@agent-native/core 0.101.11 → 0.101.13

package/corpus/README.md

@@ -28,4 +28,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 ## Generated Counts
 
 - core files: 2258
-- template files: 5674
+- template files: 5675

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @agent-native/core
 
+## 0.101.13
+
+### Patch Changes
+
+- e503433: Keep CLI repository downloads asynchronous and challenge bare loopback MCP URLs for OAuth clients.
+- e503433: Keep completed chat work disclosures collapsed and stable when submitting a later message.
+- e503433: Remove the automatic first-session personalization questions from agent chat so new requests are handled directly.
+
+## 0.101.12
+
+### Patch Changes
+
+- 2ff004e: Fix workspace-file resolution and run-code paging/routing edge cases. `contentFromWorkspaceFile` now resolves the same file the run-code `workspaceRead`/`workspaceWrite` bridge sees (bridge scope first, then Resources), and fails closed on a bridge read error instead of silently falling back to a possibly-different same-path Resources body. `workspaceRead` returns null instead of a silently truncated prefix when a later page fails, and the run-code bridge now returns a distinct "not registered" (404) error for unknown tools instead of a misleading read-only access error.
+
 ## 0.101.11
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.101.11",
+  "version": "0.101.13",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/cli/create.ts

@@ -1,4 +1,4 @@
-import { execFileSync } from "child_process";
+import { execFile, execFileSync } from "child_process";
 import fs from "fs";
 import path from "path";
 import { fileURLToPath, pathToFileURL } from "url";
@@ -1363,18 +1363,53 @@ function tarExtractArgs(
   return ["xzf", tarPath, "--strip-components=1", ...excludes, "-C", destDir];
 }
 
-function downloadAndExtract(
+function execFileBuffer(
+  command: string,
+  args: string[],
+  options: { maxBuffer: number },
+): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    execFile(
+      command,
+      args,
+      { ...options, encoding: "buffer" },
+      (error, stdout, stderr) => {
+        if (error) {
+          const detail = stderr?.toString().trim();
+          if (detail) error.message = `${error.message}: ${detail}`;
+          reject(error);
+          return;
+        }
+        resolve(Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout));
+      },
+    );
+  });
+}
+
+async function downloadAndExtract(
   url: string,
   destDir: string,
   options: { skipAgentSymlinks?: boolean } = {},
-): void {
+): Promise<void> {
   fs.mkdirSync(destDir, { recursive: true });
   // --fail-with-body so curl exits non-zero on HTTP 4xx/5xx instead of writing
   // the error body (HTML/JSON) to disk where tar then fails with the opaque
   // "Unrecognized archive format" message.
-  const tarball = execFileSync("curl", ["--fail-with-body", "-sL", url], {
-    maxBuffer: 100 * 1024 * 1024,
-  });
+  // Keep this asynchronous: a synchronous curl blocks the event loop, which
+  // makes the create command's spinner look frozen during the GitHub fetch.
+  const tarball = await execFileBuffer(
+    "curl",
+    [
+      "--fail-with-body",
+      "--connect-timeout",
+      "10",
+      "--max-time",
+      "120",
+      "-sL",
+      url,
+    ],
+    { maxBuffer: 100 * 1024 * 1024 },
+  );
   const tarPath = path.join(destDir, ".download.tar.gz");
   fs.writeFileSync(tarPath, tarball);
   try {
@@ -1407,7 +1442,9 @@ async function downloadGitHubSubdir(
       `.agent-native-tmp-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
     );
     try {
-      downloadAndExtract(tarUrl, tmpDir, { skipAgentSymlinks: repo === REPO });
+      await downloadAndExtract(tarUrl, tmpDir, {
+        skipAgentSymlinks: repo === REPO,
+      });
       const srcDir = path.join(tmpDir, subdir);
       if (!fs.existsSync(srcDir)) {
         throw new Error(
@@ -1435,7 +1472,7 @@ async function downloadGitHubRepo(
 ): Promise<void> {
   validateRepoName(repo);
   const tarUrl = `https://api.github.com/repos/${repo}/tarball/main`;
-  downloadAndExtract(tarUrl, targetDir);
+  await downloadAndExtract(tarUrl, targetDir);
 }
 
 /* ─────────────────────────────────────────────────────────────────────────

package/corpus/core/src/client/assistant-ui-recovery.tsx

@@ -38,6 +38,8 @@ export function isAssistantUiRecoverableRenderError(error: unknown): boolean {
 
 type AssistantUiStaleIndexErrorBoundaryProps = {
   resetKey: string;
+  /** Remount children when the recovery scope changes. */
+  remountOnResetKey?: boolean;
   componentName?: string;
   children: React.ReactNode;
 };
@@ -173,10 +175,13 @@ export class AssistantUiStaleIndexErrorBoundary extends React.Component<
       return null;
     }
 
+    const fragmentKey =
+      this.props.remountOnResetKey === false
+        ? String(this.state.retryToken)
+        : `${this.props.resetKey}:${this.state.retryToken}`;
+
     return (
-      <React.Fragment key={`${this.props.resetKey}:${this.state.retryToken}`}>
-        {this.props.children}
-      </React.Fragment>
+      <React.Fragment key={fragmentKey}>{this.props.children}</React.Fragment>
     );
   }
 }
@@ -191,6 +196,7 @@ export function AssistantMessageListErrorBoundary({
   return (
     <AssistantUiStaleIndexErrorBoundary
       resetKey={resetKey}
+      remountOnResetKey={false}
       componentName="AssistantMessageList"
     >
       {children}

package/corpus/core/src/client/chat/message-components.tsx

@@ -848,6 +848,25 @@ export function shouldShowAssistantMessageFooter({
   return !chatRunning && statusIsTerminal;
 }
 
+export function shouldShowAssistantWorkSummary({
+  isLast,
+  isComplete,
+  hasCollapsibleWork,
+  hasUnresolvedTool,
+}: {
+  isLast: boolean;
+  isComplete: boolean;
+  hasCollapsibleWork: boolean;
+  hasUnresolvedTool: boolean;
+}): boolean {
+  if (!hasCollapsibleWork || hasUnresolvedTool) return false;
+
+  // Keep completed historical work wrapped while a later turn is running.
+  // Removing the wrapper exposes/remounts ReasoningCell and resets its
+  // disclosure state to the default-open value on every new submission.
+  return isComplete || !isLast;
+}
+
 function ReasoningMessagePart() {
   const part = useMessagePartReasoning();
   const partRuntime = useMessagePartRuntime();
@@ -1040,8 +1059,12 @@ export function AssistantMessage() {
           {({ part, children }) => {
             switch (part.type) {
               case "group-work": {
-                const showSummary =
-                  isComplete && !chatRunning && hasCollapsibleWork;
+                const showSummary = shouldShowAssistantWorkSummary({
+                  isLast,
+                  isComplete,
+                  hasCollapsibleWork,
+                  hasUnresolvedTool,
+                });
                 if (!showSummary) return <>{children}</>;
                 return (
                   <WorkedForSummary

package/corpus/core/src/client/chat/tool-call-display.tsx

@@ -1088,20 +1088,17 @@ export function WorkedForSummary({
   children,
 }: {
   durationMs?: number | null;
-  /** When true, start open then animate closed (post-run collapse). */
+  /** When true, close the summary after a run has completed. */
   autoCollapse?: boolean;
   children: React.ReactNode;
 }) {
-  const [open, setOpen] = useState(autoCollapse);
-  const didAutoCollapseRef = useRef(false);
+  // Start closed so a remounted completed message never flashes its work
+  // details open while auto-collapse settles. If the summary was already
+  // open when autoCollapse changes, AnimatedCollapse still animates it shut.
+  const [open, setOpen] = useState(false);
 
   useEffect(() => {
-    if (!autoCollapse || didAutoCollapseRef.current) return;
-    didAutoCollapseRef.current = true;
-    const frame = requestAnimationFrame(() => {
-      setOpen(false);
-    });
-    return () => cancelAnimationFrame(frame);
+    if (autoCollapse) setOpen(false);
   }, [autoCollapse]);
 
   const label =

package/corpus/core/src/coding-tools/run-code.ts

@@ -740,8 +740,18 @@ function handleBridgeRequest(
 
   // Enforce allowlist.
   const entry = actions[toolName];
+  // Unknown/mistyped tool: report "not registered" (404) before the
+  // access-control branch below. Otherwise an undefined `entry` falls into the
+  // allowlist 403 and returns a misleading access error for a tool that simply
+  // does not exist. (Bridge-allowlisted tools always have an entry, so this
+  // cannot mask a legitimate allowlisted call.)
+  if (!entry) {
+    res.writeHead(404, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ error: `Tool "${toolName}" is not registered.` }));
+    return;
+  }
   const isReadOnlyAction =
-    entry?.readOnly === true &&
+    entry.readOnly === true &&
     entry.agentTool !== false &&
     entry.toolCallable !== false;
   if (
@@ -749,21 +759,24 @@ function handleBridgeRequest(
     !extraTools.has(toolName) &&
     !isReadOnlyAction
   ) {
+    // A registered, agent-exposed action that isn't read-only is a mutation.
+    // (Unknown tools already returned 404 above, so `entry` is defined here.)
+    // Point the caller at the native tool path instead of leaving them to guess
+    // (the common trap: retrying create-extension/update-extension through
+    // appAction, which cannot work).
+    const isMutatingAction =
+      entry.agentTool !== false && entry.readOnly !== true;
     res.writeHead(403, { "Content-Type": "application/json" });
     res.end(
       JSON.stringify({
-        error: `Tool "${toolName}" is not an agent-exposed read-only action or sandbox bridge allowlisted tool.`,
+        error: isMutatingAction
+          ? `Tool "${toolName}" is a mutating action and cannot be called from run-code (appAction only exposes read-only actions). Call "${toolName}" directly as a native tool. For large content bodies, stage the content and pass "contentFromAttachment" instead of an inline string rather than routing it through run-code.`
+          : `Tool "${toolName}" is not an agent-exposed read-only action or sandbox bridge allowlisted tool.`,
       }),
     );
     return;
   }
 
-  if (!entry) {
-    res.writeHead(404, { "Content-Type": "application/json" });
-    res.end(JSON.stringify({ error: `Tool "${toolName}" is not registered.` }));
-    return;
-  }
-
   const toolArgs = parsed.args ?? {};
   usedTools.add(toolName);
   // Run the tool with the parent request context so auth/org/owner resolution
@@ -1534,12 +1547,52 @@ async function webRead(url, init = {}) {
 /**
  * Read a Resources-backed workspace file by path. Returns the file content as
  * a string, or null if not found.
- * Supports optional offset and maxChars for paging large files.
+ *
+ * By default this returns the WHOLE file: the underlying store caps a single
+ * read at 100k chars, so this auto-pages across chunks and concatenates them,
+ * so callers never get a silently truncated body. Pass an explicit \`offset\`
+ * or \`maxChars\` to take manual control of a single page instead.
  */
 async function workspaceRead(path, opts = {}) {
-  const parsed = await workspaceReadMeta(path, opts);
-  if (parsed && parsed.ok === false) return null;
-  return parsed && typeof parsed.content === "string" ? parsed.content : null;
+  // Explicit paging requested → single read, caller owns the window.
+  if (opts.offset !== undefined || opts.maxChars !== undefined) {
+    const parsed = await workspaceReadMeta(path, opts);
+    if (parsed && parsed.ok === false) return null;
+    return parsed && typeof parsed.content === "string" ? parsed.content : null;
+  }
+  // Default → assemble the full file by paging until the store reports no more.
+  let offset = 0;
+  let out = "";
+  let found = false;
+  let complete = false;
+  // Bounded loop (files cap at 2 MB / 100k-char reads) so a misbehaving store
+  // can never spin forever.
+  for (let i = 0; i < 512; i++) {
+    const parsed = await workspaceReadMeta(path, { offset, maxChars: 100000 });
+    // A failed/missing page aborts. If it failed before the first page we never
+    // found the file (return null below); if it failed part-way through a
+    // truncated read, complete stays false and we return null rather than a
+    // silently truncated body.
+    if (!parsed || parsed.ok === false) break;
+    found = true;
+    const chunk = typeof parsed.content === "string" ? parsed.content : "";
+    out += chunk;
+    if (!parsed.truncated) {
+      complete = true;
+      break;
+    }
+    const next =
+      typeof parsed.nextOffset === "number"
+        ? parsed.nextOffset
+        : offset + chunk.length;
+    if (next <= offset) break; // no forward progress; stop rather than loop
+    offset = next;
+  }
+  if (!found) return null;
+  // Only hand back a body we know is whole. A truncated read followed by a
+  // failed/stalled page would otherwise corrupt a large clone with a partial
+  // prefix and no error signal.
+  return complete ? out : null;
 }
 
 /**

package/corpus/core/src/extensions/actions.ts

@@ -3,8 +3,17 @@ import type { ActionRunContext } from "../action.js";
 import type { ActionEntry } from "../agent/production-agent.js";
 import type { AgentChatAttachment } from "../agent/types.js";
 import { writeAppState } from "../application-state/script-helpers.js";
-import { getRequestRunContext } from "../server/request-context.js";
+import { readResource } from "../resources/script-helpers.js";
+import {
+  getRequestOrgId,
+  getRequestRunContext,
+  getRequestUserEmail,
+} from "../server/request-context.js";
 import { resolveAccess } from "../sharing/access.js";
+import {
+  readWorkspaceFile,
+  type WorkspaceFilesScope,
+} from "../workspace-files/store.js";
 import type {
   ExtensionContentEdit,
   ExtensionLegacyPatch,
@@ -483,7 +492,7 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
     "create-extension": {
       tool: {
         description:
-          'Create a persisted sandboxed Alpine.js mini-app extension and render it inline in the chat. Use this when the user wants generated UI that should be saved, reusable, or visible in the Extensions view: extensions, widgets, dashboards, calculators, mini-apps, and reusable interactive utilities. For one-time chat-only UI, use render-inline-extension instead. The content must be a self-contained Alpine.js HTML body snippet that can use appAction(), appFetch(), dbQuery(), extensionFetch(), extensionData, agentNative.ui.output(value, opts?), and agentNative.chat.send()/sendToAgentChat(). Use appAction() for app data writes and extensionData for extension-owned persisted UI state; dbQuery() is for read-only inspection of known app SQL tables. Use agentNative.ui.output for passive current values from knobs, sliders, and selections; it writes application state at inline-ui:<extension id>:output, which the agent can read later with readAppState when the user says to use that value. Use agentNative.chat.send for visible submit/apply actions. Persist reusable user-edited state with extensionData: if the extension has checkboxes, todos, notes, filters, preferences, or any control whose value should survive reload/reopen, load that state on init and save changes with extensionData, usually at user scope, instead of keeping it only in Alpine state. IMPORTANT — hosting a pasted file: if the user pasted a large HTML/Alpine file (it appears in your context as an <attachment name="pasted-text-…"> block) and asked you to host it as-is, do NOT copy that file into `content`. Instead leave `content` empty and pass `contentFromAttachment` set to that attachment\'s name (or the literal "latest" for the most recent pasted block) — the server reads the file verbatim. Re-emitting a large pasted file as `content` regularly gets cut off mid-stream and stalls the turn. Prefer appAction(name, params) for app data and actions, including read actions mounted as GET; do not call template /api/* routes from appFetch because the extension bridge only allows framework /_agent-native/* paths. Parse JSON string action results before aggregating; use dbQuery() only for known existing SQL tables and never for writes. Keep the initial create-extension payload compact and working; for complex extensions, create a useful v1 first, then use focused update-extension edits for refinements rather than assembling one enormous initial tool input. For any non-trivial component (more than a couple of state fields, any methods, any string formatting, any branching) put the component in a <script> block via Alpine.data(\'name\', () => ({...})) and reference it with x-data="name" — do NOT cram methods, template literals, or branching logic into an inline x-data="{...}" attribute (HTML parser pitfalls cause ReferenceError failures). Define every variable referenced from x-text/x-show/x-if/x-for on the data object\'s initial state. If the extension\'s value depends on an LLM call, require a real key via \\${keys.OPENAI_API_KEY}/\\${keys.ANTHROPIC_API_KEY} (and tell the user to add it in the Dispatch Vault, or in app Settings → API Keys & Connections for standalone apps, if missing) or route the AI work to the agent chat — never ship a stubbed analysis step that renders a placeholder/boolean as the result.',
+          'Create a persisted sandboxed Alpine.js mini-app extension and render it inline in the chat. Use this when the user wants generated UI that should be saved, reusable, or visible in the Extensions view: extensions, widgets, dashboards, calculators, mini-apps, and reusable interactive utilities. For one-time chat-only UI, use render-inline-extension instead. The content must be a self-contained Alpine.js HTML body snippet that can use appAction(), appFetch(), dbQuery(), extensionFetch(), extensionData, agentNative.ui.output(value, opts?), and agentNative.chat.send()/sendToAgentChat(). Use appAction() for app data writes and extensionData for extension-owned persisted UI state; dbQuery() is for read-only inspection of known app SQL tables. Use agentNative.ui.output for passive current values from knobs, sliders, and selections; it writes application state at inline-ui:<extension id>:output, which the agent can read later with readAppState when the user says to use that value. Use agentNative.chat.send for visible submit/apply actions. Persist reusable user-edited state with extensionData: if the extension has checkboxes, todos, notes, filters, preferences, or any control whose value should survive reload/reopen, load that state on init and save changes with extensionData, usually at user scope, instead of keeping it only in Alpine state. IMPORTANT — hosting a pasted file: if the user pasted a large HTML/Alpine file (it appears in your context as an <attachment name="pasted-text-…"> block) and asked you to host it as-is, do NOT copy that file into `content`. Instead leave `content` empty and pass `contentFromAttachment` set to that attachment\'s name (or the literal "latest" for the most recent pasted block) — the server reads the file verbatim. Re-emitting a large pasted file as `content` regularly gets cut off mid-stream and stalls the turn. IMPORTANT — cloning a large extension that lives as a workspace resource (not a chat attachment): leave `content` empty and pass `contentFromWorkspaceFile` set to the resource path (e.g. "intuit-analytics-extension.html"); the server reads the full file. Do NOT try to reconstruct the body with run-code or route create-extension through run-code (mutating actions are not callable there). Prefer appAction(name, params) for app data and actions, including read actions mounted as GET; do not call template /api/* routes from appFetch because the extension bridge only allows framework /_agent-native/* paths. Parse JSON string action results before aggregating; use dbQuery() only for known existing SQL tables and never for writes. Keep the initial create-extension payload compact and working; for complex extensions, create a useful v1 first, then use focused update-extension edits for refinements rather than assembling one enormous initial tool input. For any non-trivial component (more than a couple of state fields, any methods, any string formatting, any branching) put the component in a <script> block via Alpine.data(\'name\', () => ({...})) and reference it with x-data="name" — do NOT cram methods, template literals, or branching logic into an inline x-data="{...}" attribute (HTML parser pitfalls cause ReferenceError failures). Define every variable referenced from x-text/x-show/x-if/x-for on the data object\'s initial state. If the extension\'s value depends on an LLM call, require a real key via \\${keys.OPENAI_API_KEY}/\\${keys.ANTHROPIC_API_KEY} (and tell the user to add it in the Dispatch Vault, or in app Settings → API Keys & Connections for standalone apps, if missing) or route the AI work to the agent chat — never ship a stubbed analysis step that renders a placeholder/boolean as the result.',
         parameters: {
           type: "object",
           properties: {
@@ -506,6 +515,11 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
               description:
                 'Host a pasted/attached file verbatim WITHOUT re-typing it. Set this to the name of an attachment on the current turn (e.g. "pasted-text-1718000000000-ab12cd.txt") or the literal "latest" for the most recent pasted block; the server resolves it into the extension content. Use this instead of `content` whenever the user pasted a large file to host — it avoids re-emitting thousands of tokens. When set, leave `content` empty.',
             },
+            contentFromWorkspaceFile: {
+              type: "string",
+              description:
+                'Host a workspace/shared resource file verbatim WITHOUT re-typing it. Set this to the resource path (e.g. "intuit-analytics-extension.html"); the server reads the full file and uses it as the extension content. Use this — NOT run-code or contentFromAttachment — when cloning a large extension body that already exists as a workspace resource. When set, leave `content` empty.',
+            },
             icon: {
               type: "string",
               description: "Optional icon name or short label.",
@@ -521,7 +535,7 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
       run: async (args, ctx) => {
         const name = String(args?.name ?? "").trim();
         if (!name) return "Error: name is required.";
-        const resolved = resolveExtensionContent(args, ctx);
+        const resolved = await resolveExtensionContentAsync(args, ctx);
         if ("error" in resolved) return resolved.error;
         const content = resolved.content.trim();
         if (!content) return "Error: content is required.";
@@ -553,9 +567,12 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
           } catch {
             // Non-fatal — agent can still mention the path in its reply.
           }
+          const hiddenIds = await getHiddenExtensionIdsForCurrentUser();
           return {
             ok: true,
-            extension: { ...existing, path: existingPath },
+            // Compact summary (contentLength + contentHash, no full body). Echoing
+            // the whole HTML back is pure token waste — the agent just supplied it.
+            extension: await summarizeExtension(existing, hiddenIds, false),
             path: existingPath,
             next: `Extension was already created in this session (recovered from a connection retry). The user is being navigated to it — no further navigation tool calls needed.`,
           };
@@ -585,9 +602,12 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
           // Non-fatal — agent can still mention the path in its reply.
         }
 
+        const hiddenIds = await getHiddenExtensionIdsForCurrentUser();
         return {
           ok: true,
-          extension: { ...extension, path },
+          // Compact summary (contentLength + contentHash, no full body). Echoing
+          // the whole HTML back is pure token waste — the agent just supplied it.
+          extension: await summarizeExtension(extension, hiddenIds, false),
           path,
           next: `Created. The user is being navigated to the new extension automatically — no further navigation tool calls needed.`,
         };
@@ -624,6 +644,11 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
               description:
                 'Optional full replacement sourced from a pasted/attached file on the current turn, by attachment name (or the literal "latest" for the most recent pasted block). Use instead of `content` when replacing the whole body with a large pasted file so you do not have to re-type it. Ignored when `content` is provided.',
             },
+            contentFromWorkspaceFile: {
+              type: "string",
+              description:
+                'Optional full replacement sourced from a workspace/shared resource file, by resource path (e.g. "intuit-analytics-extension.html"). The server reads the full file and uses it as the replacement body. Use instead of `content` when replacing the whole body with a large file that exists as a workspace resource. Ignored when `content` is provided.',
+            },
             patches: {
               type: "string",
               description:
@@ -670,9 +695,10 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
             : undefined;
         if (
           replacementContent === undefined &&
-          args?.contentFromAttachment !== undefined
+          (args?.contentFromAttachment !== undefined ||
+            args?.contentFromWorkspaceFile !== undefined)
         ) {
-          const resolved = resolveExtensionContent(args, ctx);
+          const resolved = await resolveExtensionContentAsync(args, ctx);
           if ("error" in resolved) return resolved.error;
           replacementContent = resolved.content;
         }
@@ -1320,6 +1346,114 @@ function resolveExtensionContent(
   return { content: resolved };
 }
 
+/**
+ * Resolve the workspace-files bridge scope exactly the way run-code's
+ * workspaceRead/workspaceWrite do: org-preferred (org → shared owner) with the
+ * requesting user's email as the solo fallback. Kept in lockstep with
+ * `resolveScope` in `workspace-files/tool.ts`.
+ */
+function workspaceFilesBridgeScope(): WorkspaceFilesScope | null {
+  const orgId = getRequestOrgId();
+  if (orgId) return { scope: "org", scopeId: orgId };
+  const email = getRequestUserEmail();
+  if (email) return { scope: "user", scopeId: email };
+  return null;
+}
+
+/**
+ * Read a workspace/shared/personal resource file's FULL content by path.
+ *
+ * Precedence (single, documented rule so this never silently resolves a
+ * different file than the agent inspected):
+ *   1. The run-code `workspace-files` bridge scope (org → shared owner, else the
+ *      user's email). This is the SAME owner/scope `workspaceRead` /
+ *      `workspaceWrite` use, so a body the agent staged via `workspaceWrite` is
+ *      resolved here verbatim — the two paths cannot diverge.
+ *   2. User-managed Resources (personal override → org/shared → workspace
+ *      default) as a fallback, for pre-built resources that were created in the
+ *      Resources panel rather than staged through the bridge.
+ *
+ * Unlike attachments, resource content is not capped/truncated on the way in, so
+ * this is the correct path for cloning a large extension body that already
+ * exists as a workspace resource (e.g. a per-customer dashboard).
+ */
+async function readWorkspaceFileContent(path: string): Promise<string | null> {
+  const trimmed = path.trim();
+  if (!trimmed) return null;
+  // 1) Bridge parity — resolve exactly the file workspaceRead/workspaceWrite see.
+  const bridgeScope = workspaceFilesBridgeScope();
+  if (bridgeScope) {
+    let bridgeFile: Awaited<ReturnType<typeof readWorkspaceFile>>;
+    try {
+      bridgeFile = await readWorkspaceFile(bridgeScope, trimmed);
+    } catch {
+      // A THROW here is a transient store error or invalid path — NOT a
+      // definitive "not found". Fail closed rather than silently hosting a
+      // possibly-different same-path Resources body than workspaceRead
+      // inspected. A retry re-runs this read cleanly.
+      return null;
+    }
+    // A null result means the file genuinely does not exist in the bridge scope;
+    // fall through to user-managed Resources for pre-built resource-panel files.
+    if (bridgeFile && typeof bridgeFile.content === "string") {
+      return bridgeFile.content;
+    }
+  }
+  // 2) Fallback — user-managed Resources by scope precedence.
+  for (const scope of ["personal", "shared", "workspace"] as const) {
+    try {
+      const content = await readResource(trimmed, { scope });
+      if (typeof content === "string") return content;
+    } catch {
+      // A given scope can throw (e.g. `personal` when no user identity is
+      // resolvable in this context). Don't let one scope abort the lookup —
+      // fall through and try the next one.
+    }
+  }
+  return null;
+}
+
+/**
+ * Resolve the extension HTML body from (in priority order) inline `content`, a
+ * `contentFromWorkspaceFile` resource path, or a `contentFromAttachment` handle.
+ *
+ * The workspace-file path exists because a large extension body frequently lives
+ * as a workspace resource (not a chat attachment). Without it the model has no
+ * viable route — inline is too large to shuttle reliably, contentFromAttachment
+ * only sees chat attachments, and mutating actions cannot run from run-code — so
+ * it loops and the run aborts with no_progress.
+ */
+async function resolveExtensionContentAsync(
+  args: Record<string, string> | undefined,
+  ctx: ActionRunContext | undefined,
+): Promise<{ content: string } | { error: string }> {
+  const inline = args?.content !== undefined ? String(args.content) : undefined;
+  if (inline !== undefined && inline.trim().length > 0) {
+    return { content: inline };
+  }
+
+  const wsRef =
+    args?.contentFromWorkspaceFile !== undefined
+      ? String(args.contentFromWorkspaceFile).trim()
+      : "";
+  if (wsRef) {
+    const content = await readWorkspaceFileContent(wsRef);
+    if (content === null) {
+      return {
+        error: `Error: contentFromWorkspaceFile="${wsRef}" did not match any readable workspace/shared/personal resource file. Check the exact path (e.g. "intuit-analytics-extension.html"), or pass the HTML inline via content.`,
+      };
+    }
+    if (content.trim().length === 0) {
+      return {
+        error: `Error: workspace file "${wsRef}" is empty. Pass non-empty HTML inline via content, or point contentFromWorkspaceFile at a file with content.`,
+      };
+    }
+    return { content };
+  }
+
+  return resolveExtensionContent(args, ctx);
+}
+
 function coerceBoolean(value: unknown): boolean {
   return value === true || value === "true";
 }

package/corpus/core/src/mcp/server.ts

@@ -310,9 +310,18 @@ export async function handleMcpRequest(
   // must fail closed rather than trust a spoofable owner-email header that
   // `fullSurface` would otherwise escalate to the full mutating surface.
   const requestMeta = deriveRequestMeta(event);
+  const hasLocalOwnerHint = Boolean(ownerEmailHeader?.trim());
   const authResult = await verifyAuth(authHeader, ownerEmailHeader, {
+    // A bare localhost URL is still a protected MCP resource. This lets
+    // OAuth-native hosts (Kiro, Claude Code, etc.) receive the standard 401
+    // challenge and open browser approval instead of silently getting the
+    // sparse anonymous dev surface. The stdio proxy remains zero-config for
+    // local installs because it forwards an owner hint; an explicit opt-in is
+    // available for local diagnostics.
     allowDevOpen:
-      isLoopbackRequest(event) && isLoopbackOrigin(requestMeta.origin),
+      isLoopbackRequest(event) &&
+      isLoopbackOrigin(requestMeta.origin) &&
+      (hasLocalOwnerHint || process.env.AGENT_NATIVE_MCP_DEV_OPEN === "1"),
     resourceUrl: getMcpOAuthAudiences(event),
   });
   if (!authResult.authed) {

package/corpus/core/src/server/agent-chat/framework-prompts.ts

@@ -45,9 +45,6 @@ export function buildFrameworkPrompts(
   PROD_FRAMEWORK_PROMPT_COMPACT: string;
   DEV_FRAMEWORK_PROMPT_COMPACT: string;
 } {
-  // Note: FIRST_SESSION_PERSONALIZATION is NOT appended here — it is injected
-  // at per-request prompt-assembly time only for new threads (no prior messages).
-  // This prevents the ~1.5KB block from appearing on every request forever.
   const FRAMEWORK_CORE = buildFrameworkCore(examples, options);
   const FRAMEWORK_CORE_COMPACT = buildFrameworkCoreCompact(examples, options);
   const extensionToolsEnabled = options?.extensionTools !== false;