@agent-native/core 0.87.0 → 0.90.1

package/dist/server/prompts/shared-rules.js

@@ -34,13 +34,13 @@ export function sharedRule8(examples, options) {
         return `8. **Use typed actions for data** — Raw database tools are not available on this surface. For app-owned data, use the template's typed actions; for external data, use the appropriate provider or warehouse action — ${warehouseExample}${providerExamples ? `${providerExamples} for their respective providers, ` : ""}etc. When the user names an external provider, that named provider action wins; do not substitute a warehouse tool like BigQuery unless the user explicitly asks for the warehouse copy. When \`provider-api-catalog\`, \`provider-api-docs\`, and \`provider-api-request\` are available, first-class provider actions are shortcuts, not limits: call the endpoint/filter/body/pagination the question needs. For broad searches, joins, counts/classification, or absence claims, fetch every relevant page or a bounded cohort, stage/save large responses, and reduce with \`query-staged-dataset\` or \`run-code\`. Report filters, row counts, failed pages, and gaps; never infer "none found" from sampled, truncated, default-limited, or aborted results.${extensionAdvice}`;
     }
     if (databaseToolsMode === "read") {
-        return `8. **Read-only \`db-*\` tools are internal only** — \`db-schema\` and \`db-query\` ONLY inspect the app's own SQL database (settings, application_state, template tables). Raw SQL write tools such as \`db-exec\` and \`db-patch\` are not available on this surface; use typed app actions for writes. The DB tools CANNOT reach ${providerList.length > 0
+        return `8. **Read-only \`db-*\` tools are internal only** — \`db-schema\` and \`db-query\` ONLY inspect the app's own SQL database (settings, application_state, template tables); \`db-exec\` and \`db-patch\` are not available, so use typed app actions for writes. DB tools cannot reach ${providerList.length > 0
             ? providerList
                 .split(",")
                 .slice(0, 3)
                 .map((s) => s.trim())
                 .join(", ")
-            : "external data sources"}, or any external data source. If the user asks about a table that is NOT in the app schema (e.g. \`dbt_analytics.*\`, \`dbt_mart.*\`, or any fully-qualified \`project.dataset.table\`), use the appropriate template action instead — ${warehouseExample}${providerExamples ? `${providerExamples} for their respective providers, ` : ""}etc. When the user names an external provider, that named provider action wins; do not substitute a warehouse tool like BigQuery unless the user explicitly asks for the warehouse copy. **Never use \`db-query\` for external data — it will fail.** When \`provider-api-catalog\`, \`provider-api-docs\`, and \`provider-api-request\` are available, first-class provider actions are shortcuts, not limits: call the endpoint/filter/body/pagination the question needs. For broad searches, joins, counts/classification, or absence claims, fetch every relevant page or a bounded cohort, stage/save large responses, and reduce with \`query-staged-dataset\` or \`run-code\`. Report filters, row counts, failed pages, and gaps; never infer "none found" from sampled, truncated, default-limited, or aborted results.${extensionAdvice}`;
+            : "external data sources"} or any external source. If a table is NOT in the app schema, use the appropriate template action instead — ${warehouseExample}${providerExamples ? `${providerExamples} for their providers, ` : ""}etc. Named provider actions win over warehouse copies unless the user explicitly asks for the warehouse. **Never use \`db-query\` for external data.** When \`provider-api-catalog\`, \`provider-api-docs\`, and \`provider-api-request\` are available, first-class provider actions are shortcuts, not limits: call the endpoint/filter/body/pagination needed. For broad searches, joins, counts/classification, or absence claims, fetch every relevant page or bounded cohort, stage/save large responses, and reduce with \`query-staged-dataset\` or \`run-code\`. Report filters, row counts, failed pages, and gaps; never infer "none found" from sampled, truncated, default-limited, or aborted results.${extensionAdvice}`;
     }
     return `8. **\`db-*\` tools are internal only** — \`db-query\`, \`db-exec\`, \`db-patch\` ONLY access the app's own SQL database (settings, application_state, template tables). They CANNOT reach ${providerList.length > 0
         ? providerList

package/dist/server/prompts/shared-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared-rules.js","sourceRoot":"","sources":["../../../src/server/prompts/shared-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,0BAA0B,GAE3B,MAAM,+BAA+B,CAAC;AAkBvC,MAAM,wBAAwB,GAAG;IAC/B,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,sBAAsB;CACvB,CAAC;AACF,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CACzB,QAAyB,EACzB,OAA2B;IAE3B,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,QAAQ,EAAE,eAAe,IAAI,wBAAwB,CAAC;IACxE,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,2DAA2D;IAC3D,MAAM,gBAAgB,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrD,CAAC,CAAC,mCAAmC;QACrC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,gBAAgB,GAAG,SAAS;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC;SAC/B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SACtB,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,eAAe,GACnB,OAAO,EAAE,cAAc,KAAK,KAAK;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,6PAA6P,CAAC;IAEpQ,IAAI,iBAAiB,KAAK,KAAK,EAAE,CAAC;QAChC,OAAO,yNAAyN,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,mCAAmC,CAAC,CAAC,CAAC,EAAE,uuBAAuuB,eAAe,EAAE,CAAC;IAC5jC,CAAC;IAED,IAAI,iBAAiB,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,sUACL,YAAY,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,YAAY;iBACT,KAAK,CAAC,GAAG,CAAC;iBACV,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,IAAI,CAAC,IAAI,CAAC;YACf,CAAC,CAAC,uBACN,2OAA2O,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,mCAAmC,CAAC,CAAC,CAAC,EAAE,oyBAAoyB,eAAe,EAAE,CAAC;IACpoC,CAAC;IAED,OAAO,8LACL,YAAY,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,YAAY;aACT,KAAK,CAAC,GAAG,CAAC;aACV,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,IAAI,CAAC,IAAI,CAAC;QACf,CAAC,CAAC,uBACN,2OAA2O,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,mCAAmC,CAAC,CAAC,CAAC,EAAE,oyBAAoyB,eAAe,EAAE,CAAC;AACpoC,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,aAAa,GAAG,igCAAigC,CAAC;AAE/hC,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GAAG,kcAAkc,CAAC;AAEje,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;2IAQ6G,CAAC;AAE5I,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,qxBAAqxB,CAAC","sourcesContent":["/**\n * Shared rule text used in both FRAMEWORK_CORE (full) and FRAMEWORK_CORE_COMPACT.\n * Single source of truth so the two variants can't drift on rules that are\n * identical between them.\n *\n * Rules 8–10 (db-* tools, no fabrication, no false success) are reproduced\n * verbatim in both prompts — keep them here.\n */\nimport {\n  normalizeDatabaseToolsMode,\n  type DatabaseToolsOption,\n} from \"../../scripts/db/tool-mode.js\";\n\n/**\n * Injectable provider/action examples. Defaults are generic; templates that\n * have named providers pass their own list via AgentChatPluginOptions.promptExamples.\n */\nexport interface PromptExamples {\n  /** Named external provider actions accessible from the agent (e.g. [\"provider-search\", \"warehouse-query\"]). */\n  providerActions?: string[];\n  /** Named template-specific actions to cite as examples (e.g. [\"log-meal\", \"update-form\"]). */\n  appActions?: string[];\n}\n\nexport interface SharedRuleOptions {\n  databaseTools?: DatabaseToolsOption;\n  extensionTools?: boolean;\n}\n\nconst DEFAULT_PROVIDER_ACTIONS = [\n  \"provider-search\",\n  \"provider-records\",\n  \"warehouse-query\",\n  \"provider-api-request\",\n];\n/** Rule 8 — db-* tools are internal only (shared between full and compact). */\nexport function sharedRule8(\n  examples?: PromptExamples,\n  options?: SharedRuleOptions,\n): string {\n  const databaseToolsMode = normalizeDatabaseToolsMode(options?.databaseTools);\n  const providers = examples?.providerActions ?? DEFAULT_PROVIDER_ACTIONS;\n  const providerList = providers.join(\", \");\n  // Build the \"e.g.\" clause for warehouse vs. named provider\n  const warehouseExample = providers.includes(\"bigquery\")\n    ? \"`bigquery` for warehouse tables, \"\n    : \"\";\n  const providerExamples = providers\n    .filter((p) => p !== \"bigquery\")\n    .slice(0, 4)\n    .map((p) => `\\`${p}\\``)\n    .join(\", \");\n\n  const extensionAdvice =\n    options?.extensionTools === false\n      ? \"\"\n      : \" For extensions, use `get-extension` when you already have an id from `<current-screen>` or `<current-url>`; otherwise use `list-extensions`, `update-extension`, `hide-extension`, and `delete-extension`. Do not query the legacy `tools` table directly.\";\n\n  if (databaseToolsMode === \"off\") {\n    return `8. **Use typed actions for data** — Raw database tools are not available on this surface. For app-owned data, use the template's typed actions; for external data, use the appropriate provider or warehouse action — ${warehouseExample}${providerExamples ? `${providerExamples} for their respective providers, ` : \"\"}etc. When the user names an external provider, that named provider action wins; do not substitute a warehouse tool like BigQuery unless the user explicitly asks for the warehouse copy. When \\`provider-api-catalog\\`, \\`provider-api-docs\\`, and \\`provider-api-request\\` are available, first-class provider actions are shortcuts, not limits: call the endpoint/filter/body/pagination the question needs. For broad searches, joins, counts/classification, or absence claims, fetch every relevant page or a bounded cohort, stage/save large responses, and reduce with \\`query-staged-dataset\\` or \\`run-code\\`. Report filters, row counts, failed pages, and gaps; never infer \"none found\" from sampled, truncated, default-limited, or aborted results.${extensionAdvice}`;\n  }\n\n  if (databaseToolsMode === \"read\") {\n    return `8. **Read-only \\`db-*\\` tools are internal only** — \\`db-schema\\` and \\`db-query\\` ONLY inspect the app's own SQL database (settings, application_state, template tables). Raw SQL write tools such as \\`db-exec\\` and \\`db-patch\\` are not available on this surface; use typed app actions for writes. The DB tools CANNOT reach ${\n      providerList.length > 0\n        ? providerList\n            .split(\",\")\n            .slice(0, 3)\n            .map((s) => s.trim())\n            .join(\", \")\n        : \"external data sources\"\n    }, or any external data source. If the user asks about a table that is NOT in the app schema (e.g. \\`dbt_analytics.*\\`, \\`dbt_mart.*\\`, or any fully-qualified \\`project.dataset.table\\`), use the appropriate template action instead — ${warehouseExample}${providerExamples ? `${providerExamples} for their respective providers, ` : \"\"}etc. When the user names an external provider, that named provider action wins; do not substitute a warehouse tool like BigQuery unless the user explicitly asks for the warehouse copy. **Never use \\`db-query\\` for external data — it will fail.** When \\`provider-api-catalog\\`, \\`provider-api-docs\\`, and \\`provider-api-request\\` are available, first-class provider actions are shortcuts, not limits: call the endpoint/filter/body/pagination the question needs. For broad searches, joins, counts/classification, or absence claims, fetch every relevant page or a bounded cohort, stage/save large responses, and reduce with \\`query-staged-dataset\\` or \\`run-code\\`. Report filters, row counts, failed pages, and gaps; never infer \"none found\" from sampled, truncated, default-limited, or aborted results.${extensionAdvice}`;\n  }\n\n  return `8. **\\`db-*\\` tools are internal only** — \\`db-query\\`, \\`db-exec\\`, \\`db-patch\\` ONLY access the app's own SQL database (settings, application_state, template tables). They CANNOT reach ${\n    providerList.length > 0\n      ? providerList\n          .split(\",\")\n          .slice(0, 3)\n          .map((s) => s.trim())\n          .join(\", \")\n      : \"external data sources\"\n  }, or any external data source. If the user asks about a table that is NOT in the app schema (e.g. \\`dbt_analytics.*\\`, \\`dbt_mart.*\\`, or any fully-qualified \\`project.dataset.table\\`), use the appropriate template action instead — ${warehouseExample}${providerExamples ? `${providerExamples} for their respective providers, ` : \"\"}etc. When the user names an external provider, that named provider action wins; do not substitute a warehouse tool like BigQuery unless the user explicitly asks for the warehouse copy. **Never use \\`db-query\\` for external data — it will fail.** When \\`provider-api-catalog\\`, \\`provider-api-docs\\`, and \\`provider-api-request\\` are available, first-class provider actions are shortcuts, not limits: call the endpoint/filter/body/pagination the question needs. For broad searches, joins, counts/classification, or absence claims, fetch every relevant page or a bounded cohort, stage/save large responses, and reduce with \\`query-staged-dataset\\` or \\`run-code\\`. Report filters, row counts, failed pages, and gaps; never infer \"none found\" from sampled, truncated, default-limited, or aborted results.${extensionAdvice}`;\n}\n\n/** Rule 9 — Never fabricate factual claims (shared). */\nexport const SHARED_RULE_9 = `9. **Never fabricate factual claims or records** — Do NOT invent numbers, metrics, records, query results, URLs, citations, source attributions, customer names, dates, or success rates. This applies inside generated artifacts too: decks, documents, reports, dashboards, Slack/email replies, and charts must not contain unsupported factual specifics. Only state factual numbers/claims when the user provided them or you retrieved them with an action/tool. If a data source is unavailable, returns no rows, is missing credentials, or has a connection error, say so clearly; do not create placeholder rows or fetch unrelated external providers to make the answer look complete unless the user explicitly asked you to import/sync/backfill. If a specific metric would be useful but is not known, use qualitative wording, placeholders like \\`[metric TBD]\\`, or clearly labeled draft assumptions instead of plausible-looking facts. Presenting made-up data as real is a critical failure — it is worse than admitting the limitation.`;\n\n/** Rule 10 — Never fabricate success from tool errors (shared). */\nexport const SHARED_RULE_10 = `10. **Never fabricate success from tool errors** — When any tool call returns an error (marked \\`isError: true\\`, contains \"Command failed\", \"Error:\", or non-zero exit output), the operation FAILED. Do NOT synthesize a success narrative or describe what the action \"would have\" produced. Report the failure verbatim from the tool output. This applies especially to \\`bash(command=\"pnpm action ...\")\\` calls: if the action threw, it did NOT succeed.`;\n\n/** Rule 14 — Planning and progress (adapted from Codex's update_plan discipline). */\nexport const SHARED_RULE_14 = `14. **Plan and track multi-step work** — For non-trivial tasks that span several actions or phases, use \\`manage-progress\\` to make work visible and keep it on track.\n\n  - Call \\`manage-progress\\` with \\`action: \"start\"\\` at the beginning of multi-step work; include a descriptive \\`title\\` and the first \\`step\\`.\n  - Update with \\`action: \"update\"\\` after each meaningful milestone — include \\`step\\` (what you just did or are doing now) and \\`percent\\` when there is a known upper bound. Do not batch-complete multiple steps after the fact; update as you go.\n  - Exactly one logical task should be \\`in_progress\\` at a time within a turn. Finish (or explicitly complete/cancel) a run before starting an unrelated one.\n  - Mark done with \\`action: \"complete\"\\` and \\`status: \"succeeded\"\\` (or \"failed\"/\"cancelled\") as the last step. Never leave a run open indefinitely.\n  - **Skip for trivial work**: single-action lookups, simple reads, one-line answers, and any task that finishes in one tool call do not need a progress run. Plans add value only when there are multiple real steps the user would want to watch.\n  - Never create single-step plans — if everything fits in one \\`start\\`+\\`complete\\`, just call the action and report the outcome directly.\n  - If the task pivots mid-run (unexpected blocker, scope change), update the current step to reflect the new direction before continuing.`;\n\n/** Rule 15 — Collaborate through uncertainty (better-specified version). */\nexport const SHARED_RULE_15 = `15. **Collaborate through uncertainty** — If a task stalls, errors, or depends on setup the user may not know about, shift into builder-coach mode instead of repeating the same attempt. State what you verified, name the most likely next checks, and proactively try common unblockers you can inspect (for example prompt size, missing environment variables, unavailable connections, current screen state, or tool choice). When you finish a meaningful step, offer one or two concrete next steps or improvements so non-technical users can keep iterating. When you are genuinely blocked on a decision you cannot resolve from context — and a wrong guess would be costly — use \\`ask-question\\` to present the choice instead of guessing; otherwise prefer a reasonable assumption and keep moving.`;\n"]}
+{"version":3,"file":"shared-rules.js","sourceRoot":"","sources":["../../../src/server/prompts/shared-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,0BAA0B,GAE3B,MAAM,+BAA+B,CAAC;AAkBvC,MAAM,wBAAwB,GAAG;IAC/B,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,sBAAsB;CACvB,CAAC;AACF,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CACzB,QAAyB,EACzB,OAA2B;IAE3B,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,SAAS,GAAG,QAAQ,EAAE,eAAe,IAAI,wBAAwB,CAAC;IACxE,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,2DAA2D;IAC3D,MAAM,gBAAgB,GAAG,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;QACrD,CAAC,CAAC,mCAAmC;QACrC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,gBAAgB,GAAG,SAAS;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC;SAC/B,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SACtB,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,MAAM,eAAe,GACnB,OAAO,EAAE,cAAc,KAAK,KAAK;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,6PAA6P,CAAC;IAEpQ,IAAI,iBAAiB,KAAK,KAAK,EAAE,CAAC;QAChC,OAAO,yNAAyN,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,mCAAmC,CAAC,CAAC,CAAC,EAAE,uuBAAuuB,eAAe,EAAE,CAAC;IAC5jC,CAAC;IAED,IAAI,iBAAiB,KAAK,MAAM,EAAE,CAAC;QACjC,OAAO,yRACL,YAAY,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,YAAY;iBACT,KAAK,CAAC,GAAG,CAAC;iBACV,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,IAAI,CAAC,IAAI,CAAC;YACf,CAAC,CAAC,uBACN,+GAA+G,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,wBAAwB,CAAC,CAAC,CAAC,EAAE,urBAAurB,eAAe,EAAE,CAAC;IACh5B,CAAC;IAED,OAAO,8LACL,YAAY,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,YAAY;aACT,KAAK,CAAC,GAAG,CAAC;aACV,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,IAAI,CAAC,IAAI,CAAC;QACf,CAAC,CAAC,uBACN,2OAA2O,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,gBAAgB,mCAAmC,CAAC,CAAC,CAAC,EAAE,oyBAAoyB,eAAe,EAAE,CAAC;AACpoC,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,MAAM,aAAa,GAAG,igCAAigC,CAAC;AAE/hC,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GAAG,kcAAkc,CAAC;AAEje,qFAAqF;AACrF,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;2IAQ6G,CAAC;AAE5I,4EAA4E;AAC5E,MAAM,CAAC,MAAM,cAAc,GAAG,qxBAAqxB,CAAC","sourcesContent":["/**\n * Shared rule text used in both FRAMEWORK_CORE (full) and FRAMEWORK_CORE_COMPACT.\n * Single source of truth so the two variants can't drift on rules that are\n * identical between them.\n *\n * Rules 8–10 (db-* tools, no fabrication, no false success) are reproduced\n * verbatim in both prompts — keep them here.\n */\nimport {\n  normalizeDatabaseToolsMode,\n  type DatabaseToolsOption,\n} from \"../../scripts/db/tool-mode.js\";\n\n/**\n * Injectable provider/action examples. Defaults are generic; templates that\n * have named providers pass their own list via AgentChatPluginOptions.promptExamples.\n */\nexport interface PromptExamples {\n  /** Named external provider actions accessible from the agent (e.g. [\"provider-search\", \"warehouse-query\"]). */\n  providerActions?: string[];\n  /** Named template-specific actions to cite as examples (e.g. [\"log-meal\", \"update-form\"]). */\n  appActions?: string[];\n}\n\nexport interface SharedRuleOptions {\n  databaseTools?: DatabaseToolsOption;\n  extensionTools?: boolean;\n}\n\nconst DEFAULT_PROVIDER_ACTIONS = [\n  \"provider-search\",\n  \"provider-records\",\n  \"warehouse-query\",\n  \"provider-api-request\",\n];\n/** Rule 8 — db-* tools are internal only (shared between full and compact). */\nexport function sharedRule8(\n  examples?: PromptExamples,\n  options?: SharedRuleOptions,\n): string {\n  const databaseToolsMode = normalizeDatabaseToolsMode(options?.databaseTools);\n  const providers = examples?.providerActions ?? DEFAULT_PROVIDER_ACTIONS;\n  const providerList = providers.join(\", \");\n  // Build the \"e.g.\" clause for warehouse vs. named provider\n  const warehouseExample = providers.includes(\"bigquery\")\n    ? \"`bigquery` for warehouse tables, \"\n    : \"\";\n  const providerExamples = providers\n    .filter((p) => p !== \"bigquery\")\n    .slice(0, 4)\n    .map((p) => `\\`${p}\\``)\n    .join(\", \");\n\n  const extensionAdvice =\n    options?.extensionTools === false\n      ? \"\"\n      : \" For extensions, use `get-extension` when you already have an id from `<current-screen>` or `<current-url>`; otherwise use `list-extensions`, `update-extension`, `hide-extension`, and `delete-extension`. Do not query the legacy `tools` table directly.\";\n\n  if (databaseToolsMode === \"off\") {\n    return `8. **Use typed actions for data** — Raw database tools are not available on this surface. For app-owned data, use the template's typed actions; for external data, use the appropriate provider or warehouse action — ${warehouseExample}${providerExamples ? `${providerExamples} for their respective providers, ` : \"\"}etc. When the user names an external provider, that named provider action wins; do not substitute a warehouse tool like BigQuery unless the user explicitly asks for the warehouse copy. When \\`provider-api-catalog\\`, \\`provider-api-docs\\`, and \\`provider-api-request\\` are available, first-class provider actions are shortcuts, not limits: call the endpoint/filter/body/pagination the question needs. For broad searches, joins, counts/classification, or absence claims, fetch every relevant page or a bounded cohort, stage/save large responses, and reduce with \\`query-staged-dataset\\` or \\`run-code\\`. Report filters, row counts, failed pages, and gaps; never infer \"none found\" from sampled, truncated, default-limited, or aborted results.${extensionAdvice}`;\n  }\n\n  if (databaseToolsMode === \"read\") {\n    return `8. **Read-only \\`db-*\\` tools are internal only** — \\`db-schema\\` and \\`db-query\\` ONLY inspect the app's own SQL database (settings, application_state, template tables); \\`db-exec\\` and \\`db-patch\\` are not available, so use typed app actions for writes. DB tools cannot reach ${\n      providerList.length > 0\n        ? providerList\n            .split(\",\")\n            .slice(0, 3)\n            .map((s) => s.trim())\n            .join(\", \")\n        : \"external data sources\"\n    } or any external source. If a table is NOT in the app schema, use the appropriate template action instead — ${warehouseExample}${providerExamples ? `${providerExamples} for their providers, ` : \"\"}etc. Named provider actions win over warehouse copies unless the user explicitly asks for the warehouse. **Never use \\`db-query\\` for external data.** When \\`provider-api-catalog\\`, \\`provider-api-docs\\`, and \\`provider-api-request\\` are available, first-class provider actions are shortcuts, not limits: call the endpoint/filter/body/pagination needed. For broad searches, joins, counts/classification, or absence claims, fetch every relevant page or bounded cohort, stage/save large responses, and reduce with \\`query-staged-dataset\\` or \\`run-code\\`. Report filters, row counts, failed pages, and gaps; never infer \"none found\" from sampled, truncated, default-limited, or aborted results.${extensionAdvice}`;\n  }\n\n  return `8. **\\`db-*\\` tools are internal only** — \\`db-query\\`, \\`db-exec\\`, \\`db-patch\\` ONLY access the app's own SQL database (settings, application_state, template tables). They CANNOT reach ${\n    providerList.length > 0\n      ? providerList\n          .split(\",\")\n          .slice(0, 3)\n          .map((s) => s.trim())\n          .join(\", \")\n      : \"external data sources\"\n  }, or any external data source. If the user asks about a table that is NOT in the app schema (e.g. \\`dbt_analytics.*\\`, \\`dbt_mart.*\\`, or any fully-qualified \\`project.dataset.table\\`), use the appropriate template action instead — ${warehouseExample}${providerExamples ? `${providerExamples} for their respective providers, ` : \"\"}etc. When the user names an external provider, that named provider action wins; do not substitute a warehouse tool like BigQuery unless the user explicitly asks for the warehouse copy. **Never use \\`db-query\\` for external data — it will fail.** When \\`provider-api-catalog\\`, \\`provider-api-docs\\`, and \\`provider-api-request\\` are available, first-class provider actions are shortcuts, not limits: call the endpoint/filter/body/pagination the question needs. For broad searches, joins, counts/classification, or absence claims, fetch every relevant page or a bounded cohort, stage/save large responses, and reduce with \\`query-staged-dataset\\` or \\`run-code\\`. Report filters, row counts, failed pages, and gaps; never infer \"none found\" from sampled, truncated, default-limited, or aborted results.${extensionAdvice}`;\n}\n\n/** Rule 9 — Never fabricate factual claims (shared). */\nexport const SHARED_RULE_9 = `9. **Never fabricate factual claims or records** — Do NOT invent numbers, metrics, records, query results, URLs, citations, source attributions, customer names, dates, or success rates. This applies inside generated artifacts too: decks, documents, reports, dashboards, Slack/email replies, and charts must not contain unsupported factual specifics. Only state factual numbers/claims when the user provided them or you retrieved them with an action/tool. If a data source is unavailable, returns no rows, is missing credentials, or has a connection error, say so clearly; do not create placeholder rows or fetch unrelated external providers to make the answer look complete unless the user explicitly asked you to import/sync/backfill. If a specific metric would be useful but is not known, use qualitative wording, placeholders like \\`[metric TBD]\\`, or clearly labeled draft assumptions instead of plausible-looking facts. Presenting made-up data as real is a critical failure — it is worse than admitting the limitation.`;\n\n/** Rule 10 — Never fabricate success from tool errors (shared). */\nexport const SHARED_RULE_10 = `10. **Never fabricate success from tool errors** — When any tool call returns an error (marked \\`isError: true\\`, contains \"Command failed\", \"Error:\", or non-zero exit output), the operation FAILED. Do NOT synthesize a success narrative or describe what the action \"would have\" produced. Report the failure verbatim from the tool output. This applies especially to \\`bash(command=\"pnpm action ...\")\\` calls: if the action threw, it did NOT succeed.`;\n\n/** Rule 14 — Planning and progress (adapted from Codex's update_plan discipline). */\nexport const SHARED_RULE_14 = `14. **Plan and track multi-step work** — For non-trivial tasks that span several actions or phases, use \\`manage-progress\\` to make work visible and keep it on track.\n\n  - Call \\`manage-progress\\` with \\`action: \"start\"\\` at the beginning of multi-step work; include a descriptive \\`title\\` and the first \\`step\\`.\n  - Update with \\`action: \"update\"\\` after each meaningful milestone — include \\`step\\` (what you just did or are doing now) and \\`percent\\` when there is a known upper bound. Do not batch-complete multiple steps after the fact; update as you go.\n  - Exactly one logical task should be \\`in_progress\\` at a time within a turn. Finish (or explicitly complete/cancel) a run before starting an unrelated one.\n  - Mark done with \\`action: \"complete\"\\` and \\`status: \"succeeded\"\\` (or \"failed\"/\"cancelled\") as the last step. Never leave a run open indefinitely.\n  - **Skip for trivial work**: single-action lookups, simple reads, one-line answers, and any task that finishes in one tool call do not need a progress run. Plans add value only when there are multiple real steps the user would want to watch.\n  - Never create single-step plans — if everything fits in one \\`start\\`+\\`complete\\`, just call the action and report the outcome directly.\n  - If the task pivots mid-run (unexpected blocker, scope change), update the current step to reflect the new direction before continuing.`;\n\n/** Rule 15 — Collaborate through uncertainty (better-specified version). */\nexport const SHARED_RULE_15 = `15. **Collaborate through uncertainty** — If a task stalls, errors, or depends on setup the user may not know about, shift into builder-coach mode instead of repeating the same attempt. State what you verified, name the most likely next checks, and proactively try common unblockers you can inspect (for example prompt size, missing environment variables, unavailable connections, current screen state, or tool choice). When you finish a meaningful step, offer one or two concrete next steps or improvements so non-technical users can keep iterating. When you are genuinely blocked on a decision you cannot resolve from context — and a wrong guess would be costly — use \\`ask-question\\` to present the choice instead of guessing; otherwise prefer a reasonable assumption and keep moving.`;\n"]}

package/dist/server/transcribe-voice.d.ts

@@ -20,7 +20,7 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;
 //# sourceMappingURL=transcribe-voice.d.ts.map

package/dist/server/transcribe-voice.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transcribe-voice.d.ts","sourceRoot":"","sources":["../../src/server/transcribe-voice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAsGH,wBAAgB,4BAA4B;;;;;;IAuX3C"}
+{"version":3,"file":"transcribe-voice.d.ts","sourceRoot":"","sources":["../../src/server/transcribe-voice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA8IH,wBAAgB,4BAA4B;;;;;;IAkY3C"}

package/dist/server/transcribe-voice.js

@@ -34,7 +34,14 @@ const OPENAI_MODEL = "whisper-1";
 const OPENAI_CHAT_URL = "https://api.openai.com/v1/chat/completions";
 const OPENAI_CLEANUP_MODEL = "gpt-5.4-mini";
 const MAX_AUDIO_BYTES = 25 * 1024 * 1024; // Whisper hard limit.
-const MAX_TRANSCRIPT_CHARS = 40_000;
+// Hard cap for the dictation-cleanup text path (`sanitizeTranscriptText`
+// below). This endpoint has no `task` field — it's always the Hold-Fn
+// dictation cleanup pass — but a long session (many minutes across
+// multiple pause-triggered final segments) can still exceed a tight cap.
+// 150k gives real headroom for a long dictation session while still
+// bounding worst-case request size; truncation (when it does happen) keeps
+// both ends of the text instead of silently dropping the tail.
+const MAX_TRANSCRIPT_CHARS = 150_000;
 // Public Builder transcription model id. The Builder gateway maps this to
 // Gemini 3.1 Flash-Lite.
 const BUILDER_GEMINI_TRANSCRIPTION_MODEL = "gemini-3-1-flash-lite";
@@ -94,6 +101,33 @@ function isSameOriginRequest(event) {
     // server-side) — safe to allow, CSRF requires a browser with ambient cookies.
     return true;
 }
+/**
+ * Derive an AbortSignal that fires when the client disconnects mid-request
+ * (e.g. the desktop client's own 8s ceiling firing before a provider call's
+ * longer timeout). Without this, an abandoned client connection leaves the
+ * server-side provider fetch running for its full timeout, burning provider
+ * quota/cost on a response nobody will read. `req.on("close", ...)` fires on
+ * abnormal/early disconnect in Node's http server; a stray fire after normal
+ * completion is a harmless no-op since the response has already been sent.
+ * Returns undefined if the underlying Node request isn't available (e.g. a
+ * non-Node adapter), so callers fall back to their existing timeout-only
+ * signal.
+ */
+function clientDisconnectSignal(event) {
+    const req = event.node?.req;
+    if (!req?.on)
+        return undefined;
+    const controller = new AbortController();
+    req.on("close", () => controller.abort());
+    return controller.signal;
+}
+/** Combine a provider call's own timeout signal with the request's optional
+ * client-disconnect signal so either one aborts the upstream fetch. */
+function withClientAbort(timeoutSignal, clientAbortSignal) {
+    return clientAbortSignal
+        ? AbortSignal.any([timeoutSignal, clientAbortSignal])
+        : timeoutSignal;
+}
 export function createTranscribeVoiceHandler() {
     return defineEventHandler(async (event) => {
         if (getMethod(event) !== "POST") {
@@ -104,6 +138,11 @@ export function createTranscribeVoiceHandler() {
             setResponseStatus(event, 403);
             return { error: "Cross-origin request rejected" };
         }
+        // One client-disconnect signal per request, threaded into every
+        // provider-fetch AbortController below via AbortSignal.any so a client
+        // giving up early aborts the same upstream fetch instead of leaving it
+        // running for its full timeout.
+        const clientAbort = clientDisconnectSignal(event);
         const parts = await readMultipartFormData(event).catch(() => null);
         const audio = parts?.find((p) => p.name === "audio");
         const textPart = parts?.find((p) => p.name === "text");
@@ -221,6 +260,7 @@ export function createTranscribeVoiceHandler() {
                 hasBuilderPrivateKey,
                 withRequestContext,
                 resolveApiKey,
+                clientAbortSignal: clientAbort,
             });
         }
         if (!audio?.data?.length) {
@@ -251,6 +291,7 @@ export function createTranscribeVoiceHandler() {
                     apiKey: geminiKey,
                     language: language || undefined,
                     instructions: voiceGuidance,
+                    clientAbortSignal: clientAbort,
                 });
                 const trimmed = applyVoiceContext(text);
                 if (!trimmed) {
@@ -319,6 +360,7 @@ export function createTranscribeVoiceHandler() {
                 language,
                 instructions: voiceGuidance,
                 contextPack: voiceContext,
+                clientAbortSignal: clientAbort,
             });
         }
         // ── Auto / undefined / openai fallback chain ────────────────────────
@@ -360,6 +402,7 @@ export function createTranscribeVoiceHandler() {
                         apiKey: geminiKey,
                         language: language || undefined,
                         instructions: voiceGuidance,
+                        clientAbortSignal: clientAbort,
                     });
                     const trimmed = applyVoiceContext(text);
                     if (trimmed) {
@@ -416,6 +459,7 @@ export function createTranscribeVoiceHandler() {
             language,
             instructions: voiceGuidance,
             contextPack: voiceContext,
+            clientAbortSignal: clientAbort,
         });
     });
 }
@@ -426,7 +470,7 @@ export function createTranscribeVoiceHandler() {
  * strict-Groq preference path and the auto fallback chain share one
  * implementation.
  */
-async function callWhisperCompat({ event, provider, audioBytes, mime, language, instructions, contextPack, }) {
+async function callWhisperCompat({ event, provider, audioBytes, mime, language, instructions, contextPack, clientAbortSignal, }) {
     const ext = pickExtension(mime);
     const filename = `composer-voice.${ext}`;
     const form = new FormData();
@@ -444,7 +488,7 @@ async function callWhisperCompat({ event, provider, audioBytes, mime, language,
             method: "POST",
             headers: { Authorization: `Bearer ${provider.apiKey}` },
             body: form,
-            signal: controller.signal,
+            signal: withClientAbort(controller.signal, clientAbortSignal),
         });
         if (!res.ok) {
             const text = await res.text().catch(() => "");
@@ -472,7 +516,7 @@ async function callWhisperCompat({ event, provider, audioBytes, mime, language,
         clearTimeout(timeout);
     }
 }
-async function cleanupTranscriptText({ event, text, instructions, contextPack, providerPref, hasBuilderPrivateKey, withRequestContext, resolveApiKey, }) {
+async function cleanupTranscriptText({ event, text, instructions, contextPack, providerPref, hasBuilderPrivateKey, withRequestContext, resolveApiKey, clientAbortSignal, }) {
     const original = text.trim();
     if (!original)
         return { text: "" };
@@ -488,7 +532,7 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
             };
         }
         try {
-            const cleaned = await withRequestContext(() => cleanupWithBuilder({ text: original, instructions }));
+            const cleaned = await withRequestContext(() => cleanupWithBuilder({ text: original, instructions, clientAbortSignal }));
             return { text: finalizeText(cleaned || original) };
         }
         catch (err) {
@@ -511,6 +555,7 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
                 text: original,
                 apiKey: geminiKey,
                 instructions,
+                clientAbortSignal,
             });
             return { text: finalizeText(cleaned || original) };
         }
@@ -536,6 +581,7 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
                 text: original,
                 apiKey,
                 instructions,
+                clientAbortSignal,
             });
             return { text: finalizeText(cleaned || original) };
         }
@@ -548,7 +594,7 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
     }
     if (await hasBuilderPrivateKey()) {
         try {
-            const cleaned = await withRequestContext(() => cleanupWithBuilder({ text: original, instructions }));
+            const cleaned = await withRequestContext(() => cleanupWithBuilder({ text: original, instructions, clientAbortSignal }));
             if (cleaned)
                 return { text: finalizeText(cleaned) };
         }
@@ -563,6 +609,7 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
                 text: original,
                 apiKey: geminiKey,
                 instructions,
+                clientAbortSignal,
             });
             if (cleaned)
                 return { text: finalizeText(cleaned) };
@@ -579,6 +626,7 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
                 text: original,
                 apiKey: groqKey,
                 instructions,
+                clientAbortSignal,
             });
             if (cleaned)
                 return { text: finalizeText(cleaned) };
@@ -595,6 +643,7 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
                 text: original,
                 apiKey: openaiKey,
                 instructions,
+                clientAbortSignal,
             });
             if (cleaned)
                 return { text: finalizeText(cleaned) };
@@ -605,7 +654,7 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
     }
     return { text: finalizeText(original) };
 }
-async function cleanupWithBuilder({ text, instructions, }) {
+async function cleanupWithBuilder({ text, instructions, clientAbortSignal, }) {
     const engine = createBuilderEngine();
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 8_000);
@@ -623,7 +672,7 @@ async function cleanupWithBuilder({ text, instructions, }) {
                 },
             ],
             tools: [],
-            abortSignal: controller.signal,
+            abortSignal: withClientAbort(controller.signal, clientAbortSignal),
             maxOutputTokens: Math.min(4096, Math.max(512, text.length * 2)),
             temperature: 0,
         })) {
@@ -648,7 +697,7 @@ async function cleanupWithBuilder({ text, instructions, }) {
         throw new Error(terminalError);
     return stripTranscriptEnvelope(finalText || streamedText);
 }
-async function cleanupWithGemini({ text, apiKey, instructions, }) {
+async function cleanupWithGemini({ text, apiKey, instructions, clientAbortSignal, }) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 8_000);
     try {
@@ -669,7 +718,7 @@ async function cleanupWithGemini({ text, apiKey, instructions, }) {
                 ],
                 generationConfig: { temperature: 0 },
             }),
-            signal: controller.signal,
+            signal: withClientAbort(controller.signal, clientAbortSignal),
         });
         if (!res.ok) {
             const body = await res.text().catch(() => "");
@@ -686,7 +735,7 @@ async function cleanupWithGemini({ text, apiKey, instructions, }) {
         clearTimeout(timeout);
     }
 }
-async function cleanupWithChatProvider({ provider, text, apiKey, instructions, }) {
+async function cleanupWithChatProvider({ provider, text, apiKey, instructions, clientAbortSignal, }) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 8_000);
     const endpoint = provider === "openai" ? OPENAI_CHAT_URL : GROQ_CHAT_URL;
@@ -706,7 +755,7 @@ async function cleanupWithChatProvider({ provider, text, apiKey, instructions, }
                 ],
                 temperature: 0,
             }),
-            signal: controller.signal,
+            signal: withClientAbort(controller.signal, clientAbortSignal),
         });
         if (!res.ok) {
             const body = await res.text().catch(() => "");
@@ -741,7 +790,20 @@ function sanitizeTranscriptText(value) {
     const trimmed = value.replace(/\0/g, "").trim();
     if (!trimmed)
         return undefined;
-    return trimmed.slice(0, MAX_TRANSCRIPT_CHARS);
+    if (trimmed.length <= MAX_TRANSCRIPT_CHARS)
+        return trimmed;
+    // Truncate the middle rather than the tail — losing the end of a long
+    // dictation silently (previous behavior) is worse than losing the middle,
+    // since users notice a cut-off ending immediately but rarely proofread
+    // the entire cleaned output against the original.
+    console.warn(`[transcribe-voice] transcript truncated: ${trimmed.length} chars exceeds ${MAX_TRANSCRIPT_CHARS} cap`);
+    const marker = "\n[... transcript truncated ...]\n";
+    const keepChars = MAX_TRANSCRIPT_CHARS - marker.length;
+    const headChars = Math.floor((keepChars * 2) / 3);
+    const tailChars = keepChars - headChars;
+    return (trimmed.slice(0, headChars) +
+        marker +
+        trimmed.slice(trimmed.length - tailChars));
 }
 function buildCleanupSystemPrompt(instructions) {
     const custom = instructions
@@ -787,7 +849,7 @@ function buildGeminiTranscriptionPrompt({ language, instructions, }) {
  * FLAC — webm/opus is not officially supported but in practice it
  * accepts webm too. If Gemini rejects it the caller falls through.
  */
-async function transcribeWithGemini({ audioBytes, mimeType, apiKey, language, instructions, }) {
+async function transcribeWithGemini({ audioBytes, mimeType, apiKey, language, instructions, clientAbortSignal, }) {
     const base64 = uint8ArrayToBase64(audioBytes);
     const prompt = buildGeminiTranscriptionPrompt({ language, instructions });
     const controller = new AbortController();
@@ -817,7 +879,7 @@ async function transcribeWithGemini({ audioBytes, mimeType, apiKey, language, in
                 // creative reinterpretation.
                 generationConfig: { temperature: 0 },
             }),
-            signal: controller.signal,
+            signal: withClientAbort(controller.signal, clientAbortSignal),
         });
         if (!res.ok) {
             const body = await res.text().catch(() => "");