@agent-native/core 0.214.0 → 0.216.0

package/dist/file-upload/actions/manage-file-storage.js

@@ -27,6 +27,11 @@ export default defineAction({
             ? "Cleared file storage credentials"
             : "Saved file storage settings",
     }),
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        openWorldHint: false,
+    },
     run: async ({ operation, ...values }, ctx) => operation === "clear"
         ? clearFileStorage(ctx)
         : { removedKeys: [], status: await saveFileStorage(ctx, values) },

package/dist/file-upload/actions/upload-image.d.ts

@@ -42,8 +42,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
     configured?: undefined;
+    error?: undefined;
 } | {
     url?: undefined;
     id?: undefined;

package/dist/file-upload/actions/upload-image.js

@@ -442,6 +442,11 @@ export default defineAction({
         .refine((args) => args.cleanup ? !!args.idempotencyKey : !!args.data || !!args.url, {
         message: "Either a data/url upload or an idempotencyKey cleanup is required.",
     }),
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        openWorldHint: true,
+    },
     run: async (args) => {
         const idempotencyKey = args.idempotencyKey?.trim();
         if (args.cleanup && idempotencyKey) {

package/dist/history/actions/create-resource-version.js

@@ -13,6 +13,11 @@ const schema = z.object({
 export default defineAction({
     description: "Create a reusable version-history snapshot for a resource.",
     schema,
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: false,
+    },
     run: async (args, ctx) => {
         const actionCtx = ctx;
         const access = await assertVersionedResourceAccess(args.resourceType, args.resourceId, actionCtx, "editor");

package/dist/history/actions/restore-resource-version.js

@@ -16,6 +16,11 @@ const schema = z
 export default defineAction({
     description: "Restore a resource from a reusable version-history snapshot.",
     schema,
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        openWorldHint: false,
+    },
     run: async (args, ctx) => {
         const actionCtx = ctx;
         const scope = {

package/dist/ingestion/index.d.ts

@@ -1,7 +1,7 @@
 export { acquireIngestionLease, assertInventoryComplete, consumeIngestionBudget, createIngestionBudgetState, createIngestionCheckpoint, ingestionBudgetStopReason, releaseIngestionLease, renewIngestionLease, type AcquireIngestionLeaseInput, type AcquireIngestionLeaseResult, type IngestionBudgetLimits, type IngestionBudgetState, type IngestionBudgetStopReason, type IngestionCheckpoint, type IngestionLease, type IngestionPhase, } from "./orchestration.js";
 export { detectOfficeDocumentType, normalizeDocumentText, parseOfficeDocument, type OfficeDocumentAst, type OfficeDocumentParser, type OfficeDocumentPart, type OfficeDocumentType, type ParsedOfficeDocument, type ParseOfficeDocumentInput, } from "./office.js";
 export { detectSpreadsheetDocumentType, isSpreadsheetDocument, parseSpreadsheetDocument, type ParsedSpreadsheetDocument, type ParsedSpreadsheetSheet, type ParseSpreadsheetDocumentInput, type SpreadsheetDocumentType, } from "./spreadsheet.js";
-export { parsePptxPresentation, type ParsedPptxImage, type ParsedPptxElement, type ParsedPptxGrid, type ParsedPptxParagraph, type ParsedPptxPresentation, type ParsedPptxSlide, type ParsedPptxTextRun, } from "./pptx.js";
+export { DEFAULT_PPTX_IMAGE_BYTE_LIMITS, PptxImageByteLimitError, parsePptxPresentation, type ParsedPptxImage, type ParsedPptxElement, type ParsedPptxGrid, type ParsedPptxParagraph, type ParsedPptxPresentation, type ParsedPptxSlide, type ParsedPptxTextRun, type PptxImageByteLimits, } from "./pptx.js";
 export { extractDocxSections, parseDocxDocument, sanitizeInertDocumentHtml, type ParsedDocxDocument, type ParsedDocxSection, } from "./docx.js";
 export { compositeFigmaColors, extractFigmaTopLevelFrames, figmaColorToHex, figmaContrastRatio, summarizeFigmaFrame, summarizeFigmaNode, type FigmaContextNode, type FigmaFrameSummary, type FigmaRgba, type SummarizeFigmaNodeResult, } from "./figma.js";
 export { cssBlendMode, gradientAngleDegreesFromHandles, gradientGeometryFromTransform, gradientRayAngleDegreesFromHandles, handlePositionsFromArrayTransform, handlePositionsFromObjectTransform, invert2x3, mat2x3FromArray, remapLinearStopPosition, resolveGradientHandles, vectorLength, type BlendModeResult, type BlendVerdict, type GradientGeometry, type GradientHandles, type GradientKind, type Mat2x3Array, type Mat2x3Object, type Vec2, } from "./figma-paint-math.js";

package/dist/ingestion/index.js

@@ -1,7 +1,7 @@
 export { acquireIngestionLease, assertInventoryComplete, consumeIngestionBudget, createIngestionBudgetState, createIngestionCheckpoint, ingestionBudgetStopReason, releaseIngestionLease, renewIngestionLease, } from "./orchestration.js";
 export { detectOfficeDocumentType, normalizeDocumentText, parseOfficeDocument, } from "./office.js";
 export { detectSpreadsheetDocumentType, isSpreadsheetDocument, parseSpreadsheetDocument, } from "./spreadsheet.js";
-export { parsePptxPresentation, } from "./pptx.js";
+export { DEFAULT_PPTX_IMAGE_BYTE_LIMITS, PptxImageByteLimitError, parsePptxPresentation, } from "./pptx.js";
 export { extractDocxSections, parseDocxDocument, sanitizeInertDocumentHtml, } from "./docx.js";
 export { compositeFigmaColors, extractFigmaTopLevelFrames, figmaColorToHex, figmaContrastRatio, summarizeFigmaFrame, summarizeFigmaNode, } from "./figma.js";
 export { cssBlendMode, gradientAngleDegreesFromHandles, gradientGeometryFromTransform, gradientRayAngleDegreesFromHandles, handlePositionsFromArrayTransform, handlePositionsFromObjectTransform, invert2x3, mat2x3FromArray, remapLinearStopPosition, resolveGradientHandles, vectorLength, } from "./figma-paint-math.js";

package/dist/ingestion/pptx.d.ts

@@ -155,7 +155,18 @@ export interface ParsedPptxPresentation {
     };
     hiddenSlideCount?: number;
 }
+export interface PptxImageByteLimits {
+    maxImageBytes: number;
+    maxTotalImageBytes: number;
+}
+export declare const DEFAULT_PPTX_IMAGE_BYTE_LIMITS: Readonly<PptxImageByteLimits>;
+export declare class PptxImageByteLimitError extends Error {
+    readonly limit: "per-image" | "aggregate";
+    readonly maxBytes: number;
+    constructor(limit: "per-image" | "aggregate", maxBytes: number);
+}
 export declare function parsePptxPresentation(fileBuffer: Uint8Array, options?: {
     includeHiddenSlides?: boolean;
+    imageByteLimits?: Readonly<PptxImageByteLimits>;
 }): Promise<ParsedPptxPresentation>;
 export declare function parsePptxSlideMetadata(value: unknown): ParsedPptxSlideMetadata;

package/dist/ingestion/pptx.js

@@ -1,5 +1,34 @@
 import { loadOptionalPeer } from "../shared/optional-peer.js";
+export const DEFAULT_PPTX_IMAGE_BYTE_LIMITS = Object.freeze({
+    maxImageBytes: 10 * 1024 * 1024,
+    maxTotalImageBytes: 50 * 1024 * 1024,
+});
+export class PptxImageByteLimitError extends Error {
+    limit;
+    maxBytes;
+    constructor(limit, maxBytes) {
+        super(`PPTX image data exceeded its ${limit} byte limit.`);
+        this.name = "PptxImageByteLimitError";
+        this.limit = limit;
+        this.maxBytes = maxBytes;
+    }
+}
+function resolvePptxImageByteLimits(limits) {
+    const configured = limits ?? DEFAULT_PPTX_IMAGE_BYTE_LIMITS;
+    if (!Number.isSafeInteger(configured.maxImageBytes) ||
+        configured.maxImageBytes < 0 ||
+        !Number.isSafeInteger(configured.maxTotalImageBytes) ||
+        configured.maxTotalImageBytes < 0) {
+        throw new RangeError("PPTX image byte limits must be non-negative integers.");
+    }
+    return {
+        maxImageBytes: configured.maxImageBytes,
+        maxTotalImageBytes: configured.maxTotalImageBytes,
+    };
+}
 export async function parsePptxPresentation(fileBuffer, options = {}) {
+    const imageByteLimits = resolvePptxImageByteLimits(options.imageByteLimits);
+    const imageBudget = { totalBytes: 0, limits: imageByteLimits };
     const dependencies = await loadPptxDependencies();
     const loadZip = dependencies.loadZip.bind(dependencies);
     const parseXml = dependencies.parseXml.bind(dependencies);
@@ -127,6 +156,7 @@ export async function parsePptxPresentation(fileBuffer, options = {}) {
             themeCache,
             masterInfoCache,
             templateContextCache,
+            imageBudget,
         })) ?? fallbackContext;
         const number = slideNumber(slidePath);
         elements = await parseSlideElements({
@@ -143,6 +173,7 @@ export async function parsePptxPresentation(fileBuffer, options = {}) {
             placeholderDefaults: slideMasterContext.placeholderDefaults,
             slideNumber: slides.length + 1,
             tableStyles,
+            imageBudget,
         });
         images.unshift(...slideMasterContext.layerImages);
         elements.unshift(...substituteSlideNumber(slideMasterContext.layerElements, slides.length + 1));
@@ -372,6 +403,7 @@ async function buildSlideTemplateContext(args) {
             slideHeightEmu: args.slideHeightEmu,
             images: layerImages,
             colorContext,
+            imageBudget: args.imageBudget,
         })));
     }
     return {
@@ -410,6 +442,7 @@ async function parseTemplateLayerElements(args) {
             images,
             tablesDegraded,
             colorContext: args.colorContext,
+            imageBudget: args.imageBudget,
             context: { matrix: IDENTITY_MAT, rotation: 0 },
         })));
     }
@@ -562,6 +595,7 @@ async function parseSlideElements(args) {
                 y: 0,
                 width: args.slideWidthEmu ?? 0,
                 height: args.slideHeightEmu ?? 0,
+                imageBudget: args.imageBudget,
             });
             if (image) {
                 args.images.unshift(image.image);
@@ -671,6 +705,7 @@ async function parseShapeFragment(fragment, args) {
             width: transform.width,
             height: transform.height,
             crop: parseImageCrop(node),
+            imageBudget: args.imageBudget,
         });
         if (!image)
             return [];
@@ -1652,8 +1687,9 @@ async function loadPptxImage(args) {
     if (!imageFile)
         return null;
     const name = imagePath.split("/").at(-1) ?? "image";
+    const imageData = await readPptxImageWithinBudget(imageFile, args.imageBudget);
     const image = {
-        data: new Uint8Array(await imageFile.async("nodebuffer")),
+        data: new Uint8Array(imageData),
         mimeType: imageMimeType(name),
         name,
         aspectRatio: args.width && args.height ? args.width / args.height : undefined,
@@ -1679,6 +1715,50 @@ async function loadPptxImage(args) {
         },
     };
 }
+async function readPptxImageWithinBudget(imageFile, budget) {
+    const stream = imageFile.nodeStream("nodebuffer");
+    return await new Promise((resolve, reject) => {
+        const chunks = [];
+        let imageBytes = 0;
+        let settled = false;
+        const fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            stream.destroy();
+            reject(error);
+        };
+        stream.on("data", (chunk) => {
+            if (settled)
+                return;
+            const nextImageBytes = imageBytes + chunk.byteLength;
+            if (nextImageBytes > budget.limits.maxImageBytes) {
+                fail(new PptxImageByteLimitError("per-image", budget.limits.maxImageBytes));
+                return;
+            }
+            if (budget.totalBytes + nextImageBytes >
+                budget.limits.maxTotalImageBytes) {
+                fail(new PptxImageByteLimitError("aggregate", budget.limits.maxTotalImageBytes));
+                return;
+            }
+            imageBytes = nextImageBytes;
+            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        });
+        stream.on("error", (error) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(error);
+        });
+        stream.on("end", () => {
+            if (settled)
+                return;
+            settled = true;
+            budget.totalBytes += imageBytes;
+            resolve(Buffer.concat(chunks, imageBytes));
+        });
+    });
+}
 function flattenElementText(elements) {
     const output = [];
     const textElements = elements.filter((element) => element.kind === "text" && element.paragraphs);

package/dist/integrations/actions/manage-messaging-channel.js

@@ -44,6 +44,11 @@ export default defineAction({
             }
         },
     }),
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        openWorldHint: true,
+    },
     run: async ({ operation, platform, values }, ctx) => {
         switch (operation) {
             case "save-credentials":

package/dist/jobs/scheduler.js

@@ -9,6 +9,7 @@ import { backgroundRunCutOffReason, checkBackgroundAutomationCredentials, isBack
 import { nextOccurrence, isValidCron, describeCron, effectiveTimezone, } from "./cron.js";
 import { buildJobResourceContent, isRecoveredFactoryJob, jobBelongsToApp, parseJobResource, patchJobFrontmatterFields, recoveredFactoryOwnerOrgId, } from "./frontmatter.js";
 import { dispatchRemoteAutomation, finishRemoteAutomationHistory, getRemoteAutomationStatus, } from "./remote-execution.js";
+import { automationRunOwnership } from "./run-history-ownership.js";
 import { automationRunClaimLeaseMs, claimAutomationRun, finishAutomationRun, getAutomationRun, listAutomationRuns, RUNS_RETAINED_PER_AUTOMATION, } from "./run-history.js";
 import { acquireAutomationSchedulerLease, recordAutomationSchedulerHealth, releaseAutomationSchedulerLease, renewAutomationSchedulerLease, AUTOMATION_SCHEDULER_LEASE_RENEWAL_MS, AutomationSchedulerLeaseLostError, } from "./scheduler-health.js";
 import { reapStaleWork } from "./stale-reaper.js";
@@ -273,7 +274,7 @@ async function processRecurringJobsWithLease(deps, leaseSignal, assertCanStart)
                     meta.nextRun = nextOccurrence(meta.schedule, now, meta.timezone).toISOString();
                 }
                 if (await updateResource(resource, meta, body)) {
-                    await recoverStaleAutomationHistory(resource.owner, resource.path, now);
+                    await recoverStaleAutomationHistory(staleHistoryOwner(resource, meta), resource.path, now);
                 }
                 continue;
             }
@@ -462,6 +463,21 @@ async function processRecurringJobsWithLease(deps, leaseSignal, assertCanStart)
         });
     }
 }
+/**
+ * The owner the runner recorded this automation's history under: a legacy
+ * shared resource has no organization in its owner, so the resolved execution
+ * identity decides (the organization for an org-bound run, the creator
+ * otherwise). Recovery must query that owner, not the resource owner.
+ */
+function staleHistoryOwner(resource, meta) {
+    const effectiveRunAs = meta.runAs ?? "creator";
+    const executionOwner = effectiveRunAs === "creator"
+        ? meta.createdBy?.trim() || resource.owner
+        : resource.owner;
+    return automationRunOwnership(resource.owner, executionOwner, recoveredFactoryOwnerOrgId(meta, resource.path, resource.owner) ??
+        meta.orgId ??
+        null).owner;
+}
 async function recoverStaleAutomationHistory(owner, path, now) {
     const automation = path.replace(/^jobs\//, "").replace(/\.md$/, "");
     const nowMs = now.getTime();

package/dist/labs/actions/set-lab.js

@@ -10,6 +10,11 @@ export default defineAction({
     description: "Opt the current user into or out of one registered lab. Unset preferences inherit declared legacy flags or use the app-defined default; labs may expose new or unstable features.",
     schema,
     http: { method: "POST" },
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: false,
+    },
     run: async (args, ctx) => {
         const email = ctx?.userEmail;
         if (!email)

package/dist/localization/actions/set-localization-preference.js

@@ -20,6 +20,11 @@ export default defineAction({
         when: (_args, result) => normalizeActionChangeResult(result) !== null,
         projectResult: (_args, result) => normalizeActionChangeResult(result),
     },
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: false,
+    },
     run: async (args, ctx) => {
         if (!ctx?.userEmail)
             throw new Error("Not authenticated.");

package/dist/observability/actions/save-observability-instruction-update.js

@@ -13,6 +13,11 @@ const schema = z.object({
 export default defineAction({
     description: "Save a human-proposed instruction update for an agent output. The draft is explicit and never applied automatically.",
     schema,
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: false,
+    },
     authorize: authorizeObservabilityOrgAdmin,
     run: async (args, ctx) => {
         const { userId, orgId } = getObservabilityOrgAdminAccess(ctx);

package/dist/observability/actions/save-observability-review-summary.js

@@ -95,6 +95,11 @@ function artifactEvidenceMatches(source, appId, artifactId) {
 }
 export default defineAction({
     description: "Persist a concise human-review summary for a run. Artifact IDs must exactly match IDs returned by get-observability-review-summary-source; do not create, guess, or infer IDs. Include only real design, slide-deck, or analytics artifacts.",
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        openWorldHint: false,
+    },
     schema: z
         .object({
         runId: z

package/dist/progress/routes.d.ts

@@ -2,6 +2,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,7 +75,9 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    message?: undefined;
+    id?: undefined;
+    deleted?: undefined;
+    provider?: undefined;
     found?: undefined;
     providers: {
         id: string;
@@ -87,47 +89,45 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    provider?: undefined;
-    deleted?: undefined;
     registered?: undefined;
-    id?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
-    providers?: undefined;
+} | {
+    id?: undefined;
+    deleted?: undefined;
     count?: undefined;
+    providers?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
-    deleted?: undefined;
     registered?: undefined;
-    id?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
-    providers?: undefined;
-    count?: undefined;
+} | {
+    deleted?: undefined;
     provider?: undefined;
+    count?: undefined;
+    providers?: undefined;
     found: boolean;
     id: string;
-    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
+    provider?: undefined;
+    count?: undefined;
     found?: undefined;
     providers?: undefined;
-    count?: undefined;
-    provider?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
+    deleted?: undefined;
+    provider?: undefined;
+    count?: undefined;
     found?: undefined;
     providers?: undefined;
-    count?: undefined;
-    provider?: undefined;
-    deleted?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -317,8 +317,10 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         scope?: "org" | "user" | undefined;
     }, {
         id?: undefined;
-        found?: undefined;
+        provider?: undefined;
+        message?: undefined;
         deleted?: undefined;
+        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -329,46 +331,44 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
-        provider?: undefined;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
         id?: undefined;
+        count?: undefined;
+        message?: undefined;
         deleted?: undefined;
         providers?: undefined;
-        count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
+        provider?: undefined;
+        count?: undefined;
+        message?: undefined;
         deleted?: undefined;
         providers?: undefined;
-        count?: undefined;
-        provider?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
+        provider?: undefined;
+        count?: undefined;
+        message?: undefined;
         found?: undefined;
         providers?: undefined;
-        count?: undefined;
-        provider?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
-        found?: undefined;
+        provider?: undefined;
+        count?: undefined;
         deleted?: undefined;
+        found?: undefined;
         providers?: undefined;
-        count?: undefined;
-        provider?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/provider-api/corpus-jobs.d.ts

@@ -73,6 +73,7 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
     offset?: unknown;
     limit?: unknown;
 }, {
+    deleted?: undefined;
     jobs: {
         id: string;
         name: string;
@@ -83,7 +84,6 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
         updatedAt: string;
     }[];
     total: number;
-    deleted?: undefined;
     jobId?: undefined;
 } | {
     jobs?: undefined;
@@ -91,9 +91,9 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
     deleted: boolean;
     jobId: string;
 } | {
+    deleted?: undefined;
     jobs?: undefined;
     total?: undefined;
-    deleted?: undefined;
     jobId?: undefined;
     hits: Record<string, unknown>[];
     offset: number;

package/dist/provider-api/index.js

@@ -787,7 +787,14 @@ const PROVIDER_CONFIGS = {
         docsUrls: ["https://developers.google.com/drive/api/reference/rest/v3"],
         specUrls: ["https://www.googleapis.com/discovery/v1/apis/drive/v3/rest"],
         allowedHostSuffixes: ["googleapis.com"],
-        templateUses: ["brain", "content", "slides", "dispatch", "analytics"],
+        templateUses: [
+            "brain",
+            "content",
+            "slides",
+            "slides-2",
+            "dispatch",
+            "analytics",
+        ],
         examples: [
             { label: "List files", method: "GET", path: "/files" },
             { label: "Get file metadata", method: "GET", path: "/files/{fileId}" },
@@ -843,7 +850,7 @@ const PROVIDER_CONFIGS = {
         ],
         specUrls: ["https://slides.googleapis.com/$discovery/rest?version=v1"],
         allowedHostSuffixes: ["googleapis.com"],
-        templateUses: ["brain", "content", "slides", "dispatch"],
+        templateUses: ["brain", "content", "slides", "slides-2", "dispatch"],
         examples: [
             {
                 label: "Get presentation with slides and speaker notes",

package/dist/review/actions/consume-review-feedback.js

@@ -10,6 +10,11 @@ const schema = z.object({
 export default defineAction({
     description: "Mark review feedback as consumed by the agent or reviewer workflow.",
     schema,
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: false,
+    },
     run: async (args, ctx) => {
         const actionCtx = ctx;
         await assertReviewableResourceAccess(args.resourceType, args.resourceId, actionCtx, "editor");

package/dist/review/actions/create-review-comment.js

@@ -40,6 +40,11 @@ const schema = z.object({
 export default defineAction({
     description: "Create an inline comment, annotation, or review thread for a resource. Body text supports inline Markdown without headings.",
     schema,
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: true,
+    },
     run: async (args, ctx) => {
         const actionCtx = ctx;
         const access = await assertReviewableResourceAccess(args.resourceType, args.resourceId, actionCtx, "commenter");

package/dist/review/actions/delete-review-comment.js

@@ -12,6 +12,11 @@ const schema = z.object({
 export default defineAction({
     description: "Soft-delete a review comment.",
     schema,
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        openWorldHint: false,
+    },
     run: async (args, ctx) => {
         const actionCtx = ctx;
         const scope = {

package/dist/review/actions/react-to-review-comment.js

@@ -11,6 +11,11 @@ export default defineAction({
         reaction: z.string().trim().min(1).max(32),
         active: z.boolean(),
     }),
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: false,
+    },
     run: async (args, ctx) => {
         await assertReviewableResourceAccess(args.resourceType, args.resourceId, ctx, "commenter");
         const comment = await getReviewCommentById(args.commentId, {

package/dist/review/actions/reply-review-comment.js

@@ -29,6 +29,11 @@ const schema = z.object({
 export default defineAction({
     description: "Reply to an existing review comment thread with inline Markdown text without headings.",
     schema,
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: true,
+    },
     run: async (args, ctx) => {
         const actionCtx = ctx;
         const scope = {

package/dist/review/actions/resolve-review-thread.js

@@ -21,6 +21,11 @@ const schema = z
 export default defineAction({
     description: "Resolve or reopen an inline comment or review thread. Resolution notes support inline Markdown without headings and are only valid when resolving.",
     schema,
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        openWorldHint: false,
+    },
     run: async (args, ctx) => {
         const status = args.status ?? "resolved";
         const actionCtx = ctx;

package/dist/review/actions/send-review-thread-to-agent.js

@@ -10,6 +10,11 @@ const schema = z.object({
 export default defineAction({
     description: "Send one open review thread to the agent queue without routing other threads.",
     schema,
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: false,
+        openWorldHint: false,
+    },
     run: async (args, ctx) => {
         const actionCtx = ctx;
         const access = await assertReviewableResourceAccess(args.resourceType, args.resourceId, actionCtx, "editor");

package/dist/review/actions/set-review-status.js

@@ -12,6 +12,11 @@ const schema = z.object({
 export default defineAction({
     description: "Set the review status for a reusable resource.",
     schema,
+    mcpAnnotations: {
+        readOnlyHint: false,
+        destructiveHint: true,
+        openWorldHint: false,
+    },
     run: async (args, ctx) => {
         const actionCtx = ctx;
         const access = await assertReviewableResourceAccess(args.resourceType, args.resourceId, actionCtx, "editor");