@agent-native/core 0.103.1 → 0.105.0

package/corpus/core/src/search-utils/index.ts

@@ -0,0 +1,112 @@
+import safeRegex from "safe-regex2";
+
+export type SearchMatchMode = "allTerms" | "anyTerm" | "phrase" | "regex";
+
+const STOPWORDS = new Set([
+  "about",
+  "and",
+  "did",
+  "does",
+  "for",
+  "from",
+  "have",
+  "our",
+  "the",
+  "what",
+  "when",
+  "where",
+  "which",
+  "while",
+  "why",
+  "with",
+]);
+
+export function escapeLikeTerm(value: string): string {
+  return value.replace(/[\\%_]/g, (match) => `\\${match}`);
+}
+
+export function normalizeSearchTerms(query: string): string[] {
+  const phrase = query
+    .toLowerCase()
+    .split(/[^\p{L}\p{N}-]+/u)
+    .map((token) => token.trim())
+    .filter(Boolean)
+    .join(" ");
+  if (!phrase) return [];
+  const tokens = phrase
+    .split(/[^\p{L}\p{N}-]+/u)
+    .map((token) => token.trim())
+    .filter((token) => token.length > 2 && !STOPWORDS.has(token));
+  return Array.from(new Set([phrase, ...tokens])).slice(0, 12);
+}
+
+export function matchesSearchMode(
+  value: string,
+  query: string,
+  mode: SearchMatchMode,
+): boolean {
+  const normalizedValue = normalizeText(value).toLowerCase();
+  if (mode === "regex") {
+    if (query.length > 240 || !safeRegex(query)) return false;
+    try {
+      return new RegExp(query, "iu").test(value);
+    } catch {
+      return false;
+    }
+  }
+  const terms = normalizeSearchTerms(query);
+  if (!terms.length) return false;
+  if (mode === "phrase") return normalizedValue.includes(terms[0] ?? "");
+  const tokens = terms.slice(1).length ? terms.slice(1) : terms;
+  return mode === "allTerms"
+    ? tokens.every((term) => normalizedValue.includes(term))
+    : tokens.some((term) => normalizedValue.includes(term));
+}
+
+export function buildSearchSnippet(
+  value: string,
+  terms: string[],
+  maxLength = 260,
+): string {
+  const text = normalizeText(value);
+  if (text.length <= maxLength) return text;
+  const lower = text.toLowerCase();
+  const firstIndex = terms.reduce((best, term) => {
+    const index = lower.indexOf(term.toLowerCase());
+    return index >= 0 && (best < 0 || index < best) ? index : best;
+  }, -1);
+  const start = Math.max(
+    0,
+    (firstIndex < 0 ? 0 : firstIndex) - Math.floor(maxLength / 3),
+  );
+  const end = Math.min(text.length, start + maxLength);
+  return `${start > 0 ? "..." : ""}${text.slice(start, end).trim()}${end < text.length ? "..." : ""}`;
+}
+
+export function scoreSearchText(
+  fields: {
+    title?: string | null;
+    summary?: string | null;
+    body?: string | null;
+    metadata?: string | null;
+  },
+  terms: string[],
+): number {
+  const title = normalizeText(fields.title).toLowerCase();
+  const summary = normalizeText(fields.summary).toLowerCase();
+  const body = normalizeText(fields.body).toLowerCase();
+  const metadata = normalizeText(fields.metadata).toLowerCase();
+  let score = 0;
+  terms.forEach((term, index) => {
+    const phraseBoost = index === 0 ? 2 : 1;
+    if (title.includes(term)) score += 40 * phraseBoost;
+    if (summary.includes(term)) score += 20 * phraseBoost;
+    if (body.includes(term)) score += 8 * phraseBoost;
+    if (metadata.includes(term)) score += 6 * phraseBoost;
+  });
+  return score;
+}
+
+function normalizeText(value: string | null | undefined): string {
+  return (value ?? "").replace(/\s+/g, " ").trim();
+}

package/corpus/core/src/secrets/register-framework-secrets.ts

@@ -17,6 +17,67 @@
 import { getRequiredSecret, registerRequiredSecret } from "./register.js";
 
 export function registerFrameworkSecrets(): void {
+  const workspaceOAuthProviders = [
+    {
+      id: "figma",
+      credentialPrefix: "FIGMA",
+      oauthProvider: "figma",
+      label: "Figma",
+      docsUrl: "https://developers.figma.com/docs/rest-api/oauth-apps/",
+    },
+    {
+      id: "google_drive",
+      credentialPrefix: "GOOGLE",
+      oauthProvider: "google",
+      label: "Google Drive",
+      docsUrl:
+        "https://developers.google.com/identity/protocols/oauth2/web-server",
+    },
+    {
+      id: "notion",
+      credentialPrefix: "NOTION",
+      oauthProvider: "notion",
+      label: "Notion",
+      docsUrl: "https://developers.notion.com/docs/authorization",
+    },
+  ] as const;
+
+  for (const provider of workspaceOAuthProviders) {
+    const prefix = provider.credentialPrefix;
+    for (const credential of [
+      { suffix: "CLIENT_ID", label: "OAuth client ID" },
+      { suffix: "CLIENT_SECRET", label: "OAuth client secret" },
+    ] as const) {
+      const key = `${prefix}_${credential.suffix}`;
+      if (!getRequiredSecret(key)) {
+        registerRequiredSecret({
+          key,
+          label: `${provider.label} ${credential.label}`,
+          description: `Workspace-owned ${provider.label} OAuth application credential. Tokens granted by users are stored separately and encrypted.`,
+          docsUrl: provider.docsUrl,
+          scope: "workspace",
+          kind: "api-key",
+          required: false,
+        });
+      }
+    }
+
+    const connectionKey = `${prefix}_CONNECTED`;
+    if (!getRequiredSecret(connectionKey)) {
+      registerRequiredSecret({
+        key: connectionKey,
+        label: `${provider.label} account`,
+        description: `Connect a ${provider.label} account for scoped workspace imports.`,
+        docsUrl: provider.docsUrl,
+        scope: "user",
+        kind: "oauth",
+        required: false,
+        oauthProvider: provider.oauthProvider,
+        oauthConnectUrl: `/_agent-native/connections/oauth/${provider.id}/start`,
+      });
+    }
+  }
+
   if (!getRequiredSecret("OPENAI_API_KEY")) {
     registerRequiredSecret({
       key: "OPENAI_API_KEY",

package/corpus/core/src/server/action-discovery.ts

@@ -68,7 +68,23 @@ function isRuntimeSourceFile(filename: string): boolean {
  * consumers can override a packaged action by dropping a same-named file
  * in their own `actions/` dir.
  */
-const packageActionRegistry: Record<string, ActionEntry> = {};
+const PACKAGE_ACTION_REGISTRY_KEY = Symbol.for(
+  "@agent-native/core.package-action-registry",
+);
+
+function getPackageActionRegistry(): Record<string, ActionEntry> {
+  const sharedGlobal = globalThis as typeof globalThis & {
+    [key: symbol]: unknown;
+  };
+  const existing = sharedGlobal[PACKAGE_ACTION_REGISTRY_KEY];
+  if (existing && typeof existing === "object") {
+    return existing as Record<string, ActionEntry>;
+  }
+
+  const registry: Record<string, ActionEntry> = {};
+  sharedGlobal[PACKAGE_ACTION_REGISTRY_KEY] = registry;
+  return registry;
+}
 
 /**
  * Register a map of actions contributed by a published package.
@@ -87,15 +103,27 @@ const packageActionRegistry: Record<string, ActionEntry> = {};
 export function registerPackageActions(
   actions: Record<string, ActionEntry>,
 ): void {
+  const packageActionRegistry = getPackageActionRegistry();
   for (const [name, entry] of Object.entries(actions)) {
     if (packageActionRegistry[name]) continue;
     packageActionRegistry[name] = entry;
   }
 }
 
-/** Internal — used by `autoDiscoverActions`. Returns a shallow copy. */
-function getPackageActions(): Record<string, ActionEntry> {
-  return { ...packageActionRegistry };
+/**
+ * Merge package-contributed actions without replacing app-local actions.
+ *
+ * This is intentionally callable even when the app passes an explicit static
+ * action registry. Published packages register through import side effects,
+ * while generated app registries only contain app-local action files.
+ */
+export function mergePackageActions(
+  registry: Record<string, ActionEntry>,
+): void {
+  for (const [name, entry] of Object.entries(getPackageActionRegistry())) {
+    if (registry[name]) continue;
+    registry[name] = entry;
+  }
 }
 
 /**
@@ -518,10 +546,7 @@ export async function autoDiscoverActions(
   //     (e.g. @agent-native/dispatch) via `registerPackageActions()` from
   //     import side effects. Merged with skip-existing so the template's
   //     own actions/ files always win on name collision.
-  for (const [name, entry] of Object.entries(getPackageActions())) {
-    if (registry[name]) continue;
-    registry[name] = entry;
-  }
+  mergePackageActions(registry);
 
   // 2. Workspace-core actions — merged in with skipExisting so they can't
   //    overwrite template entries.

package/corpus/core/src/server/agent-chat/framework-prompts.ts

@@ -74,7 +74,7 @@ Keep \`create-extension\` payloads compact enough to finish quickly. For complex
 
 Generated UI content can use appAction(), appFetch(), dbQuery(), extensionFetch(), extensionData, agentNative.ui.output(value, opts?), and agentNative.chat.send(...)/sendToAgentChat(...). Use appAction() for app data writes, and dbQuery() only for read-only inspection of known app SQL tables. It can receive chat inputs through slotContext/window.onSlotContext. Use agentNative.ui.output for passive current values from knobs, sliders, selections, and controls; it writes application state at \`inline-ui:<extensionId>:output\` scoped to the inline extension id returned by \`render-inline-extension\` or \`show-extension-inline\`. When the user later says "use that value", "apply the current setting", or similar, read it with \`readAppState("inline-ui:<id>:output")\` instead of asking them to send it again. Use agentNative.chat.send for visible submit/apply actions that should put a message into chat. Transient extensionData is browser-local and not agent-readable, synced, promoted, or garbage-collected; use application_state/appFetch, appAction, ui.output, or chat.send for anything the agent or app must observe. Use semantic Tailwind classes like bg-background, text-foreground, bg-primary, border-border, and text-muted-foreground so the UI inherits the parent app theme.
 
-If the user asks to change, edit, fix, style, rename, or add behavior to an existing extension/widget/dashboard/calculator/mini-app, use the current extension id from \`<current-screen>\` or \`<current-url>\` when present. Call \`get-extension\` only if you need to inspect its content, then \`update-extension\` with that id. After one content read, keep the body in working memory and move to focused \`update-extension\` \`edits\`/\`patches\`; do not loop on repeated \`get-extension\` + \`run-code\` string scans before writing. Use \`list-extensions\` only when no current id/name is available. Existing extension edits are SQL data updates, not source-code changes, even when the request says "change the UI" or "fix this". Do **NOT** call \`connect-builder\` for existing extension edits.
+If the user asks to change, edit, fix, style, rename, or add behavior to an existing extension/widget/dashboard/calculator/mini-app, use the current extension id from \`<current-screen>\` or \`<current-url>\` when present. Call \`get-extension\` only if you need to inspect its content, then \`update-extension\` with that id. After one content read, keep the body in working memory and move to focused \`update-extension\` \`edits\`/\`patches\`; do not loop on repeated \`get-extension\` + \`run-code\` string scans before writing. For a data-only repair, preserve the existing layout, CSS, copy, and interactions: never send a reconstructed full \`content\` body. The update action blocks full-body replacement by default; use \`allowFullReplacement=true\` only when the user explicitly requests a broad visual rewrite or supplies a complete replacement body. If a focused patch fails, read the current body and change the target rather than retrying identical arguments. Use \`list-extensions\` only when no current id/name is available. Existing extension edits are SQL data updates, not source-code changes, even when the request says "change the UI" or "fix this". Do **NOT** call \`connect-builder\` for existing extension edits.
 
 In Act mode, when in doubt — if the request asks for a new small interactive utility and does not need reuse, choose \`render-inline-extension\`; if it mentions saving/reuse or asks for an extension/widget/dashboard/calculator/mini-app, choose \`create-extension\`. If it references an existing one or the current extension page, choose \`update-extension\`. Do **not** preface the call with planning text like "let me build the dashboard…" — just call the right extension action directly.
 
@@ -115,7 +115,7 @@ Keep the first \`create-extension\` call compact and working. If the request is
 
 Generated UI can read chat inputs from slotContext/window.onSlotContext, see/update app state through appFetch/appAction, use extensionData, record passive current values through agentNative.ui.output(value, opts?), and send visible results through agentNative.chat.send(...) or sendToAgentChat(...). ui.output writes \`inline-ui:<extensionId>:output\` in application state; when the user asks to use the current slider/selection/value, read \`readAppState("inline-ui:<id>:output")\`. Transient extensionData is browser-local only, so do not rely on it for values the agent or app must observe. Use semantic Tailwind theme classes.
 
-If the user asks to change, edit, fix, style, rename, or add behavior to an existing extension/widget/dashboard/calculator/mini-app, use the current extension id from \`<current-screen>\` or \`<current-url>\` when present. Call \`get-extension\` only if you need to inspect its content, then \`update-extension\` with that id. After one content read, use focused \`update-extension\` \`edits\`/\`patches\`; do not repeatedly re-read and scan the same HTML with \`run-code\` before writing. Use \`list-extensions\` only when no current id/name is available. Existing extension edits are SQL data updates, not source-code changes. Do NOT call \`connect-builder\` for them.
+If the user asks to change, edit, fix, style, rename, or add behavior to an existing extension/widget/dashboard/calculator/mini-app, use the current extension id from \`<current-screen>\` or \`<current-url>\` when present. Call \`get-extension\` only if you need to inspect its content, then \`update-extension\` with that id. After one content read, use focused \`update-extension\` \`edits\`/\`patches\`; do not repeatedly re-read and scan the same HTML with \`run-code\` before writing. For a data-only repair, preserve the existing layout, CSS, copy, and interactions: never send a reconstructed full \`content\` body. The update action blocks full-body replacement by default; use \`allowFullReplacement=true\` only when the user explicitly requests a broad visual rewrite or supplies a complete replacement body. If a focused patch fails, read the current body and change the target rather than retrying identical arguments. Use \`list-extensions\` only when no current id/name is available. Existing extension edits are SQL data updates, not source-code changes. Do NOT call \`connect-builder\` for them.
 
 For existing extensions, use \`get-extension\` or \`update-extension\` directly when \`<current-screen>\` or \`<current-url>\` provides an \`extensionId\`. Use \`list-extensions\` only to browse or resolve an unknown name. Use \`hide-extension\` when the user wants a shared extension removed only from their own view. Do not query the legacy \`tools\` table directly.
 

package/corpus/core/src/server/agent-chat/prompt-resources.ts

@@ -33,6 +33,97 @@ import { parseSkillFrontmatter } from "./skill-frontmatter.js";
 const SHARED_PROMPT_RESOURCE_MAX_CHARS = 30_000;
 export const COMPACT_PROMPT_RESOURCE_MAX_CHARS = 6_000;
 const COMPACT_PROMPT_RESOURCES_TOTAL_MAX_CHARS = 48_000;
+const PROMPT_CONTEXT_PROVIDER_MAX_CHARS = 8_000;
+
+export interface PromptContextProviderContext {
+  owner: string;
+  compact: boolean;
+  selfAppId?: string;
+  orgId: string | null;
+}
+
+export interface PromptContextProviderContribution {
+  content: string;
+  label?: string;
+  provenance?: ContextSystemProvenance;
+  governance?: ContextGovernanceTier;
+  sourceRef?: ContextManifestSourceRef;
+}
+
+export interface PromptContextProvider {
+  id: string;
+  load(
+    context: PromptContextProviderContext,
+  ):
+    | Promise<PromptContextProviderContribution | null | undefined>
+    | PromptContextProviderContribution
+    | null
+    | undefined;
+}
+
+const promptContextProviders = new Map<string, PromptContextProvider>();
+
+/** Register a package-owned, request-scoped system-context contribution. */
+export function registerPromptContextProvider(
+  provider: PromptContextProvider,
+): () => void {
+  const id = provider.id.trim();
+  if (!/^[a-z][a-z0-9-]{1,63}$/.test(id)) {
+    throw new Error(
+      "Prompt context provider ids must be 2-64 lowercase letters, digits, or hyphens",
+    );
+  }
+  const registered = { ...provider, id };
+  promptContextProviders.set(id, registered);
+  return () => {
+    if (promptContextProviders.get(id) === registered) {
+      promptContextProviders.delete(id);
+    }
+  };
+}
+
+function xmlAttributeEscape(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/"/g, "&quot;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+}
+
+async function loadPromptContextProviderBlocks(
+  context: PromptContextProviderContext,
+): Promise<string[]> {
+  const providers = [...promptContextProviders.values()].sort((a, b) =>
+    a.id.localeCompare(b.id),
+  );
+  const settled = await Promise.allSettled(
+    providers.map(async (provider) => ({
+      provider,
+      contribution: await provider.load(context),
+    })),
+  );
+  const blocks: string[] = [];
+  for (const result of settled) {
+    if (result.status !== "fulfilled") continue;
+    const { provider, contribution } = result.value;
+    if (!contribution) continue;
+    const content = contribution.content.trim();
+    if (!content) continue;
+    const boundedContent =
+      content.length <= PROMPT_CONTEXT_PROVIDER_MAX_CHARS
+        ? content
+        : `${content.slice(0, PROMPT_CONTEXT_PROVIDER_MAX_CHARS)}\n[truncated after ${PROMPT_CONTEXT_PROVIDER_MAX_CHARS.toLocaleString()} characters]`;
+    const label = contribution.label?.trim() || provider.id;
+    const provenance = contribution.provenance ?? "runtime-context";
+    const governance = contribution.governance ?? "inherited";
+    const sourceScope = contribution.sourceRef?.scope?.trim() || "provider";
+    const sourcePath = contribution.sourceRef?.path?.trim() || provider.id;
+    blocks.push(
+      `<prompt-context-provider id="${xmlAttributeEscape(provider.id)}" label="${xmlAttributeEscape(label)}" provenance="${provenance}" governance="${governance}" scope="${xmlAttributeEscape(sourceScope)}" path="${xmlAttributeEscape(sourcePath)}">\n${boundedContent.replace(/<\/prompt-context-provider>/gi, "&lt;/prompt-context-provider&gt;")}\n</prompt-context-provider>`,
+    );
+  }
+  return blocks;
+}
 
 export function compactPromptLine(value: string, maxChars: number): string {
   const line = value.replace(/\s+/g, " ").trim();
@@ -144,6 +235,50 @@ export function promptResourceManifestSections(
     });
   }
 
+  const providerPattern =
+    /<prompt-context-provider\b([^>]*)>([\s\S]*?)<\/prompt-context-provider>/g;
+  while ((match = providerPattern.exec(prompt))) {
+    const attrs = match[1] ?? "";
+    const id = xmlAttribute(attrs, "id") ?? "prompt-context-provider";
+    const label = xmlAttribute(attrs, "label") ?? id;
+    const provenanceValue = xmlAttribute(attrs, "provenance");
+    const governanceValue = xmlAttribute(attrs, "governance");
+    const provenance = (
+      [
+        "framework-core",
+        "actions-prompt",
+        "template",
+        "enterprise-workspace-core",
+        "sql-workspace",
+        "legacy-app-default",
+        "organization",
+        "personal",
+        "memory",
+        "db-schema",
+        "tools",
+        "model-overlay",
+        "runtime-context",
+      ] as const
+    ).includes(provenanceValue as ContextSystemProvenance)
+      ? (provenanceValue as ContextSystemProvenance)
+      : "runtime-context";
+    const governance = (["required", "inherited", "user"] as const).includes(
+      governanceValue as ContextGovernanceTier,
+    )
+      ? (governanceValue as ContextGovernanceTier)
+      : "inherited";
+    sections.push({
+      label,
+      provenance,
+      governance,
+      content: match[2] ?? "",
+      sourceRef: {
+        path: xmlAttribute(attrs, "path") ?? id,
+        scope: xmlAttribute(attrs, "scope") ?? "provider",
+      },
+    });
+  }
+
   const taggedSections = [
     {
       tag: "skills-summary",
@@ -831,6 +966,15 @@ export async function loadResourcesForPrompt(
     if (organizationResourceIndex) sections.push(organizationResourceIndex);
   }
 
+  sections.push(
+    ...(await loadPromptContextProviderBlocks({
+      owner,
+      compact,
+      selfAppId,
+      orgId,
+    })),
+  );
+
   try {
     const agents = (await discoverAgents(selfAppId)).slice(0, 30);
     if (agents.length > 0) {

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -497,6 +497,12 @@ export function createAgentChatPlugin(
           // Filesystem discovery unavailable (serverless bundle) — skip.
         }
       }
+      try {
+        const { mergePackageActions } = await import("./action-discovery.js");
+        mergePackageActions(templateScriptsAll);
+      } catch {
+        // Package action registration is optional.
+      }
 
       // Resource, chat, docs, db, and cross-agent scripts are available in both prod and dev modes
       const resourceScripts = await createResourceScriptEntries();

package/corpus/core/src/server/core-routes-plugin.ts

@@ -180,6 +180,7 @@ import {
 } from "./scoped-key-storage.js";
 import { createTranscribeVoiceHandler } from "./transcribe-voice.js";
 import { createVoiceProvidersStatusHandler } from "./voice-providers-status.js";
+import { createWorkspaceProviderOAuthHandler } from "./workspace-provider-oauth.js";
 
 /**
  * The base path prefix for all framework-level routes.
@@ -1203,6 +1204,17 @@ export function createCoreRoutesPlugin(
 
       const P = FRAMEWORK_ROUTE_PREFIX;
 
+      for (const provider of ["figma", "google_drive", "notion"] as const) {
+        getH3App(nitroApp).use(
+          `${P}/connections/oauth/${provider}/start`,
+          createWorkspaceProviderOAuthHandler(provider, "start"),
+        );
+        getH3App(nitroApp).use(
+          `${P}/connections/oauth/${provider}/callback`,
+          createWorkspaceProviderOAuthHandler(provider, "callback"),
+        );
+      }
+
       getH3App(nitroApp).use(createHttpResponseTelemetryMiddleware());
 
       // Security response headers — emitted on every framework response.

package/corpus/core/src/server/index.ts

@@ -311,6 +311,15 @@ export {
   markDefaultPluginProvided,
   type H3AppShim,
 } from "./framework-request-handler.js";
+export {
+  fireInternalDispatch,
+  resolveSelfDispatchBaseUrl,
+  type FireInternalDispatchOptions,
+} from "./self-dispatch.js";
+export {
+  extractBearerToken as extractInternalBearerToken,
+  verifyInternalToken,
+} from "../integrations/internal-token.js";
 export {
   autoDiscoverActions,
   autoDiscoverScripts,
@@ -318,6 +327,12 @@ export {
   mergeCoreSharingActions,
   registerPackageActions,
 } from "./action-discovery.js";
+export {
+  registerPromptContextProvider,
+  type PromptContextProvider,
+  type PromptContextProviderContext,
+  type PromptContextProviderContribution,
+} from "./agent-chat/prompt-resources.js";
 export {
   mountActionRoutes,
   type MountActionRoutesOptions,
@@ -417,6 +432,20 @@ export {
   type OAuthSessionResult,
 } from "./google-oauth.js";
 
+export {
+  buildWorkspaceProviderAuthorizationUrl,
+  createWorkspaceProviderOAuthHandler,
+  exchangeWorkspaceProviderOAuthCode,
+  handleWorkspaceProviderOAuthCallback,
+  handleWorkspaceProviderOAuthStart,
+  isWorkspaceProviderOAuthFlowValid,
+  mergeWorkspaceOAuthValues,
+  resolveWorkspaceProviderIdentity,
+  workspaceProviderOAuthPath,
+  type GenericWorkspaceOAuthProvider,
+  type WorkspaceProviderOAuthFlow,
+} from "./workspace-provider-oauth.js";
+
 export {
   FeatureNotConfiguredError,
   hasBuilderPrivateKey,
@@ -462,6 +491,7 @@ export {
 export {
   getBuilderBranchProjectId,
   isBuilderBranchingEnabled,
+  requestBuilderBrowserConnection,
   resolveBuilderBranchProjectId,
   resolveIsBuilderBranchingEnabled,
   runBuilderAgent,