@agent-native/core 0.90.10 → 0.91.0

package/corpus/README.md

@@ -27,5 +27,5 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- core files: 2145
-- template files: 4841
+- core files: 2149
+- template files: 4940

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @agent-native/core
 
+## 0.91.0
+
+### Minor Changes
+
+- e310ac1: Add first-party, Sentry-style error capture to the analytics client SDK. `configureTracking({ errorCapture })` now auto-captures uncaught exceptions (`window.onerror`) and unhandled promise rejections, exposes a manual `captureException(error, context?)` / `captureMessage(message, level?)` API plus `addErrorBreadcrumb`, and ties each captured exception to the active session replay id so errors link straight to the recording they happened in. Captured exceptions are sent through the existing first-party analytics ingest as a dedicated `$exception` event and are redacted + deduped client-side. Additive and backward-compatible; error capture only installs when a public key is configured (or explicitly enabled).
+- e310ac1: Revamp the shared settings shell (`SettingsTabsPage`): an edge-aligned,
+  independently scrolling left nav with consistent theming, a built-in settings
+  search that deep-links into tabs and sections via `searchEntries` /
+  `generalSearchEntries`, and a new controlled `value` / `onValueChange` mode so
+  apps can drive the active tab from their own routing and application state.
+- e310ac1: Make agent-native chat threads shareable through the framework share dialog so collaborators can view or edit shared chats.
+
+### Patch Changes
+
+- e310ac1: Populate in-app "What's new" surfaces from pending app changelog entries during dev and build.
+- e310ac1: Use shadcn's message scroller primitives for core chat transcripts so streaming replies, turn anchoring, and scroll-to-bottom behavior stay smoother in long or dynamically resizing chats.
+- e310ac1: Auto-continue recoverable chat run timeouts during reconnect without showing the internal resume prompt in chat history, and retry transient `ask_app_status` bridge fetch failures before surfacing an error.
+- e310ac1: Recover Google popup sign-in pages when the session cookie is present but the parent page misses the automatic OAuth exchange redirect.
+- e310ac1: Hide internal share principal ids in share dialogs by resolving organization names and using safe fallback labels.
+- e310ac1: Fix Vite dev server resolution for Agent Native templates that load local or transitive `@agent-native/toolkit` subpath exports.
+- e310ac1: Avoid repeated Sentry reports when workspace dev app discovery hits local filesystem permission errors.
+
+## 0.90.11
+
+### Patch Changes
+
+- bba7332: Keep agent-chat workers on the hosted foreground timeout unless they are actually running inside a background function, preventing misrouted workers from being killed as stale runs.
+- bba7332: Fix "The model returned an empty response" on hard/long-context chat turns: interactive chat now resolves max_output_tokens to min(model ceiling, 32K) instead of the flat 4096-8192 per-engine defaults, Anthropic/Gemini numeric thinking budgets are clamped to always leave real output headroom under max_tokens, and the empty-final-response retry now raises the token ceiling and steps reasoning effort down a tier (with the retry budget raised from 1 to 2 attempts) instead of re-issuing the identical doomed request.
+- bba7332: Stop misrouted agent-chat workers from taking the large background Neon connection pool. `isBackgroundFunctionPoolContext()` no longer trusts the dispatch marker (`__AGENT_NATIVE_BACKGROUND_RUNTIME_EXPECTED__`) — a worker dispatched toward a `-background` URL but routed onto the ~60s synchronous function would otherwise open the 8-connection worker pool while running as one of many warm sync-function instances, exhausting the Neon pooled endpoint (connection terminated / statement timeouts / failed heartbeat writes surfacing as stale runs). Only the genuine `-background` runtime marker (set at cold start) unlocks the larger pool now, mirroring the same proof-of-landing tightening applied to the worker soft-timeout.
+
 ## 0.90.10
 
 ### Patch Changes

package/corpus/core/docs/content/toolkit-settings.mdx

@@ -1,6 +1,6 @@
 ---
 title: "Settings Kit"
-description: "A standard settings-page contract for app, agent, provider, team, and language settings."
+description: "A standard, searchable settings-page contract for app, agent, provider, team, and language settings."
 ---
 
 # Settings Kit
@@ -10,11 +10,17 @@ not have to wonder whether model keys live in an app settings page, a giant
 agent sidebar panel, or a provider-specific setup card. The app route owns the
 page; framework tabs can be mounted inside it.
 
+Every settings page is **searchable out of the box**: `<SettingsTabsPage>`
+renders a search box that indexes tabs and their controls, so a user can type
+"language", "S3", or "API key" and jump straight to the right section across any
+tab — no hunting through the nav. This is a core value prop of the kit and comes
+free the moment an app adopts the shared page.
+
 <WireframeBlock id="doc-block-toolkit-settings">
   <Screen
     surface="desktop"
     html={
-      "<div style='min-height:520px;box-sizing:border-box;padding:26px;display:grid;grid-template-columns:200px 1fr;gap:18px'><aside class='wf-card' style='display:flex;flex-direction:column;gap:6px'><strong style='margin-bottom:4px'>Settings</strong><div style='padding:7px 9px;border-radius:8px'>General</div><div style='padding:7px 9px;border-radius:8px;background:var(--wf-accent-soft);display:flex;align-items:center;gap:8px'><span data-icon='settings'></span> AI and models</div><div style='padding:7px 9px;border-radius:8px'>Connections</div><div style='padding:7px 9px;border-radius:8px'>Team</div><div style='padding:7px 9px;border-radius:8px'>Developer</div></aside><main class='wf-card' style='display:flex;flex-direction:column;gap:14px'><h2 style='margin:0'>AI and models</h2><div style='display:flex;flex-direction:column;gap:6px'><small class='wf-muted'>Default model</small><div class='wf-box' style='display:flex;align-items:center;gap:8px'><div style='flex:1'>GPT-5</div><span data-icon='chevronDown'></span></div></div><div style='display:flex;flex-direction:column;gap:8px'><small class='wf-muted'>Provider keys</small><div class='wf-box' style='display:flex;align-items:center;gap:10px'><span data-icon='check'></span><div style='flex:1'>OpenAI</div><span class='wf-pill'>Connected</span></div><div class='wf-box' style='display:flex;align-items:center;gap:10px'><span data-icon='lock'></span><div style='flex:1'>Anthropic</div><button>Add key</button></div><div class='wf-box' style='display:flex;align-items:center;gap:10px'><span data-icon='check'></span><div style='flex:1'>Builder</div><span class='wf-pill'>Connected</span></div></div><div style='flex:1'></div><div style='display:flex;gap:10px'><button>Open agent settings</button><div style='flex:1'></div><button class='primary'>Save changes</button></div></main></div>"
+      "<div style='min-height:520px;box-sizing:border-box;padding:26px;display:grid;grid-template-columns:200px 1fr;gap:18px'><aside class='wf-card' style='display:flex;flex-direction:column;gap:6px'><strong style='margin-bottom:4px'>Settings</strong><div class='wf-box' style='display:flex;align-items:center;gap:8px;margin-bottom:4px'><span data-icon='search'></span><span class='wf-muted'>Search settings</span></div><div style='padding:7px 9px;border-radius:8px'>General</div><div style='padding:7px 9px;border-radius:8px;background:var(--wf-accent-soft);display:flex;align-items:center;gap:8px'><span data-icon='settings'></span> AI and models</div><div style='padding:7px 9px;border-radius:8px'>Connections</div><div style='padding:7px 9px;border-radius:8px'>Team</div><div style='padding:7px 9px;border-radius:8px'>Developer</div></aside><main class='wf-card' style='display:flex;flex-direction:column;gap:14px'><h2 style='margin:0'>AI and models</h2><div style='display:flex;flex-direction:column;gap:6px'><small class='wf-muted'>Default model</small><div class='wf-box' style='display:flex;align-items:center;gap:8px'><div style='flex:1'>GPT-5</div><span data-icon='chevronDown'></span></div></div><div style='display:flex;flex-direction:column;gap:8px'><small class='wf-muted'>Provider keys</small><div class='wf-box' style='display:flex;align-items:center;gap:10px'><span data-icon='check'></span><div style='flex:1'>OpenAI</div><span class='wf-pill'>Connected</span></div><div class='wf-box' style='display:flex;align-items:center;gap:10px'><span data-icon='lock'></span><div style='flex:1'>Anthropic</div><button>Add key</button></div><div class='wf-box' style='display:flex;align-items:center;gap:10px'><span data-icon='check'></span><div style='flex:1'>Builder</div><span class='wf-pill'>Connected</span></div></div><div style='flex:1'></div><div style='display:flex;gap:10px'><button>Open agent settings</button><div style='flex:1'></div><button class='primary'>Save changes</button></div></main></div>"
     }
   />
 </WireframeBlock>
@@ -23,8 +29,9 @@ page; framework tabs can be mounted inside it.
 
 | Piece                    | Purpose                                                                               |
 | ------------------------ | ------------------------------------------------------------------------------------- |
-| `<SettingsTabsPage>`     | Standard tabbed settings route surface.                                               |
+| `<SettingsTabsPage>`     | Standard tabbed settings route surface with a built-in settings search box.           |
 | `useAgentSettingsTabs()` | Framework-provided agent, model, key, automation, and voice tabs that apps can mount. |
+| `SettingsSearchEntry`    | A deep-link target (label, keywords, tab, and hash) that makes a control findable.    |
 | `<LanguagePicker>`       | Standard language selector for app settings.                                          |
 | `openAgentSettings()`    | Compatibility escape hatch for opening the sidebar settings tab when needed.          |
 | Hash deep links          | Stable links such as `/settings#secrets:OPENAI_API_KEY` and `/settings#connections`.  |
@@ -52,10 +59,56 @@ export default function SettingsRoute() {
 }
 ```
 
+## Search {#search}
+
+The search box is enabled by default. With no extra work it matches on tab
+labels, so users can already filter the nav. To make individual controls
+discoverable, register `SettingsSearchEntry` items — each result switches to the
+right tab and scrolls to the target section:
+
+```tsx
+const agentSettingsTabs = useAgentSettingsTabs(); // already ships search entries
+
+return (
+  <SettingsTabsPage
+    extraTabs={[
+      {
+        id: "alerts",
+        label: "Alerts",
+        content: <AlertRulesSettingsCard />,
+        keywords: "notifications thresholds monitors",
+        searchEntries: [
+          { id: "alert-rules", label: "Alert rules", hash: "alert-rules" },
+        ],
+      },
+      ...agentSettingsTabs,
+    ]}
+    general={<LanguagePicker label="Interface language" />}
+    // Deep-link targets that live inside the General tab.
+    generalSearchEntries={[
+      {
+        id: "language",
+        label: "Language",
+        keywords: "locale translation interface",
+        hash: "language",
+      },
+    ]}
+  />
+);
+```
+
+Give each searchable card a matching `id` (e.g. `id="language"`) so the entry's
+`hash` can scroll to it. Add `keywords` for synonyms and provider names the
+label does not contain (e.g. "S3", "R2", "bucket" for replay storage). Set
+`enableSearch={false}` only for trivial single-section pages; prefer keeping it
+on so settings stay findable everywhere.
+
 ## UX Standard {#ux-standard}
 
 - Keep model keys, OAuth connections, Builder connect, language, team, and app
   preferences in one route.
+- Keep search on and register a `SettingsSearchEntry` for every meaningful
+  control so users can find settings by name instead of scanning tabs.
 - Link to tabs by hash so setup prompts can send users to the exact missing
   credential.
 - Use the agent sidebar settings only as a compact access point, not as the

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.90.10",
+  "version": "0.91.0",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -265,6 +265,7 @@
     "@rrweb/record": "2.0.1",
     "@sentry/browser": "10.60.0",
     "@sentry/node": "10.60.0",
+    "@shadcn/react": "^0.2.0",
     "@standard-schema/spec": "^1.1.0",
     "@tanstack/react-table": "^8.21.3",
     "@tiptap/core": "3.27.1",

package/corpus/core/src/agent/durable-background.ts

@@ -260,12 +260,12 @@ export function backgroundRunMarkerExpectsBackgroundRuntime(
 }
 
 export function shouldUseBackgroundFunctionTimeoutForWorker(
-  marker: unknown,
+  _marker: unknown,
 ): boolean {
-  return (
-    isInBackgroundFunctionRuntime() ||
-    backgroundRunMarkerExpectsBackgroundRuntime(marker)
-  );
+  // The dispatch marker says which URL the foreground targeted, not where the
+  // request actually landed. Only the worker runtime proof can safely lift the
+  // hosted 40s clamp to the 15-minute background-function budget.
+  return isInBackgroundFunctionRuntime();
 }
 
 export function backgroundRuntimeDiagnosticDetail(marker: unknown): string {

package/corpus/core/src/agent/engine/ai-sdk-engine.ts

@@ -19,7 +19,10 @@ import {
 } from "../../server/credential-provider.js";
 import { normalizeReasoningEffortForModel } from "../../shared/reasoning-effort.js";
 import { AI_SDK_MODEL_CONFIG, type AISDKProvider } from "../model-config.js";
-import { resolveMaxOutputTokensForEngine } from "./output-tokens.js";
+import {
+  clampThinkingBudgetTokens,
+  resolveMaxOutputTokensForEngine,
+} from "./output-tokens.js";
 import {
   engineToolsToAISDK,
   engineMessagesToAISDK,
@@ -262,16 +265,34 @@ class AISDKEngine implements AgentEngine {
       toolResultImages: this.capabilities.vision,
     });
 
+    // Resolved once so both `maxOutputTokens` (below, in the streamText call)
+    // and the thinking-budget headroom clamp agree on the same ceiling.
+    const resolvedMaxOutputTokens = resolveMaxOutputTokensForEngine(
+      this.name,
+      opts.maxOutputTokens,
+      opts.model,
+    );
+
     // Build providerOptions for Anthropic-native features when using Anthropic provider
     const providerOpts: Record<string, unknown> = {};
     if (this.provider === "anthropic" && opts.providerOptions?.anthropic) {
       const anthropicOpts = opts.providerOptions.anthropic;
       if (anthropicOpts.thinking) {
+        // Only the "enabled" config carries a numeric budgetTokens; clamp it
+        // so thinking can't consume the entire maxOutputTokens budget and
+        // leave zero room for the actual response ("adaptive" thinking has
+        // no budgetTokens field at all per @ai-sdk/anthropic's schema).
         providerOpts.anthropic = {
           ...((providerOpts.anthropic as object) ?? {}),
           thinking: {
             type: "enabled",
-            budgetTokens: anthropicOpts.thinking.budgetTokens,
+            budgetTokens:
+              typeof anthropicOpts.thinking.budgetTokens === "number"
+                ? clampThinkingBudgetTokens(
+                    anthropicOpts.thinking.budgetTokens,
+                    resolvedMaxOutputTokens,
+                  )
+                : anthropicOpts.thinking.budgetTokens,
           },
         };
       }
@@ -309,11 +330,26 @@ class AISDKEngine implements AgentEngine {
         // Gemini 3.x models reject thinkingBudget — they require thinkingLevel.
         // Gemini 2.5.x models use thinkingBudget (integer token count or -1).
         const isGemini3 = /^gemini-3/.test(opts.model);
+        const thinkingBudget = googleThinkingBudget(reasoningEffort);
         providerOpts.google = {
           ...((providerOpts.google as object) ?? {}),
           thinkingConfig: isGemini3
             ? { thinkingLevel: gemini3ThinkingLevel(reasoningEffort) }
-            : { thinkingBudget: googleThinkingBudget(reasoningEffort) },
+            : {
+                // Unlike Anthropic's adaptive thinking, Gemini 2.5's
+                // thinkingBudget IS a concrete numeric token count, so the
+                // same headroom clamp applies: at "max" effort this maps to
+                // 32000 tokens, which can equal (or exceed) a small
+                // maxOutputTokens cap and leave zero room for the actual
+                // response. Preserve Gemini's -1 "dynamic" sentinel.
+                thinkingBudget:
+                  thinkingBudget > 0
+                    ? clampThinkingBudgetTokens(
+                        thinkingBudget,
+                        resolvedMaxOutputTokens,
+                      )
+                    : thinkingBudget,
+              },
         };
       }
     }
@@ -326,11 +362,7 @@ class AISDKEngine implements AgentEngine {
         system: opts.systemPrompt,
         messages,
         tools: aiSdkTools,
-        maxOutputTokens: resolveMaxOutputTokensForEngine(
-          this.name,
-          opts.maxOutputTokens,
-          opts.model,
-        ),
+        maxOutputTokens: resolvedMaxOutputTokens,
         ...(opts.temperature !== undefined
           ? { temperature: opts.temperature }
           : {}),

package/corpus/core/src/agent/engine/anthropic-engine.ts

@@ -19,7 +19,10 @@ import {
   LLM_MISSING_CREDENTIALS_ERROR_CODE,
   LLM_MISSING_CREDENTIALS_MESSAGE,
 } from "./credential-errors.js";
-import { resolveMaxOutputTokensForEngine } from "./output-tokens.js";
+import {
+  clampThinkingBudgetTokens,
+  resolveMaxOutputTokensForEngine,
+} from "./output-tokens.js";
 import {
   engineToolsToAnthropic,
   engineMessagesToAnthropic,
@@ -67,12 +70,31 @@ class AnthropicEngine implements AgentEngine {
     const messages = engineMessagesToAnthropic(opts.messages);
     const anthropicOpts = opts.providerOptions?.anthropic;
 
+    // Resolved once so both max_tokens and the thinking-budget headroom
+    // clamp below agree on the same ceiling.
+    const resolvedMaxOutputTokens = resolveMaxOutputTokensForEngine(
+      this.name,
+      opts.maxOutputTokens,
+      opts.model,
+    );
+
     // Build extra body params for Anthropic-native features
     const extra: Record<string, unknown> = {};
     if (anthropicOpts?.thinking) {
       extra.thinking = {
         type: anthropicOpts.thinking.type,
-        budget_tokens: anthropicOpts.thinking.budgetTokens,
+        // Only the "enabled" config carries a numeric budget_tokens; clamp it
+        // so thinking can't consume the entire max_tokens budget and leave
+        // zero room for the actual response ("adaptive" thinking has no
+        // budget_tokens field at all, so it passes through unclamped).
+        budget_tokens:
+          anthropicOpts.thinking.type === "enabled" &&
+          typeof anthropicOpts.thinking.budgetTokens === "number"
+            ? clampThinkingBudgetTokens(
+                anthropicOpts.thinking.budgetTokens,
+                resolvedMaxOutputTokens,
+              )
+            : anthropicOpts.thinking.budgetTokens,
       };
     }
     if (anthropicOpts?.topK !== undefined) {
@@ -139,11 +161,7 @@ class AnthropicEngine implements AgentEngine {
 
     const requestParams: any = {
       model: opts.model,
-      max_tokens: resolveMaxOutputTokensForEngine(
-        this.name,
-        opts.maxOutputTokens,
-        opts.model,
-      ),
+      max_tokens: resolvedMaxOutputTokens,
       system: systemBlocks,
       tools: cachedTools.length > 0 ? cachedTools : undefined,
       messages: cachedMessages,

package/corpus/core/src/agent/engine/output-tokens.ts

@@ -13,6 +13,100 @@ export const DEFAULT_AI_SDK_MAX_OUTPUT_TOKENS = 4096;
 export const DEFAULT_ANTHROPIC_MAX_OUTPUT_TOKENS = 8192;
 export const DEFAULT_BUILDER_MAX_OUTPUT_TOKENS = 8192;
 
+// ---------------------------------------------------------------------------
+// Main interactive chat path
+//
+// The per-engine defaults above (4096-8192) exist for internal/eval/
+// observational-memory callers that intentionally want a small explicit cap.
+// The main interactive chat turn (the one the end user is staring at) needs
+// real headroom: on long-context or reasoning-heavy turns, a tiny completion
+// budget means extended thinking alone can consume the entire response,
+// leaving zero tokens for visible text/tool calls ("empty response" bug).
+// These helpers give the chat path a much higher floor while staying at or
+// under each model's documented ceiling — they never lower the ceiling.
+// ---------------------------------------------------------------------------
+
+/** Cap for the first attempt of an interactive chat turn. */
+export const MAIN_CHAT_MAX_OUTPUT_TOKENS_CAP = 32_000;
+/**
+ * Cap used only when retrying a turn that came back with an empty final
+ * response (see production-agent.ts's empty-final-response retry). Higher
+ * than the first-attempt cap so the retry meaningfully raises the ceiling.
+ */
+export const EMPTY_RESPONSE_RETRY_MAX_OUTPUT_TOKENS_CAP = 64_000;
+
+/**
+ * Resolve the max_output_tokens floor for the first attempt of an
+ * interactive chat turn: min(model ceiling, 32K). Always at or above the
+ * flat per-engine defaults above, regardless of whether the model is known.
+ */
+export function resolveMainChatMaxOutputTokens(modelId?: string): number {
+  return Math.min(
+    getMaxOutputTokensForModel(modelId),
+    MAIN_CHAT_MAX_OUTPUT_TOKENS_CAP,
+  );
+}
+
+/**
+ * Resolve the max_output_tokens to use when retrying a turn after an empty
+ * final response: min(model ceiling, 64K).
+ */
+export function resolveEmptyResponseRetryMaxOutputTokens(
+  modelId?: string,
+): number {
+  return Math.min(
+    getMaxOutputTokensForModel(modelId),
+    EMPTY_RESPONSE_RETRY_MAX_OUTPUT_TOKENS_CAP,
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Extended-thinking budget headroom
+//
+// Anthropic's `thinking: { type: "enabled", budget_tokens }` config requires
+// budget_tokens >= 1024 and STRICTLY LESS THAN max_tokens (confirmed against
+// the installed @anthropic-ai/sdk@0.90.0 type defs — see ThinkingConfigEnabled
+// in resources/messages/messages.d.ts). budget_tokens counts toward
+// max_tokens, so an unclamped large budget can leave too little (or zero)
+// room for the actual visible completion. This clamp guarantees at least
+// max(8000, 40% of maxOutputTokens) tokens of non-thinking headroom.
+//
+// Note: this only applies to the explicit numeric-budget "enabled" config.
+// Anthropic's `type: "adaptive"` thinking config (used by the
+// reasoningEffort -> output_config.effort mapping in anthropic-engine.ts /
+// ai-sdk-engine.ts) has NO budget_tokens field at all per the SDK types, so
+// there is nothing to clamp there — those callers rely on the raised
+// maxOutputTokens ceiling above instead.
+// ---------------------------------------------------------------------------
+
+/** Anthropic's documented minimum extended-thinking budget. */
+export const ANTHROPIC_MIN_THINKING_BUDGET_TOKENS = 1024;
+
+/**
+ * Clamp a requested Anthropic thinking budget so it leaves guaranteed
+ * headroom under `maxOutputTokens` for non-thinking output, and stays within
+ * the provider's valid range (>= 1024, < maxOutputTokens).
+ */
+export function clampThinkingBudgetTokens(
+  requestedBudgetTokens: number,
+  maxOutputTokens: number,
+): number | undefined {
+  if (maxOutputTokens <= ANTHROPIC_MIN_THINKING_BUDGET_TOKENS) {
+    return undefined;
+  }
+  const headroom = Math.max(8000, Math.round(0.4 * maxOutputTokens));
+  const budgetCapForHeadroom = Math.max(
+    ANTHROPIC_MIN_THINKING_BUDGET_TOKENS,
+    maxOutputTokens - headroom,
+  );
+  // budget_tokens must stay strictly below max_tokens per the API contract.
+  const strictUpperBound = maxOutputTokens - 1;
+  return Math.max(
+    ANTHROPIC_MIN_THINKING_BUDGET_TOKENS,
+    Math.min(requestedBudgetTokens, budgetCapForHeadroom, strictUpperBound),
+  );
+}
+
 function parsePositiveInteger(value: unknown): number | null {
   if (typeof value === "string" && value.trim() === "") return null;
   const n =

package/corpus/core/src/agent/production-agent.ts

@@ -45,6 +45,7 @@ import { fireInternalDispatch } from "../server/self-dispatch.js";
 import {
   isReasoningEffort,
   normalizeReasoningEffortForModel,
+  stepDownReasoningEffort,
   type ReasoningEffort,
 } from "../shared/reasoning-effort.js";
 import { actionPreparationContinuationNote } from "./action-continuation-guidance.js";
@@ -77,7 +78,11 @@ import {
   normalizeModelForEngine,
   isResolvedEngineUsableForRequest,
 } from "./engine/index.js";
-import { resolveMaxOutputTokensForEngine } from "./engine/output-tokens.js";
+import {
+  resolveEmptyResponseRetryMaxOutputTokens,
+  resolveMainChatMaxOutputTokens,
+  resolveMaxOutputTokensForEngine,
+} from "./engine/output-tokens.js";
 import { PROVIDER_TO_ENV } from "./engine/provider-env-vars.js";
 import {
   backfillEngineMessagesToolResults,
@@ -1015,7 +1020,10 @@ const TOOL_INPUT_ACTIVITY_INTERVAL_MS = 1500;
 const ACTION_PREPARATION_NO_PROGRESS_TIMEOUT_MS = 90_000;
 const ACTION_PREPARATION_ZERO_BYTE_RESTART_LIMIT = 2;
 const MODEL_STREAM_NO_PROGRESS_TIMEOUT_MS = 90_000;
-const EMPTY_FINAL_RESPONSE_RETRY_LIMIT = 1;
+// Raised from 1 -> 2 now that each retry actually adapts (raises the token
+// ceiling and steps reasoning effort down a tier) instead of re-issuing the
+// exact same doomed request twice.
+const EMPTY_FINAL_RESPONSE_RETRY_LIMIT = 2;
 const MAIN_CHAT_INTERNAL_CONTINUATION_LIMIT = 6;
 const RUN_BUDGET_EXHAUSTED_ERROR_CODE = "run_budget_exhausted";
 const RUN_BUDGET_EXHAUSTED_MESSAGE =
@@ -2736,6 +2744,12 @@ export async function runAgentLoop(opts: {
   let finalGuardRetries = 0;
   let emptyFinalResponseRetries = 0;
   let iterations = 0;
+  // Overridden (raised tokens, lowered effort) only after an empty-final-
+  // response retry below — kept separate from `opts.maxOutputTokens`/
+  // `opts.reasoningEffort` so the very first attempt is unaffected and later
+  // tool-loop turns revert to the caller's original request after a success.
+  let effectiveMaxOutputTokens = opts.maxOutputTokens;
+  let effectiveReasoningEffort = opts.reasoningEffort;
 
   // Set when an in-loop processor aborts via `abort()` / throws a `TripWire`.
   // The loop emits the `tripwire` event, surfaces the reason as a final
@@ -2845,10 +2859,10 @@ export async function runAgentLoop(opts: {
           abortSignal: signal,
           maxOutputTokens: resolveMaxOutputTokensForEngine(
             engine.name,
-            opts.maxOutputTokens,
+            effectiveMaxOutputTokens,
             model,
           ),
-          reasoningEffort: opts.reasoningEffort,
+          reasoningEffort: effectiveReasoningEffort,
           providerOptions: opts.providerOptions,
         };
 
@@ -3351,8 +3365,10 @@ export async function runAgentLoop(opts: {
       // text — typically when reasoning consumes the entire output-token
       // budget. Without a final text part the SSE stream still ends with a
       // clean `done`, which renders as a totally empty assistant bubble.
-      // Retry once so a transient reasoning-budget miss can still finish; if
-      // the retry also has no visible content, surface a plain-language error.
+      // Retry so a reasoning-budget miss can still finish; each retry raises
+      // the token ceiling and steps reasoning effort down a tier so it's not
+      // just re-issuing the identical doomed request. If retries also come
+      // back empty, surface a plain-language error.
       const hasEmptyFinalResponse =
         !guardEmittedFallback &&
         collectTextParts(assistantContentForHistory).trim().length === 0 &&
@@ -3360,6 +3376,11 @@ export async function runAgentLoop(opts: {
       if (hasEmptyFinalResponse) {
         if (emptyFinalResponseRetries < EMPTY_FINAL_RESPONSE_RETRY_LIMIT) {
           emptyFinalResponseRetries += 1;
+          effectiveMaxOutputTokens =
+            resolveEmptyResponseRetryMaxOutputTokens(model);
+          effectiveReasoningEffort = stepDownReasoningEffort(
+            effectiveReasoningEffort,
+          );
           appendAgentLoopContinuation(messages, "max_tokens");
           continue;
         }
@@ -3369,6 +3390,8 @@ export async function runAgentLoop(opts: {
         });
       } else {
         emptyFinalResponseRetries = 0;
+        effectiveMaxOutputTokens = opts.maxOutputTokens;
+        effectiveReasoningEffort = opts.reasoningEffort;
       }
       break;
     }
@@ -6795,6 +6818,11 @@ export function createProductionAgentHandler(
           orgId: getRequestOrgId() ?? null,
           attachments: requestAttachments,
           reasoningEffort,
+          // The interactive chat turn needs real completion headroom — the
+          // flat per-engine defaults (4096-8192) exist for internal/eval
+          // callers and are far below what a hard, long-context turn needs
+          // once extended thinking is in play. See output-tokens.ts.
+          maxOutputTokens: resolveMainChatMaxOutputTokens(effectiveModel),
           providerOptions: options.providerOptions,
           executionMode: requestMode,
           maxIterations: loopSettings.maxIterations,

package/corpus/core/src/agent/run-ownership.ts

@@ -1,4 +1,6 @@
-import { getThread } from "../chat-threads/store.js";
+import { getThread, resolveThreadAccess } from "../chat-threads/store.js";
+import type { AccessContext } from "../sharing/access.js";
+import type { ShareRole } from "../sharing/schema.js";
 /**
  * Ownership checks for the agent run HTTP routes (`/runs/:id/events`,
  * `/runs/:id/abort`, `/runs/active`).
@@ -38,6 +40,17 @@ export async function callerOwnsThread(
   return !!thread && thread.ownerEmail === owner;
 }
 
+/** True when `owner` has at least `role` access to the chat thread. */
+export async function callerHasThreadAccess(
+  owner: string,
+  threadId: string | null | undefined,
+  role: ShareRole | "owner" = "viewer",
+  ctx: Omit<AccessContext, "userEmail"> = {},
+): Promise<boolean> {
+  if (!threadId) return false;
+  return !!(await resolveThreadAccess(owner, threadId, role, ctx));
+}
+
 /** True when `owner` owns the thread that run `runId` belongs to. */
 export async function callerOwnsRun(
   owner: string,
@@ -45,3 +58,18 @@ export async function callerOwnsRun(
 ): Promise<boolean> {
   return callerOwnsThread(owner, await resolveRunThreadId(runId));
 }
+
+/** True when `owner` has at least `role` access to the thread behind `runId`. */
+export async function callerHasRunAccess(
+  owner: string,
+  runId: string,
+  role: ShareRole | "owner" = "viewer",
+  ctx: Omit<AccessContext, "userEmail"> = {},
+): Promise<boolean> {
+  return callerHasThreadAccess(
+    owner,
+    await resolveRunThreadId(runId),
+    role,
+    ctx,
+  );
+}

package/corpus/core/src/agent/types.ts

@@ -180,8 +180,9 @@ export interface AgentChatRequest {
     continuationCount?: number;
     /**
      * True when the dispatcher expects the self-POST to land in a real
-     * Netlify `-background` function (15-min budget) rather than the ~60s
-     * synchronous function. See `shouldUseBackgroundFunctionTimeoutForWorker`.
+     * Netlify `-background` function rather than the ~60s synchronous function.
+     * This is diagnostic only; the 15-minute budget is unlocked by the worker's
+     * actual runtime marker.
      */
     backgroundFunctionRuntimeExpected?: boolean;
     /**