@agent-native/core 0.106.3 → 0.107.1

package/dist/secrets/register-framework-secrets.js

@@ -174,5 +174,30 @@ export function registerFrameworkSecrets() {
             required: false,
         });
     }
+    if (!getRequiredSecret("FIGMA_ACCESS_TOKEN")) {
+        registerRequiredSecret({
+            key: "FIGMA_ACCESS_TOKEN",
+            label: "Figma access token",
+            description: "Optional fallback for reading Figma file and node context when the hosted Figma MCP server is unavailable. Generate a personal access token with current_user:read and file_content:read.",
+            docsUrl: "https://developers.figma.com/docs/rest-api/personal-access-tokens/",
+            scope: "user",
+            kind: "api-key",
+            required: false,
+            validator: async (value) => {
+                const response = await fetch("https://api.figma.com/v1/me", {
+                    headers: {
+                        "X-Figma-Token": value,
+                        "User-Agent": "AgentNative/1.0",
+                    },
+                });
+                return response.ok
+                    ? { ok: true }
+                    : {
+                        ok: false,
+                        error: `Figma rejected the token (HTTP ${response.status}).`,
+                    };
+            },
+        });
+    }
 }
 //# sourceMappingURL=register-framework-secrets.js.map

package/dist/secrets/register-framework-secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"register-framework-secrets.js","sourceRoot":"","sources":["../../src/secrets/register-framework-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE1E,MAAM,UAAU,wBAAwB;IACtC,MAAM,uBAAuB,GAAG;QAC9B;YACE,EAAE,EAAE,OAAO;YACX,gBAAgB,EAAE,OAAO;YACzB,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,wDAAwD;SAClE;QACD;YACE,EAAE,EAAE,cAAc;YAClB,gBAAgB,EAAE,QAAQ;YAC1B,aAAa,EAAE,QAAQ;YACvB,KAAK,EAAE,cAAc;YACrB,OAAO,EACL,oEAAoE;SACvE;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,gBAAgB,EAAE,QAAQ;YAC1B,aAAa,EAAE,QAAQ;YACvB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,6DAA6D;SACvE;QACD;YACE,EAAE,EAAE,SAAS;YACb,gBAAgB,EAAE,SAAS;YAC3B,aAAa,EAAE,SAAS;YACxB,KAAK,EAAE,SAAS;YAChB,OAAO,EACL,oHAAoH;SACvH;QACD;YACE,EAAE,EAAE,MAAM;YACV,gBAAgB,EAAE,MAAM;YACxB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,YAAY;YACnB,OAAO,EACL,uEAAuE;SAC1E;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,gBAAgB,EAAE,QAAQ;YAC1B,aAAa,EAAE,QAAQ;YACvB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,kCAAkC;SAC5C;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,gBAAgB,EAAE,QAAQ;YAC1B,aAAa,EAAE,QAAQ;YACvB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,kDAAkD;SAC5D;KACO,CAAC;IAEX,KAAK,MAAM,QAAQ,IAAI,uBAAuB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QACzC,KAAK,MAAM,UAAU,IAAI;YACvB,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE;YACjD,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,EAAE;SACjD,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,sBAAsB,CAAC;oBACrB,GAAG;oBACH,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE;oBAC9C,WAAW,EAAE,mBAAmB,QAAQ,CAAC,KAAK,6FAA6F;oBAC3I,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,GAAG,MAAM,YAAY,CAAC;QAC5C,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;YACtC,sBAAsB,CAAC;gBACrB,GAAG,EAAE,aAAa;gBAClB,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,UAAU;gBAClC,WAAW,EAAE,aAAa,QAAQ,CAAC,KAAK,wCAAwC;gBAChF,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,KAAK;gBACf,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,eAAe,EAAE,oCAAoC,QAAQ,CAAC,EAAE,QAAQ;aACzE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzC,sBAAsB,CAAC;YACrB,GAAG,EAAE,gBAAgB;YACrB,KAAK,EAAE,gBAAgB;YACvB,WAAW,EACT,mGAAmG;YACrG,OAAO,EAAE,sCAAsC;YAC/C,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACzB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kCAAkC,EAAE;oBAC/D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;iBAC9C,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,EAAE;oBAChB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;oBACd,CAAC,CAAC;wBACE,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,iCAAiC,QAAQ,CAAC,MAAM,IAAI;qBAC5D,CAAC;YACR,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,0EAA0E;IAC1E,MAAM,aAAa,GAKd;QACH;YACE,GAAG,EAAE,sBAAsB;YAC3B,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EACT,mHAAmH;YACrH,OAAO,EAAE,+BAA+B;SACzC;QACD;YACE,GAAG,EAAE,gBAAgB;YACrB,KAAK,EAAE,gBAAgB;YACvB,WAAW,EACT,wIAAwI;YAC1I,OAAO,EAAE,qBAAqB;SAC/B;QACD;YACE,GAAG,EAAE,aAAa;YAClB,KAAK,EAAE,aAAa;YACpB,WAAW,EACT,kIAAkI;YACpI,OAAO,EAAE,iBAAiB;SAC3B;QACD;YACE,GAAG,EAAE,mBAAmB;YACxB,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EACT,8IAA8I;YAChJ,OAAO,EAAE,wBAAwB;SAClC;KACF,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,sBAAsB,CAAC;gBACrB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,sBAAsB,CAAC;YACrB,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,cAAc;YACrB,WAAW,EACT,0FAA0F;YAC5F,OAAO,EACL,kHAAkH;YACpH,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["/**\n * Framework-level secret registrations.\n *\n * Side-effect module — imported by the core-routes plugin at boot so the\n * sidebar settings UI and the `/_agent-native/secrets` list route surface the\n * relevant keys in every template.\n *\n * Each call uses a `getRequiredSecret` guard so a template that has already\n * registered the same key (often with stricter settings like `required: true`)\n * wins — the framework registration is a fallback, not an override.\n *\n * OPENAI_API_KEY is optional framework-wide because it enables the shared\n * realtime speech-to-speech agent mode. Templates can pre-register the same\n * key with stricter requirements; the guard below preserves their definition.\n */\n\nimport { getRequiredSecret, registerRequiredSecret } from \"./register.js\";\n\nexport function registerFrameworkSecrets(): void {\n  const workspaceOAuthProviders = [\n    {\n      id: \"figma\",\n      credentialPrefix: \"FIGMA\",\n      oauthProvider: \"figma\",\n      label: \"Figma\",\n      docsUrl: \"https://developers.figma.com/docs/rest-api/oauth-apps/\",\n    },\n    {\n      id: \"google_drive\",\n      credentialPrefix: \"GOOGLE\",\n      oauthProvider: \"google\",\n      label: \"Google Drive\",\n      docsUrl:\n        \"https://developers.google.com/identity/protocols/oauth2/web-server\",\n    },\n    {\n      id: \"github\",\n      credentialPrefix: \"GITHUB\",\n      oauthProvider: \"github\",\n      label: \"GitHub\",\n      docsUrl: \"https://docs.github.com/apps/oauth-apps/building-oauth-apps\",\n    },\n    {\n      id: \"hubspot\",\n      credentialPrefix: \"HUBSPOT\",\n      oauthProvider: \"hubspot\",\n      label: \"HubSpot\",\n      docsUrl:\n        \"https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/oauth/oauth-quickstart-guide\",\n    },\n    {\n      id: \"jira\",\n      credentialPrefix: \"JIRA\",\n      oauthProvider: \"jira\",\n      label: \"Jira Cloud\",\n      docsUrl:\n        \"https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/\",\n    },\n    {\n      id: \"sentry\",\n      credentialPrefix: \"SENTRY\",\n      oauthProvider: \"sentry\",\n      label: \"Sentry\",\n      docsUrl: \"https://docs.sentry.io/api/auth/\",\n    },\n    {\n      id: \"notion\",\n      credentialPrefix: \"NOTION\",\n      oauthProvider: \"notion\",\n      label: \"Notion\",\n      docsUrl: \"https://developers.notion.com/docs/authorization\",\n    },\n  ] as const;\n\n  for (const provider of workspaceOAuthProviders) {\n    const prefix = provider.credentialPrefix;\n    for (const credential of [\n      { suffix: \"CLIENT_ID\", label: \"OAuth client ID\" },\n      { suffix: \"CLIENT_SECRET\", label: \"OAuth client secret\" },\n    ] as const) {\n      const key = `${prefix}_${credential.suffix}`;\n      if (!getRequiredSecret(key)) {\n        registerRequiredSecret({\n          key,\n          label: `${provider.label} ${credential.label}`,\n          description: `Workspace-owned ${provider.label} OAuth application credential. Tokens granted by users are stored separately and encrypted.`,\n          docsUrl: provider.docsUrl,\n          scope: \"workspace\",\n          kind: \"api-key\",\n          required: false,\n        });\n      }\n    }\n\n    const connectionKey = `${prefix}_CONNECTED`;\n    if (!getRequiredSecret(connectionKey)) {\n      registerRequiredSecret({\n        key: connectionKey,\n        label: `${provider.label} account`,\n        description: `Connect a ${provider.label} account for scoped workspace imports.`,\n        docsUrl: provider.docsUrl,\n        scope: \"user\",\n        kind: \"oauth\",\n        required: false,\n        oauthProvider: provider.oauthProvider,\n        oauthConnectUrl: `/_agent-native/connections/oauth/${provider.id}/start`,\n      });\n    }\n  }\n\n  if (!getRequiredSecret(\"OPENAI_API_KEY\")) {\n    registerRequiredSecret({\n      key: \"OPENAI_API_KEY\",\n      label: \"OpenAI API key\",\n      description:\n        \"Optional fallback for realtime voice when Builder is not connected, and for OpenAI transcription.\",\n      docsUrl: \"https://platform.openai.com/api-keys\",\n      scope: \"user\",\n      kind: \"api-key\",\n      required: false,\n      validator: async (value) => {\n        const response = await fetch(\"https://api.openai.com/v1/models\", {\n          headers: { Authorization: `Bearer ${value}` },\n        });\n        return response.ok\n          ? { ok: true }\n          : {\n              ok: false,\n              error: `OpenAI rejected the key (HTTP ${response.status}).`,\n            };\n      },\n    });\n  }\n\n  // Web-search tool backends — optional; the tool selects the first\n  // configured manual key at call time, then falls back to Builder Connect.\n  const webSearchKeys: Array<{\n    key: string;\n    label: string;\n    description: string;\n    docsUrl: string;\n  }> = [\n    {\n      key: \"BRAVE_SEARCH_API_KEY\",\n      label: \"Brave Search API Key\",\n      description:\n        \"Enables the web-search agent tool via Brave Search. Optional when Builder.io is connected for managed web search.\",\n      docsUrl: \"https://brave.com/search/api/\",\n    },\n    {\n      key: \"TAVILY_API_KEY\",\n      label: \"Tavily API Key\",\n      description:\n        \"Enables the web-search agent tool via Tavily. Used as fallback when BRAVE_SEARCH_API_KEY is not set and before Builder-managed search.\",\n      docsUrl: \"https://tavily.com/\",\n    },\n    {\n      key: \"EXA_API_KEY\",\n      label: \"Exa API Key\",\n      description:\n        \"Enables the web-search agent tool via Exa. Used as fallback when Brave and Tavily are not set and before Builder-managed search.\",\n      docsUrl: \"https://exa.ai/\",\n    },\n    {\n      key: \"FIRECRAWL_API_KEY\",\n      label: \"Firecrawl API Key\",\n      description:\n        \"Enables the web-search agent tool via Firecrawl. Used as fallback when Brave, Tavily, and Exa are not set and before Builder-managed search.\",\n      docsUrl: \"https://firecrawl.dev/\",\n    },\n  ];\n\n  for (const entry of webSearchKeys) {\n    if (!getRequiredSecret(entry.key)) {\n      registerRequiredSecret({\n        key: entry.key,\n        label: entry.label,\n        description: entry.description,\n        docsUrl: entry.docsUrl,\n        scope: \"workspace\",\n        kind: \"api-key\",\n        required: false,\n      });\n    }\n  }\n\n  if (!getRequiredSecret(\"GITHUB_TOKEN\")) {\n    registerRequiredSecret({\n      key: \"GITHUB_TOKEN\",\n      label: \"GitHub token\",\n      description:\n        \"Enables connector-scoped repository file reads and writes for headless/cloud agent runs.\",\n      docsUrl:\n        \"https://docs.github.com/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens\",\n      scope: \"workspace\",\n      kind: \"api-key\",\n      required: false,\n    });\n  }\n}\n"]}
+{"version":3,"file":"register-framework-secrets.js","sourceRoot":"","sources":["../../src/secrets/register-framework-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE1E,MAAM,UAAU,wBAAwB;IACtC,MAAM,uBAAuB,GAAG;QAC9B;YACE,EAAE,EAAE,OAAO;YACX,gBAAgB,EAAE,OAAO;YACzB,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,wDAAwD;SAClE;QACD;YACE,EAAE,EAAE,cAAc;YAClB,gBAAgB,EAAE,QAAQ;YAC1B,aAAa,EAAE,QAAQ;YACvB,KAAK,EAAE,cAAc;YACrB,OAAO,EACL,oEAAoE;SACvE;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,gBAAgB,EAAE,QAAQ;YAC1B,aAAa,EAAE,QAAQ;YACvB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,6DAA6D;SACvE;QACD;YACE,EAAE,EAAE,SAAS;YACb,gBAAgB,EAAE,SAAS;YAC3B,aAAa,EAAE,SAAS;YACxB,KAAK,EAAE,SAAS;YAChB,OAAO,EACL,oHAAoH;SACvH;QACD;YACE,EAAE,EAAE,MAAM;YACV,gBAAgB,EAAE,MAAM;YACxB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,YAAY;YACnB,OAAO,EACL,uEAAuE;SAC1E;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,gBAAgB,EAAE,QAAQ;YAC1B,aAAa,EAAE,QAAQ;YACvB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,kCAAkC;SAC5C;QACD;YACE,EAAE,EAAE,QAAQ;YACZ,gBAAgB,EAAE,QAAQ;YAC1B,aAAa,EAAE,QAAQ;YACvB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,kDAAkD;SAC5D;KACO,CAAC;IAEX,KAAK,MAAM,QAAQ,IAAI,uBAAuB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,gBAAgB,CAAC;QACzC,KAAK,MAAM,UAAU,IAAI;YACvB,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE;YACjD,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,EAAE;SACjD,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YAC7C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,sBAAsB,CAAC;oBACrB,GAAG;oBACH,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE;oBAC9C,WAAW,EAAE,mBAAmB,QAAQ,CAAC,KAAK,6FAA6F;oBAC3I,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,GAAG,MAAM,YAAY,CAAC;QAC5C,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,EAAE,CAAC;YACtC,sBAAsB,CAAC;gBACrB,GAAG,EAAE,aAAa;gBAClB,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,UAAU;gBAClC,WAAW,EAAE,aAAa,QAAQ,CAAC,KAAK,wCAAwC;gBAChF,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,OAAO;gBACb,QAAQ,EAAE,KAAK;gBACf,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,eAAe,EAAE,oCAAoC,QAAQ,CAAC,EAAE,QAAQ;aACzE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACzC,sBAAsB,CAAC;YACrB,GAAG,EAAE,gBAAgB;YACrB,KAAK,EAAE,gBAAgB;YACvB,WAAW,EACT,mGAAmG;YACrG,OAAO,EAAE,sCAAsC;YAC/C,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACzB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,kCAAkC,EAAE;oBAC/D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;iBAC9C,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,EAAE;oBAChB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;oBACd,CAAC,CAAC;wBACE,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,iCAAiC,QAAQ,CAAC,MAAM,IAAI;qBAC5D,CAAC;YACR,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,0EAA0E;IAC1E,MAAM,aAAa,GAKd;QACH;YACE,GAAG,EAAE,sBAAsB;YAC3B,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EACT,mHAAmH;YACrH,OAAO,EAAE,+BAA+B;SACzC;QACD;YACE,GAAG,EAAE,gBAAgB;YACrB,KAAK,EAAE,gBAAgB;YACvB,WAAW,EACT,wIAAwI;YAC1I,OAAO,EAAE,qBAAqB;SAC/B;QACD;YACE,GAAG,EAAE,aAAa;YAClB,KAAK,EAAE,aAAa;YACpB,WAAW,EACT,kIAAkI;YACpI,OAAO,EAAE,iBAAiB;SAC3B;QACD;YACE,GAAG,EAAE,mBAAmB;YACxB,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EACT,8IAA8I;YAChJ,OAAO,EAAE,wBAAwB;SAClC;KACF,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,sBAAsB,CAAC;gBACrB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,sBAAsB,CAAC;YACrB,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,cAAc;YACrB,WAAW,EACT,0FAA0F;YAC5F,OAAO,EACL,kHAAkH;YACpH,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC7C,sBAAsB,CAAC;YACrB,GAAG,EAAE,oBAAoB;YACzB,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EACT,2LAA2L;YAC7L,OAAO,EACL,oEAAoE;YACtE,KAAK,EAAE,MAAM;YACb,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACzB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,6BAA6B,EAAE;oBAC1D,OAAO,EAAE;wBACP,eAAe,EAAE,KAAK;wBACtB,YAAY,EAAE,iBAAiB;qBAChC;iBACF,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC,EAAE;oBAChB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;oBACd,CAAC,CAAC;wBACE,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,kCAAkC,QAAQ,CAAC,MAAM,IAAI;qBAC7D,CAAC;YACR,CAAC;SACF,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["/**\n * Framework-level secret registrations.\n *\n * Side-effect module — imported by the core-routes plugin at boot so the\n * sidebar settings UI and the `/_agent-native/secrets` list route surface the\n * relevant keys in every template.\n *\n * Each call uses a `getRequiredSecret` guard so a template that has already\n * registered the same key (often with stricter settings like `required: true`)\n * wins — the framework registration is a fallback, not an override.\n *\n * OPENAI_API_KEY is optional framework-wide because it enables the shared\n * realtime speech-to-speech agent mode. Templates can pre-register the same\n * key with stricter requirements; the guard below preserves their definition.\n */\n\nimport { getRequiredSecret, registerRequiredSecret } from \"./register.js\";\n\nexport function registerFrameworkSecrets(): void {\n  const workspaceOAuthProviders = [\n    {\n      id: \"figma\",\n      credentialPrefix: \"FIGMA\",\n      oauthProvider: \"figma\",\n      label: \"Figma\",\n      docsUrl: \"https://developers.figma.com/docs/rest-api/oauth-apps/\",\n    },\n    {\n      id: \"google_drive\",\n      credentialPrefix: \"GOOGLE\",\n      oauthProvider: \"google\",\n      label: \"Google Drive\",\n      docsUrl:\n        \"https://developers.google.com/identity/protocols/oauth2/web-server\",\n    },\n    {\n      id: \"github\",\n      credentialPrefix: \"GITHUB\",\n      oauthProvider: \"github\",\n      label: \"GitHub\",\n      docsUrl: \"https://docs.github.com/apps/oauth-apps/building-oauth-apps\",\n    },\n    {\n      id: \"hubspot\",\n      credentialPrefix: \"HUBSPOT\",\n      oauthProvider: \"hubspot\",\n      label: \"HubSpot\",\n      docsUrl:\n        \"https://developers.hubspot.com/docs/apps/developer-platform/build-apps/authentication/oauth/oauth-quickstart-guide\",\n    },\n    {\n      id: \"jira\",\n      credentialPrefix: \"JIRA\",\n      oauthProvider: \"jira\",\n      label: \"Jira Cloud\",\n      docsUrl:\n        \"https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/\",\n    },\n    {\n      id: \"sentry\",\n      credentialPrefix: \"SENTRY\",\n      oauthProvider: \"sentry\",\n      label: \"Sentry\",\n      docsUrl: \"https://docs.sentry.io/api/auth/\",\n    },\n    {\n      id: \"notion\",\n      credentialPrefix: \"NOTION\",\n      oauthProvider: \"notion\",\n      label: \"Notion\",\n      docsUrl: \"https://developers.notion.com/docs/authorization\",\n    },\n  ] as const;\n\n  for (const provider of workspaceOAuthProviders) {\n    const prefix = provider.credentialPrefix;\n    for (const credential of [\n      { suffix: \"CLIENT_ID\", label: \"OAuth client ID\" },\n      { suffix: \"CLIENT_SECRET\", label: \"OAuth client secret\" },\n    ] as const) {\n      const key = `${prefix}_${credential.suffix}`;\n      if (!getRequiredSecret(key)) {\n        registerRequiredSecret({\n          key,\n          label: `${provider.label} ${credential.label}`,\n          description: `Workspace-owned ${provider.label} OAuth application credential. Tokens granted by users are stored separately and encrypted.`,\n          docsUrl: provider.docsUrl,\n          scope: \"workspace\",\n          kind: \"api-key\",\n          required: false,\n        });\n      }\n    }\n\n    const connectionKey = `${prefix}_CONNECTED`;\n    if (!getRequiredSecret(connectionKey)) {\n      registerRequiredSecret({\n        key: connectionKey,\n        label: `${provider.label} account`,\n        description: `Connect a ${provider.label} account for scoped workspace imports.`,\n        docsUrl: provider.docsUrl,\n        scope: \"user\",\n        kind: \"oauth\",\n        required: false,\n        oauthProvider: provider.oauthProvider,\n        oauthConnectUrl: `/_agent-native/connections/oauth/${provider.id}/start`,\n      });\n    }\n  }\n\n  if (!getRequiredSecret(\"OPENAI_API_KEY\")) {\n    registerRequiredSecret({\n      key: \"OPENAI_API_KEY\",\n      label: \"OpenAI API key\",\n      description:\n        \"Optional fallback for realtime voice when Builder is not connected, and for OpenAI transcription.\",\n      docsUrl: \"https://platform.openai.com/api-keys\",\n      scope: \"user\",\n      kind: \"api-key\",\n      required: false,\n      validator: async (value) => {\n        const response = await fetch(\"https://api.openai.com/v1/models\", {\n          headers: { Authorization: `Bearer ${value}` },\n        });\n        return response.ok\n          ? { ok: true }\n          : {\n              ok: false,\n              error: `OpenAI rejected the key (HTTP ${response.status}).`,\n            };\n      },\n    });\n  }\n\n  // Web-search tool backends — optional; the tool selects the first\n  // configured manual key at call time, then falls back to Builder Connect.\n  const webSearchKeys: Array<{\n    key: string;\n    label: string;\n    description: string;\n    docsUrl: string;\n  }> = [\n    {\n      key: \"BRAVE_SEARCH_API_KEY\",\n      label: \"Brave Search API Key\",\n      description:\n        \"Enables the web-search agent tool via Brave Search. Optional when Builder.io is connected for managed web search.\",\n      docsUrl: \"https://brave.com/search/api/\",\n    },\n    {\n      key: \"TAVILY_API_KEY\",\n      label: \"Tavily API Key\",\n      description:\n        \"Enables the web-search agent tool via Tavily. Used as fallback when BRAVE_SEARCH_API_KEY is not set and before Builder-managed search.\",\n      docsUrl: \"https://tavily.com/\",\n    },\n    {\n      key: \"EXA_API_KEY\",\n      label: \"Exa API Key\",\n      description:\n        \"Enables the web-search agent tool via Exa. Used as fallback when Brave and Tavily are not set and before Builder-managed search.\",\n      docsUrl: \"https://exa.ai/\",\n    },\n    {\n      key: \"FIRECRAWL_API_KEY\",\n      label: \"Firecrawl API Key\",\n      description:\n        \"Enables the web-search agent tool via Firecrawl. Used as fallback when Brave, Tavily, and Exa are not set and before Builder-managed search.\",\n      docsUrl: \"https://firecrawl.dev/\",\n    },\n  ];\n\n  for (const entry of webSearchKeys) {\n    if (!getRequiredSecret(entry.key)) {\n      registerRequiredSecret({\n        key: entry.key,\n        label: entry.label,\n        description: entry.description,\n        docsUrl: entry.docsUrl,\n        scope: \"workspace\",\n        kind: \"api-key\",\n        required: false,\n      });\n    }\n  }\n\n  if (!getRequiredSecret(\"GITHUB_TOKEN\")) {\n    registerRequiredSecret({\n      key: \"GITHUB_TOKEN\",\n      label: \"GitHub token\",\n      description:\n        \"Enables connector-scoped repository file reads and writes for headless/cloud agent runs.\",\n      docsUrl:\n        \"https://docs.github.com/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens\",\n      scope: \"workspace\",\n      kind: \"api-key\",\n      required: false,\n    });\n  }\n\n  if (!getRequiredSecret(\"FIGMA_ACCESS_TOKEN\")) {\n    registerRequiredSecret({\n      key: \"FIGMA_ACCESS_TOKEN\",\n      label: \"Figma access token\",\n      description:\n        \"Optional fallback for reading Figma file and node context when the hosted Figma MCP server is unavailable. Generate a personal access token with current_user:read and file_content:read.\",\n      docsUrl:\n        \"https://developers.figma.com/docs/rest-api/personal-access-tokens/\",\n      scope: \"user\",\n      kind: \"api-key\",\n      required: false,\n      validator: async (value) => {\n        const response = await fetch(\"https://api.figma.com/v1/me\", {\n          headers: {\n            \"X-Figma-Token\": value,\n            \"User-Agent\": \"AgentNative/1.0\",\n          },\n        });\n        return response.ok\n          ? { ok: true }\n          : {\n              ok: false,\n              error: `Figma rejected the token (HTTP ${response.status}).`,\n            };\n      },\n    });\n  }\n}\n"]}

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — re-run the validator against the
  * current stored value without changing anything. Useful for the "Test" button.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,12 +95,12 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/server/agent-chat-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-chat-plugin.d.ts","sourceRoot":"","sources":["../../src/server/agent-chat-plugin.ts"],"names":[],"mappings":"AA+IA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,EACL,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,+BAA+B,CAAC;AAkCvC,OAAO,EAAE,yBAAyB,EAAE,CAAC;AACrC,YAAY,EAAE,6BAA6B,EAAE,CAAC;AAuB9C,OAAO,EACL,0BAA0B,EAK1B,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EAE1B,MAAM,oCAAoC,CAAC;AAW5C,OAAO,EACL,gCAAgC,EAOjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EACL,sBAAsB,EAGvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAEL,sCAAsC,EACvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,OAAO,EAAE,gCAAgC,EAAE,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,CAAC;AACpC,YAAY,EAAE,sBAAsB,EAAE,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACtC,OAAO,EAAE,sCAAsC,EAAE,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,OAAO,EAAE,iCAAiC,EAAE,CAAC;AAC7C,OAAO,EAAE,yCAAyC,EAAE,CAAC;AAErD,wBAAgB,wBAAwB,CACtC,6BAA6B,EAAE,MAAM,EACrC,sBAAsB,EAAE,MAAM,GAC7B,MAAM,CAER;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,oBAAoB,EAAE,GAAG,SAAS,EAChD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,eAAe,EAAE,CACf,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9B,uBAAuB,EAAE,CACvB,GAAG,EAAE,oBAAoB,KACtB,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;CAC/B,GACA,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAI1B;AAED,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CAstKhB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC;AAE9E,OAAO,EAEL,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"agent-chat-plugin.d.ts","sourceRoot":"","sources":["../../src/server/agent-chat-plugin.ts"],"names":[],"mappings":"AA+IA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,EACL,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,+BAA+B,CAAC;AAkCvC,OAAO,EAAE,yBAAyB,EAAE,CAAC;AACrC,YAAY,EAAE,6BAA6B,EAAE,CAAC;AAuB9C,OAAO,EACL,0BAA0B,EAK1B,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EAE1B,MAAM,oCAAoC,CAAC;AAW5C,OAAO,EACL,gCAAgC,EAOjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EACL,sBAAsB,EAGvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAEL,sCAAsC,EACvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,OAAO,EAAE,gCAAgC,EAAE,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,CAAC;AACpC,YAAY,EAAE,sBAAsB,EAAE,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACtC,OAAO,EAAE,sCAAsC,EAAE,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,OAAO,EAAE,iCAAiC,EAAE,CAAC;AAC7C,OAAO,EAAE,yCAAyC,EAAE,CAAC;AAErD,wBAAgB,wBAAwB,CACtC,6BAA6B,EAAE,MAAM,EACrC,sBAAsB,EAAE,MAAM,GAC7B,MAAM,CAER;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,oBAAoB,EAAE,GAAG,SAAS,EAChD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,eAAe,EAAE,CACf,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,KACZ,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9B,uBAAuB,EAAE,CACvB,GAAG,EAAE,oBAAoB,KACtB,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;CAC/B,GACA,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAI1B;AAED,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CAkvKhB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC;AAE9E,OAAO,EAEL,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/server/agent-chat-plugin.js

@@ -11,7 +11,7 @@ import { AGENT_CHAT_BACKGROUND_RUN_FIELD, AGENT_CHAT_PROCESS_RUN_PATH, backgroun
 import { resolveEngine, createAnthropicEngine, getStoredModelForEngine, normalizeModelForEngine, getAgentEngineEntry, isAgentEnginePackageInstalled, isStoredEngineUsableForRequest, listAgentEngines, registerBuiltinEngines, } from "../agent/engine/index.js";
 import { createProductionAgentHandler, actionsToEngineTools, executeAgentToolCall, toolCallCacheKey, getActiveRunForThreadAsync, abortRunDurably, subscribeToRun, } from "../agent/production-agent.js";
 import { callerHasRunAccess, callerHasThreadAccess, } from "../agent/run-ownership.js";
-import { readBackgroundRunClaim } from "../agent/run-store.js";
+import { markTurnAborted, readBackgroundRunClaim } from "../agent/run-store.js";
 import { buildCurrentTimeUserContext, buildRuntimeContextPrompt, } from "../agent/runtime-context.js";
 import { buildAssistantMessage, buildUserMessage, extractThreadMeta, foldAssistantTurn, mergeThreadDataForClientSave, upsertUserMessage, } from "../agent/thread-data-builder.js";
 import { attachToolSearch } from "../agent/tool-search.js";
@@ -3293,6 +3293,25 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 const canViewThread = (threadId) => callerHasThreadAccess(owner, threadId, "viewer", { orgId });
                 const canViewRun = (runId) => callerHasRunAccess(owner, runId, "viewer", { orgId });
                 const canEditRun = (runId) => callerHasRunAccess(owner, runId, "editor", { orgId });
+                const canEditThread = (threadId) => callerHasThreadAccess(owner, threadId, "editor", { orgId });
+                // Route: POST /runs/turn/:turnId/abort
+                // Covers the short window where the client has sent a turn but the
+                // server has not yet created its background run id.
+                const turnAbortMatch = url.match(/\/runs\/turn\/([^/?]+)\/abort/) ||
+                    url.match(/^\/turn\/([^/?]+)\/abort/);
+                if (turnAbortMatch && method === "POST") {
+                    const turnId = decodeURIComponent(turnAbortMatch[1]);
+                    const body = await readBody(event).catch(() => null);
+                    const threadId = typeof body?.threadId === "string" ? body.threadId : "";
+                    if (!/^[a-zA-Z0-9_-]{1,160}$/.test(turnId) ||
+                        !threadId ||
+                        !(await canEditThread(threadId))) {
+                        setResponseStatus(event, 404);
+                        return { error: "Run not found" };
+                    }
+                    await markTurnAborted(threadId, turnId);
+                    return { ok: true };
+                }
                 // Route: GET /runs/list?goalId=agent-team|agent-harness
                 // Returns background agents in the Code hub-compatible run shape.
                 const listMatch = url.match(/\/runs\/list(?:[/?]|$)/) ||
@@ -4143,6 +4162,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         }
                         workerBody = {
                             ...parsedPayload,
+                            ...(prepared.body.internalContinuation === true
+                                ? { internalContinuation: true }
+                                : {}),
                             [AGENT_CHAT_BACKGROUND_RUN_FIELD]: preparedMarker,
                         };
                     }