@agent-native/core 0.101.12 → 0.101.13

package/corpus/README.md

@@ -28,4 +28,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 ## Generated Counts
 
 - core files: 2258
-- template files: 5674
+- template files: 5675

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @agent-native/core
 
+## 0.101.13
+
+### Patch Changes
+
+- e503433: Keep CLI repository downloads asynchronous and challenge bare loopback MCP URLs for OAuth clients.
+- e503433: Keep completed chat work disclosures collapsed and stable when submitting a later message.
+- e503433: Remove the automatic first-session personalization questions from agent chat so new requests are handled directly.
+
 ## 0.101.12
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.101.12",
+  "version": "0.101.13",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/cli/create.ts

@@ -1,4 +1,4 @@
-import { execFileSync } from "child_process";
+import { execFile, execFileSync } from "child_process";
 import fs from "fs";
 import path from "path";
 import { fileURLToPath, pathToFileURL } from "url";
@@ -1363,18 +1363,53 @@ function tarExtractArgs(
   return ["xzf", tarPath, "--strip-components=1", ...excludes, "-C", destDir];
 }
 
-function downloadAndExtract(
+function execFileBuffer(
+  command: string,
+  args: string[],
+  options: { maxBuffer: number },
+): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    execFile(
+      command,
+      args,
+      { ...options, encoding: "buffer" },
+      (error, stdout, stderr) => {
+        if (error) {
+          const detail = stderr?.toString().trim();
+          if (detail) error.message = `${error.message}: ${detail}`;
+          reject(error);
+          return;
+        }
+        resolve(Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout));
+      },
+    );
+  });
+}
+
+async function downloadAndExtract(
   url: string,
   destDir: string,
   options: { skipAgentSymlinks?: boolean } = {},
-): void {
+): Promise<void> {
   fs.mkdirSync(destDir, { recursive: true });
   // --fail-with-body so curl exits non-zero on HTTP 4xx/5xx instead of writing
   // the error body (HTML/JSON) to disk where tar then fails with the opaque
   // "Unrecognized archive format" message.
-  const tarball = execFileSync("curl", ["--fail-with-body", "-sL", url], {
-    maxBuffer: 100 * 1024 * 1024,
-  });
+  // Keep this asynchronous: a synchronous curl blocks the event loop, which
+  // makes the create command's spinner look frozen during the GitHub fetch.
+  const tarball = await execFileBuffer(
+    "curl",
+    [
+      "--fail-with-body",
+      "--connect-timeout",
+      "10",
+      "--max-time",
+      "120",
+      "-sL",
+      url,
+    ],
+    { maxBuffer: 100 * 1024 * 1024 },
+  );
   const tarPath = path.join(destDir, ".download.tar.gz");
   fs.writeFileSync(tarPath, tarball);
   try {
@@ -1407,7 +1442,9 @@ async function downloadGitHubSubdir(
       `.agent-native-tmp-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
     );
     try {
-      downloadAndExtract(tarUrl, tmpDir, { skipAgentSymlinks: repo === REPO });
+      await downloadAndExtract(tarUrl, tmpDir, {
+        skipAgentSymlinks: repo === REPO,
+      });
       const srcDir = path.join(tmpDir, subdir);
       if (!fs.existsSync(srcDir)) {
         throw new Error(
@@ -1435,7 +1472,7 @@ async function downloadGitHubRepo(
 ): Promise<void> {
   validateRepoName(repo);
   const tarUrl = `https://api.github.com/repos/${repo}/tarball/main`;
-  downloadAndExtract(tarUrl, targetDir);
+  await downloadAndExtract(tarUrl, targetDir);
 }
 
 /* ─────────────────────────────────────────────────────────────────────────

package/corpus/core/src/client/assistant-ui-recovery.tsx

@@ -38,6 +38,8 @@ export function isAssistantUiRecoverableRenderError(error: unknown): boolean {
 
 type AssistantUiStaleIndexErrorBoundaryProps = {
   resetKey: string;
+  /** Remount children when the recovery scope changes. */
+  remountOnResetKey?: boolean;
   componentName?: string;
   children: React.ReactNode;
 };
@@ -173,10 +175,13 @@ export class AssistantUiStaleIndexErrorBoundary extends React.Component<
       return null;
     }
 
+    const fragmentKey =
+      this.props.remountOnResetKey === false
+        ? String(this.state.retryToken)
+        : `${this.props.resetKey}:${this.state.retryToken}`;
+
     return (
-      <React.Fragment key={`${this.props.resetKey}:${this.state.retryToken}`}>
-        {this.props.children}
-      </React.Fragment>
+      <React.Fragment key={fragmentKey}>{this.props.children}</React.Fragment>
     );
   }
 }
@@ -191,6 +196,7 @@ export function AssistantMessageListErrorBoundary({
   return (
     <AssistantUiStaleIndexErrorBoundary
       resetKey={resetKey}
+      remountOnResetKey={false}
       componentName="AssistantMessageList"
     >
       {children}

package/corpus/core/src/client/chat/message-components.tsx

@@ -848,6 +848,25 @@ export function shouldShowAssistantMessageFooter({
   return !chatRunning && statusIsTerminal;
 }
 
+export function shouldShowAssistantWorkSummary({
+  isLast,
+  isComplete,
+  hasCollapsibleWork,
+  hasUnresolvedTool,
+}: {
+  isLast: boolean;
+  isComplete: boolean;
+  hasCollapsibleWork: boolean;
+  hasUnresolvedTool: boolean;
+}): boolean {
+  if (!hasCollapsibleWork || hasUnresolvedTool) return false;
+
+  // Keep completed historical work wrapped while a later turn is running.
+  // Removing the wrapper exposes/remounts ReasoningCell and resets its
+  // disclosure state to the default-open value on every new submission.
+  return isComplete || !isLast;
+}
+
 function ReasoningMessagePart() {
   const part = useMessagePartReasoning();
   const partRuntime = useMessagePartRuntime();
@@ -1040,8 +1059,12 @@ export function AssistantMessage() {
           {({ part, children }) => {
             switch (part.type) {
               case "group-work": {
-                const showSummary =
-                  isComplete && !chatRunning && hasCollapsibleWork;
+                const showSummary = shouldShowAssistantWorkSummary({
+                  isLast,
+                  isComplete,
+                  hasCollapsibleWork,
+                  hasUnresolvedTool,
+                });
                 if (!showSummary) return <>{children}</>;
                 return (
                   <WorkedForSummary

package/corpus/core/src/client/chat/tool-call-display.tsx

@@ -1088,20 +1088,17 @@ export function WorkedForSummary({
   children,
 }: {
   durationMs?: number | null;
-  /** When true, start open then animate closed (post-run collapse). */
+  /** When true, close the summary after a run has completed. */
   autoCollapse?: boolean;
   children: React.ReactNode;
 }) {
-  const [open, setOpen] = useState(autoCollapse);
-  const didAutoCollapseRef = useRef(false);
+  // Start closed so a remounted completed message never flashes its work
+  // details open while auto-collapse settles. If the summary was already
+  // open when autoCollapse changes, AnimatedCollapse still animates it shut.
+  const [open, setOpen] = useState(false);
 
   useEffect(() => {
-    if (!autoCollapse || didAutoCollapseRef.current) return;
-    didAutoCollapseRef.current = true;
-    const frame = requestAnimationFrame(() => {
-      setOpen(false);
-    });
-    return () => cancelAnimationFrame(frame);
+    if (autoCollapse) setOpen(false);
   }, [autoCollapse]);
 
   const label =

package/corpus/core/src/mcp/server.ts

@@ -310,9 +310,18 @@ export async function handleMcpRequest(
   // must fail closed rather than trust a spoofable owner-email header that
   // `fullSurface` would otherwise escalate to the full mutating surface.
   const requestMeta = deriveRequestMeta(event);
+  const hasLocalOwnerHint = Boolean(ownerEmailHeader?.trim());
   const authResult = await verifyAuth(authHeader, ownerEmailHeader, {
+    // A bare localhost URL is still a protected MCP resource. This lets
+    // OAuth-native hosts (Kiro, Claude Code, etc.) receive the standard 401
+    // challenge and open browser approval instead of silently getting the
+    // sparse anonymous dev surface. The stdio proxy remains zero-config for
+    // local installs because it forwards an owner hint; an explicit opt-in is
+    // available for local diagnostics.
     allowDevOpen:
-      isLoopbackRequest(event) && isLoopbackOrigin(requestMeta.origin),
+      isLoopbackRequest(event) &&
+      isLoopbackOrigin(requestMeta.origin) &&
+      (hasLocalOwnerHint || process.env.AGENT_NATIVE_MCP_DEV_OPEN === "1"),
     resourceUrl: getMcpOAuthAudiences(event),
   });
   if (!authResult.authed) {

package/corpus/core/src/server/agent-chat/framework-prompts.ts

@@ -45,9 +45,6 @@ export function buildFrameworkPrompts(
   PROD_FRAMEWORK_PROMPT_COMPACT: string;
   DEV_FRAMEWORK_PROMPT_COMPACT: string;
 } {
-  // Note: FIRST_SESSION_PERSONALIZATION is NOT appended here — it is injected
-  // at per-request prompt-assembly time only for new threads (no prior messages).
-  // This prevents the ~1.5KB block from appearing on every request forever.
   const FRAMEWORK_CORE = buildFrameworkCore(examples, options);
   const FRAMEWORK_CORE_COMPACT = buildFrameworkCoreCompact(examples, options);
   const extensionToolsEnabled = options?.extensionTools !== false;

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -86,7 +86,6 @@ import type {
   MentionProvider,
 } from "../agent/types.js";
 import { readAppStateForCurrentTab } from "../application-state/script-helpers.js";
-import { appStateGet } from "../application-state/store.js";
 import {
   createThread,
   forkThread,
@@ -167,10 +166,7 @@ import {
 } from "./framework-request-handler.js";
 import { getOrigin } from "./google-oauth.js";
 import { readBody } from "./h3-helpers.js";
-import {
-  FIRST_SESSION_PERSONALIZATION,
-  getModelFamilyOverlay,
-} from "./prompts/index.js";
+import { getModelFamilyOverlay } from "./prompts/index.js";
 import { mountRealtimeVoiceRoutes } from "./realtime-voice.js";
 import {
   runWithRequestContext,
@@ -283,41 +279,6 @@ export function buildLeanRunPolicyPrompt(
   return codeEditingSurfaceRestriction + prodCodeExecPromptNote;
 }
 
-/**
- * Returns whether `owner` has already finished (or explicitly skipped) the
- * First-Session Personalization flow, via the owner-scoped
- * `application_state` "personalization" flag the agent itself writes
- * (`writeAppState("personalization", { done: true })` — see
- * FIRST_SESSION_PERSONALIZATION in prompts/framework-core.ts).
- *
- * This used to be gated on "does this thread have prior messages", which
- * flips false the instant a second request comes in for the SAME thread —
- * making turn 2's system prompt diverge from turn 1's and invalidating the
- * prompt-cache prefix on every thread's second request. The flow itself
- * spans two turns (turn 1 asks the personalization questions and waits;
- * turn 2 answers them and only then writes the "done" flag), so this flag
- * is still false when BOTH turns' system prompts are assembled — turn 1
- * and turn 2 come out byte-identical. It only flips once the flow
- * completes, and it never flips back, so every later turn (and every
- * later thread the same owner creates) stays consistent from then on. As
- * a bonus, it also fixes a latent waste: the old gate re-included the
- * ~1.5KB block on turn 1 of every new thread a user ever created, even
- * long after they'd completed personalization once.
- */
-export async function hasCompletedFirstSessionPersonalization(
-  owner: string,
-): Promise<boolean> {
-  try {
-    const state = await appStateGet(owner, "personalization");
-    return state?.done === true;
-  } catch {
-    // Fail open to "not done" — same default as a brand-new user (block
-    // shown) rather than silently skipping personalization because of a
-    // transient appstate read error.
-    return false;
-  }
-}
-
 /**
  * In-memory rate-limit tracker for `/generate-title`. Keyed by user email,
  * value is recent invocation timestamps within the rolling window. Stale
@@ -2650,14 +2611,6 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
           )
             ? APP_RENDERED_CHAT_NO_DIRECT_CODE_PROMPT
             : "";
-          // Personalization block: included until this owner has finished (or
-          // skipped) the flow — see hasCompletedFirstSessionPersonalization
-          // for why this is gated on the owner-scoped appstate flag rather
-          // than "is this a new thread" (keeps turn 1 and turn 2 identical).
-          const personalizationBlock =
-            (await hasCompletedFirstSessionPersonalization(owner))
-              ? ""
-              : FIRST_SESSION_PERSONALIZATION;
           // Per-model overlay: nudge GPT/Gemini engines toward our behavioral norms.
           const modelOverlay = resolveModelOverlay();
           // Stable-first ordering: base prompt / schema / extra come before
@@ -2712,13 +2665,10 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             modelOverlay,
             runtimeContext,
             additionalFramework:
-              personalizationBlock +
-              codeEditingSurfaceRestriction +
-              prodCodeExecPromptNote,
+              codeEditingSurfaceRestriction + prodCodeExecPromptNote,
           });
           return setSystemPromptOnContext(
             basePrompt +
-              personalizationBlock +
               resources +
               schemaBlock +
               codeEditingSurfaceRestriction +
@@ -2940,10 +2890,6 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
           systemPrompt: async (event: any) => {
             const { owner, extra } = await prepareRun(event);
             const runtimeContext = runtimeContextForEvent(event);
-            const personalizationBlock =
-              (await hasCompletedFirstSessionPersonalization(owner))
-                ? ""
-                : FIRST_SESSION_PERSONALIZATION;
             const modelOverlay = resolveModelOverlay();
             // Stable-first ordering: runtimeContext (day-granular) is
             // appended LAST so a day rollover invalidates as little of the
@@ -2989,11 +2935,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
               extra,
               modelOverlay,
               runtimeContext,
-              additionalFramework: personalizationBlock,
             });
             return setSystemPromptOnContext(
               devPrompt +
-                personalizationBlock +
                 resources +
                 schemaBlock +
                 extra +

package/corpus/core/src/server/prompts/framework-core-compact.ts

@@ -7,7 +7,6 @@
  *   - Verbose "Extended Capabilities" section (agent uses get-framework-context)
  *   - Detailed "Parallel Tool Calls" prose (replaced with one-liner)
  *   - Detailed "Resources" section (agent uses resources tool)
- *   - "First-Session Personalization" (gated externally — see buildSystemPrompt)
  */
 
 import {

package/corpus/core/src/server/prompts/framework-core.ts

@@ -141,33 +141,3 @@ Each of these has a one-line pointer here and a full doc you can pull on demand
 - **Structured memory** — persist knowledge across sessions with \`save-memory\` / \`delete-memory\`; save proactively when you learn preferences, corrections, or project context. Detailed instructions: call \`get-framework-context\` with key \`memory\`.
 `;
 }
-
-/**
- * Build the First-Session Personalization block.
- * Gated by caller: only include when the session has no prior messages
- * (cheapest reliable signal that personalization hasn't run yet).
- * Recording happens via writeAppState("personalization", { done: true })
- * so the block is omitted from all subsequent requests once the agent
- * completes the flow.
- */
-export const FIRST_SESSION_PERSONALIZATION = `
-### First-Session Personalization
-
-On the user's very first interaction in this app, before answering their actual request, briefly personalize the workspace.
-
-Check the application_state key \`personalization\` via \`readAppState("personalization")\`:
-- If it returns null (or has no \`done: true\`), this is the first session — run the flow below.
-- If \`done: true\` is set, skip the flow and answer normally.
-
-**The flow (keep it to one short message, then wait for their answer before continuing):**
-
-1. Greet briefly in one sentence.
-2. Ask **two** yes/no questions inline, on separate lines:
-   - A theme question: _"Want me to pick a color theme for your workspace? I have a few presets — say a name or just 'yes' for my pick."_ Available presets: \`warm\`, \`ocean\`, \`forest\`, \`rose\`, \`slate\` (call \`change-appearance\` with one of these; or \`default\` to clear). When the user says yes without a name, pick one preset that fits this template's tone.
-   - A template-specific question that the template's AGENTS.md / CLAUDE.md documents (e.g. for calendar: _"Want me to color-code meetings by attendee or by category?"_; for mail: _"Want me to surface emails that look like they need a reply at the top?"_). If the template doesn't suggest a question, ask one generic preference question (e.g. _"Do you prefer a denser layout or roomy spacing?"_).
-3. After they answer (or decline), call \`change-appearance\` if appropriate, do whatever the second answer implies (e.g. set a calendar visual preference), and then write \`application_state.personalization\` = \`{ "done": true }\` via \`writeAppState\` so this flow doesn't run again.
-
-If the user's first message is clearly already on-task (e.g. "what's on my calendar today?"), answer it first — but still surface ONE line at the end like _"By the way, want me to set a theme for your workspace? Try \`change-appearance warm\` or just ask."_ — then mark personalization done so the offer never repeats.
-
-Do NOT block on this flow. If the user ignores it, just proceed; never re-ask the personalization questions in later sessions.
-`;

package/corpus/core/src/server/prompts/index.ts

@@ -3,10 +3,7 @@
  * agent-chat-plugin.ts has a single clean import.
  */
 
-export {
-  buildFrameworkCore,
-  FIRST_SESSION_PERSONALIZATION,
-} from "./framework-core.js";
+export { buildFrameworkCore } from "./framework-core.js";
 export { buildFrameworkCoreCompact } from "./framework-core-compact.js";
 export {
   sharedRule8,

package/corpus/templates/chat/app/components/layout/Sidebar.tsx

@@ -9,10 +9,8 @@ import {
 import { ExtensionsSidebarSection } from "@agent-native/core/client/extensions";
 import { OrgSwitcher } from "@agent-native/core/client/org";
 import {
-  IconActivity,
   IconArchive,
   IconBrain,
-  IconDatabase,
   IconDots,
   IconEdit,
   IconLayoutSidebarLeftCollapse,
@@ -48,18 +46,6 @@ const navItems = [
     href: "/",
     view: "chat",
   },
-  {
-    icon: IconActivity,
-    labelKey: "navigation.observability",
-    href: "/observability",
-    view: "observability",
-  },
-  {
-    icon: IconDatabase,
-    labelKey: "navigation.database",
-    href: "/database",
-    view: "database",
-  },
   {
     icon: IconBrain,
     labelKey: "settings.agentTitle",

package/corpus/templates/chat/changelog/2026-07-15-chat-navigation-focuses-on-chat-and-agent.md

@@ -0,0 +1,6 @@
+---
+type: removed
+date: 2026-07-15
+---
+
+The main navigation is now focused on Chat, Agent, and essential workspace settings.

package/dist/cli/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/cli/create.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAkB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AA8BvE;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AA6BD,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAC7B,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,IAAI,CAAC,CAwEf;AA2OD,iBAAS,oCAAoC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAa1E;AAiBD,iBAAe,qBAAqB,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAiDD;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAoLD;;;;;GAKG;AACH,iBAAe,mBAAmB,CAChC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAmDD;;;;GAIG;AACH,iBAAe,wBAAwB,CACrC,aAAa,EAAE,MAAM,EAAE,EACvB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAkFf;AAED;;;GAGG;AACH,iBAAS,qBAAqB,CAC5B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACpB,IAAI,CA4HN;AAmLD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,GACf;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkB7D;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B,yCAAyC;AACzC,OAAO,EACL,qBAAqB,IAAI,sBAAsB,EAC/C,mBAAmB,IAAI,oBAAoB,EAC3C,wBAAwB,IAAI,yBAAyB,EACrD,qBAAqB,IAAI,sBAAsB,EAC/C,WAAW,IAAI,YAAY,EAC3B,kBAAkB,IAAI,mBAAmB,EACzC,eAAe,IAAI,gBAAgB,EACnC,kBAAkB,IAAI,mBAAmB,EACzC,wBAAwB,IAAI,yBAAyB,EACrD,4BAA4B,IAAI,6BAA6B,EAC7D,2BAA2B,IAAI,4BAA4B,EAC3D,oBAAoB,IAAI,qBAAqB,EAC7C,8BAA8B,IAAI,+BAA+B,EACjE,oCAAoC,IAAI,qCAAqC,EAC7E,uBAAuB,IAAI,wBAAwB,EACnD,cAAc,IAAI,eAAe,GAClC,CAAC;AAcF,iBAAS,cAAc,CACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC5C,MAAM,EAAE,CAQV;AA4ID;;;;;GAKG;AACH,iBAAS,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA+B7C;AAiCD,iBAAS,kBAAkB,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,IAAI,CAsBN;AAyBD,iBAAS,wBAAwB,IAAI,MAAM,CAW1C;AAED,iBAAS,4BAA4B,IAAI,MAAM,CAO9C;AAED,iBAAS,2BAA2B,IAAI,MAAM,CAO7C;AAgDD;;;;;;;;;;;;;GAaG;AACH,iBAAS,8BAA8B,IAAI,MAAM,EAAE,CAQlD;AAED;;qDAEqD;AACrD,iBAAS,oBAAoB,IAAI,MAAM,CAEtC;AAuID,iBAAS,kBAAkB,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,GAAG,WAAW,GAC/B,IAAI,CA8CN;AAkHD,iBAAS,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAI1C;AAyED,iBAAS,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAsCxE"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/cli/create.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAkB,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AA8BvE;;;;;GAKG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AA6BD,MAAM,WAAW,gBAAgB;IAC/B,iFAAiF;IACjF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0DAA0D;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAC7B,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,IAAI,CAAC,CAwEf;AA2OD,iBAAS,oCAAoC,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAa1E;AAiBD,iBAAe,qBAAqB,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAiDD;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,IAAI,CAAC,CA8Cf;AAoLD;;;;;GAKG;AACH,iBAAe,mBAAmB,CAChC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAmDD;;;;GAIG;AACH,iBAAe,wBAAwB,CACrC,aAAa,EAAE,MAAM,EAAE,EACvB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAkFf;AAED;;;GAGG;AACH,iBAAS,qBAAqB,CAC5B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACpB,IAAI,CA4HN;AAmLD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,GACf;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkB7D;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B,yCAAyC;AACzC,OAAO,EACL,qBAAqB,IAAI,sBAAsB,EAC/C,mBAAmB,IAAI,oBAAoB,EAC3C,wBAAwB,IAAI,yBAAyB,EACrD,qBAAqB,IAAI,sBAAsB,EAC/C,WAAW,IAAI,YAAY,EAC3B,kBAAkB,IAAI,mBAAmB,EACzC,eAAe,IAAI,gBAAgB,EACnC,kBAAkB,IAAI,mBAAmB,EACzC,wBAAwB,IAAI,yBAAyB,EACrD,4BAA4B,IAAI,6BAA6B,EAC7D,2BAA2B,IAAI,4BAA4B,EAC3D,oBAAoB,IAAI,qBAAqB,EAC7C,8BAA8B,IAAI,+BAA+B,EACjE,oCAAoC,IAAI,qCAAqC,EAC7E,uBAAuB,IAAI,wBAAwB,EACnD,cAAc,IAAI,eAAe,GAClC,CAAC;AAcF,iBAAS,cAAc,CACrB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC5C,MAAM,EAAE,CAQV;AAiLD;;;;;GAKG;AACH,iBAAS,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA+B7C;AAiCD,iBAAS,kBAAkB,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,IAAI,CAsBN;AAyBD,iBAAS,wBAAwB,IAAI,MAAM,CAW1C;AAED,iBAAS,4BAA4B,IAAI,MAAM,CAO9C;AAED,iBAAS,2BAA2B,IAAI,MAAM,CAO7C;AAgDD;;;;;;;;;;;;;GAaG;AACH,iBAAS,8BAA8B,IAAI,MAAM,EAAE,CAQlD;AAED;;qDAEqD;AACrD,iBAAS,oBAAoB,IAAI,MAAM,CAEtC;AAuID,iBAAS,kBAAkB,CACzB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,YAAY,GAAG,WAAW,GAC/B,IAAI,CA8CN;AAkHD,iBAAS,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAI1C;AAyED,iBAAS,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAsCxE"}

package/dist/cli/create.js

@@ -1,4 +1,4 @@
-import { execFileSync } from "child_process";
+import { execFile, execFileSync } from "child_process";
 import fs from "fs";
 import path from "path";
 import { fileURLToPath, pathToFileURL } from "url";
@@ -1102,14 +1102,36 @@ function tarExtractArgs(tarPath, destDir, options = {}) {
         : [];
     return ["xzf", tarPath, "--strip-components=1", ...excludes, "-C", destDir];
 }
-function downloadAndExtract(url, destDir, options = {}) {
+function execFileBuffer(command, args, options) {
+    return new Promise((resolve, reject) => {
+        execFile(command, args, { ...options, encoding: "buffer" }, (error, stdout, stderr) => {
+            if (error) {
+                const detail = stderr?.toString().trim();
+                if (detail)
+                    error.message = `${error.message}: ${detail}`;
+                reject(error);
+                return;
+            }
+            resolve(Buffer.isBuffer(stdout) ? stdout : Buffer.from(stdout));
+        });
+    });
+}
+async function downloadAndExtract(url, destDir, options = {}) {
     fs.mkdirSync(destDir, { recursive: true });
     // --fail-with-body so curl exits non-zero on HTTP 4xx/5xx instead of writing
     // the error body (HTML/JSON) to disk where tar then fails with the opaque
     // "Unrecognized archive format" message.
-    const tarball = execFileSync("curl", ["--fail-with-body", "-sL", url], {
-        maxBuffer: 100 * 1024 * 1024,
-    });
+    // Keep this asynchronous: a synchronous curl blocks the event loop, which
+    // makes the create command's spinner look frozen during the GitHub fetch.
+    const tarball = await execFileBuffer("curl", [
+        "--fail-with-body",
+        "--connect-timeout",
+        "10",
+        "--max-time",
+        "120",
+        "-sL",
+        url,
+    ], { maxBuffer: 100 * 1024 * 1024 });
     const tarPath = path.join(destDir, ".download.tar.gz");
     fs.writeFileSync(tarPath, tarball);
     try {
@@ -1132,7 +1154,9 @@ async function downloadGitHubSubdir(repo, subdir, targetDir) {
         const tarUrl = `https://api.github.com/repos/${repo}/tarball/${encodeURIComponent(ref)}`;
         const tmpDir = path.join(targetDir, "..", `.agent-native-tmp-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
         try {
-            downloadAndExtract(tarUrl, tmpDir, { skipAgentSymlinks: repo === REPO });
+            await downloadAndExtract(tarUrl, tmpDir, {
+                skipAgentSymlinks: repo === REPO,
+            });
             const srcDir = path.join(tmpDir, subdir);
             if (!fs.existsSync(srcDir)) {
                 throw new Error(`Template directory "${subdir}" not found at ref "${ref}".`);
@@ -1152,7 +1176,7 @@ async function downloadGitHubSubdir(repo, subdir, targetDir) {
 async function downloadGitHubRepo(repo, targetDir) {
     validateRepoName(repo);
     const tarUrl = `https://api.github.com/repos/${repo}/tarball/main`;
-    downloadAndExtract(tarUrl, targetDir);
+    await downloadAndExtract(tarUrl, targetDir);
 }
 /* ─────────────────────────────────────────────────────────────────────────
  * Text / filesystem helpers