@agent-native/core 0.97.0 → 0.98.1

package/corpus/core/src/observability/types.ts

@@ -179,6 +179,16 @@ export interface ObservabilityConfig {
   captureToolArgs: boolean;
   captureToolResults: boolean;
   evalSampleRate: number;
+  /**
+   * Classify the raw user message as positive, negative, or neutral. Off by
+   * default for self-hosted apps; first-party agent-native.com deployments
+   * enable it automatically unless explicitly disabled.
+   */
+  inferredSentimentEnabled: boolean;
+  /** Deterministic fraction of eligible user messages to classify (0-1). */
+  inferredSentimentSampleRate: number;
+  /** Model used by the managed Builder classifier. */
+  inferredSentimentModel: string;
   exporters: ObservabilityExporterConfig[];
 }
 
@@ -194,5 +204,8 @@ export const DEFAULT_OBSERVABILITY_CONFIG: ObservabilityConfig = {
   captureToolArgs: false,
   captureToolResults: false,
   evalSampleRate: 0,
+  inferredSentimentEnabled: false,
+  inferredSentimentSampleRate: 0,
+  inferredSentimentModel: "gpt-5-6-luna",
   exporters: [],
 };

package/corpus/core/src/secrets/crypto.ts

@@ -5,12 +5,13 @@
  * credentials (`resolveCredential` / `saveCredential`, stored in `settings`) so
  * there is a single crypto implementation and a single key story.
  *
- * The encryption key is derived from `SECRETS_ENCRYPTION_KEY` (preferred) or the
- * existing `BETTER_AUTH_SECRET` env var (fallback so templates don't need a
- * second secret during development). In production we refuse to start without
- * one of them — a CWD-derived fallback would be effectively static (e.g.
- * `/var/task` on Lambda), so anyone with read access to the DB could decrypt
- * every secret.
+ * The encryption key is derived from `<APP_NAME>_SECRETS_ENCRYPTION_KEY` when
+ * set, then `SECRETS_ENCRYPTION_KEY`, then `BETTER_AUTH_SECRET`. The app-scoped
+ * key lets a local multi-app workspace read one app's encrypted production data
+ * without replacing the shared local auth secret. In production we refuse to
+ * start without configured key material — a CWD-derived fallback would be
+ * effectively static (e.g. `/var/task` on Lambda), so anyone with read access
+ * to the DB could decrypt every secret.
  *
  * Encrypted values are tagged `v1:<iv-hex>:<ct-hex>:<tag-hex>`. The `v1:` prefix
  * lets readers distinguish ciphertext from legacy plaintext during migration.
@@ -55,6 +56,17 @@ function processCwd(): string {
   return process.cwd();
 }
 
+function appScopedEncryptionKey(): string | undefined {
+  if (typeof process === "undefined") return undefined;
+  const appName = process.env.APP_NAME?.trim() // guard:allow-env-credential — deploy-level app configuration selects the scoped encryption key.
+    .toUpperCase()
+    .replace(/[^A-Z0-9]+/g, "_")
+    .replace(/^_+|_+$/g, "");
+  return appName
+    ? process.env[`${appName}_SECRETS_ENCRYPTION_KEY`] // guard:allow-env-credential — deploy-level app encryption material, never a user credential.
+    : undefined;
+}
+
 /**
  * Derive a 32-byte AES key from the configured secret material via SHA-256.
  * Re-derived per call (cheap, stateless, and makes rotation easy).
@@ -62,6 +74,7 @@ function processCwd(): string {
 export function getSecretEncryptionKey(): Buffer {
   const { createHash } = requireNodeCrypto();
   const explicit =
+    appScopedEncryptionKey() ||
     (typeof process === "undefined"
       ? undefined
       : process.env.SECRETS_ENCRYPTION_KEY) ||
@@ -71,9 +84,16 @@ export function getSecretEncryptionKey(): Buffer {
 
   if (!explicit) {
     if (processNodeEnv() === "production") {
+      const appName =
+        typeof process === "undefined"
+          ? undefined
+          : process.env.APP_NAME?.trim() // guard:allow-env-credential — deploy-level app configuration selects the scoped encryption key.
+              .toUpperCase()
+              .replace(/[^A-Z0-9]+/g, "_")
+              .replace(/^_+|_+$/g, "");
       throw new Error(
         "[agent-native/secrets] Refusing to start in production without an encryption key. " +
-          "Set SECRETS_ENCRYPTION_KEY (preferred) or BETTER_AUTH_SECRET in the deploy environment. " +
+          `Set ${appName ? `${appName}_SECRETS_ENCRYPTION_KEY, ` : ""}SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET in the deploy environment. ` +
           "The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), " +
           "which means anyone with read access to the secrets table could decrypt every user's secrets.",
       );
@@ -83,7 +103,7 @@ export function getSecretEncryptionKey(): Buffer {
       // eslint-disable-next-line no-console
       console.warn(
         "[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using a machine-local fallback. " +
-          "Set SECRETS_ENCRYPTION_KEY (or BETTER_AUTH_SECRET) for production. " +
+          "Set an app-scoped *_SECRETS_ENCRYPTION_KEY, SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET for production. " +
           "Production deploys without one of these env vars now hard-fail.",
       );
     }

package/corpus/core/src/secrets/storage.ts

@@ -201,6 +201,40 @@ export interface ReadSecretResult {
   updatedAt: number;
 }
 
+type AppSecretsReadQuery = { sql: string; args: unknown[] };
+
+/**
+ * True only when the database says the app_secrets table itself is missing.
+ * Other query failures must propagate unchanged: attempting schema bootstrap
+ * for connectivity, permission, or syntax errors both hides the real failure
+ * and can introduce DDL onto a latency-sensitive read path.
+ */
+function isMissingAppSecretsTableError(error: unknown): boolean {
+  if (!(error instanceof Error)) return false;
+  const code = String((error as Error & { code?: unknown }).code ?? "");
+  const message = error.message.toLowerCase();
+  const namesAppSecrets = /(?:app_secrets|"app_secrets")/.test(message);
+
+  if (code === "42P01") return namesAppSecrets;
+  return (
+    namesAppSecrets &&
+    (message.includes("no such table") ||
+      (message.includes("relation") && message.includes("does not exist")))
+  );
+}
+
+/** Execute a read without schema probes on the normal path. */
+async function executeAppSecretsRead(query: AppSecretsReadQuery) {
+  const client = getDbExec();
+  try {
+    return await client.execute(query);
+  } catch (error) {
+    if (!isMissingAppSecretsTableError(error)) throw error;
+    await ensureTable();
+    return client.execute(query);
+  }
+}
+
 /**
  * Read a secret's plaintext value. Returns null when not found. The caller
  * is responsible for never logging the returned value.
@@ -208,10 +242,8 @@ export interface ReadSecretResult {
 export async function readAppSecret(
   ref: SecretRef,
 ): Promise<ReadSecretResult | null> {
-  await ensureTable();
   const { key, scope, scopeId } = ref;
-  const client = getDbExec();
-  const { rows } = await client.execute({
+  const { rows } = await executeAppSecretsRead({
     sql: `SELECT encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key = ? LIMIT 1`,
     args: [scope, scopeId, key],
   });
@@ -230,6 +262,38 @@ export async function readAppSecret(
   }
 }
 
+/** Read several keys from one scope in a single database round trip. */
+export async function readAppSecrets(args: {
+  keys: readonly string[];
+  scope: SecretScope;
+  scopeId: string;
+}): Promise<Map<string, ReadSecretResult>> {
+  const keys = [...new Set(args.keys.filter(Boolean))];
+  if (keys.length === 0) return new Map();
+
+  const placeholders = keys.map(() => "?").join(", ");
+  const { rows } = await executeAppSecretsRead({
+    sql: `SELECT key, encrypted_value, updated_at FROM app_secrets WHERE scope = ? AND scope_id = ? AND key IN (${placeholders})`,
+    args: [args.scope, args.scopeId, ...keys],
+  });
+  const results = new Map<string, ReadSecretResult>();
+  for (const row of rows) {
+    const key = String(row.key ?? "");
+    if (!key) continue;
+    try {
+      const value = decryptValue(row.encrypted_value as string);
+      results.set(key, {
+        value,
+        last4: last4(value),
+        updatedAt: Number(row.updated_at ?? 0),
+      });
+    } catch {
+      // Match readAppSecret: corrupted or stale ciphertext behaves as missing.
+    }
+  }
+  return results;
+}
+
 /**
  * Return just the metadata for a secret (no value). Used by the list route so
  * the UI can show the "Set" pill and last-4 without the decrypted value going

package/corpus/core/src/server/action-change.ts

@@ -12,6 +12,7 @@ export interface NotifyActionChangeOptions {
   actionName: string;
   owner?: string;
   orgId?: string;
+  requestSource?: string;
 }
 
 function actionChangeTarget(
@@ -22,6 +23,7 @@ function actionChangeTarget(
     actionName: options.actionName,
     owner,
     orgId: owner ? undefined : (options.orgId ?? getRequestOrgId()),
+    requestSource: options.requestSource,
   };
 }
 
@@ -38,7 +40,7 @@ export async function writeActionChangeMarker(
       ...actionChangeMarkerValue(target),
       nonce: `${Date.now()}-${Math.random().toString(36).slice(2)}`,
     },
-    { requestSource: "agent" },
+    { requestSource: options.requestSource ?? "agent" },
   );
 }
 
@@ -52,11 +54,13 @@ export async function notifyActionChange(
     key: options.actionName,
     ...(target.owner ? { owner: target.owner } : {}),
     ...(target.orgId ? { orgId: target.orgId } : {}),
+    ...(options.requestSource ? { requestSource: options.requestSource } : {}),
   });
 
   await writeActionChangeMarker({
     actionName: options.actionName,
     ...(target.owner ? { owner: target.owner } : {}),
     ...(target.orgId ? { orgId: target.orgId } : {}),
+    ...(options.requestSource ? { requestSource: options.requestSource } : {}),
   });
 }

package/corpus/core/src/server/action-routes.ts

@@ -371,6 +371,14 @@ export function mountActionRoutes(
                   await notifyActionChange({
                     actionName: name,
                     ...(userEmail ? { owner: userEmail } : {}),
+                    ...(getHeader(event, "x-request-source")
+                      ? {
+                          requestSource: getHeader(
+                            event,
+                            "x-request-source",
+                          ) as string,
+                        }
+                      : {}),
                   });
                 } catch {
                   // ignore

package/corpus/core/src/server/agent-chat/action-filters-a2a.ts

@@ -0,0 +1,199 @@
+import { getHeader } from "h3";
+
+import {
+  appendA2AArtifactLinks,
+  type A2AArtifactResponseOptions,
+  type A2AToolResultSummary,
+} from "../../a2a/artifact-response.js";
+import { collectFinalResponseTextFromAgentEvents } from "../../a2a/response-text.js";
+import type { EngineTool } from "../../agent/engine/types.js";
+import {
+  filterInitialEngineTools,
+  type ActionEntry,
+} from "../../agent/production-agent.js";
+import { runAgentLoopDirectWithSoftTimeout } from "../../agent/run-loop-with-resume.js";
+import type { AgentChatEvent } from "../../agent/types.js";
+import { withConfiguredAppBasePath } from "../app-base-path.js";
+import type { AgentChatPluginOptions } from "./plugin-options.js";
+
+// ---------------------------------------------------------------------------
+// Action-visibility filters (read-only / agent-exposed / public-agent-safe)
+// and the A2A (agent-to-agent) final-response assembly + delegated-run
+// helpers that share those filters.
+// ---------------------------------------------------------------------------
+
+export function filterReadOnlyActions(
+  actions: Record<string, ActionEntry>,
+): Record<string, ActionEntry> {
+  return Object.fromEntries(
+    Object.entries(actions).filter(([, entry]) => entry.readOnly === true),
+  );
+}
+
+/** Drop actions that opted out of agent exposure via `agentTool: false`. They
+ *  remain callable from the frontend / HTTP (mounted separately from this
+ *  agent tool surface — see `httpActions`) but never appear in any agent tool
+ *  list (in-app assistant, MCP, A2A, job/trigger runners) or actions prompt.
+ *  Default-allow: only an explicit `false` is excluded. */
+export function filterAgentTools(
+  actions: Record<string, ActionEntry>,
+): Record<string, ActionEntry> {
+  return Object.fromEntries(
+    Object.entries(actions).filter(([, entry]) => entry.agentTool !== false),
+  );
+}
+
+export function filterPublicAgentActions(
+  actions: Record<string, ActionEntry>,
+): Record<string, ActionEntry> {
+  return Object.fromEntries(
+    Object.entries(actions).filter(([, entry]) => {
+      const config = entry.publicAgent;
+      return (
+        config?.expose === true &&
+        config.readOnly === true &&
+        config.requiresAuth !== true &&
+        config.isConsequential !== true
+      );
+    }),
+  );
+}
+
+export function buildPublicAgentA2ASkills(
+  actions: Record<string, ActionEntry>,
+): Array<{
+  id: string;
+  name: string;
+  description: string;
+  publicAgent: ActionEntry["publicAgent"];
+}> {
+  return Object.entries(filterPublicAgentActions(actions)).map(
+    ([name, entry]) => ({
+      id: name,
+      name,
+      description: entry.tool.description,
+      publicAgent: entry.publicAgent,
+    }),
+  );
+}
+
+export function resolveArtifactBaseUrl(
+  event: any | undefined,
+): string | undefined {
+  const fromEnv =
+    process.env.APP_URL ||
+    process.env.URL ||
+    process.env.DEPLOY_URL ||
+    process.env.BETTER_AUTH_URL;
+  if (fromEnv) return withConfiguredAppBasePath(String(fromEnv));
+
+  try {
+    const proto = getHeader(event, "x-forwarded-proto") || "https";
+    const host = getHeader(event, "host");
+    if (host) return withConfiguredAppBasePath(`${proto}://${host}`);
+  } catch {}
+
+  return undefined;
+}
+
+export function assembleA2AFinalResponse(
+  events: readonly AgentChatEvent[],
+  toolResults: readonly A2AToolResultSummary[],
+  options: A2AArtifactResponseOptions & { event?: any } = {},
+): { responseText: string; finalText: string } {
+  const terminalError = getA2ATerminalErrorEvent(events);
+  const responseText = collectFinalResponseTextFromAgentEvents(events, {
+    fallbackToPreToolText: !terminalError,
+  });
+  const finalText = appendA2AArtifactLinks(responseText, [...toolResults], {
+    baseUrl: options.baseUrl ?? resolveArtifactBaseUrl(options.event),
+    includeReferencedArtifacts: true,
+  });
+  if (terminalError && !finalText.trim()) {
+    throw new Error(formatA2ATerminalError(terminalError));
+  }
+  return { responseText, finalText };
+}
+
+function getA2ATerminalErrorEvent(
+  events: readonly AgentChatEvent[],
+): Extract<AgentChatEvent, { type: "error" }> | null {
+  for (let i = events.length - 1; i >= 0; i--) {
+    const event = events[i];
+    if (event.type === "clear") continue;
+    if (event.type === "done") return null;
+    if (event.type === "error") return event;
+    if (event.type === "auto_continue") {
+      return {
+        type: "error",
+        error: `Agent stopped before finishing (${event.reason}).`,
+        errorCode: event.reason,
+        recoverable: true,
+      };
+    }
+  }
+  return null;
+}
+
+function formatA2ATerminalError(
+  event: Extract<AgentChatEvent, { type: "error" }>,
+): string {
+  const parts = [
+    event.error || "Agent failed before producing a final response.",
+    event.errorCode ? `code: ${event.errorCode}` : "",
+    event.details ? `details: ${event.details}` : "",
+  ].filter(Boolean);
+  return parts.join("\n");
+}
+
+type A2AAgentLoopRunner = typeof runAgentLoopDirectWithSoftTimeout;
+
+/**
+ * Run an A2A-delegated agent turn with the same final-response guard used by
+ * the app's interactive chat surface.
+ *
+ * Keeping this in one helper prevents delegated calls from silently bypassing
+ * template guarantees such as Analytics' requirement to query real data
+ * before presenting metrics or exhaustive provider conclusions.
+ */
+export function runA2AAgentLoop(
+  runOptions: Parameters<A2AAgentLoopRunner>[0],
+  pluginOptions: Pick<
+    AgentChatPluginOptions,
+    "finalResponseGuard" | "runSoftTimeoutMs"
+  >,
+  timeoutOptions: Parameters<A2AAgentLoopRunner>[2],
+  runner: A2AAgentLoopRunner = runAgentLoopDirectWithSoftTimeout,
+) {
+  return runner(
+    {
+      ...runOptions,
+      finalResponseGuard: pluginOptions.finalResponseGuard,
+    },
+    pluginOptions.runSoftTimeoutMs,
+    timeoutOptions,
+  );
+}
+
+/**
+ * Keep delegated A2A turns on the same compact initial tool surface as
+ * interactive chat. `tool-search` remains in the initial set, while the
+ * complete registry is supplied separately so the run loop can load a matched
+ * schema after a tool-search result.
+ */
+export function createA2AEngineToolSurface(
+  availableTools: EngineTool[],
+  initialToolNames?: string[],
+): { tools: EngineTool[]; availableTools: EngineTool[] } {
+  return {
+    tools: filterInitialEngineTools(availableTools, initialToolNames),
+    availableTools,
+  };
+}
+
+export function resolveInitialToolNames(
+  templateActions: Record<string, ActionEntry>,
+  configured?: string[],
+): string[] {
+  return configured ?? Object.keys(templateActions);
+}