@agent-native/core 0.104.0 → 0.106.0

package/corpus/core/src/templates/workspace-core/.agents/skills/external-agents/SKILL.md

@@ -68,6 +68,52 @@ the real app focused on exactly what was produced. It reuses the existing
 `navigate` / `application_state` contract the UI already drains every 2s (see
 **context-awareness**) — we never invent a second navigation mechanism.
 
+## App-facing MCP connectors
+
+Apps can also consume connected remote MCP servers as a server-side API. The
+framework stores each connector's OAuth client registration, discovery metadata,
+access token, and refresh token in the encrypted `oauth_tokens` store, scoped to
+the user or organization. The browser and sandboxed MCP App iframes never
+receive those credentials.
+
+Use the hidden core actions `list-mcp-tools` and `call-mcp-tool` when an app UI
+needs a request-scoped API surface. Server-side app actions can import
+`listVisibleMcpTools` and `callMcpTool` from `@agent-native/core/mcp-client`.
+Both paths require an authenticated request context and enforce user/org server
+visibility plus MCP App visibility metadata. Pass the configured server id and
+the server's original tool name; the framework resolves the internal prefixed
+tool name and injects the connector's bearer token.
+
+```ts
+import { callMcpTool } from "@agent-native/core/mcp-client";
+
+const result = await callMcpTool("org_acme_linear", "list_issues", {
+  project: "<PROJECT_ID>",
+});
+```
+
+Use this for bounded product workflows (for example, syncing issues or
+refreshing analytics). Do not expose a raw token, arbitrary server URL, or
+unbounded proxy from an app action. Keep provider-specific schemas and access
+checks in the app action, and use the connector catalog/OAuth button for setup.
+
+## Provider API connectors
+
+The shared workspace connection catalog is also the setup surface for provider
+APIs. When a provider advertises OAuth, show that connection as the primary
+setup action and retain its API key or token as an explicit fallback. Current
+shared OAuth providers include Figma, GitHub, Google Drive, HubSpot, Jira Cloud, Notion, and Sentry. Slack
+uses its managed messaging-install OAuth flow. Gmail,
+Calendar, and Slides may use template-owned Google OAuth flows with broader
+scopes; do not replace those flows with the narrower Drive connection.
+
+Provider API actions resolve credentials server-side. Pass a granted
+`connectionId` when a request must use a particular OAuth account; never copy
+the access token into a browser, extension, MCP App, prompt, or stored action
+payload. Key-only providers should remain in the normal scoped secrets flow
+until their upstream OAuth app, scopes, refresh behavior, and identity mapping
+have been implemented and configured.
+
 ## How
 
 ### 1. Connect to hosted apps

package/corpus/templates/analytics/app/lib/data-source-status.ts

@@ -68,7 +68,9 @@ export interface SharedConnectionStatus {
 const dataSourceWorkspaceProviderIds: Record<string, string> = {
   github: "github",
   hubspot: "hubspot",
+  jira: "jira",
   notion: "notion",
+  sentry: "sentry",
   slack: "slack",
 };
 

package/corpus/templates/analytics/app/pages/DataSources.tsx

@@ -26,6 +26,7 @@ import {
   IconCopy,
   IconDotsVertical,
   IconBrandGithub,
+  IconPlugConnected,
 } from "@tabler/icons-react";
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
 import { useEffect, useState } from "react";
@@ -427,6 +428,55 @@ function GitHubOAuthView({
   );
 }
 
+function WorkspaceOAuthView({
+  provider,
+  label,
+  connected,
+}: {
+  provider: string;
+  label: string;
+  connected: boolean;
+}) {
+  const t = useT();
+  const connect = () => {
+    const params = new URLSearchParams({
+      appId: "analytics",
+      return: "/data-sources",
+    });
+    window.location.assign(
+      agentNativePath(
+        `/_agent-native/connections/oauth/${provider}/start?${params.toString()}`,
+      ),
+    );
+  };
+
+  return (
+    <div className="space-y-3 rounded-md border border-border/50 bg-muted/20 p-3">
+      <div className="flex items-start justify-between gap-3">
+        <div className="flex items-start gap-3">
+          <div className="flex h-8 w-8 shrink-0 items-center justify-center rounded-md bg-background text-muted-foreground">
+            <IconPlugConnected className="h-4 w-4" />
+          </div>
+          <div className="min-w-0 space-y-1">
+            <p className="text-xs font-medium text-foreground">{label}</p>
+            <p className="text-xs text-muted-foreground">
+              {t("dataSources.sharedIntegration")}
+            </p>
+          </div>
+        </div>
+        <Button
+          size="sm"
+          variant={connected ? "outline" : "default"}
+          onClick={connect}
+          className="shrink-0 text-xs"
+        >
+          {connected ? t("dataSources.reconnect") : t("dataSources.connect")}
+        </Button>
+      </div>
+    </div>
+  );
+}
+
 function SharedConnectionBadge({ status }: { status: SharedConnectionStatus }) {
   const tone =
     status.kind === "ready"
@@ -1101,6 +1151,17 @@ function DataSourceCard({
               />
             </div>
           )}
+          {(["notion", "hubspot", "jira", "sentry"] as const).includes(
+            source.id as "notion" | "hubspot" | "jira" | "sentry",
+          ) && (
+            <div className="mb-4">
+              <WorkspaceOAuthView
+                provider={source.id}
+                label={source.name}
+                connected={readyViaWorkspace}
+              />
+            </div>
+          )}
           {sharedConnectionStatus && (
             <SharedConnectionStatusRow status={sharedConnectionStatus} />
           )}

package/corpus/templates/analytics/server/handlers/jira.ts

@@ -1,3 +1,4 @@
+import { resolveWorkspaceConnectionForApp } from "@agent-native/core/workspace-connections";
 import { defineEventHandler, getQuery, setResponseStatus } from "h3";
 
 import {
@@ -17,6 +18,12 @@ import {
 async function requireJiraCredentials(
   event: Parameters<typeof requireCredential>[0],
 ) {
+  const workspaceConnection = await resolveWorkspaceConnectionForApp({
+    appId: "analytics",
+    provider: "jira",
+    requireConnected: true,
+  });
+  if (workspaceConnection.available) return null;
   return (
     (await requireCredential(event, "JIRA_BASE_URL", "Jira")) ||
     (await requireCredential(event, "JIRA_USER_EMAIL", "Jira")) ||

package/corpus/templates/analytics/server/lib/jira.ts

@@ -1,11 +1,7 @@
 // Jira Cloud REST API client
-// Uses Basic auth (email + API token)
 
-import { resolveCredential } from "./credentials";
-import {
-  requireRequestCredentialContext,
-  scopedCredentialCacheKey,
-} from "./credentials-context";
+import { scopedCredentialCacheKey } from "./credentials-context";
+import { executeProviderApiRequest } from "./provider-api";
 
 const API_V3 = "/rest/api/3";
 const API_AGILE = "/rest/agile/1.0";
@@ -15,29 +11,6 @@ const cache = new Map<string, { data: unknown; ts: number }>();
 const CACHE_TTL_MS = 10 * 60 * 1000;
 const MAX_CACHE = 100;
 
-async function getAuth(): Promise<{
-  baseUrl: string;
-  headers: Record<string, string>;
-}> {
-  const ctx = requireRequestCredentialContext("JIRA_BASE_URL");
-  const baseUrl = await resolveCredential("JIRA_BASE_URL", ctx);
-  const email = await resolveCredential("JIRA_USER_EMAIL", ctx);
-  const token = await resolveCredential("JIRA_API_TOKEN", ctx);
-  if (!baseUrl || !email || !token) {
-    throw new Error(
-      "JIRA_BASE_URL, JIRA_USER_EMAIL, and JIRA_API_TOKEN are not configured",
-    );
-  }
-  const encoded = Buffer.from(`${email}:${token}`).toString("base64");
-  return {
-    baseUrl: baseUrl.replace(/\/$/, ""),
-    headers: {
-      Authorization: `Basic ${encoded}`,
-      Accept: "application/json",
-    },
-  };
-}
-
 async function jiraGet<T>(
   path: string,
   params?: Record<string, string>,
@@ -53,21 +26,20 @@ async function jiraGet<T>(
     return cached.data as T;
   }
 
-  const { baseUrl, headers } = await getAuth();
-  const url = new URL(path, baseUrl);
-  if (params) {
-    for (const [k, v] of Object.entries(params)) {
-      url.searchParams.set(k, v);
-    }
-  }
-
-  const res = await fetch(url.toString(), { headers });
-  if (!res.ok) {
-    const text = await res.text();
-    throw new Error(`Jira API error ${res.status}: ${text}`);
+  const result = (await executeProviderApiRequest({
+    provider: "jira",
+    path,
+    query: params,
+  })) as {
+    response: { ok: boolean; status: number; json?: unknown; text?: string };
+  };
+  if (!result.response.ok) {
+    throw new Error(
+      `Jira API error ${result.response.status}: ${String(result.response.text ?? "")}`,
+    );
   }
 
-  const data = await res.json();
+  const data = result.response.json;
   if (cache.size >= MAX_CACHE) {
     const oldest = cache.keys().next().value;
     if (oldest) cache.delete(oldest);

package/corpus/templates/analytics/server/routes/api/test-connection.post.ts

@@ -1,4 +1,5 @@
 import { readBody } from "@agent-native/core/server";
+import { resolveWorkspaceConnectionForApp } from "@agent-native/core/workspace-connections";
 import { defineEventHandler } from "h3";
 
 import {
@@ -141,6 +142,16 @@ export default defineEventHandler(async (event) => {
         }
 
         case "jira": {
+          const workspaceConnection = await resolveWorkspaceConnectionForApp({
+            appId: "analytics",
+            provider: "jira",
+            requireConnected: true,
+          });
+          if (workspaceConnection.available) {
+            const { getProjects } = await import("../../lib/jira");
+            await getProjects();
+            return { ok: true };
+          }
           const baseUrl = await resolveCredential("JIRA_BASE_URL", ctx);
           const email = await resolveCredential("JIRA_USER_EMAIL", ctx);
           const token = await resolveCredential("JIRA_API_TOKEN", ctx);

package/corpus/templates/clips/app/routes.ts

@@ -1,4 +1,6 @@
 import { type RouteConfig } from "@react-router/dev/routes";
 import { flatRoutes } from "@react-router/fs-routes";
 
-export default flatRoutes() satisfies RouteConfig;
+export default flatRoutes({
+  ignoredRouteFiles: ["**/*.test.{ts,tsx}", "**/*.spec.{ts,tsx}"],
+}) satisfies RouteConfig;

package/corpus/templates/dispatch/app/routes/integrations.tsx

@@ -1,4 +1,5 @@
 import {
+  agentNativePath,
   useActionMutation,
   useActionQuery,
   useT,
@@ -127,6 +128,13 @@ interface WorkspaceConnectionProvider {
   credentialKeys: WorkspaceConnectionCredentialKey[];
   capabilities: string[];
   recommendedTemplateUses: string[];
+  oauth?: {
+    provider: string;
+    authorizationUrl: string;
+    tokenUrl: string;
+    refreshUrl?: string;
+    scopes: string[];
+  };
   readiness?: WorkspaceConnectionProviderReadiness;
 }
 
@@ -718,6 +726,32 @@ function summarizeAppList(
     : t("integrations.noApps");
 }
 
+function startWorkspaceProviderOAuth(provider: WorkspaceConnectionProvider) {
+  const returnPath = `${window.location.pathname}${window.location.search}`;
+  if (provider.id === "slack") {
+    const params = new URLSearchParams({ return: returnPath });
+    window.location.assign(
+      agentNativePath(
+        `/_agent-native/integrations/slack/oauth/install?${params.toString()}`,
+      ),
+    );
+    return;
+  }
+  const params = new URLSearchParams({
+    appId: "dispatch",
+    return: returnPath,
+  });
+  window.location.assign(
+    agentNativePath(
+      `/_agent-native/connections/oauth/${provider.id}/start?${params.toString()}`,
+    ),
+  );
+}
+
+function providerHasOAuth(provider: WorkspaceConnectionProvider): boolean {
+  return Boolean(provider.oauth) || provider.id === "slack";
+}
+
 function ProviderCard({
   provider,
   connections,
@@ -788,10 +822,29 @@ function ProviderCard({
                   count: provider.credentialKeys.length,
                 })}
         </span>
-        <Button type="button" variant="outline" size="sm" onClick={onCreate}>
-          <IconPlus size={14} />
-          {t("integrations.connect")}
-        </Button>
+        <div className="flex items-center gap-2">
+          {providerHasOAuth(provider) ? (
+            <Button
+              type="button"
+              size="sm"
+              onClick={() => startWorkspaceProviderOAuth(provider)}
+            >
+              <IconShieldCheck size={14} />
+              {t("integrations.connect")}
+            </Button>
+          ) : null}
+          <Button
+            type="button"
+            variant={providerHasOAuth(provider) ? "ghost" : "outline"}
+            size="sm"
+            onClick={onCreate}
+          >
+            <IconKey size={14} />
+            {providerHasOAuth(provider)
+              ? t("integrations.connectionFallback")
+              : t("integrations.connect")}
+          </Button>
+        </div>
       </div>
     </article>
   );

package/dist/client/AgentPanel.js

@@ -212,7 +212,7 @@ export function shouldShowAgentPanelChatTabBar(tabs, activeTabId) {
     return mainTabs.length > 1 || hasSubTabs;
 }
 export function shouldShowAgentPanelSidebarChatTabs(tabs) {
-    return tabs.some((tab) => !tab.parentThreadId);
+    return tabs.filter((tab) => !tab.parentThreadId).length > 1;
 }
 export function shouldShowAgentPanelPageNewChatButton(tabs, activeTabId, activeTabMessageCount) {
     if (!activeTabId)