@agent-native/core 0.84.1 → 0.84.3

package/corpus/README.md

@@ -28,4 +28,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 ## Generated Counts
 
 - core files: 2043
-- template files: 4895
+- template files: 4906

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @agent-native/core
 
+## 0.84.3
+
+### Patch Changes
+
+- af049a8: Improve agent-chat timeout recovery so completed tool actions end with a clear saved-result note instead of a generic connection failure, and bound repeated no-progress tool stalls.
+- af049a8: Allow share panels to hide copyable link fields, omit the bottom Done action, and render compact host-provided footer actions.
+- af049a8: Stack nested share popover menus above their parent panel so users can change visibility.
+
+## 0.84.2
+
+### Patch Changes
+
+- 3ff4f55: Extend Builder gateway timeouts for local and background agent-chat runs, and surface recoverable gateway timeout failures instead of silently retrying activity-only tool preparation loops.
+- 3ff4f55: Allow scoped chat surfaces to hide the composer scope badge while keeping thread context attached.
+
 ## 0.84.1
 
 ### Patch Changes

package/corpus/core/docs/design/durable-agent-runs.md

@@ -83,10 +83,11 @@ terminate with an untruthful "done" state.
 not buy more time — it just converts a graceful hand-off into a hard kill. The
 walls, in order:
 
-1. **Builder model gateway hard cap — ~45s.**
-   `MAX_BUILDER_GATEWAY_TIMEOUT_MS = 45_000` in
-   `packages/core/src/agent/engine/builder-engine.ts`. A single model call is
-   killed at the gateway after 45s. **Not raisable** by the framework.
+1. **Builder model gateway foreground cap — ~45s.**
+   Hosted foreground calls keep a 45s cap in
+   `packages/core/src/agent/engine/builder-engine.ts`. Local/non-hosted and
+   proven background-function calls use the longer background-style cap because
+   they are not constrained by the synchronous function wall.
 2. **Serverless function kill — ~60–65s.** The hosting function is terminated
    shortly after; the heartbeat then reaps the run row as `stale_run`.
 
@@ -366,8 +367,8 @@ The whole `auto_continue` / 40s soft-timeout dance exists to stay under the
 **serverless function wall** (~60–65s synchronous on Netlify), not under any
 model limit. Evidence:
 
-- `builder-engine.ts:62` `MAX_LOCAL_BUILDER_GATEWAY_TIMEOUT_MS = 180_000`
-  (3 min) is allowed locally; the run loop has no inherent reason to stop at 40s.
+- `builder-engine.ts` allows the long background gateway cap in local/non-hosted
+  runs; the run loop has no inherent reason to stop at 40s.
 - `run-manager.ts:58,68` `DEFAULT_HOSTED_RUN_SOFT_TIMEOUT_MS` /
   `HOSTED_SOFT_TIMEOUT_CEILING_MS = 40_000` are pinned just under the function
   wall, and `templates/brain/netlify.toml` sets `[functions."*"] timeout = 75`.
@@ -379,10 +380,9 @@ function there is no ~60s wall, so:
 
 - The agent loop can run for minutes in a single invocation with **few or no
   `auto_continue` continuations**.
-- The per-model-call gateway cap (`MAX_BUILDER_GATEWAY_TIMEOUT_MS = 45_000`,
-  `builder-engine.ts:60`) still applies per call — see
-  [Per-model-call gateway cap](#per-model-call-gateway-cap) — but the _run_ is no
-  longer chopped into 40s chunks.
+- The foreground hosted per-model-call gateway cap still applies per call — see
+  [Per-model-call gateway cap](#per-model-call-gateway-cap) — but the _run_ is
+  no longer chopped into 40s chunks.
 
 This is exactly the Layer 1 worker with a concrete long-lived host: Netlify is
 the durable worker, reached through the existing self-dispatch primitive — the
@@ -527,29 +527,27 @@ Minimal client change, because the reconnect machinery already exists:
 
 ## Per-model-call gateway cap
 
-Even in a 15-min function, a _single_ model call is still capped by the Builder
-gateway: `MAX_BUILDER_GATEWAY_TIMEOUT_MS = 45_000` (`builder-engine.ts:60`),
-resolved by `getBuilderGatewayTimeoutMs()` (`:770`) /
-`resolveMaxBuilderGatewayTimeoutMs()` (`:758`). Locally the cap is already
-`180_000` (`:62`) when the gateway base URL is localhost.
+Builder gateway calls now use a runtime-aware cap. Hosted foreground calls keep
+the 45s cap so the synchronous function can still checkpoint before its hard
+wall. Local/non-hosted runs use a longer local cap, and proven Netlify
+background-function runs may use a background cap below the 15-minute function
+wall. The run-manager's 13-minute background soft-timeout should fire before
+the gateway cap in normal durable background operation.
 
 Options, in scope-order:
 
-1. **In scope / safe now:** keep the 45s per-call cap. A 15-min function makes
-   _many_ 45s calls; the cap bounds one call, not the run. This alone delivers
-   the goal (long multi-step runs finish) with **zero gateway changes**.
-2. **Flag, out of scope until confirmed:** raise the per-call cap toward 180s in
-   the background context. `getBuilderGatewayTimeoutMs()` already honors
-   `AGENT_NATIVE_BUILDER_GATEWAY_TIMEOUT_MS`, but it is hard-clamped to
-   `resolveMaxBuilderGatewayTimeoutMs()` = 45s for non-localhost gateways. Raising
-   it requires the **hosted Builder gateway to actually allow >45s upstream** —
-   unverified, and not the framework's call. Until confirmed, do not raise it.
-3. **Escape hatch:** a direct Anthropic engine (no Builder gateway) has no 45s
-   cap, so a single very long call could use it. Out of scope for this change;
-   note it as the lever if a single model call truly needs >45s.
-
-**Recommendation:** ship with option 1. The win is removing the _run-level_
-ceiling; the per-call cap is orthogonal and rarely the binding constraint.
+1. **Foreground hosted:** keep the 45s cap. The synchronous function wall is the
+   constraint, and a larger cap would turn graceful checkpointing into a hard
+   platform kill.
+2. **Local/non-hosted:** allow longer calls by default. Local development should
+   not inherit a serverless wall it does not have.
+3. **Durable background:** allow longer calls only when the runtime proves it is
+   inside the emitted background function. Keep the cap below 15 minutes and
+   above the 13-minute run soft-timeout so background checkpointing still owns
+   logical-turn continuation.
+
+**Recommendation:** preserve this split. Do not raise the foreground cap; use
+durable background for long-running tool-input generation.
 
 ## Idempotency / dedup
 
@@ -626,7 +624,8 @@ only): foreground handler inserts the run row, dispatches, returns the SSE
 stream from `subscribeToRun`. The background `_process-run` claims the run and
 calls the same `startRun` + `runAgentLoop` the inline path uses, with
 `softTimeoutMs ≈ 13min` (new `backgroundFunction` option in
-`resolveRunSoftTimeoutMs`). Per-call gateway cap stays at 45s (option 1).
+`resolveRunSoftTimeoutMs`). Builder gateway calls use the background cap only
+when the worker proves it is inside the emitted background function.
 **Done when:** a long multi-step turn that thrashes today completes in one
 background invocation with zero `auto_continue`, events streaming to the client
 via the SQL-poll path, terminal `done` persisted.
@@ -645,10 +644,10 @@ dispatches, and background→background `auto_continue` chaining for the rare
 > 13-min turn (mirror `agent-teams.ts:1886`). Internal checkpointing (Option A)
 > for monotonic progress across any continuation.
 
-**Slice 4 (optional, separate decision) — raise the per-call gateway cap.**
-Only after confirming the hosted Builder gateway accepts >45s upstream; wire
-`AGENT_NATIVE_BUILDER_GATEWAY_TIMEOUT_MS` through with a background-context max.
-Out of scope until that confirmation exists.
+**Slice 4 — foreground remains capped.**
+Do not raise the hosted foreground per-call gateway cap. Any future tuning
+should stay in the local/background timeout regime unless the synchronous
+platform wall changes.
 
 ## Open risks / unknowns
 

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.84.1",
+  "version": "0.84.3",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/agent/engine/builder-engine.ts

@@ -24,6 +24,7 @@ import {
   normalizeReasoningEffortForModel,
   type ReasoningEffort,
 } from "../../shared/reasoning-effort.js";
+import { isInBackgroundFunctionRuntime } from "../durable-background.js";
 import { BUILDER_MODEL_CONFIG } from "../model-config.js";
 import { getBuilderGatewayRequestHeaders } from "./builder-gateway-headers.js";
 import {
@@ -53,13 +54,20 @@ export const BUILDER_CAPABILITIES: EngineCapabilities = {
 
 export const BUILDER_SUPPORTED_MODELS = BUILDER_MODEL_CONFIG.supportedModels;
 
-// Keep the gateway timeout below the hosted run soft timeout so the agent loop
-// can append a continuation and persist terminal state before serverless hosts
-// (Netlify synchronous Functions are 60s) hard-kill the invocation.
+// Keep the foreground hosted gateway timeout below the synchronous serverless
+// wall so the agent loop can append a continuation and persist terminal state
+// before the host hard-kills the invocation.
 const DEFAULT_BUILDER_GATEWAY_TIMEOUT_MS = 45_000;
-const MAX_BUILDER_GATEWAY_TIMEOUT_MS = 45_000;
-/** Local ai-services has no serverless wall; allow longer streams in dev. */
-const MAX_LOCAL_BUILDER_GATEWAY_TIMEOUT_MS = 180_000;
+const MAX_HOSTED_FOREGROUND_BUILDER_GATEWAY_TIMEOUT_MS = 45_000;
+/**
+ * Netlify background functions have a 15-minute wall. Keep the Builder gateway
+ * ceiling below that, but above the run-manager's 13-minute soft-timeout so
+ * durable background runs checkpoint before this timer wins.
+ */
+const MAX_BACKGROUND_BUILDER_GATEWAY_TIMEOUT_MS = 14 * 60_000;
+/** Local and non-hosted runtimes have no synchronous serverless wall. */
+const MAX_LOCAL_BUILDER_GATEWAY_TIMEOUT_MS =
+  MAX_BACKGROUND_BUILDER_GATEWAY_TIMEOUT_MS;
 const BUILDER_GATEWAY_NETWORK_ERROR_CODE = "builder_gateway_network_error";
 
 export const BUILDER_DEFAULT_MODEL = BUILDER_MODEL_CONFIG.defaultModel;
@@ -315,6 +323,7 @@ class BuilderEngine implements AgentEngine {
       }
 
       yield* parseJsonlStream(reader, opts.model, {
+        abortSignal: gatewayAbort.signal,
         didGatewayTimeout: gatewayAbort.didTimeout,
         gatewayTimeoutMs,
         gatewayUrl,
@@ -430,11 +439,12 @@ async function* emitHttpError(response: Response): AsyncIterable<EngineEvent> {
 // a complete line and the client must still process it.
 async function* readJsonlLines(
   reader: ReadableStreamDefaultReader<Uint8Array>,
+  abortSignal?: AbortSignal,
 ): AsyncIterable<string> {
   const decoder = new TextDecoder();
   let buffer = "";
   while (true) {
-    const { done, value } = await reader.read();
+    const { done, value } = await readStreamChunk(reader, abortSignal);
     if (done) break;
     buffer += decoder.decode(value, { stream: true });
     let newlineIdx = buffer.indexOf("\n");
@@ -457,6 +467,7 @@ async function* parseJsonlStream(
   reader: ReadableStreamDefaultReader<Uint8Array>,
   model: string,
   captureContext: {
+    abortSignal?: AbortSignal;
     didGatewayTimeout?: () => boolean;
     gatewayTimeoutMs?: number;
     gatewayUrl?: URL;
@@ -487,7 +498,10 @@ async function* parseJsonlStream(
   };
 
   try {
-    for await (const line of readJsonlLines(reader)) {
+    for await (const line of readJsonlLines(
+      reader,
+      captureContext.abortSignal,
+    )) {
       let event: any;
       try {
         event = JSON.parse(line);
@@ -722,6 +736,32 @@ async function* parseJsonlStream(
   }
 }
 
+function readStreamChunk(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  abortSignal?: AbortSignal,
+): Promise<ReadableStreamReadResult<Uint8Array>> {
+  if (!abortSignal) return reader.read();
+  if (abortSignal.aborted) {
+    return Promise.reject(abortSignal.reason ?? new Error("Stream aborted"));
+  }
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      reject(abortSignal.reason ?? new Error("Stream aborted"));
+    };
+    abortSignal.addEventListener("abort", onAbort, { once: true });
+    reader.read().then(
+      (value) => {
+        abortSignal.removeEventListener("abort", onAbort);
+        resolve(value);
+      },
+      (err) => {
+        abortSignal.removeEventListener("abort", onAbort);
+        reject(err);
+      },
+    );
+  });
+}
+
 function normalizeGatewayErrorText(raw: string, status: number): string {
   const text = raw.trim();
   const looksHtml = /<html[\s>]|<body[\s>]|<head[\s>]/i.test(text);
@@ -761,6 +801,14 @@ export function createBuilderEngine(
 }
 
 function resolveMaxBuilderGatewayTimeoutMs(): number {
+  if (isInBackgroundFunctionRuntime()) {
+    return MAX_BACKGROUND_BUILDER_GATEWAY_TIMEOUT_MS;
+  }
+
+  if (!isHostedBuilderRuntime()) {
+    return MAX_LOCAL_BUILDER_GATEWAY_TIMEOUT_MS;
+  }
+
   try {
     const base = getBuilderGatewayBaseUrl();
     if (/^https?:\/\/(localhost|127\.0\.0\.1)([:/]|$)/i.test(base)) {
@@ -769,7 +817,31 @@ function resolveMaxBuilderGatewayTimeoutMs(): number {
   } catch {
     // ignore malformed override
   }
-  return MAX_BUILDER_GATEWAY_TIMEOUT_MS;
+  return MAX_HOSTED_FOREGROUND_BUILDER_GATEWAY_TIMEOUT_MS;
+}
+
+function isHostedBuilderRuntime(): boolean {
+  if (
+    process.env.NETLIFY &&
+    process.env.NETLIFY !== "false" &&
+    process.env.NETLIFY_LOCAL !== "true"
+  ) {
+    return true;
+  }
+  if (
+    process.env.AWS_LAMBDA_FUNCTION_NAME &&
+    process.env.NETLIFY_LOCAL !== "true"
+  ) {
+    return true;
+  }
+  return Boolean(
+    process.env.CF_PAGES ||
+    process.env.VERCEL ||
+    process.env.VERCEL_ENV ||
+    process.env.RENDER ||
+    process.env.FLY_APP_NAME ||
+    process.env.K_SERVICE,
+  );
 }
 
 function getBuilderGatewayTimeoutMs(): number {

package/corpus/core/src/agent/production-agent.ts

@@ -3330,7 +3330,10 @@ export async function runAgentLoop(opts: {
       }
 
       const DEFAULT_TOOL_RESULT_CHARS = 50_000;
-      const DEFAULT_TOOL_TIMEOUT_MS = 60_000;
+      // Default action tools should not undercut durable/background runs. The
+      // run-manager still aborts foreground hosted runs around 40s, while
+      // background runs get nearly the full 15-minute function budget.
+      const DEFAULT_TOOL_TIMEOUT_MS = 12 * 60_000;
       const toolTimeoutMs =
         actionEntry.timeoutMs ??
         opts.toolLimits?.timeoutMs ??
@@ -3798,7 +3801,11 @@ export async function runAgentLoop(opts: {
         input: toolCall.input as Record<string, unknown>,
         result,
         ...(isError ? { isError: true } : {}),
-        ...(isError ? { completedSideEffect: false } : {}),
+        ...(isError
+          ? { completedSideEffect: false }
+          : actionEntry.readOnly !== true
+            ? { completedSideEffect: true }
+            : {}),
         ...(mcpApp ? { mcpApp } : {}),
         ...(actionEntry.chatUI ? { chatUI: actionEntry.chatUI } : {}),
       });

package/corpus/core/src/agent/run-loop-with-resume.ts

@@ -79,6 +79,24 @@ async function appendToolCallJournalNote(
   }
 }
 
+async function hasCompletedSideEffectToolCallInCurrentTurn(
+  threadId: string | undefined,
+): Promise<boolean> {
+  if (!threadId) return false;
+  try {
+    const events = await getCurrentTurnEventsForThread(threadId);
+    if (events.length === 0) return false;
+    return events.some(
+      (event) =>
+        event.type === "tool_done" &&
+        event.completedSideEffect === true &&
+        event.isError !== true,
+    );
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Cap on continuation iterations inside a single
  * `runAgentLoopDirectWithSoftTimeout` invocation. The host's hard function
@@ -102,12 +120,12 @@ export const RUN_BUDGET_EXHAUSTED_ERROR_CODE = "run_budget_exhausted";
  * exhausts its in-invocation continuation budget without finishing. Generic and
  * framework-level (not app-specific). Mirrors the `reliable-mutations` skill's
  * "fail loud, retry as a single bulk action" guidance so the user understands
- * the turn stopped before finishing and was not partially saved by the run
- * itself. */
+ * the turn stopped before finishing without implying that earlier completed
+ * tool calls did not persist. */
 export const RUN_BUDGET_EXHAUSTED_MESSAGE =
-  "I ran out of time before finishing this step (hosted runs have a ~40s budget). " +
-  "I stopped rather than leave things half-done — nothing was partially saved by me here. " +
-  "Please retry, ideally as a single bulk action.";
+  "I ran out of time before finishing this step. " +
+  "I stopped rather than keep retrying silently. " +
+  "Check any completed tool cards above before retrying, ideally as one smaller follow-up.";
 
 /**
  * Internal entry point used by the agent-chat plugin's run handler. Wraps
@@ -189,7 +207,11 @@ export async function runAgentLoopDirectWithSoftTimeout(
         // Clear partial text the client received before the abort so the
         // resumed model doesn't re-emit it and produce duplicated output.
         lastAttemptWasUnfinishedContinuation = true;
-        opts.send({ type: "clear" });
+        if (
+          !(await hasCompletedSideEffectToolCallInCurrentTurn(opts.threadId))
+        ) {
+          opts.send({ type: "clear" });
+        }
         appendAgentLoopContinuation(opts.messages, "run_timeout");
         await appendToolCallJournalNote(opts.messages, opts.threadId);
         continue;
@@ -209,7 +231,11 @@ export async function runAgentLoopDirectWithSoftTimeout(
       // the in-memory messages array, so the next attempt re-emits it).
       if (!upstreamSignal.aborted && isResumableEngineError(err)) {
         lastAttemptWasUnfinishedContinuation = true;
-        opts.send({ type: "clear" });
+        if (
+          !(await hasCompletedSideEffectToolCallInCurrentTurn(opts.threadId))
+        ) {
+          opts.send({ type: "clear" });
+        }
         appendAgentLoopContinuation(
           opts.messages,
           continuationReasonForResumableError(err),
@@ -234,7 +260,11 @@ export async function runAgentLoopDirectWithSoftTimeout(
   if (!upstreamSignal.aborted && lastAttemptWasUnfinishedContinuation) {
     // Discard any partial text already streamed for the unfinished attempt so
     // the terminal message stands alone instead of trailing a half sentence.
-    opts.send({ type: "clear" });
+    // Preserve completed tool cards: they are the user's only durable proof
+    // that a side effect landed before the final assistant note timed out.
+    if (!(await hasCompletedSideEffectToolCallInCurrentTurn(opts.threadId))) {
+      opts.send({ type: "clear" });
+    }
     opts.send({
       type: "error",
       error: RUN_BUDGET_EXHAUSTED_MESSAGE,

package/corpus/core/src/agent/run-manager.ts

@@ -46,8 +46,8 @@ const CLEANUP_DELAY_MS = 5 * 60 * 1000;
  *
  * This MUST fire before the two upstream hard walls that otherwise kill a run
  * mid-turn with no chance to hand off:
- *   1. The Builder model gateway hard-caps a single model call at 45s
- *      (builder-engine.ts MAX_BUILDER_GATEWAY_TIMEOUT_MS) — not raisable.
+ *   1. The Builder model gateway keeps a 45s cap only for hosted foreground
+ *      runs; local and proven background-function runs use longer caps.
  *   2. Serverless functions are hard-killed around 60-65s (the heartbeat then
  *      reaps the row as a stale_run).
  * Production data showed every cutoff landing in the 44-70s window with ZERO
@@ -61,11 +61,12 @@ export const DEFAULT_HOSTED_RUN_SOFT_TIMEOUT_MS = 40_000;
 
 /**
  * Hard ceiling for the hosted soft timeout. On a hosted runtime the
- * auto_continue soft timeout can never usefully exceed this — the gateway
- * (45s) / function (~60s) walls kill the run first, so a larger configured or
- * env value just guarantees the cutoff is a hard error instead of a graceful
- * hand-off. Any resolved value above this is clamped down when hosted. Local
- * dev (non-hosted) is left alone so long-running local turns aren't chunked.
+ * foreground auto_continue soft timeout can never usefully exceed this — the
+ * synchronous function (~60s) wall kills the run first, so a larger configured
+ * or env value just guarantees the cutoff is a hard error instead of a graceful
+ * hand-off. Any resolved value above this is clamped down for hosted foreground
+ * runs. Local dev (non-hosted) is left alone so long-running local turns aren't
+ * chunked.
  *
  * IMPORTANT: this clamp is for the INTERACTIVE / foreground path and must NOT
  * be raised. The foreground POST still rides a synchronous serverless function

package/corpus/core/src/agent/thread-data-builder.ts

@@ -18,6 +18,8 @@ interface ContentPart {
   argsText?: string;
   args?: Record<string, string>;
   result?: string;
+  isError?: boolean;
+  completedSideEffect?: boolean;
   mcpApp?: AgentMcpAppPayload;
   chatUI?: ActionChatUIConfig;
 }
@@ -159,6 +161,10 @@ export function buildAssistantMessage(
           part.result === undefined
         ) {
           part.result = event.result ?? "";
+          if (event.isError !== undefined) part.isError = event.isError;
+          if (event.completedSideEffect !== undefined) {
+            part.completedSideEffect = event.completedSideEffect;
+          }
           if (event.mcpApp) part.mcpApp = event.mcpApp;
           if (event.chatUI) part.chatUI = event.chatUI;
           break;