env-based? I want to be able to override this to a much larger value on my installation. Ideally configuring it per agent would be awesome, but if not - global per-instance override will be good enough. We have an agent that by default deals with large tool responses. And unforunately downloading the tool result to a file is impossible because we are running it A2A, not in a conversation. And this, from what I understand, makes it impossible to download tool result because there is no conversation id:

we tell the agent to fetch additional prompt/requirements from a google doc file that is managed by the legal team

So that's what we did - we hardcoded the google doc link in system prompt and told the agent - `here is the link to a google doc that contains all additional rules you need to follow, use google docs read tool to get contents - https....`
but we see it only reads 32k from those calls.

Our Archestra is *1.4.7* btw

Regarding the technical limitation of spilling the output in A2A, here is Opus' explanation (with the context of archestra github repo and our `interactions` table results for problematic A2A sessions:

> Sandbox is enabled and working — `run_command` runs fine in these sessions (`Exit code: 0`, `SKILL_SANDBOX_ROOT=/skills`), and `run_command`/`upload_file`/`download_file` are all assigned.
> The spill still never fires. `tool-result-spill.ts:71-74`:

routes/a2a/v1.ts has zero occurrences of conversationId — it calls executeA2AMessage({ agentId, message, organizationId, userId, sessionId, parentDelegationChain }). And a2a-executor.ts:135-141 says so explicitly: "When absent, the execution is headless and an isolation key scopes its per-run state instead."

So inbound A2A → conversationId === undefined → return null → plain truncation, every time. We only ever see Only the beginning is shown, never the saved in the sandbox at … variant.

Confirms in the DB: 63 files exist under /home/sandbox/tool-results/, all in sandboxes with a non-null conversation_id; zero in the 47 sandboxes where it's NULL.

Not a field swap, though — chat-tool-builder.ts:1138,1249 passes conversationId: isolationKey for headless, but skill_sandboxes.conversation_id is an FK to conversations(id), headless rows have it NULL with is_default = false, and SkillSandboxModel.findOrCreateDefault({conversationId}) can't address those. Needs a scope-key resolver.

Possible second guard: we use an org token, so v1.ts:283 sets userId = "system", which then hits userHasPermission("system", …) in isSkillSandboxAvailableForAgent. Didn't isolate which guard fires first.

tool-result-spill.test.ts only ever builds a real conversationId — headless isn't covered.

Repro: agent via POST /a2a/v1 with an org token reads a 78,659-char Google Doc → 32,348 chars + "Only the beginning is shown" → needed section sits at ~60% depth, unreachable.