n8n 2.27.4 → 2.28.1

package/dist/modules/instance-ai/instance-ai.service.js

@@ -45,6 +45,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.InstanceAiService = void 0;
 const api_types_1 = require("@n8n/api-types");
 const backend_common_1 = require("@n8n/backend-common");
+const backend_network_1 = require("@n8n/backend-network");
 const config_1 = require("@n8n/config");
 const db_1 = require("@n8n/db");
 const decorators_1 = require("@n8n/decorators");
@@ -55,41 +56,62 @@ const n8n_core_1 = require("n8n-core");
 const n8n_workflow_1 = require("n8n-workflow");
 const nanoid_1 = require("nanoid");
 const uuid_1 = require("uuid");
+const constants_1 = require("../../constants");
+const event_service_1 = require("../../events/event.service");
+const source_control_preferences_service_ee_1 = require("../../modules/source-control.ee/source-control-preferences.service.ee");
+const ai_service_1 = require("../../services/ai.service");
+const proxy_token_manager_1 = require("../../services/proxy-token-manager");
+const url_service_1 = require("../../services/url.service");
+const telemetry_1 = require("../../telemetry");
+const thread_credential_allowlist_service_1 = require("./eval/thread-credential-allowlist.service");
 const in_process_event_bus_1 = require("./event-bus/in-process-event-bus");
+const instance_ai_credit_service_1 = require("./instance-ai-credit.service");
 const instance_ai_gateway_service_1 = require("./instance-ai-gateway.service");
 const instance_ai_memory_service_1 = require("./instance-ai-memory.service");
+const instance_ai_model_service_1 = require("./instance-ai-model.service");
+const instance_ai_run_probe_1 = require("./instance-ai-run-probe");
 const instance_ai_settings_service_1 = require("./instance-ai-settings.service");
+const instance_ai_temporary_workflow_service_1 = require("./instance-ai-temporary-workflow.service");
 const instance_ai_adapter_service_1 = require("./instance-ai.adapter.service");
-const output_redaction_config_1 = require("./output-redaction-config");
 const internal_messages_1 = require("./internal-messages");
 const liveness_1 = require("./liveness");
 const mcp_1 = require("./mcp");
+const observability_1 = require("./observability");
+const output_redaction_config_1 = require("./output-redaction-config");
+const planned_task_action_runner_1 = require("./planned-task-action-runner");
 const instance_ai_pending_confirmation_repository_1 = require("./repositories/instance-ai-pending-confirmation.repository");
-const instance_ai_thread_repository_1 = require("./repositories/instance-ai-thread.repository");
-const sandbox_1 = require("./sandbox");
-const suspended_run_restorer_service_1 = require("./suspended-run-restorer.service");
-const suspended_thread_persistence_service_1 = require("./suspended-thread-persistence.service");
+const instance_ai_thread_grant_repository_1 = require("./repositories/instance-ai-thread-grant.repository");
 const run_trace_metadata_1 = require("./run-trace-metadata");
+const sandbox_1 = require("./sandbox");
 const db_iteration_log_storage_1 = require("./storage/db-iteration-log-storage");
 const db_snapshot_storage_1 = require("./storage/db-snapshot-storage");
 const typeorm_agent_checkpoint_store_1 = require("./storage/typeorm-agent-checkpoint-store");
 const typeorm_agent_memory_1 = require("./storage/typeorm-agent-memory");
+const suspended_run_restorer_service_1 = require("./suspended-run-restorer.service");
+const suspended_thread_persistence_service_1 = require("./suspended-thread-persistence.service");
 const trace_replay_state_1 = require("./trace-replay-state");
 const workflow_verification_obligation_service_1 = require("./workflow-verification-obligation-service");
-const planned_task_action_runner_1 = require("./planned-task-action-runner");
 const workflow_verification_task_projector_1 = require("./workflow-verification-task-projector");
-const constants_1 = require("../../constants");
-const event_service_1 = require("../../events/event.service");
-const source_control_preferences_service_ee_1 = require("../../modules/source-control.ee/source-control-preferences.service.ee");
-const push_1 = require("../../push");
-const ai_service_1 = require("../../services/ai.service");
-const proxy_token_manager_1 = require("../../services/proxy-token-manager");
-const url_service_1 = require("../../services/url.service");
-const telemetry_1 = require("../../telemetry");
-const backend_network_1 = require("@n8n/backend-network");
 function getErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
+function buildContextResourcesBlock(workflowAttachments) {
+    if (workflowAttachments.length === 0)
+        return '';
+    const lines = workflowAttachments.map((attachment) => {
+        const name = attachment.name ? ` "${attachment.name}"` : '';
+        const execution = attachment.executionId
+            ? `, currently viewing its execution \`${attachment.executionId}\``
+            : '';
+        return `- Workflow${name} (id: \`${attachment.id}\`)${execution}.`;
+    });
+    const prose = [
+        'The user opened this conversation from the workflow editor, where they are looking at:',
+        ...lines,
+        "Treat this purely as context. Until the user tells you what they need, don't read, inspect, run, or otherwise call tools on these resources, and don't make claims about their contents — just briefly acknowledge what they're working on and ask how you can help.",
+    ].join('\n');
+    return `${internal_messages_1.EDITOR_CONTEXT_OPEN_TAG}\n${JSON.stringify(workflowAttachments)}\n\n${prose}\n${internal_messages_1.EDITOR_CONTEXT_CLOSE_TAG}`;
+}
 function isTelemetryConfigurableAgent(agent) {
     return (typeof agent === 'object' &&
         agent !== null &&
@@ -224,21 +246,10 @@ function buildPlannedTaskConversationContext(task, graph) {
     }
     return parts.join('\n');
 }
-function getProxyFetch() {
-    const proxyUrl = process.env.HTTPS_PROXY || process.env.HTTP_PROXY;
-    if (!proxyUrl)
-        return undefined;
-    const { ProxyAgent } = require('undici');
-    const dispatcher = new ProxyAgent(proxyUrl);
-    return (async (url, init) => await globalThis.fetch(url, {
-        ...init,
-        dispatcher,
-    }));
-}
 function toConfirmationData(request) {
     switch (request.kind) {
         case 'approval':
-            return { approved: request.approved, userInput: request.userInput };
+            return { approved: request.approved, userInput: request.userInput, scope: request.scope };
         case 'domainAccessApprove':
             return { approved: true, domainAccessAction: request.domainAccessAction };
         case 'domainAccessDeny':
@@ -275,7 +286,7 @@ let InstanceAiService = class InstanceAiService {
         }
         return this._mcpClientManager;
     }
-    constructor(logger, globalConfig, instanceSettings, adapterService, eventBus, settingsService, gatewayService, memoryService, agentMemory, checkpointStore, aiService, push, threadRepo, pendingConfirmationRepo, urlService, dbSnapshotStorage, dbIterationLogStorage, sourceControlPreferencesService, telemetry, mcpRegistryService, userRepository, aiBuilderTemporaryWorkflowRepository, errorReporter, ssrfProtectionConfig, ssrfProtectionService, eventService) {
+    constructor(logger, globalConfig, instanceSettings, adapterService, eventBus, settingsService, gatewayService, memoryService, agentMemory, checkpointStore, aiService, threadGrantRepo, pendingConfirmationRepo, urlService, dbSnapshotStorage, dbIterationLogStorage, sourceControlPreferencesService, telemetry, mcpRegistryService, userRepository, temporaryWorkflowService, errorReporter, ssrfProtectionConfig, ssrfProtectionService, eventService, evalCredentialAllowlists, runProbe, modelService, creditService) {
         this.instanceSettings = instanceSettings;
         this.adapterService = adapterService;
         this.eventBus = eventBus;
@@ -285,8 +296,7 @@ let InstanceAiService = class InstanceAiService {
         this.agentMemory = agentMemory;
         this.checkpointStore = checkpointStore;
         this.aiService = aiService;
-        this.push = push;
-        this.threadRepo = threadRepo;
+        this.threadGrantRepo = threadGrantRepo;
         this.pendingConfirmationRepo = pendingConfirmationRepo;
         this.urlService = urlService;
         this.dbSnapshotStorage = dbSnapshotStorage;
@@ -295,25 +305,31 @@ let InstanceAiService = class InstanceAiService {
         this.telemetry = telemetry;
         this.mcpRegistryService = mcpRegistryService;
         this.userRepository = userRepository;
-        this.aiBuilderTemporaryWorkflowRepository = aiBuilderTemporaryWorkflowRepository;
+        this.temporaryWorkflowService = temporaryWorkflowService;
         this.errorReporter = errorReporter;
         this.eventService = eventService;
+        this.evalCredentialAllowlists = evalCredentialAllowlists;
+        this.modelService = modelService;
+        this.creditService = creditService;
         this.runState = new instance_ai_1.RunStateRegistry();
         this.backgroundTasks = new instance_ai_1.BackgroundTaskManager(MAX_CONCURRENT_BACKGROUND_TASKS_PER_THREAD);
+        this.memoryTaskRegistry = new instance_ai_1.MemoryTaskRegistry();
         this.traceContextsByRunId = new Map();
+        this.reportedErrors = new WeakSet();
         this.domainAccessTrackersByThread = new Map();
         this.threadPushRef = new Map();
         this.planRequestsByThread = new Map();
         this.schedulerLocks = new Map();
         this.pendingCheckpointReentries = new Map();
         this.pendingTerminalOutcomes = new Map();
-        this.creditedThreads = new Set();
         this.traceReplay = new trace_replay_state_1.TraceReplayState();
+        this.runDebugBuffer = new instance_ai_1.RunDebugBuffer();
         this.checkpointPruningStopped = true;
         this.inFlightExecutions = new Set();
         this.preserveHitlOnShutdown = new Set();
         this.userMessagePersistenceByRun = new Map();
         this.logger = logger.scoped('instance-ai');
+        runProbe.registerActiveRunCountProvider(() => this.runState.activeRunCount());
         this.workflowObligations = new workflow_verification_obligation_service_1.WorkflowVerificationObligationService(this.agentMemory);
         this.taskProjector = new workflow_verification_task_projector_1.WorkflowVerificationTaskProjector(this.agentMemory, this.eventBus, this.logger, this.workflowObligations);
         this.instanceAiConfig = globalConfig.instanceAi;
@@ -382,123 +398,69 @@ let InstanceAiService = class InstanceAiService {
         if (this.instanceSettings.isLeader)
             this.startCheckpointPruning();
     }
-    async getProxyAuth(user) {
+    async createProxyRunConfig(user) {
+        if (!this.aiService.isProxyEnabled())
+            return {};
         const client = await this.aiService.getClient();
-        const token = await client.getBuilderApiProxyToken({ id: user.id }, { userMessageId: (0, nanoid_1.nanoid)() });
+        const proxyBaseUrl = client.getApiProxyBaseUrl();
+        const tokenManager = new proxy_token_manager_1.ProxyTokenManager(async () => {
+            return await client.getBuilderApiProxyToken({ id: user.id }, { userMessageId: (0, nanoid_1.nanoid)() });
+        });
+        const featureHeaders = (0, api_types_1.buildProxyHeaders)({
+            feature: 'instance-ai',
+            n8nVersion: constants_1.N8N_VERSION,
+        });
         return {
-            client,
-            headers: { Authorization: `${token.tokenType} ${token.accessToken}` },
+            proxyBaseUrl,
+            tokenManager,
+            searchProxyConfig: {
+                apiUrl: proxyBaseUrl + '/brave-search',
+                getAuthHeaders: async () => ({
+                    ...(await tokenManager.getAuthHeaders()),
+                    ...featureHeaders,
+                }),
+            },
+            tracingProxyConfig: {
+                apiUrl: proxyBaseUrl + '/langsmith',
+                getAuthHeaders: async () => ({
+                    ...(await tokenManager.getAuthHeaders()),
+                    ...featureHeaders,
+                }),
+            },
         };
     }
     async resolveAgentModelConfig(user) {
-        if (this.aiService.isProxyEnabled()) {
-            const client = await this.aiService.getClient();
-            const proxyBaseUrl = client.getApiProxyBaseUrl();
-            const tokenManager = new proxy_token_manager_1.ProxyTokenManager(async () => {
-                return await client.getBuilderApiProxyToken({ id: user.id }, { userMessageId: (0, nanoid_1.nanoid)() });
-            });
-            return await this.resolveProxyModel(user, proxyBaseUrl, tokenManager);
-        }
-        const httpProxyModel = await this.resolveHttpProxyModel(user);
-        if (httpProxyModel)
-            return httpProxyModel;
-        return await this.settingsService.resolveModelConfig(user);
-    }
-    async resolveProxyModel(user, proxyBaseUrl, tokenManager) {
-        const modelName = this.settingsService.resolveModelName(user);
-        const { createAnthropic } = await Promise.resolve().then(() => __importStar(require('@ai-sdk/anthropic')));
-        const provider = createAnthropic({
-            baseURL: proxyBaseUrl + '/anthropic/v1',
-            apiKey: 'proxy-managed',
-            fetch: async (input, init) => {
-                const headers = new Headers(init?.headers);
-                const auth = await tokenManager.getAuthHeaders();
-                for (const [k, v] of Object.entries(auth)) {
-                    headers.set(k, v);
-                }
-                for (const [k, v] of Object.entries((0, api_types_1.buildProxyHeaders)({ feature: 'instance-ai', n8nVersion: constants_1.N8N_VERSION }))) {
-                    headers.set(k, v);
-                }
-                return await globalThis.fetch(input, { ...init, headers });
-            },
-        });
-        return provider(modelName);
+        return await this.modelService.resolveAgentModelConfig(user);
     }
-    async resolveHttpProxyModel(user) {
-        const proxyFetch = getProxyFetch();
-        if (!proxyFetch)
-            return undefined;
-        const config = await this.settingsService.resolveModelConfig(user);
-        const modelId = typeof config === 'string' ? config : 'id' in config ? config.id : null;
-        if (!modelId)
-            return undefined;
-        const [provider, ...rest] = modelId.split('/');
-        const modelName = rest.join('/');
-        const apiKey = typeof config === 'object' && 'apiKey' in config ? config.apiKey : undefined;
-        const baseURL = typeof config === 'object' && 'url' in config ? config.url : undefined;
-        if (provider !== 'anthropic')
-            return undefined;
-        const { createAnthropic } = await Promise.resolve().then(() => __importStar(require('@ai-sdk/anthropic')));
-        return createAnthropic({
-            apiKey,
-            baseURL: baseURL || undefined,
-            fetch: proxyFetch,
-        })(modelName);
-    }
-    async countCreditsIfFirst(user, threadId, runId) {
-        if (!this.aiService.isProxyEnabled())
-            return;
-        if (this.creditedThreads.has(threadId))
-            return;
-        let thread;
+    async loadThreadSessionGrants(threadId, userId) {
         try {
-            thread = await this.threadRepo.findOneBy({ id: threadId });
+            return await this.threadGrantRepo.findKeys(threadId, userId);
         }
         catch (error) {
-            this.logger.warn('Failed to check Instance AI credit status', {
+            this.logger.warn('Failed to load Instance AI session grants', {
                 threadId,
-                runId,
                 error: getErrorMessage(error),
             });
-            return;
-        }
-        if (!thread)
-            return;
-        if (thread.metadata?.creditCounted) {
-            this.creditedThreads.add(threadId);
-            return;
+            return new Set();
         }
+    }
+    async persistThreadSessionGrant(threadId, userId, key) {
         try {
-            this.creditedThreads.add(threadId);
-            const { client, headers: authHeaders } = await this.getProxyAuth(user);
-            const info = await client.markBuilderSuccess({ id: user.id }, authHeaders);
-            if (info) {
-                thread.metadata = { ...thread.metadata, creditCounted: true };
-                await this.threadRepo.save(thread);
-                this.push.sendToUsers({
-                    type: 'updateInstanceAiCredits',
-                    data: { creditsQuota: info.creditsQuota, creditsClaimed: info.creditsClaimed },
-                }, [user.id]);
-            }
+            await this.threadGrantRepo.grant(threadId, userId, key);
         }
         catch (error) {
-            this.creditedThreads.delete(threadId);
-            this.logger.warn('Failed to count Instance AI credits', {
-                error: getErrorMessage(error),
+            this.logger.warn('Failed to persist Instance AI session grant', {
                 threadId,
-                runId,
+                key,
+                error: getErrorMessage(error),
             });
         }
     }
     isProxyEnabled() {
-        return this.aiService.isProxyEnabled();
+        return this.modelService.isProxyEnabled();
     }
     async getCredits(user) {
-        if (!this.aiService.isProxyEnabled()) {
-            return { creditsQuota: api_types_1.UNLIMITED_CREDITS, creditsClaimed: 0 };
-        }
-        const client = await this.aiService.getClient();
-        return await client.getBuilderInstanceCredits({ id: user.id });
+        return await this.modelService.getCredits(user);
     }
     isEnabled() {
         return this.settingsService.isAgentEnabled() && !!this.instanceAiConfig.model;
@@ -507,7 +469,31 @@ let InstanceAiService = class InstanceAiService {
         return this.runState.hasLiveRun(threadId);
     }
     getThreadStatus(threadId) {
-        return this.runState.getThreadStatus(threadId, this.backgroundTasks.getTaskSnapshots(threadId));
+        const status = this.runState.getThreadStatus(threadId, this.backgroundTasks.getTaskSnapshots(threadId));
+        const memoryTasks = this.memoryTaskRegistry.getTasks(threadId);
+        return { ...status, memoryTasks };
+    }
+    memoryTaskObserverFor(threadId) {
+        return (event) => {
+            this.memoryTaskRegistry.handleEvent(threadId, event);
+            const pendingTasks = this.memoryTaskRegistry.getTasks(threadId);
+            const logContext = {
+                threadId,
+                taskId: event.task.id,
+                taskKind: event.task.taskKind,
+                pendingCount: pendingTasks.length,
+                ...(event.type === 'skipped' ? { reason: event.reason } : {}),
+                ...(event.type === 'failed' ? { error: getErrorMessage(event.error) } : {}),
+                ...(event.type === 'completed' &&
+                    event.value &&
+                    typeof event.value === 'object' &&
+                    'status' in event.value &&
+                    typeof event.value.status === 'string'
+                    ? { outcome: event.value.status }
+                    : {}),
+            };
+            this.logger.info(`Observational memory task ${event.type}`, logContext);
+        };
     }
     storeTraceContext(runId, threadId, tracing, messageGroupId) {
         const existing = this.traceContextsByRunId.get(runId);
@@ -526,6 +512,82 @@ let InstanceAiService = class InstanceAiService {
     getTraceContext(runId) {
         return this.traceContextsByRunId.get(runId)?.tracing;
     }
+    reportInstanceAiError(error, context) {
+        if (typeof error === 'object' && error !== null) {
+            if (this.reportedErrors.has(error))
+                return;
+            this.reportedErrors.add(error);
+        }
+        const observability = (0, observability_1.buildInstanceAiObservabilityContext)(context);
+        this.logger.error(`Instance AI error in ${context.component}`, {
+            error,
+            component: context.component,
+            ...observability,
+        });
+        this.errorReporter.error(error, {
+            tags: { component: context.component, ...observability },
+            extra: observability,
+        });
+    }
+    async withSetupBoundary(component, context, fn) {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            this.reportInstanceAiError(error, { component, ...context });
+            throw error;
+        }
+    }
+    isRunDebugEnabled() {
+        return this.instanceAiConfig.runDebugEnabled;
+    }
+    buildOrchestratorAgentStreamOptions(user, threadId, runId, signal) {
+        if (this.isRunDebugEnabled()) {
+            this.runDebugBuffer.ensure(runId, threadId);
+        }
+        return {
+            maxIterations: instance_ai_1.MAX_STEPS.ORCHESTRATOR,
+            abortSignal: signal,
+            recoverUsageOnAbort: true,
+            persistence: {
+                resourceId: user.id,
+                threadId,
+            },
+            providerOptions: {
+                anthropic: { cacheControl: { type: 'ephemeral' } },
+            },
+            ...(this.isRunDebugEnabled()
+                ? (0, instance_ai_1.createRunDebugStepHooks)(this.runDebugBuffer, { runId, threadId })
+                : {}),
+        };
+    }
+    buildOrchestratorResumeAgentOptions(user, threadId, runId, agentRunId, toolCallId) {
+        if (this.isRunDebugEnabled()) {
+            this.runDebugBuffer.ensure(runId, threadId);
+        }
+        return {
+            runId: agentRunId,
+            toolCallId,
+            recoverUsageOnAbort: true,
+            persistence: { resourceId: user.id, threadId },
+            ...(this.isRunDebugEnabled()
+                ? (0, instance_ai_1.createRunDebugStepHooks)(this.runDebugBuffer, { runId, threadId })
+                : {}),
+        };
+    }
+    getRunDebug(runId) {
+        return this.runDebugBuffer.get(runId);
+    }
+    listThreadDebugRuns(threadId) {
+        return this.runDebugBuffer.listByThread(threadId).map((record) => ({
+            runId: record.runId,
+            threadId: record.threadId,
+            startedAt: record.startedAt,
+            stepCount: record.steps.length,
+            workflowCodeCount: record.workflowCode.length,
+            label: record.label,
+        }));
+    }
     getTraceContextForContinuation(threadId, messageGroupId) {
         const entries = [...this.traceContextsByRunId.values()].reverse();
         const sameGroup = messageGroupId === undefined
@@ -818,7 +880,7 @@ let InstanceAiService = class InstanceAiService {
             userId: user.id,
             message: { id: userMessageId, text: message },
         });
-        this.startExecuteRun(user, threadId, runId, message, abortController, attachments, messageGroupId, timeZone, false, undefined, undefined);
+        this.startExecuteRun(user, threadId, runId, message, abortController, attachments, messageGroupId, timeZone);
         return runId;
     }
     getMessageGroupId(threadId) {
@@ -1051,14 +1113,15 @@ let InstanceAiService = class InstanceAiService {
             reason: 'thread_cleared',
             metadata: { completion_source: 'service_cleanup' },
         });
-        this.creditedThreads.delete(threadId);
         this.schedulerLocks.delete(threadId);
         this.domainAccessTrackersByThread.delete(threadId);
+        this.evalCredentialAllowlists.clearThread(threadId);
         this.threadPushRef.delete(threadId);
         this.planRequestsByThread.delete(threadId);
+        this.memoryTaskRegistry.clearThread(threadId);
         this.deleteTraceContextsForThread(threadId);
         await this.sandboxService.destroySandbox(threadId);
-        await this.reapAiTemporaryForThreadCleanup(threadId);
+        await this.temporaryWorkflowService.reapForThreadCleanup(threadId);
         await this.suspendedThreads.dropPendingConfirmationsForThread(threadId);
         this.eventBus.clearThread(threadId);
     }
@@ -1659,7 +1722,7 @@ let InstanceAiService = class InstanceAiService {
             });
         }
     }
-    async createExecutionEnvironment(user, threadId, runId, abortSignal, messageGroupId, pushRef) {
+    async createExecutionEnvironment(user, threadId, runId, abortSignal, messageGroupId, pushRef, proxyRunConfig) {
         const memory = this.agentMemory;
         const boundProjectId = await memory.getThreadProjectId(threadId);
         if (!boundProjectId) {
@@ -1669,41 +1732,13 @@ let InstanceAiService = class InstanceAiService {
         const localGatewayDisabledGlobally = adminSettings.localGatewayDisabled;
         const localGatewayDisabledForUser = await this.settingsService.isLocalGatewayDisabledForUser(user.id);
         const userGateway = this.gatewayService.findGateway(user.id);
-        let searchProxyConfig;
-        let tracingProxyConfig;
-        let tokenManager;
-        let proxyBaseUrl;
-        if (this.aiService.isProxyEnabled()) {
-            const client = await this.aiService.getClient();
-            proxyBaseUrl = client.getApiProxyBaseUrl();
-            const manager = new proxy_token_manager_1.ProxyTokenManager(async () => {
-                return await client.getBuilderApiProxyToken({ id: user.id }, { userMessageId: (0, nanoid_1.nanoid)() });
-            });
-            tokenManager = manager;
-            const featureHeaders = (0, api_types_1.buildProxyHeaders)({
-                feature: 'instance-ai',
-                n8nVersion: constants_1.N8N_VERSION,
-            });
-            searchProxyConfig = {
-                apiUrl: proxyBaseUrl + '/brave-search',
-                getAuthHeaders: async () => ({
-                    ...(await manager.getAuthHeaders()),
-                    ...featureHeaders,
-                }),
-            };
-            tracingProxyConfig = {
-                apiUrl: proxyBaseUrl + '/langsmith',
-                getAuthHeaders: async () => ({
-                    ...(await manager.getAuthHeaders()),
-                    ...featureHeaders,
-                }),
-            };
-        }
+        const { searchProxyConfig, tracingProxyConfig, tokenManager, proxyBaseUrl } = proxyRunConfig ?? (await this.createProxyRunConfig(user));
         const context = this.adapterService.createContext(user, {
             searchProxyConfig,
             pushRef,
             threadId,
             projectId: boundProjectId,
+            credentialIdAllowlist: this.evalCredentialAllowlists.get(threadId),
         });
         if (!localGatewayDisabledForUser && userGateway?.isConnected) {
             context.localMcpServer = userGateway;
@@ -1720,6 +1755,18 @@ let InstanceAiService = class InstanceAiService {
         }
         context.domainAccessTracker = domainTracker;
         context.runId = runId;
+        const sessionGrants = await this.loadThreadSessionGrants(threadId, user.id);
+        context.sessionApprovedToolKeys = sessionGrants;
+        context.grantSessionToolApproval = async (key) => {
+            await this.persistThreadSessionGrant(threadId, user.id, key);
+            sessionGrants.add(key);
+        };
+        if (this.isRunDebugEnabled()) {
+            context.recordWorkflowCodeSnapshot = (snapshot) => {
+                this.runDebugBuffer.ensure(runId, threadId);
+                this.runDebugBuffer.recordWorkflowCode(runId, snapshot);
+            };
+        }
         if (localGatewayDisabledGlobally) {
             context.localGatewayStatus = { status: 'disabledGlobally' };
         }
@@ -1738,8 +1785,8 @@ let InstanceAiService = class InstanceAiService {
             };
         }
         const modelId = proxyBaseUrl && tokenManager
-            ? await this.resolveProxyModel(user, proxyBaseUrl, tokenManager)
-            : await this.resolveAgentModelConfig(user);
+            ? await this.modelService.resolveProxyModel(user, proxyBaseUrl, tokenManager)
+            : await this.modelService.resolveAgentModelConfig(user);
         const taskStorage = new instance_ai_1.ThreadTaskStorage(memory);
         const iterationLog = this.dbIterationLogStorage;
         const snapshotStorage = this.dbSnapshotStorage;
@@ -1751,14 +1798,13 @@ let InstanceAiService = class InstanceAiService {
         if (nodeDefDirs.length > 0) {
             (0, workflow_sdk_1.setSchemaBaseDirs)(nodeDefDirs);
         }
-        const domainTools = (0, instance_ai_1.createAllTools)(context);
         const baseRuntimeSkills = (0, instance_ai_1.loadInstanceAiRuntimeSkillSource)();
         let runtimeSkills = baseRuntimeSkills;
         let runtimeWorkspace;
         let workspaceRoot;
         const sandboxStatus = this.settingsService.getSandboxStatus();
         if (sandboxStatus.workflowBuilderAvailable) {
-            const sandboxConfig = await this.sandboxService.resolveSandboxConfig(user);
+            const sandboxConfig = await this.withSetupBoundary('instance-ai-sandbox-setup', { threadId, runId, userId: user.id, messageGroupId }, async () => await this.sandboxService.resolveSandboxConfig(user));
             if (sandboxConfig.enabled) {
                 workspaceRoot = (0, instance_ai_1.getPromptWorkspaceRoot)(sandboxConfig.provider);
                 let sandboxEntryPromise;
@@ -1795,6 +1841,13 @@ let InstanceAiService = class InstanceAiService {
                 });
             }
         }
+        context.workspace = runtimeWorkspace;
+        context.threadId = threadId;
+        context.threadMemory = memory;
+        context.trackTelemetry = (eventName, properties) => {
+            this.telemetry.track(eventName, properties);
+        };
+        const domainTools = (0, instance_ai_1.createAllTools)(context);
         const orchestrationContext = {
             threadId,
             runId,
@@ -2081,7 +2134,9 @@ let InstanceAiService = class InstanceAiService {
             const obligation = this.workflowObligations.obligationFromRecord(threadId, record, {
                 source: 'direct',
             });
-            const verificationConcluded = obligation.status === 'verified' || obligation.status === 'needs_setup';
+            const verificationConcluded = obligation.status === 'verified' ||
+                obligation.status === 'needs_setup' ||
+                obligation.status === 'not_verifiable';
             if (!verificationConcluded)
                 continue;
             if (obligation.setupRequirement?.status !== 'required' || !obligation.workflowId)
@@ -2273,6 +2328,8 @@ let InstanceAiService = class InstanceAiService {
     }
     async executeRun(user, threadId, runId, message, abortController, attachments, messageGroupId, timeZone, isReplanFollowUp = false, checkpoint, resumeReason, plannedBuild) {
         const userMessagePersistence = this.userMessagePersistenceByRun.get(runId)?.message;
+        const fileAttachments = (attachments ?? []).filter((attachment) => attachment.type === 'file');
+        const workflowAttachments = (attachments ?? []).filter((attachment) => attachment.type === 'workflow');
         const signal = abortController.signal;
         let tracing;
         let messageTraceFinalization;
@@ -2281,12 +2338,61 @@ let InstanceAiService = class InstanceAiService {
         let messageId = '';
         try {
             messageId = (0, nanoid_1.nanoid)();
+            const traceInput = {
+                message,
+                ...(fileAttachments.length
+                    ? {
+                        attachments: fileAttachments.map((attachment) => ({
+                            mimeType: attachment.mimeType,
+                            size: attachment.data.length,
+                        })),
+                    }
+                    : {}),
+                ...(messageGroupId ? { messageGroupId } : {}),
+            };
+            const proxyRunConfig = await this.createProxyRunConfig(user);
+            if (resumeReason) {
+                tracing = await this.createOrchestratorResumeTraceContext({
+                    threadId,
+                    messageId,
+                    messageGroupId,
+                    runId,
+                    userId: user.id,
+                    input: traceInput,
+                    resumeReason,
+                    metadata: {
+                        ...(checkpoint?.isCheckpointFollowUp
+                            ? { checkpoint_task_id: checkpoint.checkpointTaskId }
+                            : {}),
+                        ...(plannedBuild?.isPlannedBuildFollowUp
+                            ? { build_task_id: plannedBuild.buildTaskId }
+                            : {}),
+                    },
+                });
+            }
+            else {
+                tracing = await (0, instance_ai_1.createInstanceAiTraceContext)({
+                    threadId,
+                    messageId,
+                    messageGroupId,
+                    runId,
+                    userId: user.id,
+                    input: traceInput,
+                    proxyConfig: proxyRunConfig.tracingProxyConfig,
+                    n8nVersion: constants_1.N8N_VERSION,
+                    workflowSdkVersion: constants_1.WORKFLOW_SDK_VERSION,
+                });
+            }
+            if (this.isRunDebugEnabled()) {
+                this.runDebugBuffer.ensure(runId, threadId, (0, instance_ai_1.buildRunDebugLabel)({ message, resumeReason }));
+            }
+            const traceId = tracing?.rootRun.otelTraceId;
             this.eventBus.publish(threadId, {
                 type: 'run-start',
                 runId,
                 agentId: ORCHESTRATOR_AGENT_ID,
                 userId: user.id,
-                payload: { messageId, messageGroupId },
+                payload: { messageId, messageGroupId, ...(traceId ? { traceId } : {}) },
             });
             if (signal.aborted) {
                 this.evaluateTerminalResponse(threadId, runId, 'cancelled', {
@@ -2302,10 +2408,20 @@ let InstanceAiService = class InstanceAiService {
                 return;
             }
             const staticMcpServers = this.parseMcpServers(this.instanceAiConfig.mcpServers);
-            const registryMcpServers = await this.mcpRegistryService.getRegistryMcpServers(user);
+            const registryMcpServers = this.settingsService.isMcpAccessEnabled()
+                ? await this.withSetupBoundary('instance-ai-mcp-setup', {
+                    threadId,
+                    runId,
+                    tracing,
+                    agentId: ORCHESTRATOR_AGENT_ID,
+                    userId: user.id,
+                    messageGroupId,
+                    messageId,
+                }, async () => await this.mcpRegistryService.getRegistryMcpServers(user))
+                : [];
             const mcpServers = [...staticMcpServers, ...registryMcpServers];
             const executionPushRef = this.threadPushRef.get(threadId);
-            const environment = await this.createExecutionEnvironment(user, threadId, runId, signal, messageGroupId, executionPushRef);
+            const environment = await this.createExecutionEnvironment(user, threadId, runId, signal, messageGroupId, executionPushRef, proxyRunConfig);
             activeSnapshotStorage = environment.snapshotStorage;
             const { context, memory, taskStorage, snapshotStorage, workflowTasks, plannedTaskService, modelId, orchestrationContext, } = environment;
             aiCreatedWorkflowIds = context.aiCreatedWorkflowIds ??= new Set();
@@ -2354,54 +2470,10 @@ let InstanceAiService = class InstanceAiService {
                     workflowTaskService: workflowTasks,
                 };
             }
-            if (attachments && attachments.length > 0) {
-                context.currentUserAttachments = attachments;
+            if (fileAttachments.length > 0) {
+                context.currentUserAttachments = fileAttachments;
             }
             const memoryConfig = this.createAgentMemoryOptions();
-            const traceInput = {
-                message,
-                ...(attachments?.length
-                    ? {
-                        attachments: attachments.map((attachment) => ({
-                            mimeType: attachment.mimeType,
-                            size: attachment.data.length,
-                        })),
-                    }
-                    : {}),
-                ...(messageGroupId ? { messageGroupId } : {}),
-            };
-            tracing = resumeReason
-                ? await this.createOrchestratorResumeTraceContext({
-                    threadId,
-                    messageId,
-                    messageGroupId,
-                    runId,
-                    userId: user.id,
-                    modelId,
-                    input: traceInput,
-                    proxyConfig: orchestrationContext.tracingProxyConfig,
-                    resumeReason,
-                    metadata: {
-                        ...(checkpoint?.isCheckpointFollowUp
-                            ? { checkpoint_task_id: checkpoint.checkpointTaskId }
-                            : {}),
-                        ...(plannedBuild?.isPlannedBuildFollowUp
-                            ? { build_task_id: plannedBuild.buildTaskId }
-                            : {}),
-                    },
-                })
-                : await (0, instance_ai_1.createInstanceAiTraceContext)({
-                    threadId,
-                    messageId,
-                    messageGroupId,
-                    runId,
-                    userId: user.id,
-                    modelId,
-                    input: traceInput,
-                    proxyConfig: orchestrationContext.tracingProxyConfig,
-                    n8nVersion: constants_1.N8N_VERSION,
-                    workflowSdkVersion: constants_1.WORKFLOW_SDK_VERSION,
-                });
             if (!tracing && process.env.E2E_TESTS === 'true') {
                 const { createTraceReplayOnlyContext } = await Promise.resolve().then(() => __importStar(require('@n8n/instance-ai')));
                 tracing = createTraceReplayOnlyContext();
@@ -2416,9 +2488,15 @@ let InstanceAiService = class InstanceAiService {
             }
             const thread = await memory.getThread(threadId);
             if (thread && !thread.title) {
+                const handoffTitle = workflowAttachments.find((attachment) => attachment.name)?.name;
                 await (0, instance_ai_1.patchThread)(memory, {
                     threadId,
-                    update: () => ({ title: (0, instance_ai_1.truncateToTitle)(message) }),
+                    update: ({ metadata }) => handoffTitle
+                        ? {
+                            title: (0, instance_ai_1.truncateToTitle)(handoffTitle),
+                            metadata: { ...metadata, titleRefined: true },
+                        }
+                        : { title: (0, instance_ai_1.truncateToTitle)(message) },
                 });
             }
             const existingTasks = await taskStorage.get(threadId);
@@ -2431,12 +2509,13 @@ let InstanceAiService = class InstanceAiService {
                 });
             }
             const enrichedMessage = await this.buildMessageWithRunningTasks(threadId, message);
+            const contextResourcesBlock = buildContextResourcesBlock(workflowAttachments);
             let nonStructuredAttachments = [];
             let attachmentManifest = '';
             let hasParseableAttachment = false;
-            if (attachments && attachments.length > 0) {
-                const classifiedAttachments = (0, instance_ai_1.classifyAttachments)(attachments);
-                nonStructuredAttachments = attachments.filter((attachment) => !(0, instance_ai_1.isParseableAttachment)(attachment));
+            if (fileAttachments.length > 0) {
+                const classifiedAttachments = (0, instance_ai_1.classifyAttachments)(fileAttachments);
+                nonStructuredAttachments = fileAttachments.filter((attachment) => !(0, instance_ai_1.isParseableAttachment)(attachment));
                 hasParseableAttachment = classifiedAttachments.some((attachment) => attachment.parseable);
                 attachmentManifest = (0, instance_ai_1.buildAttachmentManifest)(classifiedAttachments);
             }
@@ -2445,7 +2524,8 @@ let InstanceAiService = class InstanceAiService {
                 : attachmentManifest
                     ? `${enrichedMessage}\n\n${attachmentManifest}`
                     : enrichedMessage;
-            const fullMessage = (0, internal_messages_1.withCurrentDateTime)(messageBody, (0, instance_ai_1.getDateTimeSection)(timeZone ?? this.defaultTimeZone));
+            const messageWithContext = [contextResourcesBlock, messageBody].filter(Boolean).join('\n\n');
+            const fullMessage = (0, internal_messages_1.withCurrentDateTime)(messageWithContext, (0, instance_ai_1.getDateTimeSection)(timeZone ?? this.defaultTimeZone));
             const promptBuildRun = tracing
                 ? await tracing.startChildRun(tracing.messageRun, {
                     name: 'prepare: prompt',
@@ -2527,20 +2607,13 @@ let InstanceAiService = class InstanceAiService {
                 memoryConfig,
                 memory,
                 checkpointStore: this.checkpointStore,
+                onMemoryTaskEvent: this.memoryTaskObserverFor(threadId),
+                thinkingEnabled: this.instanceAiConfig.thinkingEnabled,
             });
+            const streamOptions = this.buildOrchestratorAgentStreamOptions(user, threadId, runId, signal);
             const result = tracing
                 ? await tracing.withActiveSpan(tracing.actorRun, async () => {
-                    return await (0, instance_ai_1.streamAgentRun)(agent, streamInput, {
-                        maxIterations: instance_ai_1.MAX_STEPS.ORCHESTRATOR,
-                        abortSignal: signal,
-                        persistence: {
-                            resourceId: user.id,
-                            threadId,
-                        },
-                        providerOptions: {
-                            anthropic: { cacheControl: { type: 'ephemeral' } },
-                        },
-                    }, {
+                    return await (0, instance_ai_1.streamAgentRun)(agent, streamInput, streamOptions, {
                         threadId,
                         runId,
                         agentId: ORCHESTRATOR_AGENT_ID,
@@ -2551,17 +2624,7 @@ let InstanceAiService = class InstanceAiService {
                         outputRedaction: (0, output_redaction_config_1.resolveOutputRedaction)(this.instanceAiConfig),
                     });
                 })
-                : await (0, instance_ai_1.streamAgentRun)(agent, streamInput, {
-                    maxIterations: instance_ai_1.MAX_STEPS.ORCHESTRATOR,
-                    abortSignal: signal,
-                    persistence: {
-                        resourceId: user.id,
-                        threadId,
-                    },
-                    providerOptions: {
-                        anthropic: { cacheControl: { type: 'ephemeral' } },
-                    },
-                }, {
+                : await (0, instance_ai_1.streamAgentRun)(agent, streamInput, streamOptions, {
                     threadId,
                     runId,
                     agentId: ORCHESTRATOR_AGENT_ID,
@@ -2671,6 +2734,18 @@ let InstanceAiService = class InstanceAiService {
                 return;
             }
             const outputText = await (result.text ?? Promise.resolve(''));
+            if (result.status === 'errored') {
+                this.reportInstanceAiError(result.error ?? new Error('Instance AI stream errored'), {
+                    component: 'instance-ai-stream',
+                    threadId,
+                    runId,
+                    tracing,
+                    agentId: ORCHESTRATOR_AGENT_ID,
+                    userId: user.id,
+                    messageGroupId,
+                    messageId,
+                });
+            }
             this.evaluateTerminalResponse(threadId, runId, result.status, {
                 messageGroupId,
                 correlationId: messageId,
@@ -2690,14 +2765,16 @@ let InstanceAiService = class InstanceAiService {
                 modelId,
                 metadata: this.buildMessageTraceMetadata(threadId, runId, { status: finalStatus }),
             };
-            const archivedWorkflowIds = await this.reapAiTemporaryFromRun(threadId, user, aiCreatedWorkflowIds);
+            const archivedWorkflowIds = await this.temporaryWorkflowService.reapForRun(threadId, user, aiCreatedWorkflowIds, this.backgroundTasks.getRunningTasks(threadId).length);
             await this.finalizeRun(threadId, runId, result.status, snapshotStorage, {
                 userId: user.id,
                 modelId,
                 archivedWorkflowIds,
+                workSummary: result.workSummary,
+                usage: result.usage,
             });
+            await this.creditService.claimRunUsage(user, threadId, result.agentRunId || runId, result.usage?.usage ?? [], result.status);
             if (result.status === 'completed') {
-                await this.countCreditsIfFirst(user, threadId, runId);
                 this.telemetry.track('Builder sent message', {
                     thread_id: threadId,
                     message: outputText,
@@ -2736,7 +2813,7 @@ let InstanceAiService = class InstanceAiService {
                         runTimeout,
                     }),
                 };
-                const archivedWorkflowIds = await this.reapAiTemporaryFromRun(threadId, user, aiCreatedWorkflowIds);
+                const archivedWorkflowIds = await this.temporaryWorkflowService.reapForRun(threadId, user, aiCreatedWorkflowIds, this.backgroundTasks.getRunningTasks(threadId).length);
                 this.publishRunFinish(threadId, runId, 'cancelled', cancellationReason, archivedWorkflowIds);
                 if (activeSnapshotStorage) {
                     await this.saveAgentTreeSnapshot(threadId, runId, activeSnapshotStorage);
@@ -2745,15 +2822,20 @@ let InstanceAiService = class InstanceAiService {
             }
             const errorMessage = getErrorMessage(error);
             const userFacingErrorMessage = getUserFacingErrorMessage(error);
-            this.logger.error(`Instance AI run error: ${errorMessage}`, {
-                error: errorMessage,
+            const errCtx = {
                 threadId,
                 runId,
+                tracing,
+                agentId: ORCHESTRATOR_AGENT_ID,
+                userId: user.id,
+                messageGroupId,
+                messageId,
+            };
+            this.logger.error(`Instance AI run error: ${errorMessage}`, {
+                error: errorMessage,
+                ...(0, observability_1.buildInstanceAiObservabilityContext)(errCtx),
             });
-            this.errorReporter.error(error, {
-                tags: { component: 'instance-ai-run' },
-                extra: { threadId, runId },
-            });
+            this.reportInstanceAiError(error, { component: 'instance-ai-run', ...errCtx });
             this.evaluateTerminalResponse(threadId, runId, 'errored', {
                 messageGroupId,
                 correlationId: messageId,
@@ -2768,7 +2850,7 @@ let InstanceAiService = class InstanceAiService {
                 reason: errorMessage,
                 metadata: this.buildMessageTraceMetadata(threadId, runId, { status: 'error' }),
             };
-            const archivedWorkflowIds = await this.reapAiTemporaryFromRun(threadId, user, aiCreatedWorkflowIds);
+            const archivedWorkflowIds = await this.temporaryWorkflowService.reapForRun(threadId, user, aiCreatedWorkflowIds, this.backgroundTasks.getRunningTasks(threadId).length);
             this.eventBus.publish(threadId, {
                 type: 'run-finish',
                 runId,
@@ -3015,6 +3097,8 @@ let InstanceAiService = class InstanceAiService {
                 memoryConfig: this.createAgentMemoryOptions(),
                 memory: environment.memory,
                 checkpointStore: this.checkpointStore,
+                onMemoryTaskEvent: this.memoryTaskObserverFor(orphan.threadId),
+                thinkingEnabled: this.instanceAiConfig.thinkingEnabled,
             });
         }
         catch (error) {
@@ -3095,6 +3179,7 @@ let InstanceAiService = class InstanceAiService {
             ...(data.testTriggerNode ? { testTriggerNode: data.testTriggerNode } : {}),
             ...(data.answers ? { answers: data.answers } : {}),
             ...(data.resourceDecision ? { resourceDecision: data.resourceDecision } : {}),
+            ...(data.scope ? { scope: data.scope } : {}),
         };
         const resumeTracing = await this.createOrchestratorResumeTraceContext({
             baseTracing: tracing,
@@ -3158,13 +3243,10 @@ let InstanceAiService = class InstanceAiService {
                     });
                 }
             }
+            const resumeOptions = this.buildOrchestratorResumeAgentOptions(opts.user, opts.threadId, opts.runId, opts.agentRunId, opts.toolCallId);
             const result = opts.tracing
                 ? await opts.tracing.withActiveSpan(opts.tracing.actorRun, async () => {
-                    return await (0, instance_ai_1.resumeAgentRun)(agent, resumeData, {
-                        runId: opts.agentRunId,
-                        toolCallId: opts.toolCallId,
-                        persistence: { resourceId: opts.user.id, threadId: opts.threadId },
-                    }, {
+                    return await (0, instance_ai_1.resumeAgentRun)(agent, resumeData, resumeOptions, {
                         threadId: opts.threadId,
                         runId: opts.runId,
                         agentId: ORCHESTRATOR_AGENT_ID,
@@ -3176,11 +3258,7 @@ let InstanceAiService = class InstanceAiService {
                         outputRedaction: (0, output_redaction_config_1.resolveOutputRedaction)(this.instanceAiConfig),
                     });
                 })
-                : await (0, instance_ai_1.resumeAgentRun)(agent, resumeData, {
-                    runId: opts.agentRunId,
-                    toolCallId: opts.toolCallId,
-                    persistence: { resourceId: opts.user.id, threadId: opts.threadId },
-                }, {
+                : await (0, instance_ai_1.resumeAgentRun)(agent, resumeData, resumeOptions, {
                     threadId: opts.threadId,
                     runId: opts.runId,
                     agentId: ORCHESTRATOR_AGENT_ID,
@@ -3291,6 +3369,17 @@ let InstanceAiService = class InstanceAiService {
             }
             const outputText = await (result.text ?? Promise.resolve(''));
             const messageGroupId = this.traceContextsByRunId.get(opts.runId)?.messageGroupId;
+            if (result.status === 'errored') {
+                this.reportInstanceAiError(result.error ?? new Error('Instance AI resumed stream errored'), {
+                    component: 'instance-ai-stream',
+                    threadId: opts.threadId,
+                    runId: opts.runId,
+                    tracing: opts.tracing,
+                    agentId: ORCHESTRATOR_AGENT_ID,
+                    userId: opts.user.id,
+                    messageGroupId,
+                });
+            }
             this.evaluateTerminalResponse(opts.threadId, opts.runId, result.status, {
                 messageGroupId,
                 workSummary: result.workSummary,
@@ -3309,12 +3398,14 @@ let InstanceAiService = class InstanceAiService {
                     status: finalStatus,
                 }),
             };
-            const archivedWorkflowIds = await this.reapAiTemporaryFromRun(opts.threadId, opts.user, undefined);
+            const archivedWorkflowIds = await this.temporaryWorkflowService.reapForRun(opts.threadId, opts.user, undefined, this.backgroundTasks.getRunningTasks(opts.threadId).length);
             await this.finalizeRun(opts.threadId, opts.runId, result.status, opts.snapshotStorage, {
                 archivedWorkflowIds,
+                workSummary: result.workSummary,
+                usage: result.usage,
             });
+            await this.creditService.claimRunUsage(opts.user, opts.threadId, result.agentRunId || opts.runId, result.usage?.usage ?? [], result.status);
             if (result.status === 'completed') {
-                await this.countCreditsIfFirst(opts.user, opts.threadId, opts.runId);
                 this.telemetry.track('Builder sent message', {
                     thread_id: opts.threadId,
                     message: outputText,
@@ -3353,23 +3444,27 @@ let InstanceAiService = class InstanceAiService {
                         runTimeout,
                     }),
                 };
-                const archivedWorkflowIds = await this.reapAiTemporaryFromRun(opts.threadId, opts.user, undefined);
+                const archivedWorkflowIds = await this.temporaryWorkflowService.reapForRun(opts.threadId, opts.user, undefined, this.backgroundTasks.getRunningTasks(opts.threadId).length);
                 this.publishRunFinish(opts.threadId, opts.runId, 'cancelled', cancellationReason, archivedWorkflowIds);
                 await this.saveAgentTreeSnapshot(opts.threadId, opts.runId, opts.snapshotStorage);
                 return;
             }
             const errorMessage = getErrorMessage(error);
             const userFacingErrorMessage = getUserFacingErrorMessage(error);
-            this.logger.error(`Instance AI resumed run error: ${errorMessage}`, {
-                error: errorMessage,
+            const messageGroupId = this.traceContextsByRunId.get(opts.runId)?.messageGroupId;
+            const errCtx = {
                 threadId: opts.threadId,
                 runId: opts.runId,
+                tracing: opts.tracing,
+                agentId: ORCHESTRATOR_AGENT_ID,
+                userId: opts.user.id,
+                messageGroupId,
+            };
+            this.logger.error(`Instance AI resumed run error: ${errorMessage}`, {
+                error: errorMessage,
+                ...(0, observability_1.buildInstanceAiObservabilityContext)(errCtx),
             });
-            this.errorReporter.error(error, {
-                tags: { component: 'instance-ai-run' },
-                extra: { threadId: opts.threadId, runId: opts.runId },
-            });
-            const messageGroupId = this.traceContextsByRunId.get(opts.runId)?.messageGroupId;
+            this.reportInstanceAiError(error, { component: 'instance-ai-run', ...errCtx });
             this.evaluateTerminalResponse(opts.threadId, opts.runId, 'errored', {
                 messageGroupId,
                 errorMessage: userFacingErrorMessage,
@@ -3385,7 +3480,7 @@ let InstanceAiService = class InstanceAiService {
                     status: 'error',
                 }),
             };
-            const archivedWorkflowIds = await this.reapAiTemporaryFromRun(opts.threadId, opts.user, undefined);
+            const archivedWorkflowIds = await this.temporaryWorkflowService.reapForRun(opts.threadId, opts.user, undefined, this.backgroundTasks.getRunningTasks(opts.threadId).length);
             this.eventBus.publish(opts.threadId, {
                 type: 'run-finish',
                 runId: opts.runId,
@@ -3477,6 +3572,16 @@ let InstanceAiService = class InstanceAiService {
             },
             onFailed: async (task) => {
                 await this.finalizeBackgroundTaskTracing(task, 'failed');
+                this.reportInstanceAiError(new Error(task.error ?? 'Instance AI background task failed'), {
+                    component: 'instance-ai-background-task',
+                    threadId: opts.threadId,
+                    runId,
+                    tracing: task.traceContext,
+                    agentId: opts.agentId,
+                    messageGroupId: task.messageGroupId,
+                    taskId: task.taskId,
+                    role: task.role,
+                });
                 this.eventBus.publish(opts.threadId, {
                     type: 'agent-completed',
                     runId,
@@ -3518,6 +3623,14 @@ let InstanceAiService = class InstanceAiService {
                         });
                         return;
                     }
+                    if (task.timeoutReason) {
+                        this.logger.debug('Skipping background auto-follow-up after task timeout', {
+                            threadId: opts.threadId,
+                            taskId: task.taskId,
+                            timeoutReason: task.timeoutReason,
+                        });
+                        return;
+                    }
                     const user = this.runState.getThreadUser(opts.threadId);
                     if (user) {
                         const verificationFollowUpStarted = await this.maybeStartWorkflowVerificationFollowUp(user, task);
@@ -3637,52 +3750,6 @@ let InstanceAiService = class InstanceAiService {
             num_steps: numSteps,
         });
     }
-    async reapAiTemporaryFromRun(threadId, user, createdWorkflowIds) {
-        const runningTaskCount = this.backgroundTasks.getRunningTasks(threadId).length;
-        if (runningTaskCount > 0) {
-            this.logger.debug('Deferring AI-builder temporary workflow cleanup until tasks settle', {
-                threadId,
-                runningTaskCount,
-            });
-            return [];
-        }
-        let markedWorkflows = [];
-        try {
-            markedWorkflows = await this.aiBuilderTemporaryWorkflowRepository.findByThread(threadId);
-        }
-        catch (error) {
-            this.logger.warn('Failed to inspect AI-builder temporary workflows during run finish', {
-                threadId,
-                error: getErrorMessage(error),
-            });
-        }
-        const workflowIds = new Set([
-            ...markedWorkflows.map(({ workflowId }) => workflowId),
-            ...(createdWorkflowIds ?? []),
-        ]);
-        if (workflowIds.size === 0)
-            return [];
-        return await this.archiveAiTemporaryWorkflows(threadId, user, workflowIds);
-    }
-    async archiveAiTemporaryWorkflows(threadId, user, workflowIds) {
-        const adapter = this.adapterService.createContext(user, { threadId });
-        const archived = [];
-        for (const workflowId of workflowIds) {
-            try {
-                const didArchive = await adapter.workflowService.archiveIfAiTemporary(workflowId);
-                if (didArchive)
-                    archived.push(workflowId);
-            }
-            catch (error) {
-                this.logger.warn('Failed to reap AI-builder temporary workflow', {
-                    threadId,
-                    workflowId,
-                    error: getErrorMessage(error),
-                });
-            }
-        }
-        return archived;
-    }
     async finalizeCancelledSuspendedRun(suspended, reason = 'user_cancelled') {
         const runTimeout = reason === liveness_1.INSTANCE_AI_RUN_TIMEOUT_REASON
             ? this.liveness.consumeRunTimeout(suspended.runId)
@@ -3694,7 +3761,7 @@ let InstanceAiService = class InstanceAiService {
             status: 'cancelled',
             reason,
         });
-        const archivedWorkflowIds = await this.reapAiTemporaryFromRun(suspended.threadId, suspended.user, undefined);
+        const archivedWorkflowIds = await this.temporaryWorkflowService.reapForRun(suspended.threadId, suspended.user, undefined, this.backgroundTasks.getRunningTasks(suspended.threadId).length);
         this.publishRunFinish(suspended.threadId, suspended.runId, 'cancelled', reason, archivedWorkflowIds);
         await this.saveAgentTreeSnapshot(suspended.threadId, suspended.runId, this.dbSnapshotStorage, true);
         await this.maybeFinalizeRunTraceRoot(suspended.runId, {
@@ -3708,62 +3775,6 @@ let InstanceAiService = class InstanceAiService {
         });
         void this.suspendedThreads.dropPendingConfirmation(suspended.requestId);
     }
-    async reapAiTemporaryForThreadCleanup(threadId) {
-        let markedWorkflows;
-        try {
-            markedWorkflows = await this.aiBuilderTemporaryWorkflowRepository.findByThread(threadId);
-        }
-        catch (error) {
-            this.logger.warn('Failed to inspect AI-builder temporary workflows during thread cleanup', {
-                threadId,
-                error: getErrorMessage(error),
-            });
-            return;
-        }
-        if (markedWorkflows.length === 0)
-            return;
-        let thread;
-        try {
-            thread = await this.threadRepo.findOneBy({ id: threadId });
-        }
-        catch (error) {
-            this.logger.warn('Failed to load thread owner for AI-builder temporary workflow cleanup', {
-                threadId,
-                markedWorkflowCount: markedWorkflows.length,
-                error: getErrorMessage(error),
-            });
-            return;
-        }
-        if (!thread?.resourceId) {
-            this.logger.warn('Skipping AI-builder temporary workflow cleanup for thread without owner', {
-                threadId,
-                markedWorkflowCount: markedWorkflows.length,
-            });
-            return;
-        }
-        let user;
-        try {
-            user = await this.userRepository.findOneBy({ id: thread.resourceId });
-        }
-        catch (error) {
-            this.logger.warn('Failed to load user for AI-builder temporary workflow cleanup', {
-                threadId,
-                userId: thread.resourceId,
-                markedWorkflowCount: markedWorkflows.length,
-                error: getErrorMessage(error),
-            });
-            return;
-        }
-        if (!user) {
-            this.logger.warn('Skipping AI-builder temporary workflow cleanup for missing thread owner', {
-                threadId,
-                userId: thread.resourceId,
-                markedWorkflowCount: markedWorkflows.length,
-            });
-            return;
-        }
-        await this.archiveAiTemporaryWorkflows(threadId, user, new Set(markedWorkflows.map(({ workflowId }) => workflowId)));
-    }
     publishRunFinish(threadId, runId, status, reason, archivedWorkflowIds) {
         const effectiveStatus = status === 'errored' ? 'error' : status;
         const hasArchived = archivedWorkflowIds && archivedWorkflowIds.length > 0;
@@ -3777,14 +3788,31 @@ let InstanceAiService = class InstanceAiService {
                 ...(hasArchived ? { archivedWorkflowIds } : {}),
             },
         });
+        this.telemetry.track('instance_ai_run_finished', {
+            thread_id: threadId,
+            run_id: runId,
+            status: effectiveStatus,
+        });
     }
     async finalizeRun(threadId, runId, status, snapshotStorage, options) {
         this.publishRunFinish(threadId, runId, status, undefined, options?.archivedWorkflowIds);
+        this.emitRunMetrics(threadId, status, options);
         await this.saveAgentTreeSnapshot(threadId, runId, snapshotStorage);
         if (status === 'completed' && options?.userId && options?.modelId) {
             void this.refineTitleIfNeeded(threadId, options.userId, options.modelId);
         }
     }
+    emitRunMetrics(threadId, status, options) {
+        const startedAt = this.runState.getActiveRun(threadId)?.startedAt;
+        this.eventService.emit('instance-ai-run-finished', {
+            status: status === 'errored' ? 'error' : status,
+            durationMs: startedAt !== undefined ? Date.now() - startedAt : undefined,
+            model: typeof options?.modelId === 'string' ? options.modelId : 'custom',
+            toolCalls: options?.workSummary?.totalToolCalls ?? 0,
+            toolErrors: options?.workSummary?.totalToolErrors ?? 0,
+            ...(options?.usage ? { usage: options.usage } : {}),
+        });
+    }
     async refineTitleIfNeeded(threadId, userId, modelId) {
         try {
             const memory = this.agentMemory;
@@ -3975,8 +4003,7 @@ exports.InstanceAiService = InstanceAiService = __decorate([
         typeorm_agent_memory_1.TypeORMAgentMemory,
         typeorm_agent_checkpoint_store_1.TypeORMAgentCheckpointStore,
         ai_service_1.AiService,
-        push_1.Push,
-        instance_ai_thread_repository_1.InstanceAiThreadRepository,
+        instance_ai_thread_grant_repository_1.InstanceAiThreadGrantRepository,
         instance_ai_pending_confirmation_repository_1.InstanceAiPendingConfirmationRepository,
         url_service_1.UrlService,
         db_snapshot_storage_1.DbSnapshotStorage,
@@ -3985,10 +4012,14 @@ exports.InstanceAiService = InstanceAiService = __decorate([
         telemetry_1.Telemetry,
         mcp_1.InstanceAiMcpRegistryService,
         db_1.UserRepository,
-        db_1.AiBuilderTemporaryWorkflowRepository,
+        instance_ai_temporary_workflow_service_1.InstanceAiTemporaryWorkflowService,
         n8n_core_1.ErrorReporter,
         config_1.SsrfProtectionConfig,
         backend_network_1.SsrfProtectionService,
-        event_service_1.EventService])
+        event_service_1.EventService,
+        thread_credential_allowlist_service_1.EvalThreadCredentialAllowlistService,
+        instance_ai_run_probe_1.InstanceAiRunProbe,
+        instance_ai_model_service_1.InstanceAiModelService,
+        instance_ai_credit_service_1.InstanceAiCreditService])
 ], InstanceAiService);
 //# sourceMappingURL=instance-ai.service.js.map