@agent-native/core 0.114.13 → 0.114.16

package/bin/agent-native.js

@@ -5,6 +5,8 @@ import { existsSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { shouldUseSourceFallback } from "./launcher.js";
+
 const binDir = dirname(fileURLToPath(import.meta.url));
 const distEntry = join(binDir, "../dist/cli/index.js");
 const sourceEntry = join(binDir, "../src/cli/index.ts");
@@ -16,31 +18,50 @@ const freshnessChecks = [
   ],
 ];
 
-function shouldUseSourceFallback() {
-  if (!existsSync(sourceEntry)) return false;
-  if (!existsSync(distEntry)) return true;
+// The tsx source fallback and mtime freshness check are for local monorepo
+// development only. Published installs ship both src and dist, and tarball
+// extraction can leave .ts files newer than .js, which must not trigger tsx
+// (not a runtime dependency). Only consider the fallback in a source checkout.
+const isSourceCheckout = existsSync(join(binDir, "../tsconfig.cli.json"));
+
+function statMtimeMs(path) {
   try {
-    return freshnessChecks.some(
-      ([source, dist]) =>
-        existsSync(source) &&
-        existsSync(dist) &&
-        statSync(source).mtimeMs > statSync(dist).mtimeMs,
-    );
+    return statSync(path).mtimeMs;
   } catch {
-    return false;
+    return 0;
   }
 }
 
-if (!shouldUseSourceFallback() && existsSync(distEntry)) {
-  await import(pathToFileURL(distEntry).href);
-} else {
-  if (!existsSync(sourceEntry)) {
+const freshness = freshnessChecks.map(([source, dist]) => {
+  const sourceExists = existsSync(source);
+  const distExists = existsSync(dist);
+  return {
+    sourceExists,
+    distExists,
+    sourceMtimeMs: sourceExists ? statMtimeMs(source) : 0,
+    distMtimeMs: distExists ? statMtimeMs(dist) : 0,
+  };
+});
+
+const useSourceFallback = shouldUseSourceFallback({
+  isSourceCheckout,
+  sourceEntryExists: existsSync(sourceEntry),
+  distEntryExists: existsSync(distEntry),
+  freshness,
+});
+
+if (!useSourceFallback) {
+  // Installed packages (and up-to-date checkouts) always run the shipped build.
+  // tsx is not a runtime dependency, so it must never be invoked here.
+  if (!existsSync(distEntry)) {
     console.error(
       "agent-native CLI build output is missing. Run `pnpm --filter @agent-native/core build` and try again.",
     );
     process.exit(1);
   }
 
+  await import(pathToFileURL(distEntry).href);
+} else {
   const child = spawn("tsx", [sourceEntry, ...process.argv.slice(2)], {
     stdio: "inherit",
     env: process.env,

package/bin/launcher.js

@@ -0,0 +1,34 @@
+// Pure decision logic for the agent-native CLI launcher shim, kept dependency
+// free so it can be unit tested without touching the filesystem.
+//
+// The tsx source fallback and mtime freshness check exist for local monorepo
+// development only. Published installs ship both src and dist, and tarball
+// extraction can leave .ts files newer than .js — that must never route to tsx
+// (not a runtime dependency), or `npx @agent-native/core ...` fails with
+// `spawn tsx ENOENT`. The `isSourceCheckout` gate is what keeps installed
+// packages on the shipped dist build.
+
+/**
+ * @param {object} input
+ * @param {boolean} input.isSourceCheckout Whether we run from a monorepo checkout.
+ * @param {boolean} input.sourceEntryExists Whether the .ts CLI entry exists.
+ * @param {boolean} input.distEntryExists Whether the compiled .js CLI entry exists.
+ * @param {Array<{sourceExists: boolean, distExists: boolean, sourceMtimeMs: number, distMtimeMs: number}>} [input.freshness]
+ * @returns {boolean}
+ */
+export function shouldUseSourceFallback({
+  isSourceCheckout,
+  sourceEntryExists,
+  distEntryExists,
+  freshness = [],
+}) {
+  if (!isSourceCheckout) return false;
+  if (!sourceEntryExists) return false;
+  if (!distEntryExists) return true;
+  return freshness.some(
+    (pair) =>
+      pair.sourceExists &&
+      pair.distExists &&
+      pair.sourceMtimeMs > pair.distMtimeMs,
+  );
+}

package/corpus/README.md

@@ -28,6 +28,6 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- core files: 1519
+- core files: 1521
 - toolkit files: 137
-- template files: 6185
+- template files: 6194

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @agent-native/core
 
+## 0.114.16
+
+### Patch Changes
+
+- 3a3eb9a: Fix `npx @agent-native/core create` failing with `spawn tsx ENOENT`. The CLI launcher's tsx source fallback is now scoped to monorepo source checkouts, so installed packages always run the shipped `dist` build even when tarball extraction leaves `.ts` files newer than their compiled `.js`.
+
+## 0.114.15
+
+### Patch Changes
+
+- f8fe58b: Add `VISUAL_RECAP_REQUIRED_LABELS` so PR Visual Recap can run only when a pull request has an opt-in label.
+- Updated dependencies [f8fe58b]
+  - @agent-native/recap-cli@0.5.0
+
+## 0.114.14
+
+### Patch Changes
+
+- 8df32f6: Improve the integrations picker by removing dead discovery controls, clearly showing the available catalog size, and simplifying provider setup guidance.
+- 8df32f6: Add UTM attribution to Builder.io links opened from Agent Native.
+
 ## 0.114.13
 
 ### Patch Changes

package/corpus/core/bin/agent-native.js

@@ -5,6 +5,8 @@ import { existsSync, statSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { shouldUseSourceFallback } from "./launcher.js";
+
 const binDir = dirname(fileURLToPath(import.meta.url));
 const distEntry = join(binDir, "../dist/cli/index.js");
 const sourceEntry = join(binDir, "../src/cli/index.ts");
@@ -16,31 +18,50 @@ const freshnessChecks = [
   ],
 ];
 
-function shouldUseSourceFallback() {
-  if (!existsSync(sourceEntry)) return false;
-  if (!existsSync(distEntry)) return true;
+// The tsx source fallback and mtime freshness check are for local monorepo
+// development only. Published installs ship both src and dist, and tarball
+// extraction can leave .ts files newer than .js, which must not trigger tsx
+// (not a runtime dependency). Only consider the fallback in a source checkout.
+const isSourceCheckout = existsSync(join(binDir, "../tsconfig.cli.json"));
+
+function statMtimeMs(path) {
   try {
-    return freshnessChecks.some(
-      ([source, dist]) =>
-        existsSync(source) &&
-        existsSync(dist) &&
-        statSync(source).mtimeMs > statSync(dist).mtimeMs,
-    );
+    return statSync(path).mtimeMs;
   } catch {
-    return false;
+    return 0;
   }
 }
 
-if (!shouldUseSourceFallback() && existsSync(distEntry)) {
-  await import(pathToFileURL(distEntry).href);
-} else {
-  if (!existsSync(sourceEntry)) {
+const freshness = freshnessChecks.map(([source, dist]) => {
+  const sourceExists = existsSync(source);
+  const distExists = existsSync(dist);
+  return {
+    sourceExists,
+    distExists,
+    sourceMtimeMs: sourceExists ? statMtimeMs(source) : 0,
+    distMtimeMs: distExists ? statMtimeMs(dist) : 0,
+  };
+});
+
+const useSourceFallback = shouldUseSourceFallback({
+  isSourceCheckout,
+  sourceEntryExists: existsSync(sourceEntry),
+  distEntryExists: existsSync(distEntry),
+  freshness,
+});
+
+if (!useSourceFallback) {
+  // Installed packages (and up-to-date checkouts) always run the shipped build.
+  // tsx is not a runtime dependency, so it must never be invoked here.
+  if (!existsSync(distEntry)) {
     console.error(
       "agent-native CLI build output is missing. Run `pnpm --filter @agent-native/core build` and try again.",
     );
     process.exit(1);
   }
 
+  await import(pathToFileURL(distEntry).href);
+} else {
   const child = spawn("tsx", [sourceEntry, ...process.argv.slice(2)], {
     stdio: "inherit",
     env: process.env,

package/corpus/core/bin/launcher.js

@@ -0,0 +1,34 @@
+// Pure decision logic for the agent-native CLI launcher shim, kept dependency
+// free so it can be unit tested without touching the filesystem.
+//
+// The tsx source fallback and mtime freshness check exist for local monorepo
+// development only. Published installs ship both src and dist, and tarball
+// extraction can leave .ts files newer than .js — that must never route to tsx
+// (not a runtime dependency), or `npx @agent-native/core ...` fails with
+// `spawn tsx ENOENT`. The `isSourceCheckout` gate is what keeps installed
+// packages on the shipped dist build.
+
+/**
+ * @param {object} input
+ * @param {boolean} input.isSourceCheckout Whether we run from a monorepo checkout.
+ * @param {boolean} input.sourceEntryExists Whether the .ts CLI entry exists.
+ * @param {boolean} input.distEntryExists Whether the compiled .js CLI entry exists.
+ * @param {Array<{sourceExists: boolean, distExists: boolean, sourceMtimeMs: number, distMtimeMs: number}>} [input.freshness]
+ * @returns {boolean}
+ */
+export function shouldUseSourceFallback({
+  isSourceCheckout,
+  sourceEntryExists,
+  distEntryExists,
+  freshness = [],
+}) {
+  if (!isSourceCheckout) return false;
+  if (!sourceEntryExists) return false;
+  if (!distEntryExists) return true;
+  return freshness.some(
+    (pair) =>
+      pair.sourceExists &&
+      pair.distExists &&
+      pair.sourceMtimeMs > pair.distMtimeMs,
+  );
+}

package/corpus/core/docs/content/deployment.mdx

@@ -567,7 +567,7 @@ In a standard production deployment with [production code execution](#production
 
 ### Builder.io: Visual Editing in Production {#builderio}
 
-[Builder.io](https://www.builder.io) solves this by providing a managed cloud environment where the agent retains the ability to modify your app's UI in production. Connect your repo to Builder.io and prompt for UI changes directly — no redeploy needed.
+[Builder.io](https://www.builder.io?utm_source=agent-native&utm_medium=docs&utm_campaign=framework&utm_content=deployment) solves this by providing a managed cloud environment where the agent retains the ability to modify your app's UI in production. Connect your repo to Builder.io and prompt for UI changes directly — no redeploy needed.
 
 **How it works:**
 

package/corpus/core/docs/content/frames.mdx

@@ -186,7 +186,7 @@ time.
 
 ## Builder.io cloud frame {#cloud-frame}
 
-[Builder.io](https://www.builder.io) provides a managed frame that hosts the
+[Builder.io](https://www.builder.io?utm_source=agent-native&utm_medium=docs&utm_campaign=framework&utm_content=frames) provides a managed frame that hosts the
 same app and the same agent panel, in the cloud:
 
 - Real-time collaboration — multiple users can watch and interact at once.

package/corpus/core/docs/content/integrations.mdx

@@ -322,33 +322,33 @@ endpoint is reachable or cataloged, but a live provider authorization or tool
 session still needs to be completed. **Restricted** entries remain discoverable
 but need provider or administrator setup before a generic connection can work.
 
-| Integration                                                                                                                    | Connection mode        | Status                             | Endpoint                                  | Setup and notes                                                                                                                                                                                                                   |
-| ------------------------------------------------------------------------------------------------------------------------------ | ---------------------- | ---------------------------------- | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| [Context7](https://context7.com/)                                                                                              | No auth                | Ready · verified                   | `https://mcp.context7.com/mcp`            | Fetch current library and framework docs.                                                                                                                                                                                         |
-| [Sentry](https://docs.sentry.io/product/sentry-mcp/)                                                                           | Header / token         | Ready · preflight only             | `https://mcp.sentry.dev/mcp`              | Add a Sentry bearer token as the `Authorization` header.                                                                                                                                                                          |
-| [Notion](https://developers.notion.com/guides/mcp/get-started-with-mcp)                                                        | OAuth                  | Ready · preflight only             | `https://mcp.notion.com/mcp`              | User OAuth; enterprise admins can audit or restrict MCP clients.                                                                                                                                                                  |
-| [Semgrep](https://github.com/semgrep/mcp#readme)                                                                               | No auth                | Ready · preflight only             | `https://mcp.semgrep.ai/mcp`              | Scan code for security findings.                                                                                                                                                                                                  |
-| [Linear](https://linear.app/docs/mcp)                                                                                          | OAuth                  | Ready · preflight only             | `https://mcp.linear.app/mcp`              | Authorize the workspace and issue permissions required by the workflow.                                                                                                                                                           |
-| [Atlassian Rovo MCP](https://developer.atlassian.com/cloud/rovo-mcp/guides/getting-started/)                                   | OAuth + provider setup | Restricted                         | `https://mcp.atlassian.com/v1/mcp/authv2` | Admins may need to trust the app origin and enable Rovo Read, Write, and Search permissions.                                                                                                                                      |
-| [Supabase](https://www.builder.io/c/docs/fusion-connect-to-supabase)                                                           | OAuth                  | Ready · preflight only             | `https://mcp.supabase.com/mcp`            | Authorize the Supabase project and requested backend scopes.                                                                                                                                                                      |
-| [Neon](https://www.builder.io/c/docs/fusion-connect-to-neon)                                                                   | OAuth                  | Ready · preflight only             | `https://mcp.neon.tech/sse`               | Authorize access to the serverless Postgres projects needed by the app.                                                                                                                                                           |
-| [Stripe](https://docs.stripe.com/mcp)                                                                                          | OAuth                  | Ready · preflight only             | `https://mcp.stripe.com`                  | Review payment, customer, and subscription permissions before authorizing.                                                                                                                                                        |
-| [Cloudflare](https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/)               | OAuth                  | Ready · preflight only             | `https://mcp.cloudflare.com/mcp`          | Choose the narrowest Cloudflare server and review scopes.                                                                                                                                                                         |
-| [GitLab](https://docs.gitlab.com/user/model_context_protocol/mcp_server/)                                                      | OAuth + provider setup | Beta · restricted                  | `https://gitlab.com/api/v4/mcp`           | A top-level group admin, or the equivalent self-managed instance admin, must allow MCP.                                                                                                                                           |
-| [Figma](https://developers.figma.com/docs/figma-mcp-server/)                                                                   | Manual setup           | Approved clients only · restricted | `https://mcp.figma.com/mcp`               | Figma only allows clients in its MCP Catalog. Use the [Figma REST API personal access token fallback](https://developers.figma.com/docs/rest-api/personal-access-tokens/) for file and node reads until Agent Native is approved. |
-| [Canva](https://www.canva.dev/docs/mcp/)                                                                                       | Manual setup           | Approved domains · restricted      | `https://mcp.canva.com/mcp`               | Per-user OAuth; clients must allow Canva's canva.com and canva.ai domains and follow the current redirect setup.                                                                                                                  |
-| [Vercel](https://vercel.com/docs/agent-resources/vercel-mcp)                                                                   | Manual setup           | Approved clients only · restricted | `https://mcp.vercel.com`                  | Vercel must list the client as approved before a generic connection will work.                                                                                                                                                    |
-| [GitHub](https://github.com/github/github-mcp-server)                                                                          | Manual setup           | Provider setup · restricted        | `https://api.githubcopilot.com/mcp/`      | Use a registered OAuth app; organizations may also enforce OAuth App Access Policies.                                                                                                                                             |
-| [Slack](https://docs.slack.dev/ai/slack-mcp-server/)                                                                           | Manual setup           | Approved clients only · restricted | `https://mcp.slack.com/mcp`               | Requires a fixed registered Slack app; dynamic client registration is not supported.                                                                                                                                              |
-| [Asana](https://developers.asana.com/docs/integrating-with-asanas-mcp-server)                                                  | Manual setup           | Provider setup · restricted        | `https://mcp.asana.com/v2/mcp`            | Pre-register an Asana MCP OAuth app before connecting.                                                                                                                                                                            |
-| [HubSpot](https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server) | Manual setup           | Provider setup · restricted        | `https://mcp.hubspot.com`                 | Create a HubSpot MCP Auth App with PKCE; the existing HubSpot OAuth connector remains available to app actions.                                                                                                                   |
-| [Intercom](https://developers.intercom.com/docs/guides/mcp)                                                                    | OAuth                  | Ready · preflight only             | `https://mcp.intercom.com/mcp`            | Available for US-hosted workspaces; confirm region and scopes during authorization.                                                                                                                                               |
-| [monday.com](https://developer.monday.com/api-reference/docs/build-on-monday-with-ai)                                          | OAuth                  | Ready · preflight only             | `https://mcp.monday.com/mcp`              | Choose the workspace and permissions to share during authorization.                                                                                                                                                               |
-| [Webflow](https://developers.webflow.com/mcp/reference/getting-started)                                                        | OAuth                  | Ready · preflight only             | `https://mcp.webflow.com/mcp`             | Designer capabilities may install Webflow's Bridge App; Data API access is separate.                                                                                                                                              |
-| [PayPal](https://developer.paypal.com/ai-tools/mcp-server/)                                                                    | OAuth                  | Ready · preflight only             | `https://mcp.paypal.com/sse`              | Review merchant permissions before authorizing the remote server.                                                                                                                                                                 |
-| [Box](https://developer.box.com/guides/box-mcp)                                                                                | Manual setup           | Beta · restricted                  | `https://mcp.box.com`                     | An administrator must enable Box MCP; custom clients also need credentials, a redirect URI, and approved scopes.                                                                                                                  |
-| [Netlify](https://docs.netlify.com/build/build-with-ai/agent-setup-guides/agent-setup-overview/)                               | OAuth                  | Ready · preflight only             | `https://netlify-mcp.netlify.app/mcp`     | Review site and team permissions before completing OAuth.                                                                                                                                                                         |
-| [Zapier MCP](https://help.zapier.com/hc/en-us/articles/36265392843917-Use-Zapier-MCP-with-your-client)                         | Header / token         | User-created server · restricted   | `https://mcp.zapier.com/api/v1/connect`   | Create the MCP server in Zapier, then paste its generated bearer token into the header field.                                                                                                                                     |
+| Integration                                                                                                                                                             | Connection mode        | Status                             | Endpoint                                  | Setup and notes                                                                                                                                                                                                                   |
+| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | ---------------------------------- | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [Context7](https://context7.com/)                                                                                                                                       | No auth                | Ready · verified                   | `https://mcp.context7.com/mcp`            | Fetch current library and framework docs.                                                                                                                                                                                         |
+| [Sentry](https://docs.sentry.io/product/sentry-mcp/)                                                                                                                    | Header / token         | Ready · preflight only             | `https://mcp.sentry.dev/mcp`              | Add a Sentry bearer token as the `Authorization` header.                                                                                                                                                                          |
+| [Notion](https://developers.notion.com/guides/mcp/get-started-with-mcp)                                                                                                 | OAuth                  | Ready · preflight only             | `https://mcp.notion.com/mcp`              | User OAuth; enterprise admins can audit or restrict MCP clients.                                                                                                                                                                  |
+| [Semgrep](https://github.com/semgrep/mcp#readme)                                                                                                                        | No auth                | Ready · preflight only             | `https://mcp.semgrep.ai/mcp`              | Scan code for security findings.                                                                                                                                                                                                  |
+| [Linear](https://linear.app/docs/mcp)                                                                                                                                   | OAuth                  | Ready · preflight only             | `https://mcp.linear.app/mcp`              | Authorize the workspace and issue permissions required by the workflow.                                                                                                                                                           |
+| [Atlassian Rovo MCP](https://developer.atlassian.com/cloud/rovo-mcp/guides/getting-started/)                                                                            | OAuth + provider setup | Restricted                         | `https://mcp.atlassian.com/v1/mcp/authv2` | Admins may need to trust the app origin and enable Rovo Read, Write, and Search permissions.                                                                                                                                      |
+| [Supabase](https://www.builder.io/c/docs/fusion-connect-to-supabase?utm_source=agent-native&utm_medium=docs&utm_campaign=framework&utm_content=fusion_connect_supabase) | OAuth                  | Ready · preflight only             | `https://mcp.supabase.com/mcp`            | Authorize the Supabase project and requested backend scopes.                                                                                                                                                                      |
+| [Neon](https://www.builder.io/c/docs/fusion-connect-to-neon?utm_source=agent-native&utm_medium=docs&utm_campaign=framework&utm_content=fusion_connect_neon)             | OAuth                  | Ready · preflight only             | `https://mcp.neon.tech/sse`               | Authorize access to the serverless Postgres projects needed by the app.                                                                                                                                                           |
+| [Stripe](https://docs.stripe.com/mcp)                                                                                                                                   | OAuth                  | Ready · preflight only             | `https://mcp.stripe.com`                  | Review payment, customer, and subscription permissions before authorizing.                                                                                                                                                        |
+| [Cloudflare](https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/)                                                        | OAuth                  | Ready · preflight only             | `https://mcp.cloudflare.com/mcp`          | Choose the narrowest Cloudflare server and review scopes.                                                                                                                                                                         |
+| [GitLab](https://docs.gitlab.com/user/model_context_protocol/mcp_server/)                                                                                               | OAuth + provider setup | Beta · restricted                  | `https://gitlab.com/api/v4/mcp`           | A top-level group admin, or the equivalent self-managed instance admin, must allow MCP.                                                                                                                                           |
+| [Figma](https://developers.figma.com/docs/figma-mcp-server/)                                                                                                            | Manual setup           | Approved clients only · restricted | `https://mcp.figma.com/mcp`               | Figma only allows clients in its MCP Catalog. Use the [Figma REST API personal access token fallback](https://developers.figma.com/docs/rest-api/personal-access-tokens/) for file and node reads until Agent Native is approved. |
+| [Canva](https://www.canva.dev/docs/mcp/)                                                                                                                                | Manual setup           | Approved domains · restricted      | `https://mcp.canva.com/mcp`               | Per-user OAuth; clients must allow Canva's canva.com and canva.ai domains and follow the current redirect setup.                                                                                                                  |
+| [Vercel](https://vercel.com/docs/agent-resources/vercel-mcp)                                                                                                            | Manual setup           | Approved clients only · restricted | `https://mcp.vercel.com`                  | Vercel must list the client as approved before a generic connection will work.                                                                                                                                                    |
+| [GitHub](https://github.com/github/github-mcp-server)                                                                                                                   | Manual setup           | Provider setup · restricted        | `https://api.githubcopilot.com/mcp/`      | Use a registered OAuth app; organizations may also enforce OAuth App Access Policies.                                                                                                                                             |
+| [Slack](https://docs.slack.dev/ai/slack-mcp-server/)                                                                                                                    | Manual setup           | Approved clients only · restricted | `https://mcp.slack.com/mcp`               | Requires a fixed registered Slack app; dynamic client registration is not supported.                                                                                                                                              |
+| [Asana](https://developers.asana.com/docs/integrating-with-asanas-mcp-server)                                                                                           | Manual setup           | Provider setup · restricted        | `https://mcp.asana.com/v2/mcp`            | Pre-register an Asana MCP OAuth app before connecting.                                                                                                                                                                            |
+| [HubSpot](https://developers.hubspot.com/docs/apps/developer-platform/build-apps/integrate-with-the-remote-hubspot-mcp-server)                                          | Manual setup           | Provider setup · restricted        | `https://mcp.hubspot.com`                 | Create a HubSpot MCP Auth App with PKCE; the existing HubSpot OAuth connector remains available to app actions.                                                                                                                   |
+| [Intercom](https://developers.intercom.com/docs/guides/mcp)                                                                                                             | OAuth                  | Ready · preflight only             | `https://mcp.intercom.com/mcp`            | Available for US-hosted workspaces; confirm region and scopes during authorization.                                                                                                                                               |
+| [monday.com](https://developer.monday.com/api-reference/docs/build-on-monday-with-ai)                                                                                   | OAuth                  | Ready · preflight only             | `https://mcp.monday.com/mcp`              | Choose the workspace and permissions to share during authorization.                                                                                                                                                               |
+| [Webflow](https://developers.webflow.com/mcp/reference/getting-started)                                                                                                 | OAuth                  | Ready · preflight only             | `https://mcp.webflow.com/mcp`             | Designer capabilities may install Webflow's Bridge App; Data API access is separate.                                                                                                                                              |
+| [PayPal](https://developer.paypal.com/ai-tools/mcp-server/)                                                                                                             | OAuth                  | Ready · preflight only             | `https://mcp.paypal.com/sse`              | Review merchant permissions before authorizing the remote server.                                                                                                                                                                 |
+| [Box](https://developer.box.com/guides/box-mcp)                                                                                                                         | Manual setup           | Beta · restricted                  | `https://mcp.box.com`                     | An administrator must enable Box MCP; custom clients also need credentials, a redirect URI, and approved scopes.                                                                                                                  |
+| [Netlify](https://docs.netlify.com/build/build-with-ai/agent-setup-guides/agent-setup-overview/)                                                                        | OAuth                  | Ready · preflight only             | `https://netlify-mcp.netlify.app/mcp`     | Review site and team permissions before completing OAuth.                                                                                                                                                                         |
+| [Zapier MCP](https://help.zapier.com/hc/en-us/articles/36265392843917-Use-Zapier-MCP-with-your-client)                                                                  | Header / token         | User-created server · restricted   | `https://mcp.zapier.com/api/v1/connect`   | Create the MCP server in Zapier, then paste its generated bearer token into the header field.                                                                                                                                     |
 
 ### Repeatable preflight verification
 

package/corpus/core/docs/content/pr-visual-recap.mdx

@@ -209,7 +209,8 @@ To reduce cost:
 - **Pin a cheaper model.** For Claude, set `VISUAL_RECAP_MODEL=claude-haiku-4-5` for simple or small repos — it's the cheapest Claude tier; `claude-sonnet-5` (the default) is the balanced tier.
 - **Switch to Codex with a cheaper model.** Set `VISUAL_RECAP_AGENT=codex` with `VISUAL_RECAP_MODEL=gpt-5.6-luna` (the cheapest GPT-5.6 tier) or `gpt-5.6-terra` (mid-tier), and set `VISUAL_RECAP_REASONING=low` to cut reasoning-token spend further. Reasoning depth only applies to Codex.
 - **Point at a cheaper OpenAI-compatible provider.** Set `VISUAL_RECAP_AGENT=openai-compatible` with `VISUAL_RECAP_BASE_URL`/`VISUAL_RECAP_MODEL`/`VISUAL_RECAP_API_KEY` targeting DeepSeek, Kimi, or any other OpenAI-compatible endpoint.
-- **Recap less often.** Edit the installed workflow's `on.pull_request.types` from `[opened, synchronize, reopened, ready_for_review, closed]` to `[opened, ready_for_review, closed]` so it recaps only when a PR opens and when it merges, instead of on every push.
+- **Require an explicit PR label.** Set `VISUAL_RECAP_REQUIRED_LABELS=visual recap` to keep the workflow installed but skip recaps until a PR has that label. Use a comma-separated list, such as `visual recap,recap`, when several labels should opt in. Applying a listed label wakes the workflow immediately.
+- **Recap less often.** Edit the installed workflow's `on.pull_request.types` from `[opened, synchronize, reopened, ready_for_review, labeled, closed]` to `[opened, ready_for_review, closed]` so it recaps only when a PR opens and when it merges, instead of on every push.
 
 Every run records what it actually spent: the workflow's `recap usage` step attaches token and cost usage to the published plan, so you can look at real spend per run instead of guessing.
 
@@ -256,16 +257,17 @@ real token.
 
 ### Optional (only if you change defaults)
 
-| Secret / variable        | Default                                                       | When you need it                                                                                                                                                                                                                                         |
-| ------------------------ | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `OPENAI_API_KEY`         | —                                                             | Secret. Set together with `VISUAL_RECAP_AGENT=codex` to run the recap with Codex instead.                                                                                                                                                                |
-| `VISUAL_RECAP_API_KEY`   | —                                                             | Secret. Set with `VISUAL_RECAP_AGENT=openai-compatible` for DeepSeek, Kimi, or another OpenAI-compatible provider.                                                                                                                                       |
-| `VISUAL_RECAP_AGENT`     | `claude`                                                      | Variable. Selects the coding-agent backend (`claude`, `codex`, or `openai-compatible`).                                                                                                                                                                  |
-| `VISUAL_RECAP_BASE_URL`  | required for compatible backend                               | Variable. HTTP(S) base URL for the OpenAI-compatible backend; credentials are rejected.                                                                                                                                                                  |
-| `VISUAL_RECAP_MODEL`     | `claude-sonnet-5` for Claude; required for compatible backend | Variable. Provider model id for OpenAI-compatible backends (required there). For Claude, unset now defaults to `claude-sonnet-5` — set it to override, e.g. `claude-haiku-4-5` for the cheapest tier. For Codex, unset uses the Codex CLI's own default. |
-| `VISUAL_RECAP_REASONING` | each model's default                                          | Variable. Reasoning depth: `none`, `minimal`, `low`, `medium`, `high`, or `xhigh`. Applies to the Codex backend.                                                                                                                                         |
-| `RECAP_CLI_VERSION`      | `latest`                                                      | Variable. Pins the `@agent-native/recap-cli` version the workflow installs — e.g. `1.5.0`. See [Version pinning](#version-pinning-copy-variant).                                                                                                         |
-| `PLAN_RECAP_APP_URL`     | `https://plan.agent-native.com`                               | Secret. Only when self-hosting the Plans app at a different origin.                                                                                                                                                                                      |
+| Secret / variable              | Default                                                       | When you need it                                                                                                                                                                                                                                         |
+| ------------------------------ | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `OPENAI_API_KEY`               | —                                                             | Secret. Set together with `VISUAL_RECAP_AGENT=codex` to run the recap with Codex instead.                                                                                                                                                                |
+| `VISUAL_RECAP_API_KEY`         | —                                                             | Secret. Set with `VISUAL_RECAP_AGENT=openai-compatible` for DeepSeek, Kimi, or another OpenAI-compatible provider.                                                                                                                                       |
+| `VISUAL_RECAP_AGENT`           | `claude`                                                      | Variable. Selects the coding-agent backend (`claude`, `codex`, or `openai-compatible`).                                                                                                                                                                  |
+| `VISUAL_RECAP_BASE_URL`        | required for compatible backend                               | Variable. HTTP(S) base URL for the OpenAI-compatible backend; credentials are rejected.                                                                                                                                                                  |
+| `VISUAL_RECAP_MODEL`           | `claude-sonnet-5` for Claude; required for compatible backend | Variable. Provider model id for OpenAI-compatible backends (required there). For Claude, unset now defaults to `claude-sonnet-5` — set it to override, e.g. `claude-haiku-4-5` for the cheapest tier. For Codex, unset uses the Codex CLI's own default. |
+| `VISUAL_RECAP_REASONING`       | each model's default                                          | Variable. Reasoning depth: `none`, `minimal`, `low`, `medium`, `high`, or `xhigh`. Applies to the Codex backend.                                                                                                                                         |
+| `VISUAL_RECAP_REQUIRED_LABELS` | —                                                             | Variable. Comma-separated PR labels. When set, the gate skips until the PR has at least one listed label, for example `visual recap`.                                                                                                                    |
+| `RECAP_CLI_VERSION`            | `latest`                                                      | Variable. Pins the `@agent-native/recap-cli` version the workflow installs — e.g. `1.5.0`. See [Version pinning](#version-pinning-copy-variant).                                                                                                         |
+| `PLAN_RECAP_APP_URL`           | `https://plan.agent-native.com`                               | Secret. Only when self-hosting the Plans app at a different origin.                                                                                                                                                                                      |
 
 The workflow auto-detects how to invoke its helper CLI (local source inside this monorepo, the published `@agent-native/recap-cli` elsewhere), so there is no `RECAP_CLI` variable to set.
 
@@ -510,10 +512,11 @@ name: PR Visual Recap
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review, closed]
+    types: [opened, synchronize, reopened, ready_for_review, labeled, closed]
 
 jobs:
   visual-recap:
+    if: github.event.action != 'labeled' || vars.VISUAL_RECAP_REQUIRED_LABELS != ''
     permissions:
       actions: write
       contents: read
@@ -535,10 +538,11 @@ jobs:
       skill-source: ${{ vars.VISUAL_RECAP_SKILL_SOURCE || 'auto' }}
       runs-on: ${{ vars.VISUAL_RECAP_RUNS_ON || '"ubuntu-latest"' }}
       gate-runs-on: ${{ vars.VISUAL_RECAP_GATE_RUNS_ON || 'ubuntu-latest' }}
+      required-labels: ${{ vars.VISUAL_RECAP_REQUIRED_LABELS || '' }}
       # cli-version: "latest"  # pin to a specific @agent-native/recap-cli version
 ```
 
-The same secrets and variables described in [Secrets and variables](#secrets-and-variables) apply — set them in your repo settings the same way as for the copy variant. The reusable caller forwards `VISUAL_RECAP_RUNS_ON` through its JSON `runs-on` input for the full recap job and `VISUAL_RECAP_GATE_RUNS_ON` through its plain-label `gate-runs-on` input for the metadata-only gate. The latter is used only for trusted same-repository authors; other PRs use GitHub-hosted `ubuntu-latest`. Omitting either input preserves its `ubuntu-latest` default.
+The same secrets and variables described in [Secrets and variables](#secrets-and-variables) apply — set them in your repo settings the same way as for the copy variant. The reusable caller forwards `VISUAL_RECAP_RUNS_ON` through its JSON `runs-on` input for the full recap job, `VISUAL_RECAP_GATE_RUNS_ON` through its plain-label `gate-runs-on` input for the metadata-only gate, and `VISUAL_RECAP_REQUIRED_LABELS` through `required-labels` for optional PR-label gating. The gate runner input is used only for trusted same-repository authors; other PRs use GitHub-hosted `ubuntu-latest`. Omitting the runner inputs preserves their `ubuntu-latest` defaults; omitting required labels preserves automatic recap behavior.
 
 ### Installing via the CLI
 

package/corpus/core/docs/content/workspace-management.mdx

@@ -91,7 +91,7 @@ Keep branches short-lived. Long-lived branches diverge from main and create pain
 
 ### Non-Developer Branching
 
-Not everyone who needs to make changes is comfortable with git. [Builder.io](https://www.builder.io) supports a visual branching model that maps to git branches under the hood — useful for content and copy changes, layout adjustments, design iterations, and A/B testing without a dev environment.
+Not everyone who needs to make changes is comfortable with git. [Builder.io](https://www.builder.io?utm_source=agent-native&utm_medium=docs&utm_campaign=framework&utm_content=workspace_management) supports a visual branching model that maps to git branches under the hood — useful for content and copy changes, layout adjustments, design iterations, and A/B testing without a dev environment.
 
 ## Code Ownership
 

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.114.13",
+  "version": "0.114.16",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -150,6 +150,7 @@
     "./embedding/react": "./dist/embedding/react.js",
     "./onboarding": "./dist/onboarding/index.js",
     "./shared": "./dist/shared/index.js",
+    "./shared/builder-link-tracking": "./dist/shared/builder-link-tracking.js",
     "./voice": "./dist/voice/index.js",
     "./scripts": "./dist/scripts/index.js",
     "./guards": {

package/corpus/core/src/agent/engine/builder-engine.ts

@@ -20,6 +20,7 @@ import {
   getBuilderGatewayBaseUrl,
   recordBuilderCredentialAuthFailure,
 } from "../../server/credential-provider.js";
+import { applyBuilderUtmTrackingParams } from "../../shared/builder-link-tracking.js";
 import {
   normalizeReasoningEffortForModel,
   type ReasoningEffort,
@@ -112,6 +113,9 @@ async function buildUpgradeUrl(): Promise<string> {
   url.searchParams.set("agentNativeConnectSource", "gateway_quota_upgrade");
   url.searchParams.set("agentNativeFlow", "connect_llm");
   url.searchParams.set("framework", "agent-native");
+  applyBuilderUtmTrackingParams(url.searchParams, {
+    content: "gateway_quota_upgrade",
+  });
   return url.toString();
 }
 

package/corpus/core/src/client/AgentPanel.tsx

@@ -81,6 +81,7 @@ const MultiTabAssistantChatLazy = lazy(() =>
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { Link, useLocation, useNavigate } from "react-router";
 
+import { withBuilderUtmTrackingParams } from "../shared/builder-link-tracking.js";
 import type { AgentChatSurfaceKind } from "./agent-chat-adapter.js";
 import {
   consumeAgentSidebarUrlOpenOverride,
@@ -670,14 +671,19 @@ function CodeAccessUnavailablePanel({
   compact?: boolean;
 }) {
   const { connectUrl: builderConnectUrl } = useBuilderConnectUrl();
-  const builderHref =
-    secondaryCtaHref ??
-    (builderConnectUrl
+  const builderHref = secondaryCtaHref
+    ? withBuilderUtmTrackingParams(secondaryCtaHref, {
+        campaign: "product",
+        content: "code_access_unavailable_panel",
+      })
+    : builderConnectUrl
       ? withBuilderConnectTrackingParams(builderConnectUrl, {
           source: "code_access_unavailable_panel",
           flow: "background_agent",
         })
-      : "https://builder.io");
+      : withBuilderUtmTrackingParams("https://builder.io", {
+          content: "code_access_unavailable_panel",
+        });
 
   return (
     <div

package/corpus/core/src/client/ConnectBuilderCard.tsx

@@ -1,6 +1,7 @@
 import { IconExternalLink, IconLoader2 } from "@tabler/icons-react";
 import React, { useCallback, useEffect, useRef, useState } from "react";
 
+import { withBuilderUtmTrackingParams } from "../shared/builder-link-tracking.js";
 import { agentNativePath } from "./api-path.js";
 import { BuilderBMark } from "./builder-mark.js";
 import { getCallbackOrigin } from "./frame.js";
@@ -307,7 +308,10 @@ export function ConnectBuilderCard({
           <div className="mt-3">
             {runResult ? (
               <a
-                href={runResult.url}
+                href={withBuilderUtmTrackingParams(runResult.url, {
+                  campaign: "product",
+                  content: "connect_builder_card_branch",
+                })}
                 target="_blank"
                 rel="noopener noreferrer"
                 className={cn(

package/corpus/core/src/client/chat/markdown-renderer.tsx

@@ -28,10 +28,7 @@ import {
   smoothStreamingRevealCount,
   splitStreamingTextGraphemes,
 } from "../../shared/streaming-text-smoothing.js";
-import {
-  NEW_CHAT_ACTION_HREF,
-  BUILDER_SPACE_SETTINGS_URL,
-} from "../error-format.js";
+import { NEW_CHAT_ACTION_HREF } from "../error-format.js";
 import { HighlightedCodeBlock as SharedHighlightedCodeBlock } from "../HighlightedCodeBlock.js";
 import { IframeEmbed, parseEmbedBody } from "../IframeEmbed.js";
 import { cn } from "../utils.js";
@@ -187,7 +184,8 @@ function isBuilderErrorCtaHref(href: string | undefined): boolean {
       return false;
     }
     return (
-      url.href === BUILDER_SPACE_SETTINGS_URL ||
+      (url.origin === "https://builder.io" &&
+        url.pathname === "/account/space") ||
       url.pathname === "/account/billing" ||
       url.pathname === "/account/subscription" ||
       /^\/app\/organizations\/[^/]+\/billing$/.test(url.pathname)

package/corpus/core/src/client/error-format.ts

@@ -11,7 +11,8 @@
  * regex stays narrow; the gateway may emit URLs containing `(`
  * (e.g. `?ref=Acme%20(staging)`) and we don't want to reject them.
  */
-export const BUILDER_SPACE_SETTINGS_URL = "https://builder.io/account/space";
+export const BUILDER_SPACE_SETTINGS_URL =
+  "https://builder.io/account/space?utm_source=agent-native&utm_medium=product&utm_campaign=onboarding&utm_content=space_settings";
 
 // Pseudo-href used to mark an in-app "Start new chat" CTA inside the markdown
 // error message. The chat renderer intercepts this href and renders a button

package/corpus/core/src/client/index.ts

@@ -49,6 +49,7 @@ export {
   type FeatureFlagRules,
   type SetFeatureFlagInput,
 } from "./feature-flags/index.js";
+export { withBuilderUtmTrackingParams } from "../shared/builder-link-tracking.js";
 export {
   SettingsPanel,
   SettingsTabsPage,