@agent-native/core 0.108.0 → 0.109.0

package/corpus/core/src/server/agent-chat/action-filters-a2a.ts

@@ -15,6 +15,10 @@ import {
 } from "../../agent/production-agent.js";
 import { runAgentLoopDirectWithSoftTimeout } from "../../agent/run-loop-with-resume.js";
 import type { AgentChatEvent } from "../../agent/types.js";
+import {
+  isAuthenticatedReadAction,
+  isAutoReadExcludedActionName,
+} from "../../mcp/build-server.js";
 import { withConfiguredAppBasePath } from "../app-base-path.js";
 import type { AgentChatPluginOptions } from "./plugin-options.js";
 
@@ -61,6 +65,42 @@ export function filterPublicAgentActions(
   );
 }
 
+/**
+ * Direct A2A action calls share the authenticated external-agent policy with
+ * MCP, but remain stricter: only explicitly exposed, authenticated read-only
+ * actions can skip the receiver's model loop.
+ */
+export function filterDirectA2AActions(
+  actions: Record<string, ActionEntry>,
+  options: Pick<AgentChatPluginOptions, "connectorCatalog" | "externalAgents">,
+): Record<string, ActionEntry> {
+  const catalog = new Set(options.connectorCatalog ?? []);
+  const denied = new Set(options.externalAgents?.denyActions ?? []);
+  const autoReads = options.externalAgents?.authenticatedReads === "auto";
+
+  return Object.fromEntries(
+    Object.entries(actions).filter(([name, entry]) => {
+      const exposure = entry.publicAgent;
+      const selected =
+        catalog.has(name) ||
+        (autoReads &&
+          isAuthenticatedReadAction(entry) &&
+          !isAutoReadExcludedActionName(name));
+      return (
+        selected &&
+        !denied.has(name) &&
+        entry.agentTool !== false &&
+        entry.readOnly === true &&
+        exposure?.expose === true &&
+        exposure.readOnly === true &&
+        exposure.requiresAuth === true &&
+        (entry.needsApproval === undefined || entry.needsApproval === false) &&
+        exposure.isConsequential !== true
+      );
+    }),
+  );
+}
+
 export function buildPublicAgentA2ASkills(
   actions: Record<string, ActionEntry>,
 ): Array<{

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -210,6 +210,7 @@ import {
   createA2AEngineToolSurface,
   filterAgentTools,
   filterPublicAgentActions,
+  filterDirectA2AActions,
   filterReadOnlyActions,
   resolveInitialToolNames,
   runA2AAgentLoop,
@@ -1216,6 +1217,36 @@ export function createAgentChatPlugin(
         publicSkillsOnly: true,
         streaming: true,
         durableBackgroundRuns: options?.durableBackgroundRuns,
+        executeReadOnlyAction: async ({ action, input }) => {
+          const actions = filterDirectA2AActions(
+            mcpFullActions ?? allScripts,
+            options ?? {},
+          );
+          const entry = actions[action];
+          if (!entry) {
+            return {
+              status: "failed" as const,
+              output: "Unknown or unavailable read-only action",
+            };
+          }
+
+          const result = await executeAgentToolCall({
+            actions: { [action]: entry },
+            name: action,
+            input,
+            callId: `a2a-action-${crypto.randomUUID()}`,
+            ownerEmail: getRequestUserEmail(),
+            orgId: getRequestOrgId() ?? null,
+            caller: "a2a",
+          });
+          if (result.status === "approval_required") {
+            return {
+              status: "failed" as const,
+              output: "Read-only action unexpectedly requires approval",
+            };
+          }
+          return { status: result.status, output: result.output };
+        },
         executeApproval: async (approval) => {
           const result = await executeAgentToolCall({
             actions: mcpFullActions ?? allScripts,

package/corpus/core/src/styles/agent-conversation.css

@@ -502,6 +502,13 @@
     opacity 150ms ease-out;
 }
 
+@starting-style {
+  .agent-chat-collapse[data-state="open"] {
+    grid-template-rows: 0fr;
+    opacity: 0;
+  }
+}
+
 .agent-chat-collapse[data-state="closed"] {
   grid-template-rows: 0fr;
   opacity: 0;

package/corpus/core/src/templates/default/app/i18n/ar-SA.ts

@@ -80,12 +80,32 @@ const messages = {
         'Apps in the "{{workspace}}" workspace. Each app gets its own route under this workspace and shares its database, auth, and agent chat.',
       appsInWorkspace: "Apps in {{workspace}}",
       workspaceApps: "تطبيقات مساحة العمل",
+      otherApps: "تطبيقات أخرى",
+      otherAppsDescription: "افتح التطبيقات الأخرى المتاحة لك.",
+      availableCount: "{{count}} متاح",
       activeCount: "{{count}} active",
       hiddenCount: "{{count}} hidden",
       createApp: "إنشاء التطبيق",
       templates: "القوالب",
       checkingTemplates: "التحقق من القوالب المتاحة",
       templatesAvailable: "{{count}} available to scaffold",
+      curatedTemplates: "قوالب منسقة",
+      curatedTemplatesDescription:
+        "ابدأ من شكل تطبيق تمت مراجعته، ثم اجعله خاصًا بك.",
+      remix: "إعادة المزج",
+      remixTemplate: "إعادة مزج {{name}}",
+      remixAppIdLabel: "معرّف التطبيق الجديد",
+      remixStarted: "بدأت إعادة مزج {{name}}",
+      viewLiveApp: "عرض التطبيق المباشر",
+      alreadyInWorkspace: "موجود بالفعل في مساحة العمل",
+      remixAppIdDescription:
+        "اختر معرّفًا آمنًا لعنوان URL لتطبيق مساحة العمل الجديد.",
+      integrationSetup: "إعداد التكامل",
+      source: "المصدر",
+      remixing: "جارٍ إعادة المزج…",
+      remixSuccess: "بدأت إعادة مزج القالب.",
+      remixError: "تعذرت إعادة مزج هذا القالب",
+      appIdRequired: "معرّف التطبيق مطلوب.",
       hide: "إخفاء",
       show: "Show",
       hiddenApps: "التطبيقات المخفية",

package/corpus/core/src/templates/default/app/i18n/de-DE.ts

@@ -79,12 +79,32 @@ const messages = {
         'Apps in the "{{workspace}}" workspace. Each app gets its own route under this workspace and shares its database, auth, and agent chat.',
       appsInWorkspace: "Apps in {{workspace}}",
       workspaceApps: "Workspace-Apps",
+      otherApps: "Andere Apps",
+      otherAppsDescription: "Andere für dich verfügbare Apps öffnen.",
+      availableCount: "{{count}} verfügbar",
       activeCount: "{{count}} active",
       hiddenCount: "{{count}} hidden",
       createApp: "App erstellen",
       templates: "Vorlagen",
       checkingTemplates: "Überprüfen verfügbarer Vorlagen",
       templatesAvailable: "{{count}} available to scaffold",
+      curatedTemplates: "Kuratierte Vorlagen",
+      curatedTemplatesDescription:
+        "Starte mit einer geprüften App-Struktur und passe sie an.",
+      remix: "Remix",
+      remixTemplate: "{{name}} remixen",
+      remixAppIdLabel: "Neue App-ID",
+      remixStarted: "Remix für {{name}} gestartet",
+      viewLiveApp: "Live-App öffnen",
+      alreadyInWorkspace: "Bereits im Workspace",
+      remixAppIdDescription:
+        "Wähle eine URL-sichere ID für die neue Workspace-App.",
+      integrationSetup: "Integration einrichten",
+      source: "Quelle",
+      remixing: "Remix wird erstellt…",
+      remixSuccess: "Template-Remix gestartet.",
+      remixError: "Dieses Template konnte nicht geremixt werden",
+      appIdRequired: "App-ID ist erforderlich.",
       hide: "Ausblenden",
       show: "Show",
       hiddenApps: "Versteckte Apps",

package/corpus/core/src/templates/default/app/i18n/en-US.ts

@@ -77,12 +77,32 @@ const messages = {
         'Apps in the "{{workspace}}" workspace. Each app gets its own route under this workspace and shares its database, auth, and agent chat.',
       appsInWorkspace: "Apps in {{workspace}}",
       workspaceApps: "Workspace apps",
+      otherApps: "Other apps",
+      otherAppsDescription: "Open other apps available to you.",
+      availableCount: "{{count}} available",
       activeCount: "{{count}} active",
       hiddenCount: "{{count}} hidden",
       createApp: "Create app",
       templates: "Templates",
       checkingTemplates: "Checking available templates",
       templatesAvailable: "{{count}} available to scaffold",
+      curatedTemplates: "Curated templates",
+      curatedTemplatesDescription:
+        "Start from a reviewed app shape, then make it your own.",
+      remix: "Remix",
+      remixTemplate: "Remix {{name}}",
+      remixAppIdLabel: "New app id",
+      remixStarted: "Started {{name}} remix",
+      viewLiveApp: "View live app",
+      alreadyInWorkspace: "Already in workspace",
+      remixAppIdDescription:
+        "Choose the URL-safe id for the new workspace app.",
+      integrationSetup: "Integration setup",
+      source: "Source",
+      remixing: "Remixing…",
+      remixSuccess: "Template remix started.",
+      remixError: "Could not remix this template",
+      appIdRequired: "App ID is required.",
       hide: "Hide",
       show: "Show",
       hiddenApps: "Hidden apps",

package/corpus/core/src/templates/default/app/i18n/es-ES.ts

@@ -79,12 +79,32 @@ const messages = {
         'Apps in the "{{workspace}}" workspace. Each app gets its own route under this workspace and shares its database, auth, and agent chat.',
       appsInWorkspace: "Apps in {{workspace}}",
       workspaceApps: "Aplicaciones de espacio de trabajo",
+      otherApps: "Otras aplicaciones",
+      otherAppsDescription: "Abre otras aplicaciones disponibles para ti.",
+      availableCount: "{{count}} disponibles",
       activeCount: "{{count}} active",
       hiddenCount: "{{count}} hidden",
       createApp: "Crear aplicación",
       templates: "Plantillas",
       checkingTemplates: "Comprobando plantillas disponibles",
       templatesAvailable: "{{count}} available to scaffold",
+      curatedTemplates: "Plantillas seleccionadas",
+      curatedTemplatesDescription:
+        "Empieza con una estructura de aplicación revisada y hazla tuya.",
+      remix: "Reutilizar",
+      remixTemplate: "Reutilizar {{name}}",
+      remixAppIdLabel: "Nuevo ID de aplicación",
+      remixStarted: "Se inició la reutilización de {{name}}",
+      viewLiveApp: "Ver aplicación en vivo",
+      alreadyInWorkspace: "Ya está en el espacio de trabajo",
+      remixAppIdDescription:
+        "Elige un ID seguro para URL para la nueva aplicación.",
+      integrationSetup: "Configuración de integración",
+      source: "Origen",
+      remixing: "Reutilizando…",
+      remixSuccess: "Se inició la reutilización de la plantilla.",
+      remixError: "No se pudo reutilizar esta plantilla",
+      appIdRequired: "El ID de aplicación es obligatorio.",
       hide: "Ocultar",
       show: "Show",
       hiddenApps: "Aplicaciones ocultas",

package/corpus/core/src/templates/default/app/i18n/fr-FR.ts

@@ -80,12 +80,33 @@ const messages = {
         'Apps in the "{{workspace}}" workspace. Each app gets its own route under this workspace and shares its database, auth, and agent chat.',
       appsInWorkspace: "Apps in {{workspace}}",
       workspaceApps: "Applications d'espace de travail",
+      otherApps: "Autres applications",
+      otherAppsDescription:
+        "Ouvrez les autres applications qui vous sont accessibles.",
+      availableCount: "{{count}} disponibles",
       activeCount: "{{count}} active",
       hiddenCount: "{{count}} hidden",
       createApp: "Créer une application",
       templates: "Modèles",
       checkingTemplates: "Vérification des modèles disponibles",
       templatesAvailable: "{{count}} available to scaffold",
+      curatedTemplates: "Modèles sélectionnés",
+      curatedTemplatesDescription:
+        "Partez d’une structure d’application vérifiée et personnalisez-la.",
+      remix: "Remixer",
+      remixTemplate: "Remixer {{name}}",
+      remixAppIdLabel: "Nouvel identifiant d’application",
+      remixStarted: "Remix de {{name}} lancé",
+      viewLiveApp: "Voir l’application en direct",
+      alreadyInWorkspace: "Déjà dans l’espace de travail",
+      remixAppIdDescription:
+        "Choisissez un identifiant compatible avec l’URL pour la nouvelle application.",
+      integrationSetup: "Configuration de l’intégration",
+      source: "Source",
+      remixing: "Remix en cours…",
+      remixSuccess: "Le remix du modèle a démarré.",
+      remixError: "Impossible de remixer ce modèle",
+      appIdRequired: "L’identifiant de l’application est requis.",
       hide: "Masquer",
       show: "Show",
       hiddenApps: "Applications cachées",

package/corpus/core/src/templates/default/app/i18n/hi-IN.ts

@@ -75,12 +75,31 @@ const messages = {
         'Apps in the "{{workspace}}" workspace. Each app gets its own route under this workspace and shares its database, auth, and agent chat.',
       appsInWorkspace: "Apps in {{workspace}}",
       workspaceApps: "कार्यक्षेत्र ऐप्स",
+      otherApps: "अन्य ऐप्स",
+      otherAppsDescription: "आपके लिए उपलब्ध अन्य ऐप्स खोलें।",
+      availableCount: "{{count}} उपलब्ध",
       activeCount: "{{count}} active",
       hiddenCount: "{{count}} hidden",
       createApp: "ऐप बनाएं",
       templates: "टेम्पलेट",
       checkingTemplates: "उपलब्ध टेम्प्लेट की जाँच करना",
       templatesAvailable: "{{count}} available to scaffold",
+      curatedTemplates: "चयनित टेम्पलेट",
+      curatedTemplatesDescription:
+        "समीक्षित ऐप संरचना से शुरू करें और इसे अपने अनुसार बनाएं।",
+      remix: "रीमिक्स",
+      remixTemplate: "{{name}} रीमिक्स करें",
+      remixAppIdLabel: "नया ऐप आईडी",
+      remixStarted: "{{name}} रीमिक्स शुरू हुआ",
+      viewLiveApp: "लाइव ऐप देखें",
+      alreadyInWorkspace: "वर्कस्पेस में पहले से मौजूद",
+      remixAppIdDescription: "नए वर्कस्पेस ऐप के लिए URL-सुरक्षित आईडी चुनें।",
+      integrationSetup: "इंटीग्रेशन सेटअप",
+      source: "स्रोत",
+      remixing: "रीमिक्स हो रहा है…",
+      remixSuccess: "टेम्पलेट रीमिक्स शुरू हुआ।",
+      remixError: "यह टेम्पलेट रीमिक्स नहीं हो सका",
+      appIdRequired: "ऐप आईडी आवश्यक है।",
       hide: "छिपाएं",
       show: "Show",
       hiddenApps: "छुपे हुए ऐप्स",

package/corpus/core/src/templates/default/app/i18n/ja-JP.ts

@@ -77,12 +77,32 @@ const messages = {
         'Apps in the "{{workspace}}" workspace. Each app gets its own route under this workspace and shares its database, auth, and agent chat.',
       appsInWorkspace: "Apps in {{workspace}}",
       workspaceApps: "ワークスペースアプリ",
+      otherApps: "その他のアプリ",
+      otherAppsDescription: "利用できるその他のアプリを開きます。",
+      availableCount: "{{count}}件利用可能",
       activeCount: "{{count}} active",
       hiddenCount: "{{count}} hidden",
       createApp: "アプリの作成",
       templates: "テンプレート",
       checkingTemplates: "利用可能なテンプレートを確認する",
       templatesAvailable: "{{count}} available to scaffold",
+      curatedTemplates: "厳選テンプレート",
+      curatedTemplatesDescription:
+        "レビュー済みのアプリ構成をベースに、自分用にカスタマイズできます。",
+      remix: "リミックス",
+      remixTemplate: "{{name}} をリミックス",
+      remixAppIdLabel: "新しいアプリ ID",
+      remixStarted: "{{name}} のリミックスを開始しました",
+      viewLiveApp: "ライブアプリを見る",
+      alreadyInWorkspace: "ワークスペースに追加済み",
+      remixAppIdDescription:
+        "新しいワークスペースアプリの URL セーフな ID を選択してください。",
+      integrationSetup: "連携の設定",
+      source: "提供元",
+      remixing: "リミックス中…",
+      remixSuccess: "テンプレートのリミックスを開始しました。",
+      remixError: "このテンプレートをリミックスできませんでした",
+      appIdRequired: "アプリ ID は必須です。",
       hide: "非表示",
       show: "Show",
       hiddenApps: "隠しアプリ",

package/corpus/core/src/templates/default/app/i18n/ko-KR.ts

@@ -76,12 +76,31 @@ const messages = {
         'Apps in the "{{workspace}}" workspace. Each app gets its own route under this workspace and shares its database, auth, and agent chat.',
       appsInWorkspace: "Apps in {{workspace}}",
       workspaceApps: "작업 공간 앱",
+      otherApps: "기타 앱",
+      otherAppsDescription: "사용할 수 있는 다른 앱을 엽니다.",
+      availableCount: "{{count}}개 사용 가능",
       activeCount: "{{count}} active",
       hiddenCount: "{{count}} hidden",
       createApp: "앱 만들기",
       templates: "템플릿",
       checkingTemplates: "사용 가능한 템플릿 확인 중",
       templatesAvailable: "{{count}} available to scaffold",
+      curatedTemplates: "엄선된 템플릿",
+      curatedTemplatesDescription:
+        "검토된 앱 구조에서 시작해 나만의 앱으로 만들어 보세요.",
+      remix: "리믹스",
+      remixTemplate: "{{name}} 리믹스",
+      remixAppIdLabel: "새 앱 ID",
+      remixStarted: "{{name}} 리믹스를 시작했습니다",
+      viewLiveApp: "라이브 앱 보기",
+      alreadyInWorkspace: "워크스페이스에 이미 있음",
+      remixAppIdDescription: "새 워크스페이스 앱의 URL 안전 ID를 선택하세요.",
+      integrationSetup: "연동 설정",
+      source: "소스",
+      remixing: "리믹스 중…",
+      remixSuccess: "템플릿 리믹스를 시작했습니다.",
+      remixError: "이 템플릿을 리믹스할 수 없습니다",
+      appIdRequired: "앱 ID가 필요합니다.",
       hide: "숨기기",
       show: "Show",
       hiddenApps: "숨겨진 앱",

package/corpus/core/src/templates/default/app/i18n/pt-BR.ts

@@ -80,12 +80,32 @@ const messages = {
         'Apps in the "{{workspace}}" workspace. Each app gets its own route under this workspace and shares its database, auth, and agent chat.',
       appsInWorkspace: "Apps in {{workspace}}",
       workspaceApps: "Aplicativos de espaço de trabalho",
+      otherApps: "Outros aplicativos",
+      otherAppsDescription: "Abra outros aplicativos disponíveis para você.",
+      availableCount: "{{count}} disponíveis",
       activeCount: "{{count}} active",
       hiddenCount: "{{count}} hidden",
       createApp: "Criar aplicativo",
       templates: "Modelos",
       checkingTemplates: "Verificando modelos disponíveis",
       templatesAvailable: "{{count}} available to scaffold",
+      curatedTemplates: "Modelos selecionados",
+      curatedTemplatesDescription:
+        "Comece com uma estrutura de app revisada e personalize-a.",
+      remix: "Remixar",
+      remixTemplate: "Remixar {{name}}",
+      remixAppIdLabel: "Novo ID do app",
+      remixStarted: "Remix de {{name}} iniciado",
+      viewLiveApp: "Ver app ao vivo",
+      alreadyInWorkspace: "Já está no workspace",
+      remixAppIdDescription:
+        "Escolha um ID seguro para URL para o novo app do workspace.",
+      integrationSetup: "Configuração da integração",
+      source: "Origem",
+      remixing: "Remixando…",
+      remixSuccess: "Remix do modelo iniciado.",
+      remixError: "Não foi possível remixar este modelo",
+      appIdRequired: "O ID do app é obrigatório.",
       hide: "Ocultar",
       show: "Show",
       hiddenApps: "Aplicativos ocultos",

package/corpus/core/src/templates/default/app/i18n/zh-CN.ts

@@ -73,12 +73,31 @@ const messages = {
         'Apps in the "{{workspace}}" workspace. Each app gets its own route under this workspace and shares its database, auth, and agent chat.',
       appsInWorkspace: "Apps in {{workspace}}",
       workspaceApps: "工作区应用程序",
+      otherApps: "其他应用",
+      otherAppsDescription: "打开你可以使用的其他应用。",
+      availableCount: "可用 {{count}} 个",
       activeCount: "{{count}} active",
       hiddenCount: "{{count}} hidden",
       createApp: "创建应用程序",
       templates: "模板",
       checkingTemplates: "检查可用模板",
       templatesAvailable: "{{count}} available to scaffold",
+      curatedTemplates: "精选模板",
+      curatedTemplatesDescription:
+        "从经过审核的应用结构开始，然后打造属于你的应用。",
+      remix: "再创作",
+      remixTemplate: "再创作 {{name}}",
+      remixAppIdLabel: "新应用 ID",
+      remixStarted: "已开始再创作 {{name}}",
+      viewLiveApp: "查看在线应用",
+      alreadyInWorkspace: "已在工作区中",
+      remixAppIdDescription: "为新的工作区应用选择一个 URL 安全的 ID。",
+      integrationSetup: "集成设置",
+      source: "来源",
+      remixing: "正在再创作…",
+      remixSuccess: "已开始再创作模板。",
+      remixError: "无法再创作此模板",
+      appIdRequired: "应用 ID 是必填项。",
       hide: "隐藏",
       show: "Show",
       hiddenApps: "隐藏的应用程序",

package/corpus/core/src/templates/default/app/i18n/zh-TW.ts

@@ -73,12 +73,31 @@ const messages = {
         "「{{workspace}}」工作區中的應用程式。每個應用程式都會在此工作區下取得自己的路由，並共用資料庫、驗證與代理聊天。",
       appsInWorkspace: "{{workspace}} 中的應用程式",
       workspaceApps: "工作區應用程式",
+      otherApps: "其他應用程式",
+      otherAppsDescription: "開啟你可以使用的其他應用程式。",
+      availableCount: "可用 {{count}} 個",
       activeCount: "{{count}} 個作用中",
       hiddenCount: "{{count}} 個已隱藏",
       createApp: "建立應用程式",
       templates: "範本",
       checkingTemplates: "檢查可用範本",
       templatesAvailable: "{{count}} 個可用於產生架構",
+      curatedTemplates: "精選範本",
+      curatedTemplatesDescription:
+        "從經過審核的應用程式結構開始，打造屬於你的應用程式。",
+      remix: "重新混搭",
+      remixTemplate: "重新混搭 {{name}}",
+      remixAppIdLabel: "新應用程式 ID",
+      remixStarted: "已開始重新混搭 {{name}}",
+      viewLiveApp: "查看線上應用程式",
+      alreadyInWorkspace: "已在工作區中",
+      remixAppIdDescription: "為新的工作區應用程式選擇 URL 安全的 ID。",
+      integrationSetup: "整合設定",
+      source: "來源",
+      remixing: "正在重新混搭…",
+      remixSuccess: "已開始重新混搭範本。",
+      remixError: "無法重新混搭此範本",
+      appIdRequired: "應用程式 ID 為必填項目。",
       hide: "隱藏",
       show: "Show",
       hiddenApps: "隱藏的應用程式",

package/corpus/core/src/templates/workspace-core/.agents/skills/a2a-protocol/SKILL.md

@@ -117,6 +117,33 @@ const answer = await callAgent(
 // answer is a plain string
 ```
 
+### Fast bounded read: `invokeAgentAction()`
+
+When the caller knows the exact receiver-owned read action and arguments, skip
+the receiver's model loop:
+
+```ts
+import { invokeAgentAction } from "@agent-native/core/a2a";
+
+const { result } = await invokeAgentAction({
+  target: "analytics",
+  action: "gong-calls",
+  input: { company: "Acme", days: 90, includeTranscripts: true },
+  userEmail,
+  orgDomain,
+  orgSecret,
+});
+```
+
+The receiver still owns schema validation, credentials, access scoping, audit
+attribution, and exposure policy. Direct invocation is available only for
+cataloged, authenticated, explicitly exposed read-only actions that do not
+require approval. Its JWT is audience-bound to the receiving app. Use normal
+message delegation for planning, synthesis, multi-step work, or mutations.
+
+Inside an agent loop, `call-agent` exposes the same path with `action` + `input`;
+omit `message` and `taskId` in that mode.
+
 ### Advanced: `A2AClient` (full control)
 
 ```ts
@@ -178,6 +205,7 @@ cannot carry these grants.
 | ---------------- | -------------------------------- | ------------- |
 | `message/send`   | Send a message, get a task back  | Yes           |
 | `message/stream` | Send a message, stream responses | Yes           |
+| `actions/invoke` | Invoke one exposed read action   | Yes, JWT      |
 | `tasks/get`      | Get task status by ID            | Yes           |
 | `tasks/cancel`   | Cancel a running task            | Yes           |
 

package/corpus/core/src/templates/workspace-core/.agents/skills/composable-mini-apps/SKILL.md

@@ -42,6 +42,11 @@ The main agent should discover available siblings before assuming capability:
 - In the agent loop, use `call-agent` with the sibling app id when another app
   owns the work or data. Never call the current app through `call-agent`; use
   local actions instead.
+- When the exact sibling-owned read action and input are already known, use
+  `invokeAgentAction()` or `call-agent` with `action` + `input`. This preserves
+  the receiver's credentials and access checks while skipping its second model
+  loop. Use prompt-based `invokeAgent()` only when the sibling must reason,
+  synthesize, mutate, or perform a multi-step workflow.
 
 Send narrow prompts to siblings: name the exact question, relevant ids, date
 ranges, and expected output shape. Preserve returned ids and URLs verbatim.

package/corpus/core/src/templates/workspace-core/.agents/skills/performance/SKILL.md

@@ -99,6 +99,19 @@ index the growing tables first.
   `await`s — each `await` is another round-trip.
 - Prefer **one composed endpoint** over several dependent calls.
 
+For provider wrappers, inspect the upstream API before building a list-then-
+enrich flow. Prefer the richest endpoint that can apply the real filters and
+return the needed associations or participants in one paginated operation.
+Cursor pagination is already serial; adding a serial detail/enrichment request
+to every page doubles its critical path. Exhaustive records belong in corpus
+recipes or data programs with explicit coverage, not one agent tool call per
+page or item.
+
+First-class provider actions should represent one stable conceptual operation.
+Keep arbitrary endpoint, filter, and pagination access in the provider API
+substrate; do not turn a convenience action into a capability ceiling or
+duplicate the provider transport, auth, quota, and cache implementation.
+
 ## 4. Avoid client-side waterfalls
 
 - Don't gate query B on query A's result unless B truly needs it. Fire

package/corpus/templates/analytics/.agents/skills/dashboard-management/SKILL.md

@@ -83,7 +83,7 @@ When the user asks for a dashboard:
 2. If a metric definition, date range, or grain is ambiguous and the choice would change the panel's numbers, use the `ask-question` clarifying tool once before building. Skip it when the dictionary or the user already settled it.
 3. If a metric is not documented, do not guess column names. Ask for the table/columns or introspect the provider schema, then propose a dictionary entry with `save-data-dictionary-entry`.
 4. Build a complete `SqlDashboardConfig` with `name` and `panels`. Optionally set top-level `columns` (1–6, default 2) to control how many grid columns the panels before any section use.
-5. Every panel needs `id`, `title`, `source`, `chartType`, `width`, and `sql`. `width` is the number of grid columns the panel spans (1..6, clamped to the active section's column count). Section panels skip `source` and `sql` and may set their own `columns` (1–6) to override the dashboard default for the panels following the section. Extension panels (`chartType: "extension"`) also skip `source` and `sql`; use `config.extensionSlotId` for new panels, with legacy `config.extensionId` supported for existing direct embeds (see "Embedding An Extension As A Panel").
+5. Every panel needs `id`, `title`, `source`, `chartType`, `width`, and `sql`. `width` is the number of grid columns the panel spans (1..6, clamped to the active section's column count). Section panels skip `source` and `sql` and may set their own `columns` (1–6) to override the dashboard default for the panels following the section. Extension panels (`chartType: "extension"`) also skip `source` and `sql`; use `config.extensionId` for ordinary author-selected shared embeds. Use `config.extensionSlotId` only when the user explicitly asks for a personal/per-viewer slot (see "Embedding An Extension As A Panel").
 6. Persist with `update-dashboard`, not raw SQL or settings writes.
 7. Navigate to it with `pnpm action navigate --view=adhoc --dashboardId=<id>`.
 
@@ -115,8 +115,27 @@ rather than forcing it into a native dashboard config.
 ## Embedding An Extension As A Panel
 
 Use `chartType: "extension"` to add an extension box alongside normal SQL
-charts. The panel skips `source` and `sql`. New boxes use a stable slot id in
-`config.extensionSlotId`:
+charts. The panel skips `source` and `sql`. For ordinary requests such as "put
+X in this dashboard," save the author-selected extension id in
+`config.extensionId`. This makes the selection part of the shared dashboard and
+keeps the widget present in scheduled report captures:
+
+```jsonc
+{
+  "id": "pipeline-widget",
+  "title": "Pipeline Widget",
+  "chartType": "extension",
+  "width": 3,
+  "config": { "extensionId": "extension-123" },
+}
+```
+
+Direct embeds receive the dashboard id, name, description, current filters,
+and panel context. Embedding does not grant extension access, so share the
+extension with the dashboard audience.
+
+Use a stable `config.extensionSlotId` only when the user explicitly wants each
+viewer to choose or install their own widget:
 
 ```text
 analytics.dashboard.<dashboard-id>.panel.<panel-id>
@@ -141,14 +160,14 @@ Empty slots show the normal install affordance instead of a broken iframe.
 
 Notes:
 
-- Slot-backed extensions receive the dashboard id, name, description, current
-  filters, and panel id/title/slot id as live context.
+- Both direct and slot-backed extensions receive dashboard and panel context.
 - Installs and extension access are per viewer. Sharing the dashboard does not
   automatically install or grant access to its extension for other viewers.
-- `config.extensionId` remains supported for legacy direct embeds. Use it only
-  when preserving an existing dashboard; new boxes should use a slot.
+- Slot installs are per-user preferences. Different viewers can see different
+  widgets, and scheduled reports running as a service identity may show an
+  empty slot. This is why slots are opt-in rather than the default.
 
-## Cloning A Legacy Direct-Extension Dashboard (e.g. per-customer copies)
+## Cloning A Direct-Extension Dashboard (e.g. per-customer copies)
 
 When the user asks for a copy of an existing extension-backed dashboard for a
 different customer/org (for example "make an Intuit version of the Roku usage
@@ -159,7 +178,7 @@ from that written file — never by pulling the body into chat context first or
 re-typing it as a `content` argument.
 
 1. `get-sql-dashboard` with `includeConfig: true` on the source dashboard and
-   confirm the target panel is a legacy `chartType: "extension"` panel with
+   confirm the target panel is a `chartType: "extension"` panel with
    `config.extensionId`; grab that extension id. For a slot-backed panel, clone
    the dashboard panel with a new stable `extensionSlotId`, then target and
    install the desired extension into that slot instead of using this body-copy
@@ -405,7 +424,7 @@ type PanelInput = PanelPatch & {
   chartType: NonNullable<PanelPatch["chartType"]>;
   source?: PanelPatch["source"]; // required for non-section / non-extension panels
   sql?: string; // required for non-section / non-extension panels
-  // For chartType "extension": use config.extensionSlotId; extensionId is legacy direct embed compatibility.
+  // For chartType "extension": use config.extensionId by default; extensionSlotId is opt-in per-viewer content.
 };
 
 type PanelFilter = {