@agent-native/core 0.100.0 → 0.100.2

package/corpus/README.md

@@ -28,4 +28,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 ## Generated Counts
 
 - core files: 2255
-- template files: 5582
+- template files: 5588

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @agent-native/core
 
+## 0.100.2
+
+### Patch Changes
+
+- f8cf755: Add a native local-runtime sign-in handoff for Codex-backed ChatGPT subscriptions in Agent composer surfaces.
+- f8cf755: Fix Slack integration fallbacks and link replies directly to Dispatch chat threads.
+- f8cf755: Keep workspace-shared app secrets decryptable across sibling apps.
+
+## 0.100.1
+
+### Patch Changes
+
+- 037cc3a: Validate explicit Calendar and Mail connector catalog actions through the external MCP lifecycle.
+
 ## 0.100.0
 
 ### Minor Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.100.0",
+  "version": "0.100.2",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/client/AssistantChat.tsx

@@ -1813,6 +1813,8 @@ export interface AssistantChatProps {
   onForkChat?: () => void | boolean | Promise<void | boolean>;
   /** Override Builder/provider connect routing for embedded hosts. */
   onConnectProvider?: () => void;
+  /** Route local runtime setup through the host's native bridge. */
+  onConnectLocalRuntime?: (engine: string) => void;
   /**
    * Controls the shared composer + menu. Sidebar keeps the full menu by default;
    * hosts without the sidebar provider stack can use upload-only.
@@ -2177,6 +2179,7 @@ const AssistantChatInner = forwardRef<
     imageModelMenu,
     onForkChat,
     onConnectProvider,
+    onConnectLocalRuntime,
     plusMenuMode = "full",
     providerStatusChecksEnabled = true,
     loadHistoryRepository,
@@ -5529,6 +5532,7 @@ const AssistantChatInner = forwardRef<
                             onEffortChange={onEffortChange}
                             imageModelMenu={imageModelMenu}
                             onConnectProvider={onConnectProvider}
+                            onConnectLocalRuntime={onConnectLocalRuntime}
                             toolbarSlot={composerToolbarSlot}
                             contextItems={composerContextItems}
                             onRemoveContextItem={removeComposerContextItem}

package/corpus/core/src/client/composer/PromptComposer.tsx

@@ -154,6 +154,8 @@ export interface PromptComposerProps {
    * Used by the Electron desktop app to route through the native IPC handler.
    */
   onConnectProvider?: () => void;
+  /** Called when a local runtime needs its native sign-in/setup flow. */
+  onConnectLocalRuntime?: (engine: string) => void;
   /** Imperative handle for focusing the composer. */
   composerRef?: Ref<TiptapComposerHandle>;
 }
@@ -474,6 +476,7 @@ function PromptComposerInner({
   modelStatusChecksEnabled,
   onTextChange,
   onConnectProvider,
+  onConnectLocalRuntime,
   composerRef,
 }: PromptComposerProps) {
   const localRef = useRef<TiptapComposerHandle>(null);
@@ -656,6 +659,7 @@ function PromptComposerInner({
           onEffortChange={handleEffortChange}
           providerConnectStatusEnabled={resolvedModelStatusChecksEnabled}
           onConnectProvider={onConnectProvider}
+          onConnectLocalRuntime={onConnectLocalRuntime}
         />
       </AgentComposerFrame>
     </>

package/corpus/core/src/client/composer/TiptapComposer.tsx

@@ -628,6 +628,8 @@ export interface TiptapComposerProps {
    * Used by the Electron desktop app to route through the native IPC handler.
    */
   onConnectProvider?: () => void;
+  /** Route local runtime setup through the host's native bridge. */
+  onConnectLocalRuntime?: (engine: string) => void;
   /**
    * Optional secondary model menu (e.g. an image-generation model) rendered as
    * an extra section inside the model picker. Opt-in; omit for chat-only apps.
@@ -807,6 +809,7 @@ function ModeSelector({
 
 const FRIENDLY_MODEL_NAMES: Record<string, string> = {
   auto: "Default model",
+  "codex-cli": "ChatGPT subscription",
   "claude-fable-5": "Fable 5",
   "kimi-k2-5": "Kimi K2.5",
   "deepseek-v3-1": "DeepSeek v3.1",
@@ -949,6 +952,7 @@ function ModelSelector({
   onEffortChange,
   providerConnectStatusEnabled = true,
   onConnectProvider,
+  onConnectLocalRuntime,
   imageModel,
 }: {
   model: string;
@@ -963,6 +967,7 @@ function ModelSelector({
   onEffortChange?: (effort: ReasoningEffort) => void;
   providerConnectStatusEnabled?: boolean;
   onConnectProvider?: () => void;
+  onConnectLocalRuntime?: (engine: string) => void;
   imageModel?: ComposerImageModelMenu;
 }) {
   const [open, setOpen] = useState(false);
@@ -1050,6 +1055,13 @@ function ModelSelector({
     window.dispatchEvent(new CustomEvent("agent-panel:open-settings"));
     setOpen(false);
   }, []);
+  const connectLocalRuntime = useCallback(
+    (engine: string) => {
+      onConnectLocalRuntime?.(engine);
+      setOpen(false);
+    },
+    [onConnectLocalRuntime],
+  );
 
   return (
     <Popover open={open} onOpenChange={setOpen}>
@@ -1207,9 +1219,15 @@ function ModelSelector({
                   <button
                     type="button"
                     className="text-[10px] text-muted-foreground/60 hover:text-foreground cursor-pointer pe-3 py-1.5"
-                    onClick={openLlmSettings}
+                    onClick={() =>
+                      group.engine === "codex-cli" && onConnectLocalRuntime
+                        ? connectLocalRuntime(group.engine)
+                        : openLlmSettings()
+                    }
                   >
-                    needs API key
+                    {group.engine === "codex-cli" && onConnectLocalRuntime
+                      ? "sign in"
+                      : "needs API key"}
                   </button>
                 )}
               </div>
@@ -1220,7 +1238,14 @@ function ModelSelector({
                     type="button"
                     onClick={() => {
                       if (!group.configured) {
-                        openLlmSettings();
+                        if (
+                          group.engine === "codex-cli" &&
+                          onConnectLocalRuntime
+                        ) {
+                          connectLocalRuntime(group.engine);
+                        } else {
+                          openLlmSettings();
+                        }
                         return;
                       }
                       onChange(m, group.engine);
@@ -1339,6 +1364,7 @@ export function TiptapComposer({
   onEffortChange,
   providerConnectStatusEnabled,
   onConnectProvider,
+  onConnectLocalRuntime,
   imageModelMenu,
   draftScope,
   contextItems = [],
@@ -2740,6 +2766,7 @@ export function TiptapComposer({
             onEffortChange={onEffortChange}
             providerConnectStatusEnabled={providerConnectStatusEnabled}
             onConnectProvider={onConnectProvider}
+            onConnectLocalRuntime={onConnectLocalRuntime}
             imageModel={imageModelMenu}
           />
         )}

package/corpus/core/src/integrations/webhook-handler.ts

@@ -74,6 +74,8 @@ import {
 const PROCESSOR_DISPATCH_SETTLE_WAIT_MS = 1_500;
 const DEFERRED_RESPONSE_DISPATCH_SETTLE_WAIT_MS = 1_500;
 const DEFERRED_RESPONSE_MAX_HANDLER_MS = 2_500;
+const EMPTY_INTEGRATION_RESPONSE_MESSAGE =
+  "The model finished without a visible answer. Try again, or open the thread in Dispatch to inspect the run.";
 
 type ToolDoneEvent = { type: "tool_done"; tool: string; result: string };
 
@@ -972,7 +974,7 @@ async function processIncomingMessage(
                 "If it was a complex analytics question, opening the analytics app " +
                 "directly is the most reliable way to get an answer right now.";
             } else {
-              responseText = "(No response)";
+              responseText = EMPTY_INTEGRATION_RESPONSE_MESSAGE;
             }
           }
           if (approval?.type === "approval_required") {
@@ -995,7 +997,7 @@ async function processIncomingMessage(
           }
           const threadDeepLinkUrl =
             appBaseUrl && threadId
-              ? `${appBaseUrl}/?thread=${threadId}`
+              ? `${appBaseUrl}/chat/${encodeURIComponent(threadId)}`
               : undefined;
 
           // Format and send back to platform — update the "thinking…"

package/corpus/core/src/secrets/crypto.ts

@@ -1,17 +1,23 @@
 /**
  * Shared AES-256-GCM encryption for secret values at rest.
  *
- * Used by both the framework secrets vault (`app_secrets`) and per-user/per-org
- * credentials (`resolveCredential` / `saveCredential`, stored in `settings`) so
- * there is a single crypto implementation and a single key story.
+ * Used by the framework secrets vault, per-user/per-org credentials
+ * (`resolveCredential` / `saveCredential`, stored in `settings`), and other
+ * column-level encrypted values. The `app_secrets` storage layer uses the
+ * shared-key variant below because workspace-scoped vault rows are readable by
+ * sibling apps in the same workspace. When a deployment has not been given
+ * shared key material yet, that variant falls back to the app-scoped key so
+ * existing single-app deployments can keep reading and writing secrets while
+ * they migrate to the shared key.
  *
- * The encryption key is derived from `<APP_NAME>_SECRETS_ENCRYPTION_KEY` when
- * set, then `SECRETS_ENCRYPTION_KEY`, then `BETTER_AUTH_SECRET`. The app-scoped
- * key lets a local multi-app workspace read one app's encrypted production data
- * without replacing the shared local auth secret. In production we refuse to
- * start without configured key material — a CWD-derived fallback would be
- * effectively static (e.g. `/var/task` on Lambda), so anyone with read access
- * to the DB could decrypt every secret.
+ * The default encryption key is derived from
+ * `<APP_NAME>_SECRETS_ENCRYPTION_KEY` when set, then `SECRETS_ENCRYPTION_KEY`,
+ * then `BETTER_AUTH_SECRET`. The app-scoped key lets a local multi-app
+ * workspace read one app's encrypted production data without replacing the
+ * shared local auth secret. In production we refuse to start without
+ * configured key material — a CWD-derived fallback would be effectively
+ * static (e.g. `/var/task` on Lambda), so anyone with read access to the DB
+ * could decrypt every secret.
  *
  * Encrypted values are tagged `v1:<iv-hex>:<ct-hex>:<tag-hex>`. The `v1:` prefix
  * lets readers distinguish ciphertext from legacy plaintext during migration.
@@ -67,45 +73,26 @@ function appScopedEncryptionKey(): string | undefined {
     : undefined;
 }
 
-/**
- * Derive a 32-byte AES key from the configured secret material via SHA-256.
- * Re-derived per call (cheap, stateless, and makes rotation easy).
- */
-export function getSecretEncryptionKey(): Buffer {
+function sharedEncryptionKeyMaterial(): string | undefined {
+  if (typeof process === "undefined") return undefined;
+  return process.env.SECRETS_ENCRYPTION_KEY || process.env.BETTER_AUTH_SECRET;
+}
+
+function deriveSecretEncryptionKey(
+  explicit: string | undefined,
+  errorMessage: string,
+  warningMessage: string,
+): Buffer {
   const { createHash } = requireNodeCrypto();
-  const explicit =
-    appScopedEncryptionKey() ||
-    (typeof process === "undefined"
-      ? undefined
-      : process.env.SECRETS_ENCRYPTION_KEY) ||
-    (typeof process === "undefined"
-      ? undefined
-      : process.env.BETTER_AUTH_SECRET);
 
   if (!explicit) {
     if (processNodeEnv() === "production") {
-      const appName =
-        typeof process === "undefined"
-          ? undefined
-          : process.env.APP_NAME?.trim() // guard:allow-env-credential — deploy-level app configuration selects the scoped encryption key.
-              .toUpperCase()
-              .replace(/[^A-Z0-9]+/g, "_")
-              .replace(/^_+|_+$/g, "");
-      throw new Error(
-        "[agent-native/secrets] Refusing to start in production without an encryption key. " +
-          `Set ${appName ? `${appName}_SECRETS_ENCRYPTION_KEY, ` : ""}SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET in the deploy environment. ` +
-          "The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), " +
-          "which means anyone with read access to the secrets table could decrypt every user's secrets.",
-      );
+      throw new Error(errorMessage);
     }
     if (!_warnedFallback) {
       _warnedFallback = true;
       // eslint-disable-next-line no-console
-      console.warn(
-        "[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using a machine-local fallback. " +
-          "Set an app-scoped *_SECRETS_ENCRYPTION_KEY, SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET for production. " +
-          "Production deploys without one of these env vars now hard-fail.",
-      );
+      console.warn(warningMessage);
     }
   }
 
@@ -113,10 +100,56 @@ export function getSecretEncryptionKey(): Buffer {
   return createHash("sha256").update(material).digest();
 }
 
-/** Encrypt a plain-text value. Returns `v1:<iv-hex>:<ct-hex>:<tag-hex>`. */
-export function encryptSecretValue(plaintext: string): string {
+/**
+ * Derive the key used by generic encrypted values such as credentials and
+ * OAuth tokens. App-specific key material is allowed for these app-local
+ * values.
+ */
+export function getSecretEncryptionKey(): Buffer {
+  const appName =
+    typeof process === "undefined"
+      ? undefined
+      : process.env.APP_NAME?.trim() // guard:allow-env-credential — deploy-level app configuration selects the scoped encryption key.
+          .toUpperCase()
+          .replace(/[^A-Z0-9]+/g, "_")
+          .replace(/^_+|_+$/g, "");
+  return deriveSecretEncryptionKey(
+    appScopedEncryptionKey() || sharedEncryptionKeyMaterial(),
+    "[agent-native/secrets] Refusing to start in production without an encryption key. " +
+      `Set ${appName ? `${appName}_SECRETS_ENCRYPTION_KEY, ` : ""}SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET in the deploy environment. ` +
+      "The previous CWD-derived fallback was effectively static (e.g. `/var/task` on Lambda), " +
+      "which means anyone with read access to the DB could decrypt every secret.",
+    "[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using a machine-local fallback. " +
+      "Set an app-scoped *_SECRETS_ENCRYPTION_KEY, SECRETS_ENCRYPTION_KEY, or BETTER_AUTH_SECRET for production. " +
+      "Production deploys without one of these env vars now hard-fail.",
+  );
+}
+
+/**
+ * Derive the preferred workspace-shared key used by `app_secrets` rows.
+ * Unlike generic column-level encryption, workspace vault data should decrypt
+ * in sibling apps, so `SECRETS_ENCRYPTION_KEY` / `BETTER_AUTH_SECRET` take
+ * precedence. The app-scoped key remains a compatibility fallback for
+ * deployments that have not configured shared material yet; once the shared
+ * key is configured, writes use it and reads still fall back to old rows.
+ */
+export function getSharedSecretEncryptionKey(): Buffer {
+  return deriveSecretEncryptionKey(
+    sharedEncryptionKeyMaterial() || appScopedEncryptionKey(),
+    "[agent-native/secrets] Refusing to start in production without encryption key material for workspace secrets. " +
+      "Set SECRETS_ENCRYPTION_KEY, BETTER_AUTH_SECRET, or the app-scoped *_SECRETS_ENCRYPTION_KEY in the deploy environment.",
+    "[agent-native/secrets] SECRETS_ENCRYPTION_KEY not set — using app-scoped or machine-local fallback for workspace secrets. " +
+      "Set SECRETS_ENCRYPTION_KEY or BETTER_AUTH_SECRET in every workspace app so sibling apps share vault rows.",
+  );
+}
+
+/** Whether this deployment has stable workspace-shared key material. */
+export function hasSharedSecretEncryptionKeyMaterial(): boolean {
+  return Boolean(sharedEncryptionKeyMaterial());
+}
+
+function encryptWithKey(plaintext: string, key: Buffer): string {
   const { createCipheriv, randomBytes } = requireNodeCrypto();
-  const key = getSecretEncryptionKey();
   const iv = randomBytes(12);
   const cipher = createCipheriv("aes-256-gcm", key, iv);
   const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
@@ -124,8 +157,7 @@ export function encryptSecretValue(plaintext: string): string {
   return `v1:${iv.toString("hex")}:${ct.toString("hex")}:${tag.toString("hex")}`;
 }
 
-/** Decrypt a value produced by `encryptSecretValue`. Throws on tampering. */
-export function decryptSecretValue(encrypted: string): string {
+function decryptWithKey(encrypted: string, key: Buffer): string {
   const { createDecipheriv } = requireNodeCrypto();
   if (!encrypted.startsWith("v1:")) {
     throw new Error("Unrecognised secret encoding");
@@ -134,7 +166,6 @@ export function decryptSecretValue(encrypted: string): string {
   if (!ivHex || !ctHex || !tagHex) {
     throw new Error("Corrupt secret payload");
   }
-  const key = getSecretEncryptionKey();
   const decipher = createDecipheriv(
     "aes-256-gcm",
     key,
@@ -148,6 +179,26 @@ export function decryptSecretValue(encrypted: string): string {
   return pt.toString("utf8");
 }
 
+/** Encrypt a plain-text value with the generic app-local key. */
+export function encryptSecretValue(plaintext: string): string {
+  return encryptWithKey(plaintext, getSecretEncryptionKey());
+}
+
+/** Decrypt a value produced by `encryptSecretValue`. Throws on tampering. */
+export function decryptSecretValue(encrypted: string): string {
+  return decryptWithKey(encrypted, getSecretEncryptionKey());
+}
+
+/** Encrypt a workspace-shared `app_secrets` value. */
+export function encryptSharedSecretValue(plaintext: string): string {
+  return encryptWithKey(plaintext, getSharedSecretEncryptionKey());
+}
+
+/** Decrypt a workspace-shared `app_secrets` value. */
+export function decryptSharedSecretValue(encrypted: string): string {
+  return decryptWithKey(encrypted, getSharedSecretEncryptionKey());
+}
+
 /**
  * Strict check for a value produced by `encryptSecretValue`: `v1:` followed by
  * three hex segments. Intentionally strict so a legacy plaintext credential

package/corpus/core/src/secrets/index.ts

@@ -38,7 +38,8 @@ export { APP_SECRETS_CREATE_SQL, appSecrets } from "./schema.js";
 
 // AES-256-GCM helpers for column-level encryption of per-row secret values
 // (e.g. a per-record share password) that don't fit the keyed app_secrets /
-// credentials stores. Same key story as the vault.
+// credentials stores. These use the app-local key, unlike the workspace-shared
+// app_secrets storage layer.
 export {
   encryptSecretValue,
   decryptSecretValue,

package/corpus/core/src/secrets/schema.ts

@@ -22,6 +22,8 @@ export const appSecrets = table("app_secrets", {
   key: text("key").notNull(),
   /** Encrypted value — never return this through any API. */
   encryptedValue: text("encrypted_value").notNull(),
+  /** Preferred workspace-shared ciphertext; nullable during key migration. */
+  sharedEncryptedValue: text("shared_encrypted_value"),
   /** Optional human-readable description (used for ad-hoc keys). */
   description: text("description"),
   /** JSON array of allowed URL origins. Null = allow all. */
@@ -41,6 +43,7 @@ export const APP_SECRETS_CREATE_SQL = `CREATE TABLE IF NOT EXISTS app_secrets (
   scope_id TEXT NOT NULL,
   key TEXT NOT NULL,
   encrypted_value TEXT NOT NULL,
+  shared_encrypted_value TEXT,
   description TEXT,
   url_allowlist TEXT,
   created_at INTEGER NOT NULL,