@agent-native/core 0.84.20 → 0.84.21

package/corpus/core/src/client/sse-event-processor.ts

@@ -49,6 +49,7 @@ export interface SSEEvent {
   /** Server-assigned call identifier emitted on tool_start / tool_done events. */
   id?: string;
   label?: string;
+  progressBytes?: number;
   input?: Record<string, string>;
   result?: string;
   isError?: boolean;
@@ -144,9 +145,58 @@ export class AgentAutoContinueSignal extends Error {
 }
 
 export const SSE_NO_PROGRESS_TIMEOUT_MS = 75_000;
+export const SSE_ACTION_PREPARATION_STALL_TIMEOUT_MS = 90_000;
 
 type ActivityTrailEntry = AgentActivityTrailEntry;
 
+type PreparingActionState = {
+  tool?: string;
+  startedAt?: number;
+  /**
+   * Timestamp of the last real streaming progress for the in-preparation tool
+   * input. The server emits a throttled `activity` heartbeat per
+   * `tool-input-delta`, so while the model is actively streaming a (possibly
+   * very large) tool argument this keeps advancing. The stall guard measures
+   * silence from HERE — not from `startedAt` — so a legitimately large, still-
+   * streaming input is never aborted; only genuine silence (keepalive-only, no
+   * further deltas) can trip it.
+   */
+  lastProgressAt?: number;
+};
+
+function formatProgressBytes(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+
+function activityProgressBytes(ev: SSEEvent): number | undefined {
+  return typeof ev.progressBytes === "number" &&
+    Number.isFinite(ev.progressBytes) &&
+    ev.progressBytes >= 0
+    ? Math.floor(ev.progressBytes)
+    : undefined;
+}
+
+function isPreparingActionActivity(ev: SSEEvent): boolean {
+  if (ev.type !== "activity") return false;
+  const label = (ev.label ?? "").trim().toLowerCase();
+  return label.startsWith("preparing ") && label.includes(" action");
+}
+
+function baseActivityLabel(ev: SSEEvent, tool?: string): string {
+  return humanizeToolLabelText(ev.label ?? "Working", tool);
+}
+
+function visibleActivityLabel(ev: SSEEvent, tool?: string): string {
+  const label = baseActivityLabel(ev, tool);
+  const progressBytes = activityProgressBytes(ev);
+  if (progressBytes === undefined || !isPreparingActionActivity(ev)) {
+    return label;
+  }
+  return `${label} (${formatProgressBytes(progressBytes)} streamed)`;
+}
+
 function findPendingToolCallIndex(
   content: ContentPart[],
   toolName: string,
@@ -199,6 +249,53 @@ function appendActivityTrail(
   }
 }
 
+function updatePreparingActionState(
+  state: PreparingActionState,
+  ev: SSEEvent,
+  now: number,
+) {
+  if (ev.type === "activity" && isPreparingActionActivity(ev)) {
+    const tool = ev.tool?.trim() || undefined;
+    if (!tool) return;
+    if (state.tool !== tool || state.startedAt === undefined) {
+      state.tool = tool;
+      state.startedAt = now;
+    }
+    // Every tool-input activity is a throttled proof the model is still
+    // streaming this action's argument. Treat it as progress so large inputs
+    // that take many seconds/minutes to stream are NOT flagged as stalled.
+    state.lastProgressAt = now;
+    return;
+  }
+
+  if (
+    ev.type === "clear" ||
+    ev.type === "text" ||
+    ev.type === "tool_start" ||
+    ev.type === "tool_done" ||
+    ev.type === "done" ||
+    ev.type === "error" ||
+    ev.type === "missing_api_key"
+  ) {
+    state.tool = undefined;
+    state.startedAt = undefined;
+    state.lastProgressAt = undefined;
+  }
+}
+
+function hasStalledPreparingAction(state: PreparingActionState, now: number) {
+  // Fire only when a tool input has gone SILENT — no further streaming deltas
+  // for the whole window — never merely because a large input has been
+  // streaming for a long time. `lastProgressAt` advances on every delta
+  // heartbeat, so an actively-streaming large output keeps resetting this and
+  // survives; a genuinely stuck prep (keepalive-only, no deltas) trips it.
+  return (
+    state.tool !== undefined &&
+    state.lastProgressAt !== undefined &&
+    now - state.lastProgressAt >= SSE_ACTION_PREPARATION_STALL_TIMEOUT_MS
+  );
+}
+
 async function readChunkWithProgressTimeout(
   reader: ReadableStreamDefaultReader<Uint8Array>,
   lastMeaningfulEventAt: number,
@@ -491,7 +588,7 @@ export function processEvent(
 
   if (ev.type === "activity") {
     const tool = ev.tool?.trim() || undefined;
-    const label = humanizeToolLabelText(ev.label ?? "Working", tool);
+    const label = visibleActivityLabel(ev, tool);
     if (typeof window !== "undefined") {
       window.dispatchEvent(
         new CustomEvent("agent-chat:activity", {
@@ -941,6 +1038,7 @@ export async function* readSSEStream(
   let buf = "";
   let lastMeaningfulEventAt = Date.now();
   const activityTrail: ActivityTrailEntry[] = [];
+  const preparingActionState: PreparingActionState = {};
   const processEventState: ProcessEventState = {
     completedToolsAfterLastAssistantText: new Set(),
   };
@@ -1000,7 +1098,9 @@ export async function* readSSEStream(
           continue;
         }
         sawDataEvent = true;
-        lastMeaningfulEventAt = Date.now();
+        const now = Date.now();
+        lastMeaningfulEventAt = now;
+        updatePreparingActionState(preparingActionState, ev, now);
 
         // Track sequence number for reconnection
         if (ev.seq !== undefined && onSeq) {
@@ -1012,7 +1112,7 @@ export async function* readSSEStream(
         } else if (ev.type === "activity") {
           const tool = ev.tool?.trim() || undefined;
           appendActivityTrail(activityTrail, {
-            label: humanizeToolLabelText(ev.label ?? "Working", tool),
+            label: baseActivityLabel(ev, tool),
             ...(tool ? { tool } : {}),
           });
         } else if (ev.type === "tool_start") {
@@ -1039,6 +1139,12 @@ export async function* readSSEStream(
         );
 
         if (result) yield withStreamMetadata(result);
+        if (hasStalledPreparingAction(preparingActionState, Date.now())) {
+          throw new AgentAutoContinueSignal({
+            reason: "no_progress",
+            activityTrail: [...activityTrail],
+          });
+        }
         if (action === "auto_continue") {
           throw new AgentAutoContinueSignal(
             autoContinue
@@ -1099,6 +1205,8 @@ export async function readSSEStreamRaw(
   const decoder = new TextDecoder();
   let buf = "";
   let lastMeaningfulEventAt = Date.now();
+  const activityTrail: ActivityTrailEntry[] = [];
+  const preparingActionState: PreparingActionState = {};
   const processEventState: ProcessEventState = {
     completedToolsAfterLastAssistantText: new Set(),
   };
@@ -1134,12 +1242,37 @@ export async function readSSEStreamRaw(
           continue;
         }
         sawDataEvent = true;
-        lastMeaningfulEventAt = Date.now();
+        const now = Date.now();
+        lastMeaningfulEventAt = now;
+        updatePreparingActionState(preparingActionState, ev, now);
 
         if (ev.seq !== undefined && onSeq) {
           onSeq(ev.seq);
         }
 
+        if (ev.type === "clear") {
+          activityTrail.length = 0;
+        } else if (ev.type === "activity") {
+          const tool = ev.tool?.trim() || undefined;
+          appendActivityTrail(activityTrail, {
+            label: baseActivityLabel(ev, tool),
+            ...(tool ? { tool } : {}),
+          });
+        } else if (ev.type === "tool_start") {
+          const tool = ev.tool ?? "unknown";
+          appendActivityTrail(activityTrail, {
+            label: runningToolLabel(tool),
+            tool,
+          });
+        } else if (ev.type === "tool_done") {
+          const tool = ev.tool ?? "unknown";
+          for (let i = activityTrail.length - 1; i >= 0; i--) {
+            if (activityTrail[i]?.tool === tool) {
+              activityTrail.splice(i, 1);
+            }
+          }
+        }
+
         const { action, autoContinue } = processEvent(
           ev,
           content,
@@ -1159,9 +1292,18 @@ export async function readSSEStreamRaw(
         if (action === "auto_continue") {
           onUpdate([...content]);
           throw new AgentAutoContinueSignal(
-            autoContinue ?? { reason: "stream_ended" },
+            autoContinue
+              ? { ...autoContinue, activityTrail: [...activityTrail] }
+              : { reason: "stream_ended", activityTrail: [...activityTrail] },
           );
         }
+        if (hasStalledPreparingAction(preparingActionState, Date.now())) {
+          onUpdate([...content]);
+          throw new AgentAutoContinueSignal({
+            reason: "no_progress",
+            activityTrail: [...activityTrail],
+          });
+        }
         if (
           action === "done" ||
           action === "error" ||

package/corpus/core/src/file-upload/builder.ts

@@ -27,6 +27,15 @@ function makeBody(bytes: Uint8Array, mimeType: string): BodyInit {
     : (bytes as unknown as BodyInit);
 }
 
+function shouldUseSignedUrlUpload(
+  bytes: Uint8Array,
+  mimeType: string,
+): boolean {
+  return (
+    bytes.byteLength > LARGE_FILE_THRESHOLD_BYTES || /^video\//i.test(mimeType)
+  );
+}
+
 function fetchWithTimeout(url: string, init: RequestInit): Promise<Response> {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), UPLOAD_TIMEOUT_MS);
@@ -86,6 +95,7 @@ async function uploadLargeFileViaSignedUrl(
     privateKey,
     assetId,
     input.filename,
+    { skipCompressionWait: input.skipCompressionWait },
   );
   console.log(`[builder-upload] done [${assetId}]: ${url}`);
   return { url, id, provider: "builder" };
@@ -139,19 +149,21 @@ async function completeBuilderUpload(
   privateKey: string,
   assetId: string,
   filename: string | undefined,
+  options?: { skipCompressionWait?: boolean },
 ): Promise<{ url: string; id?: string }> {
   const host = builderUploadHost();
-  const res = await fetchWithTimeout(
-    new URL("/api/v1/upload/complete", host).toString(),
-    {
-      method: "POST",
-      headers: {
-        Authorization: `Bearer ${privateKey}`,
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify({ assetId, name: filename }),
+  const url = new URL("/api/v1/upload/complete", host);
+  if (options?.skipCompressionWait) {
+    url.searchParams.set("skipCompressionWait", "true");
+  }
+  const res = await fetchWithTimeout(url.toString(), {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${privateKey}`,
+      "Content-Type": "application/json",
     },
-  );
+    body: JSON.stringify({ assetId, name: filename }),
+  });
   await assertOk(res, "Builder.io upload complete failed");
   const json = (await res.json()) as { url?: string; id?: string };
   if (!json.url) throw new Error("Builder.io upload/complete returned no URL");
@@ -204,7 +216,8 @@ export const builderFileUploadProvider: FileUploadProvider = {
   id: "builder",
   name: "Builder.io",
   isConfigured: () => !!process.env.BUILDER_PRIVATE_KEY,
-  upload: async ({ data, filename, mimeType }: FileUploadInput) => {
+  upload: async (input: FileUploadInput) => {
+    const { data, filename, mimeType } = input;
     const { resolveBuilderPrivateKey } =
       await import("../server/credential-provider.js");
     const privateKey = await resolveBuilderPrivateKey();
@@ -226,9 +239,9 @@ export const builderFileUploadProvider: FileUploadProvider = {
       data instanceof Uint8Array ? data : new Uint8Array(data as any);
     const mb = (bytes.byteLength / (1024 * 1024)).toFixed(1);
 
-    if (bytes.byteLength > LARGE_FILE_THRESHOLD_BYTES) {
+    if (shouldUseSignedUrlUpload(bytes, bareMimeType)) {
       return uploadLargeFileViaSignedUrl(
-        { data, filename, mimeType },
+        input,
         privateKey,
         bareMimeType,
         bytes,
@@ -241,6 +254,9 @@ export const builderFileUploadProvider: FileUploadProvider = {
 
     const url = new URL("/api/v1/upload", builderUploadHost());
     if (filename) url.searchParams.set("name", filename);
+    if (input.skipCompressionWait) {
+      url.searchParams.set("skipCompressionWait", "true");
+    }
 
     const response = await uploadSmallFile(url, {
       method: "POST",
@@ -366,7 +382,7 @@ export const builderFileUploadProvider: FileUploadProvider = {
         : new Error("GCS PUT failed after retries");
     },
 
-    async completeSession(session, filename) {
+    async completeSession(session, filename, options) {
       const { resolveBuilderPrivateKey } =
         await import("../server/credential-provider.js");
       const privateKey = await resolveBuilderPrivateKey();
@@ -378,6 +394,11 @@ export const builderFileUploadProvider: FileUploadProvider = {
         privateKey,
         assetId,
         filename,
+        {
+          skipCompressionWait:
+            options?.skipCompressionWait ||
+            session.meta.skipCompressionWait === true,
+        },
       );
       console.log(`[builder-resumable] upload complete: ${url}`);
       return url;

package/corpus/core/src/file-upload/types.ts

@@ -16,6 +16,8 @@ export interface FileUploadInput {
   mimeType?: string;
   /** Optional owner email for per-user scoping in fallback storage. */
   ownerEmail?: string;
+  /** Builder.io upload hint: return after asset registration instead of waiting for server-side compression. */
+  skipCompressionWait?: boolean;
 }
 
 export interface FileUploadResult {
@@ -77,6 +79,7 @@ export interface FileUploadProvider {
     completeSession(
       session: ResumableUploadSession,
       filename: string,
+      options?: { skipCompressionWait?: boolean },
     ): Promise<string>;
   };
 }

package/corpus/core/src/integrations/a2a-continuation-processor.ts

@@ -150,11 +150,11 @@ async function processClaimedContinuation(
     return;
   }
 
-  const client = new A2AClient(
-    continuation.agentUrl,
-    await signContinuationToken(continuation),
-    { requestTimeoutMs: POLL_REQUEST_TIMEOUT_MS },
-  );
+  const auth = await signContinuationToken(continuation);
+  const client = new A2AClient(continuation.agentUrl, auth.apiKey, {
+    requestTimeoutMs: POLL_REQUEST_TIMEOUT_MS,
+    ...(auth.apiKeyFallbacks ? { fallbackApiKeys: auth.apiKeyFallbacks } : {}),
+  });
   const deadline = Date.now() + PROCESSOR_WAIT_MS;
   let task: Task | null = null;
 
@@ -438,28 +438,35 @@ function sanitizeFailureReason(reason: string): string {
 
 async function signContinuationToken(
   continuation: A2AContinuation,
-): Promise<string | undefined> {
+): Promise<{ apiKey?: string; apiKeyFallbacks?: string[] }> {
   if (continuation.a2aAuthToken === "") {
-    return undefined;
+    return {};
   }
 
   const storedToken = continuation.a2aAuthToken;
-  if (storedToken && !isLikelyJwt(storedToken)) return storedToken;
-
-  const freshToken = await signFreshContinuationToken(continuation);
-  if (freshToken) return freshToken;
-  if (!storedToken) return undefined;
+  if (storedToken && !isLikelyJwt(storedToken)) return { apiKey: storedToken };
+
+  const freshTokens = await signFreshContinuationTokens(continuation);
+  if (freshTokens.length > 0) {
+    return {
+      apiKey: freshTokens[0],
+      ...(freshTokens.length > 1
+        ? { apiKeyFallbacks: freshTokens.slice(1) }
+        : {}),
+    };
+  }
+  if (!storedToken) return {};
 
   // Older continuations may have persisted the initial short-lived JWT. Avoid
   // replaying it forever after expiry; opaque legacy bearer keys can still be
   // reused because we cannot re-mint those.
-  if (isLikelyJwt(storedToken)) return undefined;
-  return storedToken;
+  if (isLikelyJwt(storedToken)) return {};
+  return { apiKey: storedToken };
 }
 
-async function signFreshContinuationToken(
+async function signFreshContinuationTokens(
   continuation: A2AContinuation,
-): Promise<string | undefined> {
+): Promise<string[]> {
   let orgDomain: string | undefined;
   let orgSecret: string | undefined;
   if (continuation.orgId) {
@@ -472,17 +479,35 @@ async function signFreshContinuationToken(
   }
 
   if (!continuation.ownerEmail || !(orgSecret || process.env.A2A_SECRET)) {
-    return undefined;
+    return [];
   }
 
-  try {
-    return await signA2AToken(continuation.ownerEmail, orgDomain, orgSecret, {
-      expiresIn: "30m",
-      preferGlobalSecret: !orgSecret,
-    });
-  } catch {
-    return undefined;
+  const tokens: string[] = [];
+  const add = (token: string | undefined) => {
+    if (token && !tokens.includes(token)) tokens.push(token);
+  };
+
+  if (process.env.A2A_SECRET?.trim()) {
+    try {
+      add(
+        await signA2AToken(continuation.ownerEmail, orgDomain, orgSecret, {
+          expiresIn: "30m",
+          preferGlobalSecret: true,
+        }),
+      );
+    } catch {}
+  }
+  if (orgSecret) {
+    try {
+      add(
+        await signA2AToken(continuation.ownerEmail, orgDomain, orgSecret, {
+          expiresIn: "30m",
+          preferGlobalSecret: false,
+        }),
+      );
+    } catch {}
   }
+  return tokens;
 }
 
 function isLikelyJwt(token: string): boolean {

package/corpus/core/src/mcp/builtin-tools.ts

@@ -260,6 +260,9 @@ async function createA2AClientForAskApp(origin: string): Promise<{
   return {
     client: new A2AClient(origin, auth.apiKey, {
       requestTimeoutMs: ASK_APP_A2A_REQUEST_TIMEOUT_MS,
+      ...(auth.apiKeyFallbacks
+        ? { fallbackApiKeys: auth.apiKeyFallbacks }
+        : {}),
     }),
     metadata,
   };

package/corpus/core/src/mcp/org-directory.ts

@@ -146,6 +146,15 @@ function scopedCacheKey(
   ].join("|");
 }
 
+function authTokenAttempts(auth: {
+  apiKey?: string;
+  apiKeyFallbacks?: string[];
+}): string[] {
+  return [auth.apiKey, ...(auth.apiKeyFallbacks ?? [])].filter(
+    (token): token is string => typeof token === "string" && token.length > 0,
+  );
+}
+
 function serviceScopedCacheKey(origin: string, orgId: string): string {
   return [origin, `service-org:${orgId}`].join("|");
 }
@@ -200,7 +209,8 @@ export async function fetchOrgApps(opts?: {
     const auth = serviceOrgId
       ? await resolveOrgDirectoryServiceAuth(serviceOrgId)
       : await resolveOrgDirectoryCallerAuth();
-    if (!auth.apiKey) {
+    const attempts = authTokenAttempts(auth);
+    if (attempts.length === 0) {
       // No signed token available (no A2A secret / no caller identity) — the
       // directory requires the org bearer, so degrade silently to local-only.
       return [];
@@ -215,19 +225,23 @@ export async function fetchOrgApps(opts?: {
       }
     }
 
-    const res = await fetch(`${origin}/_agent-native/org/apps`, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${auth.apiKey}`,
-        Accept: "application/json",
-      },
-      signal: AbortSignal.timeout(4000),
-    });
-    if (res.ok) {
-      const json = (await res.json()) as { apps?: unknown };
-      const list = Array.isArray(json?.apps) ? json.apps : [];
-      apps = list.map(normalizeApp).filter((a): a is OrgApp => a !== null);
-      ttl = SUCCESS_TTL_MS;
+    for (let i = 0; i < attempts.length; i++) {
+      const res = await fetch(`${origin}/_agent-native/org/apps`, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${attempts[i]}`,
+          Accept: "application/json",
+        },
+        signal: AbortSignal.timeout(4000),
+      });
+      if (res.ok) {
+        const json = (await res.json()) as { apps?: unknown };
+        const list = Array.isArray(json?.apps) ? json.apps : [];
+        apps = list.map(normalizeApp).filter((a): a is OrgApp => a !== null);
+        ttl = SUCCESS_TTL_MS;
+        break;
+      }
+      if (res.status !== 401 || i >= attempts.length - 1) break;
     }
     // Non-2xx ⇒ leave apps=[] with the short EMPTY_TTL (silent degrade).
   } catch {
@@ -252,6 +266,7 @@ export function _resetOrgDirectoryCache(): void {
 
 async function resolveOrgDirectoryCallerAuth(): Promise<{
   apiKey?: string;
+  apiKeyFallbacks?: string[];
   userEmail?: string;
   orgId?: string;
   orgDomain?: string;
@@ -266,6 +281,7 @@ async function resolveOrgDirectoryCallerAuth(): Promise<{
 
 async function resolveOrgDirectoryServiceAuth(orgId: string): Promise<{
   apiKey?: string;
+  apiKeyFallbacks?: string[];
   userEmail?: string;
   orgId?: string;
   orgDomain?: string;
@@ -285,12 +301,42 @@ async function resolveOrgDirectoryServiceAuth(orgId: string): Promise<{
       import("./connect-store.js"),
     ]);
     const userEmail = serviceIdentityEmail("mcp-client", trimmedOrgId);
-    const apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {
-      expiresIn: "5m",
-      preferGlobalSecret: !orgSecret,
-      extraClaims: { org_id: trimmedOrgId },
-    });
-    return { apiKey, userEmail, orgId: trimmedOrgId, orgDomain };
+    const apiKeyAttempts: string[] = [];
+    const addApiKeyAttempt = (token: string | undefined) => {
+      if (!token || apiKeyAttempts.includes(token)) return;
+      apiKeyAttempts.push(token);
+    };
+    if (process.env.A2A_SECRET?.trim()) {
+      try {
+        addApiKeyAttempt(
+          await signA2AToken(userEmail, orgDomain, orgSecret, {
+            expiresIn: "5m",
+            preferGlobalSecret: true,
+            extraClaims: { org_id: trimmedOrgId },
+          }),
+        );
+      } catch {}
+    }
+    if (orgSecret) {
+      try {
+        addApiKeyAttempt(
+          await signA2AToken(userEmail, orgDomain, orgSecret, {
+            expiresIn: "5m",
+            preferGlobalSecret: false,
+            extraClaims: { org_id: trimmedOrgId },
+          }),
+        );
+      } catch {}
+    }
+    return {
+      apiKey: apiKeyAttempts[0],
+      ...(apiKeyAttempts.length > 1
+        ? { apiKeyFallbacks: apiKeyAttempts.slice(1) }
+        : {}),
+      userEmail,
+      orgId: trimmedOrgId,
+      orgDomain,
+    };
   } catch {
     return { orgId: trimmedOrgId, orgDomain };
   }

package/corpus/core/src/scripts/call-agent.ts

@@ -1,6 +1,11 @@
 import { createHash } from "node:crypto";
 
-import { A2ATaskTimeoutError, callAgent, signA2AToken } from "../a2a/client.js";
+import {
+  A2ATaskTimeoutError,
+  callAgent,
+  shouldPreferGlobalA2ASecret,
+  signA2AToken,
+} from "../a2a/client.js";
 import {
   formatLlmCredentialErrorMessage,
   isLlmCredentialError,
@@ -162,7 +167,7 @@ export async function run(
             callerOrgSecret,
             {
               expiresIn: INTEGRATION_A2A_TOKEN_TTL,
-              preferGlobalSecret: !callerOrgSecret,
+              preferGlobalSecret: shouldPreferGlobalA2ASecret(callerOrgSecret),
             },
           );
         } catch {}