@agent-native/core-corpus 0.212.1 → 0.213.1

package/corpus/templates/assets/server/lib/org-admin.ts

@@ -1,11 +1,9 @@
-import { orgMembers } from "@agent-native/core/org";
+import { readOrgMemberRole } from "@agent-native/core/server";
 import {
+  getRequestContext,
   getRequestUserEmail,
   getRequestOrgId,
-} from "@agent-native/core/server/request-context";
-import { and, eq, sql } from "drizzle-orm";
-
-import { getDb } from "../db/index.js";
+} from "@agent-native/core/server";
 
 export class ForbiddenAuditError extends Error {
   readonly statusCode = 403;
@@ -36,22 +34,28 @@ export async function assertOrgAdmin(): Promise<AdminScope> {
 
   const orgId = getRequestOrgId();
   if (!orgId) {
+    if (getRequestContext()?.a2aIdentityAssurance === "org-member") {
+      throw new ForbiddenAuditError(
+        "Could not verify the delegated organization scope; refusing audit access.",
+      );
+    }
     return { ownerEmail: email };
   }
 
+  const request = getRequestContext();
+  if (
+    request?.a2aIdentityAssurance === "org-member" &&
+    (request.orgId?.trim() !== orgId.trim() ||
+      request.userEmail?.trim().toLowerCase() !== email.trim().toLowerCase())
+  ) {
+    throw new ForbiddenAuditError(
+      "Could not verify the delegated organization scope; refusing audit access.",
+    );
+  }
+
   let role: string | null = null;
   try {
-    const [row] = await getDb()
-      .select({ role: orgMembers.role })
-      .from(orgMembers)
-      .where(
-        and(
-          eq(orgMembers.orgId, orgId),
-          sql`lower(${orgMembers.email}) = ${email.toLowerCase()}`,
-        ),
-      )
-      .limit(1);
-    role = row?.role?.toLowerCase() ?? null;
+    role = await readOrgMemberRole(orgId, email);
   } catch {
     throw new ForbiddenAuditError(
       "Could not verify org admin role; refusing audit access.",

package/corpus/templates/brain/server/lib/zoom-governance.ts

@@ -1,6 +1,7 @@
 import { fail } from "@agent-native/core/action";
-import { getDbExec } from "@agent-native/core/db";
+import { readOrgMemberRole } from "@agent-native/core/server";
 import {
+  getRequestContext,
   getRequestOrgId,
   getRequestUserEmail,
 } from "@agent-native/core/server/request-context";
@@ -21,11 +22,15 @@ export async function isBrainAdmin(
   const normalizedEmail = email?.trim();
   const normalizedOrgId = orgId?.trim();
   if (!normalizedEmail || !normalizedOrgId) return false;
-  const { rows } = await getDbExec().execute({
-    sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = LOWER(?) AND federation_removal_pending_at IS NULL LIMIT 1`,
-    args: [normalizedOrgId, normalizedEmail],
-  });
-  const role = (rows[0] as { role?: unknown } | undefined)?.role;
+  const request = getRequestContext();
+  if (
+    request?.a2aIdentityAssurance === "org-member" &&
+    (request.orgId?.trim() !== normalizedOrgId ||
+      request.userEmail?.trim().toLowerCase() !== normalizedEmail.toLowerCase())
+  ) {
+    return false;
+  }
+  const role = await readOrgMemberRole(normalizedOrgId, normalizedEmail);
   return role === "owner" || role === "admin";
 }
 

package/corpus/templates/clips/CHANGELOG.md

@@ -59,6 +59,7 @@ from the command menu (Cmd+K → "What's new") or from Settings.
 
 ### Improved
 
+- Rewind settings now show whether Rewind is remembering screen only or screen + audio.
 - Clips detects browser meetings more reliably and keeps notes until the meeting stop and transcript save are confirmed.
 - Clips detects browser meetings sooner, asks before starting when the active tab is unclear, and retries failed stops.
 - Desktop dictation confirms when text is pasted or copied and keeps transcripts available when saving fails.

package/corpus/templates/clips/changelog/2026-10-16-rewind-status-says-when-it-remembers-audio.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-10-16
+---
+
+Rewind settings now show whether Rewind is remembering screen only or screen + audio.

package/corpus/templates/clips/desktop/src/app.tsx

@@ -96,6 +96,7 @@ import {
   RecordingRecoveryPage,
   type RecordingRecoveryProps,
 } from "./components/RecordingRecovery";
+import { RewindCaptureStatus } from "./components/RewindCaptureStatus";
 import { ShortcutKeycaps } from "./components/ShortcutKeycaps";
 import { SourceRow, type CaptureSource } from "./components/SourceRow";
 import { Switch } from "./components/Switch";
@@ -8151,10 +8152,12 @@ function Setup({
               >
                 {screenMemoryMessage.text}
               </p>
-            ) : rewindOn && rewindStatusPresentation.hasError ? (
-              <p className="text-xs text-destructive">
-                {rewindStatusPresentation.detail}
-              </p>
+            ) : null}
+            {rewindOn ? (
+              <RewindCaptureStatus
+                status={screenMemoryStatus}
+                presentation={rewindStatusPresentation}
+              />
             ) : null}
           </SettingsRow>
           {rewindOn ? (

package/corpus/templates/clips/desktop/src/components/RewindCaptureStatus.tsx

@@ -0,0 +1,25 @@
+import type { RewindStatusPresentation } from "../lib/rewind-status";
+import type { ScreenMemoryStatus } from "../shared/config";
+
+export function RewindCaptureStatus({
+  status,
+  presentation,
+}: {
+  status: ScreenMemoryStatus | null;
+  presentation: RewindStatusPresentation;
+}) {
+  if (!status || presentation.kind === "off") return null;
+  return (
+    <>
+      <p className="flex items-center gap-2" role="status">
+        {presentation.isLive ? (
+          <span className="rec-dot" aria-hidden="true" />
+        ) : null}
+        {presentation.title}
+      </p>
+      {presentation.hasError ? (
+        <p className="text-xs text-destructive">{presentation.detail}</p>
+      ) : null}
+    </>
+  );
+}

package/corpus/templates/clips/desktop/src/lib/rewind-status.ts

@@ -70,9 +70,14 @@ export function getRewindStatusPresentation({
   }
 
   if (status?.state === "recording") {
+    // The active segment, not the setting: a clip or meeting notes can add
+    // audio while Remember is set to Screen only.
+    const capturesAudio = status.activeSegment?.captureMode === "visuals-audio";
     return {
       kind: "recording",
-      title: "Rewind is remembering",
+      title: capturesAudio
+        ? "Rewind is remembering screen + audio"
+        : "Rewind is remembering screen only",
       detail:
         status.lastError ||
         status.coverage ||

package/corpus/templates/clips/desktop/src/shared/config.ts

@@ -70,6 +70,9 @@ export interface ScreenMemoryActiveSegment {
   durationMs: number;
   width?: number | null;
   height?: number | null;
+  // What this segment captures. A clip or meeting can add audio while the
+  // configured mode is screen only.
+  captureMode: RewindCaptureMode;
 }
 
 export interface ScreenMemoryStatus {

package/corpus/templates/clips/desktop/src-tauri/src/screen_memory.rs

@@ -417,6 +417,7 @@ pub struct ScreenMemoryActiveSegment {
     pub duration_ms: u128,
     pub width: Option<u32>,
     pub height: Option<u32>,
+    pub capture_mode: RewindCaptureMode,
 }
 
 #[derive(Debug, Clone, Serialize)]
@@ -1134,6 +1135,7 @@ fn build_status(app: &AppHandle) -> Result<ScreenMemoryStatus, String> {
                     duration_ms: active.started_at.elapsed().as_millis(),
                     width: active.width,
                     height: active.height,
+                    capture_mode: active.capture_mode,
                 }),
             guard.last_error.clone(),
             guard.exclusion_active,

package/corpus/templates/clips/server/lib/recordings.ts

@@ -1,10 +1,6 @@
 import { readAppState } from "@agent-native/core/application-state";
-import {
-  implicitServiceOrgRole,
-  organizations,
-  orgMembers,
-} from "@agent-native/core/org";
-import { getSession } from "@agent-native/core/server";
+import { implicitServiceOrgRole, organizations } from "@agent-native/core/org";
+import { getSession, readOrgMemberRole } from "@agent-native/core/server";
 import {
   getRequestUserEmail,
   getRequestOrgId,
@@ -175,20 +171,9 @@ export async function getOrganizationRoleForEmail(
   organizationId: string,
   email: string,
 ): Promise<OrganizationAccessRole | null> {
-  const lowerEmail = email.toLowerCase();
-
   try {
-    const [row] = await getDb()
-      .select({ role: orgMembers.role })
-      .from(orgMembers)
-      .where(
-        and(
-          eq(orgMembers.orgId, organizationId),
-          sql`lower(${orgMembers.email}) = ${lowerEmail}`,
-        ),
-      )
-      .limit(1);
-    if (row?.role) return normalizeOrganizationRole(row.role);
+    const role = await readOrgMemberRole(organizationId, email);
+    if (role) return normalizeOrganizationRole(role);
   } catch {
     // org_members table may not exist yet on first boot before migrations finish.
   }

package/corpus/templates/community/qr/package.json

@@ -11,7 +11,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@agent-native/core": "^0.210.2",
+    "@agent-native/core": "^0.213.1",
     "postgres": "^3.4.9",
     "qrcode": "^1.5.4",
     "zod": "^4.6.7"

package/corpus/templates/content/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable user-facing changes to Agent-Native Content are documented here. Open it any
 time from the command menu (Cmd+K → "What's new").
 
+## 2026-10-21
+
+### Fixed
+
+- Organization favorites include documents shared with the current member
+
 ## 2026-10-19
 
 ### Improved
@@ -24,6 +30,8 @@ time from the command menu (Cmd+K → "What's new").
 
 ### Added
 
+- Connected AI assistants can make a collection from a GitHub folder, or link an empty one: each Markdown file becomes a view-only page, and a sync brings in the latest pushes
+- Make a collection from a GitHub folder in the sidebar's New menu, or fill an empty one from its Sources settings, which say up front when GitHub can't link and what to do instead. A short preview comes before linking, the collection shows where its pages come from and when they last updated, and unlinking asks first
 - Connected AI assistants can link a new collection to a GitHub folder: each Markdown file becomes a view-only page, and a sync brings in the latest pushes
 
 ### Improved

package/corpus/templates/content/actions/_content-space-access.ts

@@ -1,6 +1,10 @@
 import { ActionContractError } from "@agent-native/core/action";
 import { getDbExec, type DbExec } from "@agent-native/core/db";
-import { getRequestUserEmail } from "@agent-native/core/server/request-context";
+import { readOrgMemberRole } from "@agent-native/core/server";
+import {
+  getRequestContext,
+  getRequestUserEmail,
+} from "@agent-native/core/server/request-context";
 import { and, eq, isNull, sql } from "drizzle-orm";
 
 import { getDb, schema } from "../server/db/index.js";
@@ -13,6 +17,29 @@ export type ContentSpaceAccess = {
   role: ContentSpaceRole;
 };
 
+function isDelegatedIdentityMismatch(orgId: string, email: string): boolean {
+  const request = getRequestContext();
+  return (
+    request?.a2aIdentityAssurance === "org-member" &&
+    (request.orgId?.trim() !== orgId.trim() ||
+      request.userEmail?.trim().toLowerCase() !== email.trim().toLowerCase())
+  );
+}
+
+function preserveDelegatedMemberRole(
+  orgId: string,
+  email: string,
+  validatedRole: string,
+  verifiedRole: string,
+): string {
+  const request = getRequestContext();
+  return request?.a2aIdentityAssurance === "org-member" &&
+    request.orgId?.trim() === orgId.trim() &&
+    request.userEmail?.trim().toLowerCase() === email.trim().toLowerCase()
+    ? verifiedRole
+    : validatedRole;
+}
+
 type ContentOrganizationMembership = {
   role: string;
   name: string;
@@ -59,6 +86,11 @@ export async function getContentOrganizationMembership(
   userEmail: string,
   options: { db?: any } = {},
 ): Promise<{ role: string; name: string; createdBy: string } | null> {
+  if (isDelegatedIdentityMismatch(orgId, userEmail)) return null;
+
+  const verifiedRole = await readOrgMemberRole(orgId, userEmail);
+  if (!verifiedRole) return null;
+
   if (options.db) {
     const { organizations, orgMembers } =
       await import("@agent-native/core/org");
@@ -81,7 +113,7 @@ export async function getContentOrganizationMembership(
       )
       .limit(1);
     if (!row) return null;
-    return revalidateFederatedMembership(orgId, userEmail, {
+    const validated = await revalidateFederatedMembership(orgId, userEmail, {
       role: (typeof row.role === "string"
         ? row.role
         : (JSON.stringify(row.role) ?? "member")
@@ -91,6 +123,17 @@ export async function getContentOrganizationMembership(
       identityAuthority: row.identityAuthority,
       identityId: row.identityId,
     });
+    return validated
+      ? {
+          ...validated,
+          role: preserveDelegatedMemberRole(
+            orgId,
+            userEmail,
+            validated.role,
+            verifiedRole,
+          ),
+        }
+      : null;
   }
   const result = await getDbExec().execute({
     sql: `SELECT m.role AS role, o.name AS name, o.created_by AS "createdBy",
@@ -119,7 +162,7 @@ export async function getContentOrganizationMembership(
   ) {
     return null;
   }
-  return revalidateFederatedMembership(orgId, userEmail, {
+  const validated = await revalidateFederatedMembership(orgId, userEmail, {
     role: (typeof row.role === "string"
       ? row.role
       : (JSON.stringify(row.role) ?? "member")
@@ -129,12 +172,34 @@ export async function getContentOrganizationMembership(
     identityAuthority: row.identityAuthority,
     identityId: row.identityId,
   });
+  return validated
+    ? {
+        ...validated,
+        role: preserveDelegatedMemberRole(
+          orgId,
+          userEmail,
+          validated.role,
+          verifiedRole,
+        ),
+      }
+    : null;
 }
 
 export async function listContentOrganizationMemberships(
   userEmail: string,
   transaction?: DbExec,
 ) {
+  const request = getRequestContext();
+  const normalizedEmail = normalizeContentSpaceEmail(userEmail);
+  const delegated = request?.a2aIdentityAssurance === "org-member";
+  if (
+    delegated &&
+    (!request.orgId?.trim() ||
+      request.userEmail?.trim().toLowerCase() !== normalizedEmail)
+  ) {
+    return [];
+  }
+
   if (transaction) {
     const relation = await transaction.execute({
       sql: "SELECT to_regclass('org_members') AS relation",
@@ -153,8 +218,11 @@ export async function listContentOrganizationMemberships(
           INNER JOIN organizations o ON o.id = m.org_id
           WHERE LOWER(m.email) = $1
             AND m.federation_removal_pending_at IS NULL
+            ${delegated ? "AND m.org_id = $2" : ""}
           ORDER BY m.org_id ASC`,
-      args: [normalizeContentSpaceEmail(userEmail)],
+      args: delegated
+        ? [normalizedEmail, request!.orgId!.trim()]
+        : [normalizedEmail],
     });
   } catch (error) {
     if (error instanceof Error && error.message.includes("does not exist")) {
@@ -174,11 +242,21 @@ export async function listContentOrganizationMemberships(
       identityAuthority: row.identityAuthority ?? row.identity_authority,
       identityId: row.identityId ?? row.identity_id,
     }))
+    .map((row: ContentOrganizationMembership & { orgId?: string }) => ({
+      ...row,
+      role:
+        row.role === "owner" || row.role === "admin" || row.role === "member"
+          ? delegated
+            ? "member"
+            : row.role
+          : null,
+    }))
     .filter(
       (row): row is ContentOrganizationMembership & { orgId: string } =>
         typeof row.orgId === "string" &&
         typeof row.name === "string" &&
-        typeof row.createdBy === "string",
+        typeof row.createdBy === "string" &&
+        row.role !== null,
     );
   return Promise.all(
     memberships.map(async ({ orgId, ...membership }) => {
@@ -187,7 +265,18 @@ export async function listContentOrganizationMemberships(
         userEmail,
         membership,
       );
-      return validated ? { orgId, ...validated } : null;
+      return validated
+        ? {
+            orgId,
+            ...validated,
+            role: preserveDelegatedMemberRole(
+              orgId,
+              normalizedEmail,
+              validated.role,
+              membership.role,
+            ),
+          }
+        : null;
     }),
   ).then((validated) =>
     validated.filter(

package/corpus/templates/content/actions/_database-utils.ts

@@ -1018,23 +1018,27 @@ export async function getContentDatabasePageResponse(
                 items.map((item) => item.documentId),
               ),
               isNull(schema.documents.trashedAt),
-              database.systemRole === "workspaces"
-                ? workspacesVisibleDocumentIds?.length
-                  ? inArray(schema.documents.id, workspacesVisibleDocumentIds)
+              database.systemRole === "favorites"
+                ? favoritesVisibleDocumentQuery
+                  ? inArray(schema.documents.id, favoritesVisibleDocumentQuery)
                   : sql`1 = 0`
-                : database.systemRole === "files" && database.orgId
-                  ? and(
-                      eq(schema.documents.orgId, database.orgId),
-                      or(
-                        eq(schema.documents.visibility, "org"),
-                        eq(schema.documents.visibility, "public"),
-                      ),
-                      or(
-                        eq(schema.documents.hideFromSearch, 0),
-                        isNull(schema.documents.hideFromSearch),
-                      ),
-                    )
-                  : eq(schema.documents.ownerEmail, database.ownerEmail),
+                : database.systemRole === "workspaces"
+                  ? workspacesVisibleDocumentIds?.length
+                    ? inArray(schema.documents.id, workspacesVisibleDocumentIds)
+                    : sql`1 = 0`
+                  : database.systemRole === "files" && database.orgId
+                    ? and(
+                        eq(schema.documents.orgId, database.orgId),
+                        or(
+                          eq(schema.documents.visibility, "org"),
+                          eq(schema.documents.visibility, "public"),
+                        ),
+                        or(
+                          eq(schema.documents.hideFromSearch, 0),
+                          isNull(schema.documents.hideFromSearch),
+                        ),
+                      )
+                    : eq(schema.documents.ownerEmail, database.ownerEmail),
             ),
           )
       : [];

package/corpus/templates/content/actions/_github-source-freshness.ts

@@ -65,19 +65,56 @@ function checkedWithin(lastRefreshedAt: string | null, ms: number) {
   return Number.isFinite(at) && Date.now() - at < ms;
 }
 
-function linkState(link: GitHubLink) {
+function linkState(metadataJson: string | undefined) {
   let metadata: unknown;
   try {
-    metadata = JSON.parse(link.metadataJson);
+    metadata = JSON.parse(metadataJson ?? "");
   } catch {
-    // coercion-ok: a link whose metadata can't be read has no one to read GitHub as, so the sweep passes it by.
+    // coercion-ok: a link whose metadata can't be read has no state; the sweep passes it by.
     return null;
   }
   return readGitHubSourceState(metadata);
 }
 
 function linkedBy(link: GitHubLink): string | null {
-  return linkState(link)?.linkedBy || null;
+  return linkState(link.metadataJson)?.linkedBy || null;
+}
+
+/** What the collection's status line shows about a link, as one comparable string. */
+function statusShown(metadataJson: string | undefined) {
+  const state = linkState(metadataJson);
+  return JSON.stringify([
+    state?.syncedCommitSha ?? null,
+    state?.pendingCommitSha ?? null,
+    state?.progress?.done ?? null,
+    state?.progress?.total ?? null,
+    state?.problem?.code ?? null,
+    state?.skippedCount ?? 0,
+    state?.skipped.map((file) => `${file.reason}:${file.path}`) ?? [],
+    state?.imagesWaiting ?? 0,
+  ]);
+}
+
+/**
+ * Reads what a link's status line shows now. Compare a reading from before a
+ * sync with one from after to learn whether the sync changed it, like a new
+ * problem or a few more files done.
+ */
+export async function readGitHubStatusShown(sourceId: string) {
+  const [source] = await getDb()
+    .select({ metadataJson: schema.contentDatabaseSources.metadataJson })
+    .from(schema.contentDatabaseSources)
+    .where(eq(schema.contentDatabaseSources.id, sourceId))
+    .limit(1);
+  return statusShown(source?.metadataJson);
+}
+
+/** Whether a sync changed what the status line shows, like a new problem. */
+async function statusChanged(link: GitHubLink) {
+  return (
+    statusShown(link.metadataJson) !==
+    (await readGitHubStatusShown(link.sourceId))
+  );
 }
 
 export function githubSyncChangedRows(result: GitHubSyncResult) {
@@ -85,30 +122,40 @@ export function githubSyncChangedRows(result: GitHubSyncResult) {
 }
 
 /**
- * Tells everyone who can read the collection that a sync nobody asked for
- * changed its rows. It is the event the sync action sends, so open pages,
- * tables, page lists and Trash update in place.
+ * Tells everyone who can read the collection that its rows or status changed.
+ * It is the event the sync action sends, so open pages, tables, page lists,
+ * Trash and the status line update in place. An action whose sync failed
+ * sends it too, since a failed action sends no change event of its own.
  */
-function announceSync(
-  link: GitHubLink,
+export function announceGitHubSyncChange(
+  databaseDocumentId: string,
   owner: string | null,
-  result: GitHubSyncResult,
 ) {
-  if (!githubSyncChangedRows(result)) return;
   recordChange({
     source: "action",
     type: "change",
     key: "sync-github-folder",
     ...(owner ? { owner } : {}),
-    ...documentChangeResource(link.databaseDocumentId),
+    ...documentChangeResource(databaseDocumentId),
   });
 }
 
+/** For a sync nobody asked for that changed rows or the status line. */
+async function announceSync(
+  link: GitHubLink,
+  owner: string | null,
+  result: GitHubSyncResult,
+) {
+  if (result.state === "busy") return;
+  if (!githubSyncChangedRows(result) && !(await statusChanged(link))) return;
+  announceGitHubSyncChange(link.databaseDocumentId, owner);
+}
+
 async function syncBeforeRead(link: GitHubLink | undefined) {
   if (!link || checkedWithin(link.lastRefreshedAt, GITHUB_SOURCE_STALE_MS)) {
     return false;
   }
-  const state = linkState(link);
+  const state = linkState(link.metadataJson);
   if (
     state?.pendingCommitSha &&
     checkedWithin(state.checkedAt, PUSH_LEFT_TO_SWEEP_MS)
@@ -116,8 +163,9 @@ async function syncBeforeRead(link: GitHubLink | undefined) {
     return false;
   }
   const until = Date.now() + READ_SYNC_BUDGET_MS;
+  let result: GitHubSyncResult;
   try {
-    const result = await syncGitHubSource({
+    result = await syncGitHubSource({
       sourceId: link.sourceId,
       budgetMs: READ_SYNC_BUDGET_MS,
     });
@@ -129,8 +177,6 @@ async function syncBeforeRead(link: GitHubLink | undefined) {
       if (!result.commitSha) await waitForGitHubSync(link.sourceId, until);
       return true;
     }
-    announceSync(link, linkedBy(link), result);
-    return githubSyncChangedRows(result);
   } catch (error) {
     // coercion-ok: the read goes on with the rows Content has; the next read or background sync tries GitHub again.
     console.warn(
@@ -139,6 +185,15 @@ async function syncBeforeRead(link: GitHubLink | undefined) {
     );
     return false;
   }
+  // The rows changed either way, so the read rereads them even when telling
+  // open pages fails.
+  await announceSync(link, linkedBy(link), result).catch((error: unknown) => {
+    console.warn(
+      "[github-source] change event failed:",
+      error instanceof Error ? error.message : String(error),
+    );
+  });
+  return githubSyncChangedRows(result);
 }
 
 /**
@@ -237,7 +292,7 @@ export async function runGitHubSourceSweep(context: RecurringSweepContext) {
               signal: context.signal,
             }),
         );
-        announceSync(link, owner, result);
+        await announceSync(link, owner, result);
       } catch (error) {
         // coercion-ok: one link's failure is recorded on that link by the sync; the rest still run.
         console.warn(