

@@ -0,0 +1,99 @@
+import { isActionContractError } from "../action.js";
+import { redactSensitiveFields, sanitizeToolErrorText, } from "./tool-error-redaction.js";
+/** Longest serialized `details` an agent sees with a failed action. */
+export const MAX_AGENT_ERROR_DETAILS_CHARS = 2_000;
+/** A top-level entry longer than this is left out once the whole set is too long. */
+const MAX_KEPT_ENTRY_CHARS = 300;
+const MAX_LISTED_OMITTED_KEYS = 10;
+const MAX_OMITTED_KEY_CHARS = 60;
+/**
+ * The structured `details` of a failed action, in the form an agent reads.
+ *
+ * Only a contract error (`fail()`) carries details meant for the caller; the
+ * HTTP action route already returns them to the browser, so an agent acting
+ * for the same user gets the same object. Values go through a JSON round trip
+ * first, so a `Date` reads as the browser would see it rather than as `{}`.
+ * When the whole object is too long, small top-level entries are kept in
+ * order and the rest are named in `omittedKeys`: a retry id must survive next
+ * to a large payload, and a cut must never read as a complete object.
+ */
+export function agentErrorDetails(error) {
+    if (!isActionContractError(error))
+        return undefined;
+    const raw = error.details;
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const entries = [];
+    const omittedKeys = [];
+    for (const key of Object.keys(raw)) {
+        const clean = jsonSafeEntry(raw, key);
+        if (clean === UNSERIALIZABLE)
+            omittedKeys.push(key);
+        else if (clean !== undefined)
+            entries.push([key, clean]);
+    }
+    const cleaned = Object.fromEntries(entries);
+    let details = cleaned;
+    if (JSON.stringify(cleaned).length > MAX_AGENT_ERROR_DETAILS_CHARS) {
+        details = {};
+        let budget = MAX_AGENT_ERROR_DETAILS_CHARS - 2;
+        for (const [key, value] of entries) {
+            const size = JSON.stringify({ [key]: value }).length - 1;
+            if (size <= MAX_KEPT_ENTRY_CHARS && size <= budget) {
+                details[key] = value;
+                budget -= size;
+            }
+            else {
+                omittedKeys.push(key);
+            }
+        }
+    }
+    if (Object.keys(details).length === 0 && omittedKeys.length === 0) {
+        return undefined;
+    }
+    const listed = omittedKeys
+        .slice(0, MAX_LISTED_OMITTED_KEYS)
+        .map((key) => key.length > MAX_OMITTED_KEY_CHARS
+        ? `${key.slice(0, MAX_OMITTED_KEY_CHARS)}…`
+        : key);
+    const more = omittedKeys.length > listed.length
+        ? `, and ${omittedKeys.length - listed.length} more`
+        : "";
+    return {
+        details,
+        ...(omittedKeys.length > 0
+            ? { omittedKeys: listed, omittedKeyCount: omittedKeys.length }
+            : {}),
+        line: `Error details${listed.length > 0 ? ` (omitted: ${listed.join(", ")}${more})` : ""}: ${JSON.stringify(details)}`,
+    };
+}
+const UNSERIALIZABLE = Symbol("unserializable");
+function jsonSafeEntry(raw, key) {
+    let parsed;
+    try {
+        // A getter can throw. Reading it here names the key; reading it outside
+        // would replace the action's own error.
+        const json = JSON.stringify(raw[key]);
+        if (json === undefined)
+            return undefined;
+        parsed = JSON.parse(json);
+    }
+    catch {
+        return UNSERIALIZABLE;
+    }
+    const redacted = redactSensitiveFields({ [key]: parsed }, { compoundNames: true });
+    return sanitizeStrings(redacted[key]);
+}
+function sanitizeStrings(value) {
+    if (typeof value === "string")
+        return sanitizeToolErrorText(value);
+    if (Array.isArray(value))
+        return value.map(sanitizeStrings);
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+            key,
+            sanitizeStrings(entry),
+        ]));
+    }
+    return value;
+}

package/dist/agent/execution-fence.d.ts

@@ -5,11 +5,18 @@ export interface ExecutionFence {
     runId: string;
     generation: string;
 }
-export declare class StaleExecutionFenceError extends Error {
-    readonly code = "stale_execution_fence";
+export declare class ExecutionFenceError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare class StaleExecutionFenceError extends ExecutionFenceError {
     constructor(fence: ExecutionFence);
 }
+export declare class MissingExecutionFenceError extends ExecutionFenceError {
+    constructor();
+}
 export declare function currentExecutionFence(): ExecutionFence | undefined;
+export declare function withExecutionLeaseRequested<T>(work: () => T): T;
 export declare function withExecutionFence<T>(fence: ExecutionFence, work: () => T): T;
 export declare function lockAndAssertCurrentExecutionFences(tx: DbExec): Promise<void>;
 export declare function withFencedExecutionWrite<T>(write: (tx: DbExec) => Promise<T>, scope?: {

package/dist/agent/execution-fence.js

@@ -1,27 +1,53 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getDbExec } from "../db/client.js";
-export class StaleExecutionFenceError extends Error {
-    code = "stale_execution_fence";
+export class ExecutionFenceError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = new.target.name;
+    }
+}
+export class StaleExecutionFenceError extends ExecutionFenceError {
     constructor(fence) {
-        super(`Execution lease generation ${fence.generation} for turn ${fence.turnId} is no longer current`);
-        this.name = "StaleExecutionFenceError";
+        super("stale_execution_fence", `Execution lease generation ${fence.generation} for turn ${fence.turnId} is no longer current`);
+    }
+}
+export class MissingExecutionFenceError extends ExecutionFenceError {
+    constructor() {
+        super("missing_execution_fence", "Execution lease was requested without an execution fence");
     }
 }
 const executionFenceStorage = new AsyncLocalStorage();
 export function currentExecutionFence() {
-    const fences = executionFenceStorage.getStore();
-    return fences?.at(-1);
+    const context = executionFenceStorage.getStore();
+    const fence = context?.fences.at(-1);
+    if (!fence && context?.executionLeaseRequested) {
+        throw new MissingExecutionFenceError();
+    }
+    return fence;
+}
+export function withExecutionLeaseRequested(work) {
+    const current = executionFenceStorage.getStore();
+    return executionFenceStorage.run({
+        fences: current?.fences ?? [],
+        executionLeaseRequested: true,
+    }, work);
 }
 export function withExecutionFence(fence, work) {
-    const current = executionFenceStorage.getStore() ?? [];
-    const sameFence = current.some((candidate) => candidate.threadId === fence.threadId &&
+    const current = executionFenceStorage.getStore();
+    const fences = current?.fences ?? [];
+    const sameFence = fences.some((candidate) => candidate.threadId === fence.threadId &&
         candidate.turnId === fence.turnId &&
         candidate.runId === fence.runId &&
         candidate.generation === fence.generation);
-    return executionFenceStorage.run(sameFence ? current : [...current, fence], work);
+    return executionFenceStorage.run({
+        fences: sameFence ? fences : [...fences, fence],
+        executionLeaseRequested: true,
+    }, work);
 }
 export async function lockAndAssertCurrentExecutionFences(tx) {
-    const fences = executionFenceStorage.getStore() ?? [];
+    const fences = executionFenceStorage.getStore()?.fences ?? [];
     for (const activeFence of fences) {
         const { rows } = await tx.execute({
             sql: `SELECT generation
@@ -44,11 +70,15 @@ export async function lockAndAssertCurrentExecutionFences(tx) {
     }
 }
 export async function withFencedExecutionWrite(write, scope) {
-    const fences = executionFenceStorage.getStore() ?? [];
+    const context = executionFenceStorage.getStore();
+    const fences = context?.fences ?? [];
     const fence = fences.at(-1);
     const client = getDbExec();
-    if (!fence)
+    if (!fence) {
+        if (context?.executionLeaseRequested)
+            throw new MissingExecutionFenceError();
         return write(client);
+    }
     // A nested task/run write can target either active scope; both leases still gate it.
     const scopedFence = fences.find((candidate) => (!scope?.runId || scope.runId === candidate.runId) &&
         (!scope?.threadId || scope.threadId === candidate.threadId) &&

package/dist/agent/production-agent.js

@@ -56,6 +56,7 @@ import { DurableAttachmentReferenceRequiredError, stripInlineBytes, } from "../s
 import { isReasoningEffort, normalizeReasoningEffortForRequest, stepDownReasoningEffort, } from "../shared/reasoning-effort.js";
 import { SYNTHETIC_TRAFFIC_BETA_E2E, SYNTHETIC_TRAFFIC_HEADER, } from "../shared/test-traffic.js";
 import { actionPreparationContinuationNote } from "./action-continuation-guidance.js";
+import { agentErrorDetails } from "./action-error-details.js";
 import { drainAgentWarnings, formatAgentWarningsForToolResult, } from "./action-warnings.js";
 import { approvalKeyWithArguments } from "./approval-key.js";
 import { CONTINUE_UNAVAILABLE_CODE, } from "./auto-continue.js";
@@ -6617,6 +6618,7 @@ export async function runAgentLoop(opts) {
                 // handler returned does not.
                 let toolResultLost = false;
                 let toolErrorCode;
+                let toolErrorDetailsLine = "";
                 let mcpApp;
                 let toolResultImages;
                 let toolArtifacts = [];
@@ -6928,6 +6930,7 @@ export async function runAgentLoop(opts) {
                     toolErrorCode = isActionContractError(err)
                         ? err.errorCode
                         : undefined;
+                    toolErrorDetailsLine = agentErrorDetails(err)?.line ?? "";
                     result = signal.aborted
                         ? INTERRUPTED_TOOL_RESULT_MARKER
                         : thrownToolResult(err);
@@ -6940,7 +6943,13 @@ export async function runAgentLoop(opts) {
                 if (isError) {
                     receipt = undefined;
                     if (result !== INTERRUPTED_TOOL_RESULT_MARKER) {
+                        // Details go on after the loop breakers and the precondition
+                        // stop read the result: a retry id that changes on every attempt
+                        // must not make the same failure look like a new one.
                         result = finalizeToolErrorResult(result);
+                        if (toolErrorDetailsLine) {
+                            result = `${result}\n${toolErrorDetailsLine}`;
+                        }
                     }
                 }
                 else {

package/dist/agent/run-manager.js

@@ -10,7 +10,7 @@ import { classifyTerminalErrorCode, describeErrorWithCauses, isProviderConnectio
 import { runErrorTelemetryProperties } from "./engine/error-telemetry.js";
 import { getAgentEngineEntry } from "./engine/registry.js";
 import { EngineError } from "./engine/types.js";
-import { withExecutionFence } from "./execution-fence.js";
+import { MissingExecutionFenceError, withExecutionFence, withExecutionLeaseRequested, } from "./execution-fence.js";
 import { insertRun, insertRunEvent, insertRunEvents, updateRunStatusIfRunning, markRunAborted, markRunAbortedAtSafeBoundary, getRunAbortState, getRunStatus, getRunEventsSince, getCurrentTurnRunEventsForThread, getRunById, getRunByThread, getRunTurnRef, markTurnAborted, cleanupOldRuns, updateRunHeartbeat, bumpRunProgress, setRunInFlightMarker, reapIfStale, reapUnclaimedBackgroundRun, shouldRedispatchUnclaimedBackgroundRun, reconcileTerminalRunFromEvents, ensureTerminalRunEvent, getLastTerminalRunEvent, resolveErroredRunTerminalEvent, setRunError, setRunTerminalReason, persistRunCheckpointEvent, recordRunDiagnostic, RUN_DIAG_STAGE, claimTurnExecutionLease, renewTurnExecutionLease, releaseTurnExecutionLease, TurnExecutionLeaseBusyError, terminalEventForAbortReason, RUN_RECORD_MISSING_ERROR_EVENT, RUN_RECORD_MISSING_GRACE_MS, RUN_TERMINAL_LOOKUP_FAILED_ERROR_EVENT, UNKNOWN_RUN_STATUS_ERROR_EVENT, } from "./run-store.js";
 import { isContinuationTerminalReason } from "./types.js";
 const activeRuns = new Map();
@@ -670,10 +670,12 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
     const withWorkerFence = async (work) => {
         if (!options?.executionLease)
             return work();
-        const fence = await executionFencePromise;
-        if (!fence)
-            throw new Error("Execution lease was not acquired");
-        return withExecutionFence(fence, work);
+        return withExecutionLeaseRequested(async () => {
+            const fence = await executionFencePromise;
+            if (!fence)
+                throw new MissingExecutionFenceError();
+            return withExecutionFence(fence, work);
+        });
     };
     let persistenceChain = Promise.resolve();
     run.flushEvents = () => persistenceChain;
@@ -754,7 +756,7 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
         progressWritePending = false;
         lastProgressBumpAt = Date.now();
         progressWriteAttempts += 1;
-        const write = writeProgress()
+        const write = withWorkerFence(writeProgress)
             .catch((error) => {
             recordProgressWriteFailure(error, "error");
             progressWritePending = true;
@@ -906,7 +908,7 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
     const recordRunBoundaryDiagnostic = (reason, diagnostic, disposition) => {
         if (getCurrentRequestDbPoolScope()?.closing)
             return;
-        void retainRequestDbPoolScope(recordRunDiagnostic(runId, RUN_DIAG_STAGE.runBoundaryReached, JSON.stringify({
+        void retainRequestDbPoolScope(withWorkerFence(() => recordRunDiagnostic(runId, RUN_DIAG_STAGE.runBoundaryReached, JSON.stringify({
             reason,
             disposition,
             silentForMs: diagnostic.silentForMs,
@@ -914,7 +916,7 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
             inFlightWorkCount,
             eventCount: run.events.length,
             elapsedMs: Date.now() - run.startedAt,
-        })).catch(() => { })).catch(() => { });
+        })).catch(() => { }))).catch(() => { });
     };
     const reachRunBoundary = (reason, diagnostic = {}) => {
         if (run.status !== "running" || abort.signal.aborted)
@@ -1261,15 +1263,13 @@ export function startRun(runId, threadId, runFn, onComplete, options) {
     };
     const startDriver = async () => {
         if (options?.executionLease) {
-            const fence = await executionFencePromise;
             if (executionLeaseClaimFailed || abort.signal.aborted)
                 return;
-            if (fence) {
-                await withExecutionFence(fence, () => runFn(send, runControl.chunkSignal, runControl));
-            }
-            else {
+            await withWorkerFence(async () => {
+                if (executionLeaseClaimFailed || abort.signal.aborted)
+                    return;
                 await runFn(send, runControl.chunkSignal, runControl);
-            }
+            });
             return;
         }
         if (servicePrincipalRunStart) {

package/dist/agent/run-store.js

@@ -14,7 +14,7 @@ import { approvalKeyForHistory } from "./approval-key.js";
 import { admitAutoContinue, admitManualContinue, } from "./auto-continue.js";
 import { AGENT_CHAT_RECOVERY_OF_RUN_FIELD } from "./durable-background.js";
 import { LLM_MISSING_CREDENTIALS_ERROR_CODE, LLM_MISSING_CREDENTIALS_MESSAGE, } from "./engine/credential-errors.js";
-import { currentExecutionFence, lockAndAssertCurrentExecutionFences, StaleExecutionFenceError, withFencedExecutionWrite, } from "./execution-fence.js";
+import { currentExecutionFence, ExecutionFenceError, MissingExecutionFenceError, lockAndAssertCurrentExecutionFences, StaleExecutionFenceError, withFencedExecutionWrite, } from "./execution-fence.js";
 import { AGENT_RUN_MIGRATIONS, AGENT_RUN_MIGRATIONS_TABLE, } from "./run-migrations.js";
 import { isConsistentToolCallInputFingerprint, isUnavailableToolCallInput, toolCallInputFingerprint, } from "./tool-call-journal.js";
 import { CONTINUATION_REASONS, isContinuationTerminalReason } from "./types.js";
@@ -788,7 +788,7 @@ export async function writeLedgerEntry(threadId, toolKey, resultSummary, artifac
         }), { threadId });
     }
     catch (error) {
-        if (error instanceof StaleExecutionFenceError)
+        if (error instanceof ExecutionFenceError)
             throw error;
         // Ledger is best-effort; never surface failures to the caller.
     }
@@ -874,7 +874,9 @@ export async function clearLedgerForThread(threadId) {
             args: [threadId],
         }), { threadId });
     }
-    catch {
+    catch (error) {
+        if (error instanceof MissingExecutionFenceError)
+            throw error;
         // Best-effort.
     }
 }
@@ -1489,7 +1491,7 @@ export async function setRunError(runId, errorCode, errorDetail) {
         }), { runId });
     }
     catch (error) {
-        if (error instanceof StaleExecutionFenceError)
+        if (error instanceof ExecutionFenceError)
             throw error;
         // Diagnostics are best-effort; never let them break completion.
     }
@@ -1518,7 +1520,7 @@ export async function setRunTerminalReason(runId, terminalReason) {
         }), { runId });
     }
     catch (error) {
-        if (error instanceof StaleExecutionFenceError)
+        if (error instanceof ExecutionFenceError)
             throw error;
         // Diagnostics are best-effort; never let them break completion.
     }
@@ -1766,7 +1768,7 @@ export async function recordRunDiagnostic(runId, stage, detail) {
         }
     }
     catch (error) {
-        if (error instanceof StaleExecutionFenceError)
+        if (error instanceof ExecutionFenceError)
             throw error;
         // Diagnostics are best-effort; never let them break the run or the route.
     }

package/dist/agent/tool-error-redaction.d.ts

@@ -1,3 +1,10 @@
-export declare function redactSensitiveFields(value: unknown): unknown;
+/**
+ * `compoundNames` also redacts names such as `clientSecret`, `x-api-key`,
+ * `githubToken` or `embedTicket`.
+ * Tool-error text leaves it off and keeps names like `mySecret` readable.
+ */
+export declare function redactSensitiveFields(value: unknown, options?: {
+    compoundNames?: boolean;
+}): unknown;
 export declare function sanitizeToolErrorText(value: string): string;
 export declare function sanitizeToolErrorValue(value: unknown): string;

package/dist/agent/tool-error-redaction.js

@@ -1,22 +1,85 @@
+import { EMBED_RESULT_SENSITIVE_KEYS } from "../mcp/embed-redaction.js";
 const REDACTED = "[REDACTED]";
 const SENSITIVE_FIELD_PATTERN = /^(authorization|cookie|api[_-]?key|password|secret|token|access[_-]?token|refresh[_-]?token|bearer)$/i;
+// Only the trailing words of a compound name count. A `…Token` is a
+// credential unless it is a cursor such as `nextPageToken`, which an agent
+// needs for a retry. A `…Ticket` can redeem an embed session.
+const SENSITIVE_LAST_WORDS = new Set([
+    "authorization",
+    "cookie",
+    "credential",
+    "credentials",
+    "passphrase",
+    "password",
+    "secret",
+    "secrets",
+    "ticket",
+]);
+const SENSITIVE_LAST_WORD_PAIRS = new Set([
+    "access key",
+    "api key",
+    "private key",
+    "secret key",
+]);
+const CURSOR_TOKEN_QUALIFIERS = new Set([
+    "continuation",
+    "cursor",
+    "delta",
+    "idempotency",
+    "next",
+    "page",
+    "prev",
+    "previous",
+    "resume",
+    "skip",
+    "sync",
+]);
+function isSensitiveCompoundFieldName(key) {
+    if (SENSITIVE_FIELD_PATTERN.test(key) ||
+        EMBED_RESULT_SENSITIVE_KEYS.has(key)) {
+        return true;
+    }
+    const words = key
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter(Boolean);
+    const last = words.at(-1);
+    if (!last)
+        return false;
+    if (SENSITIVE_LAST_WORDS.has(last))
+        return true;
+    if (last === "token") {
+        return words.length > 1 && !CURSOR_TOKEN_QUALIFIERS.has(words.at(-2));
+    }
+    return (words.length > 1 && SENSITIVE_LAST_WORD_PAIRS.has(`${words.at(-2)} ${last}`));
+}
 const OPENAI_LIKE_SECRET_PATTERN = /(^|[^A-Za-z0-9_-])(sk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{24,})(?=$|[^A-Za-z0-9_-])/g;
-export function redactSensitiveFields(value) {
-    return redactWalk(value, new WeakSet());
+/**
+ * `compoundNames` also redacts names such as `clientSecret`, `x-api-key`,
+ * `githubToken` or `embedTicket`.
+ * Tool-error text leaves it off and keeps names like `mySecret` readable.
+ */
+export function redactSensitiveFields(value, options = {}) {
+    const isSensitive = options.compoundNames
+        ? isSensitiveCompoundFieldName
+        : (key) => SENSITIVE_FIELD_PATTERN.test(key);
+    return redactWalk(value, new WeakSet(), isSensitive);
 }
-function redactWalk(value, seen) {
+function redactWalk(value, seen, isSensitive) {
     if (value === null || typeof value !== "object")
         return value;
     if (seen.has(value))
         return "[Circular]";
     seen.add(value);
-    if (Array.isArray(value))
-        return value.map((v) => redactWalk(v, seen));
+    if (Array.isArray(value)) {
+        return value.map((v) => redactWalk(v, seen, isSensitive));
+    }
     const out = {};
     for (const [key, entry] of Object.entries(value)) {
-        out[key] = SENSITIVE_FIELD_PATTERN.test(key)
+        out[key] = isSensitive(key)
             ? REDACTED
-            : redactWalk(entry, seen);
+            : redactWalk(entry, seen, isSensitive);
     }
     return out;
 }

package/dist/collab/awareness.d.ts

@@ -38,19 +38,19 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/collab/routes.d.ts

@@ -21,8 +21,8 @@ export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import
 }>>;
 export declare const postCollabText: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     ok?: undefined;
-    error: string;
     text?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -1,6 +1,6 @@
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/actions/upload-image.d.ts

@@ -42,8 +42,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     url: string;
     id: string;
     provider: string;
-    configured?: undefined;
     error?: undefined;
+    configured?: undefined;
 } | {
     url?: undefined;
     id?: undefined;

package/dist/mcp/actions/create-org-service-token.js

@@ -9,9 +9,11 @@
  *   - Gated to org owners/admins (see service-token-access.ts).
  *   - The token value appears ONLY in this action's response — it is never
  *     stored (only its `jti`) and never logged.
- *   - Not callable by the sandboxed agent tool loop (`toolCallable: false`):
- *     minting a long-lived credential must be an explicit human/HTTP/CLI act,
- *     never a prompt-injection target.
+ *   - Not an agent or MCP tool (`agentTool: false`), and not callable from
+ *     extensions or run-code (`toolCallable: false`): minting a long-lived
+ *     credential must be an explicit human/HTTP/CLI act, never a
+ *     prompt-injection target. `toolCallable: false` alone does not keep it
+ *     out of the agent's tool list.
  *   - Revocable via `revoke-org-service-token` — same `revoked_at` gate the
  *     personal-token revocation path uses.
  *
@@ -54,6 +56,7 @@ export default defineAction({
         allowedActions: allowedActionsSchema.nullable().optional(),
     }),
     requiresAuth: true,
+    agentTool: false,
     toolCallable: false,
     audit: orgAdminAudit({
         targetType: "service-principal",

package/dist/mcp/actions/set-service-principal-lifecycle.js

@@ -36,6 +36,7 @@ export default defineAction({
         lifecycle: z.enum(SERVICE_PRINCIPAL_LIFECYCLES),
         reason: z.string().trim().max(500).optional(),
     }),
+    agentTool: false,
     toolCallable: false,
     audit: orgAdminAudit({
         targetType: "service-principal",

package/dist/mcp/actions/set-service-principal-policy.js

@@ -39,6 +39,7 @@ export default defineAction({
         purpose: purposeSchema.nullable().optional(),
         allowedActions: allowedActionsSchema.nullable().optional(),
     }),
+    agentTool: false,
     toolCallable: false,
     audit: orgAdminAudit({
         targetType: "service-principal",