@agent-native/core 0.114.16 → 0.115.1

package/corpus/core/src/server/workspace-provider-oauth.ts

@@ -39,6 +39,7 @@ export type GenericWorkspaceOAuthProvider =
   | "google_drive"
   | "github"
   | "hubspot"
+  | "salesforce"
   | "jira"
   | "sentry"
   | "notion";
@@ -48,6 +49,7 @@ const SUPPORTED_PROVIDERS = new Set<GenericWorkspaceOAuthProvider>([
   "google_drive",
   "github",
   "hubspot",
+  "salesforce",
   "jira",
   "sentry",
   "notion",
@@ -55,6 +57,8 @@ const SUPPORTED_PROVIDERS = new Set<GenericWorkspaceOAuthProvider>([
 const FLOW_TTL_SECONDS = 10 * 60;
 const PROVIDER_REQUEST_TIMEOUT_MS = 10_000;
 const PROVIDER_RESPONSE_MAX_BYTES = 256 * 1024;
+const SALESFORCE_PRODUCTION_LOGIN_URL = "https://login.salesforce.com";
+const SALESFORCE_SANDBOX_LOGIN_URL = "https://test.salesforce.com";
 
 export interface WorkspaceProviderOAuthFlow {
   provider: GenericWorkspaceOAuthProvider;
@@ -64,6 +68,7 @@ export interface WorkspaceProviderOAuthFlow {
   owner: string;
   orgId?: string;
   appId: string;
+  salesforceLoginUrl?: string;
   expiresAt: number;
 }
 
@@ -112,6 +117,14 @@ export async function handleWorkspaceProviderOAuthStart(
   }
   const provider = requiredProvider(providerId);
   const query = getQuery(event);
+  const salesforceLoginUrl =
+    providerId === "salesforce"
+      ? resolveSalesforceOAuthLoginUrl(text(query.environment))
+      : undefined;
+  if (providerId === "salesforce" && !salesforceLoginUrl) {
+    setResponseStatus(event, 400);
+    return { error: "Salesforce environment must be production or sandbox." };
+  }
   const appId = normalizeAppId(
     text(query.appId) ??
       process.env.AGENT_NATIVE_WORKSPACE_APP_ID ??
@@ -163,6 +176,7 @@ export async function handleWorkspaceProviderOAuthStart(
         owner: session.email,
         orgId,
         appId,
+        ...(salesforceLoginUrl ? { salesforceLoginUrl } : {}),
         expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
       };
       setCookie(
@@ -183,6 +197,14 @@ export async function handleWorkspaceProviderOAuthStart(
         redirectUri,
         state,
         challenge,
+        ...(salesforceLoginUrl
+          ? {
+              authorizationUrl: salesforceOAuthEndpoint(
+                salesforceLoginUrl,
+                "authorize",
+              ),
+            }
+          : {}),
       });
       return Response.redirect(authorizationUrl, 302);
     },
@@ -259,6 +281,14 @@ export async function handleWorkspaceProviderOAuthCallback(
         code,
         verifier: flow.verifier,
         redirectUri: flow.redirectUri,
+        ...(providerId === "salesforce"
+          ? {
+              tokenUrl: salesforceOAuthEndpoint(
+                flow.salesforceLoginUrl ?? SALESFORCE_PRODUCTION_LOGIN_URL,
+                "token",
+              ),
+            }
+          : {}),
       });
       const identities = await resolveWorkspaceProviderIdentities(
         providerId,
@@ -299,10 +329,18 @@ export async function handleWorkspaceProviderOAuthCallback(
         );
         const connectionConfig = {
           credentialMode: "oauth",
-          ...(providerId === "hubspot" || providerId === "jira"
+          ...(providerId === "hubspot" ||
+          providerId === "salesforce" ||
+          providerId === "jira"
             ? { externalAccountId: identity.accountId }
             : {}),
           ...(identity.config ?? {}),
+          ...(providerId === "salesforce"
+            ? {
+                salesforceLoginUrl:
+                  flow.salesforceLoginUrl ?? SALESFORCE_PRODUCTION_LOGIN_URL,
+              }
+            : {}),
         };
         const connection = await upsertWorkspaceConnection({
           ...(existing ? { id: existing.id } : {}),
@@ -339,10 +377,13 @@ export function buildWorkspaceProviderAuthorizationUrl(input: {
   redirectUri: string;
   state: string;
   challenge: string;
+  authorizationUrl?: string;
 }): string {
   if (!input.provider.oauth)
     throw new Error("Provider does not support OAuth.");
-  const url = new URL(input.provider.oauth.authorizationUrl);
+  const url = new URL(
+    input.authorizationUrl ?? input.provider.oauth.authorizationUrl,
+  );
   url.searchParams.set("client_id", input.clientId);
   url.searchParams.set("redirect_uri", input.redirectUri);
   url.searchParams.set("response_type", "code");
@@ -378,8 +419,9 @@ export async function exchangeWorkspaceProviderOAuthCode(input: {
   code: string;
   verifier: string;
   redirectUri: string;
+  tokenUrl?: string;
 }): Promise<Record<string, unknown>> {
-  const tokenUrl = input.provider.oauth?.tokenUrl;
+  const tokenUrl = input.tokenUrl ?? input.provider.oauth?.tokenUrl;
   if (!tokenUrl) throw new Error("Provider does not support OAuth.");
   const authorization = `Basic ${Buffer.from(`${input.clientId}:${input.clientSecret}`).toString("base64")}`;
   if (input.providerId === "github") {
@@ -444,6 +486,36 @@ export async function exchangeWorkspaceProviderOAuthCode(input: {
         : {}),
     };
   }
+  if (input.providerId === "salesforce") {
+    const { response, body } = await fetchBoundedProviderJson(
+      tokenUrl,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          grant_type: "authorization_code",
+          client_id: input.clientId,
+          client_secret: input.clientSecret,
+          code: input.code,
+          redirect_uri: input.redirectUri,
+        }),
+      },
+      input.provider.label,
+    );
+    const accessToken = text(body.access_token);
+    if (!response.ok || !accessToken) {
+      throw new Error(
+        `${input.provider.label} OAuth token exchange failed (${response.status}).`,
+      );
+    }
+    const expiresIn = Number(body.expires_in);
+    return {
+      ...body,
+      ...(Number.isFinite(expiresIn) && expiresIn > 0
+        ? { expiry_date: Date.now() + expiresIn * 1_000 }
+        : {}),
+    };
+  }
   if (input.providerId === "jira") {
     const { response, body } = await fetchBoundedProviderJsonValue(
       tokenUrl,
@@ -679,6 +751,26 @@ async function resolveWorkspaceProviderIdentitySingle(
       label: text(body.hub_domain) ?? `HubSpot portal ${accountId}`,
     };
   }
+  if (providerId === "salesforce") {
+    const instanceUrl = normalizeSalesforceInstanceUrl(
+      text(tokens.instance_url),
+    );
+    const identity = parseSalesforceIdentityUrl(text(tokens.id));
+    if (!instanceUrl || !identity) {
+      throw new Error(
+        "Salesforce OAuth response did not identify the connected organization.",
+      );
+    }
+    return {
+      accountId: identity.organizationId,
+      label: instanceUrl.hostname,
+      config: {
+        salesforceInstanceUrl: instanceUrl.origin,
+        salesforceIdentityUrl: identity.url.href,
+        salesforceOrganizationId: identity.organizationId,
+      },
+    };
+  }
   if (providerId === "sentry") {
     const accessToken = text(tokens.access_token)!;
     const { response, body: user } = await fetchBoundedProviderJson(
@@ -799,7 +891,13 @@ export function scopedOAuthAccountId(
   owner: string,
   accountId: string,
 ): string {
-  if (provider !== "hubspot" && provider !== "jira") return accountId;
+  if (
+    provider !== "hubspot" &&
+    provider !== "salesforce" &&
+    provider !== "jira"
+  ) {
+    return accountId;
+  }
   const ownerKey = crypto
     .createHash("sha256")
     .update(`${provider}:${owner.trim().toLowerCase()}`)
@@ -902,9 +1000,88 @@ function clientCredentialKeys(
     const integrationPrefix = `HUBSPOT_INTEGRATION_CLIENT_${suffix}`;
     return [integrationPrefix, `HUBSPOT_CLIENT_${suffix}`];
   }
+  if (provider === "salesforce") {
+    const integrationPrefix = `SALESFORCE_INTEGRATION_CLIENT_${suffix}`;
+    const consumerCredential = `SALESFORCE_CONSUMER_${
+      field === "id" ? "KEY" : "SECRET"
+    }`;
+    return [
+      integrationPrefix,
+      `SALESFORCE_CLIENT_${suffix}`,
+      consumerCredential,
+    ];
+  }
   return [`${prefix}_CLIENT_${suffix}`];
 }
 
+function normalizeSalesforceInstanceUrl(value: string | undefined): URL | null {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    const host = url.hostname.toLowerCase();
+    if (
+      url.protocol !== "https:" ||
+      url.username ||
+      url.password ||
+      url.port ||
+      (host !== "salesforce.com" && !host.endsWith(".salesforce.com"))
+    ) {
+      return null;
+    }
+    return new URL(url.origin);
+  } catch {
+    return null;
+  }
+}
+
+function parseSalesforceIdentityUrl(
+  value: string | undefined,
+): { organizationId: string; url: URL } | null {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    const host = url.hostname.toLowerCase();
+    if (
+      url.protocol !== "https:" ||
+      url.username ||
+      url.password ||
+      url.port ||
+      (host !== "salesforce.com" && !host.endsWith(".salesforce.com"))
+    ) {
+      return null;
+    }
+    const match = url.pathname.match(/^\/id\/([^/]+)\/[^/]+\/?$/);
+    if (!match?.[1]) return null;
+    return { organizationId: match[1], url };
+  } catch {
+    return null;
+  }
+}
+
+export function resolveSalesforceOAuthLoginUrl(
+  environment: string | undefined,
+): string | null {
+  const normalized = environment?.trim().toLowerCase();
+  if (!normalized || normalized === "production") {
+    return SALESFORCE_PRODUCTION_LOGIN_URL;
+  }
+  if (normalized === "sandbox") return SALESFORCE_SANDBOX_LOGIN_URL;
+  return null;
+}
+
+export function salesforceOAuthEndpoint(
+  loginUrl: string,
+  phase: "authorize" | "token",
+): string {
+  if (
+    loginUrl !== SALESFORCE_PRODUCTION_LOGIN_URL &&
+    loginUrl !== SALESFORCE_SANDBOX_LOGIN_URL
+  ) {
+    throw new Error("Invalid Salesforce OAuth login URL.");
+  }
+  return `${loginUrl}/services/oauth2/${phase}`;
+}
+
 async function resolveProviderClientCredentials(
   provider: GenericWorkspaceOAuthProvider,
 ): Promise<[string | null, string | null]> {

package/corpus/core/src/styles/agent-native.css

@@ -771,6 +771,7 @@
 
 .agent-composer-missing-key-trigger {
   display: flex;
+  cursor: pointer;
   min-height: 4.5rem;
   width: 100%;
   flex: 1;
@@ -783,6 +784,9 @@
   text-align: start;
   color: hsl(var(--foreground));
   outline: none;
+  transition:
+    background-color 150ms ease-out,
+    box-shadow 150ms ease-out;
 }
 
 .agent-composer-missing-key-trigger:hover {
@@ -793,6 +797,14 @@
   box-shadow: inset 0 0 0 2px hsl(var(--ring));
 }
 
+.agent-composer-missing-key-content {
+  display: flex;
+  min-width: 0;
+  flex-direction: column;
+  align-items: flex-start;
+  gap: 0.5rem;
+}
+
 .agent-composer-missing-key-copy {
   display: flex;
   min-width: 0;
@@ -812,6 +824,31 @@
   color: hsl(var(--muted-foreground));
 }
 
+.agent-composer-missing-key-cta {
+  display: inline-flex;
+  min-height: 2rem;
+  align-items: center;
+  justify-content: center;
+  border-radius: 0.375rem;
+  background: hsl(var(--foreground));
+  padding: 0.5rem 0.75rem;
+  color: hsl(var(--background));
+  font-size: 0.75rem;
+  font-weight: 600;
+  line-height: 1rem;
+  transition:
+    opacity 150ms ease-out,
+    transform 150ms ease-out;
+}
+
+.agent-composer-missing-key-trigger:hover .agent-composer-missing-key-cta {
+  opacity: 0.9;
+}
+
+.agent-composer-missing-key-trigger:active .agent-composer-missing-key-cta {
+  transform: scale(0.98);
+}
+
 .agent-composer-root--hero .agent-composer-missing-key-trigger {
   min-height: 7.5rem;
   justify-content: center;
@@ -824,6 +861,10 @@
   line-height: 1.375rem;
 }
 
+.agent-composer-root--hero .agent-composer-missing-key-content {
+  align-items: center;
+}
+
 .agent-composer-stack {
   position: relative;
   flex-shrink: 0;
@@ -881,13 +922,15 @@
   line-height: 1.125rem;
 }
 
-.agent-thinking-indicator__text {
+.agent-thinking-indicator__text,
+.agent-running-shimmer {
   display: inline-block;
 }
 
 @media (prefers-reduced-motion: no-preference) {
   @supports ((background-clip: text) or (-webkit-background-clip: text)) {
-    .agent-thinking-indicator__text {
+    .agent-thinking-indicator__text,
+    .agent-running-shimmer {
       color: transparent;
       background: linear-gradient(
         90deg,

package/corpus/core/src/templates/default/.agents/skills/agent-native-docs/SKILL.md

@@ -66,6 +66,33 @@ state, auth, and agent-chat runtime contracts. Never edit `node_modules` or
 deep-import its private source. Manual copying is only the fallback described by
 an unknown third-party package's add-style blueprint.
 
+## Reuse Proven Patterns (rg + cp)
+
+Version-matched installed source outranks web docs or memory: it is the exact
+code shipping with this app. `node_modules/@agent-native/core/corpus/templates/`
+holds source for every first-party template, not just the one this app started
+from, so a pattern from the mail template is fair game for a tasks app. Grep
+across it, then copy a whole file as a starting point instead of writing the
+pattern from scratch:
+
+```bash
+# Find how other templates solved a similar problem
+rg -n "drag.*drop|reorder" node_modules/@agent-native/core/corpus/templates
+
+# Grab a proven action file as a starting point, then adapt names/schema
+cp node_modules/@agent-native/core/corpus/templates/mail/actions/archive-email.ts \
+   actions/archive-item.ts
+
+# Read the full framework source behind an API, not just the corpus copy
+rg -n "defineAction" node_modules/@agent-native/core/src/action.ts
+```
+
+Copying template-level app code (actions, components, skill files) is the
+expected reuse path — templates exist to be forked. This is different from
+copying `core`/`toolkit` **runtime internals**: for those, follow
+`customizing-agent-native`'s configure/compose/eject ladder instead of
+hand-duplicating framework logic.
+
 ## Useful Slugs
 
 | Need                           | Slugs                                                         |

package/corpus/core/src/templates/default/.agents/skills/app-branding/SKILL.md

@@ -0,0 +1,159 @@
+---
+name: app-branding
+description: >-
+  How to rename or rebrand the app so every surface — title, package metadata,
+  PWA manifest, and icons — stays consistent. Use when a prompt establishes or
+  implies a new app name, title, or visual identity, OR when you generate an app
+  title, theme, or icon yourself while scaffolding an app from an initial prompt.
+scope: dev
+metadata:
+  internal: true
+---
+
+# App Branding
+
+## Trigger
+
+Read this skill whenever the app's name, title, or visual identity is being
+established or changed — whether the user states it or **you derive it yourself**.
+
+- **Explicit** — the prompt names the app: "rename this app to …", "this is a
+  Todo app called …", "call this app …".
+- **Implicit / agent-generated** — the prompt describes what to build but leaves
+  the branding to you: "build me a habit tracker", "turn this into a recipe
+  manager", "make a CRM for my studio". The moment you decide on a title, theme
+  color, or icon from that prompt, treat it as a branding change and apply the
+  full checklist so your generated identity lands on every surface — not just
+  the one screen you happen to be building.
+
+If you are inventing an app title, theme, or icon as part of scaffolding a new
+app from an initial prompt, that counts — run the checklist in the same pass.
+
+## Rule
+
+Apply **all** of the updates below in a single consistent pass. Depending on the
+template, the app name may live in one source-of-truth module or be spread
+across several files — either way, a partial rename leaves the app half-branded
+(a stale tab title, launcher label, or icon).
+
+Derive three values once, then reuse them everywhere:
+
+- **Title** — human-readable display name, e.g. `"My Task App"`.
+- **Slug** — URL/npm-safe form: lowercase letters, digits, and hyphens only,
+  e.g. `"my-task-app"`.
+- **Description** — one sentence describing what the app does.
+
+## Locate the layout first
+
+Branding lives in different places depending on the template. Detect which
+layout you are in before editing:
+
+- **Centralized layout** — `app/lib/app-config.ts` exists. It is the single
+  source of truth for the name and title; the frontend surfaces (`<title>`,
+  route `meta()`, header, sidebar, index heading, `apple-mobile-web-app-title`)
+  derive from its `APP_NAME` / `APP_TITLE` exports, so you change the name in one
+  place.
+- **Inlined layout** — no `app/lib/app-config.ts`. The name and title are
+  written directly into `package.json`, each route's `meta()`, and
+  `app/root.tsx`. You must update each surface individually.
+
+When in doubt, `grep -rn` the current title and slug across `app/`, `server/`,
+`package.json`, and `public/` and fix every real hit — the two layouts share the
+manifest and icon steps regardless.
+
+## The Checklist
+
+### Step 1 — App name + title source
+
+**Centralized layout** (`app/lib/app-config.ts`): change both constants and stop —
+the rest of the frontend derives from them.
+
+- `rawAppName` → the **slug**.
+- `rawAppTitle` → the **title**.
+
+**Inlined layout** (no `app-config.ts`): set the title/slug at each surface.
+
+- Every route `meta()` title under `app/routes/*.tsx` (e.g. `_index.tsx`,
+  `agent.tsx`, `settings.tsx`) — replace the app title. These are seeded from a
+  `{{APP_TITLE}}` placeholder at scaffold time and become plain literals
+  afterward.
+- Any `useActionQuery("hello", { name: … })` in `app/routes/_index.tsx` seeded
+  with the title.
+- `app/root.tsx` `apple-mobile-web-app-title` — a literal (often `"App"`); set it
+  to the **title**.
+
+### Step 2 — `package.json` (both layouts)
+
+- `displayName` → the **title** (add the field if the template omits it).
+- `description` → the **description** (add if absent).
+- `name` → the **slug**. Only change this if the user explicitly asks to rename
+  the package (it is the npm package identifier).
+
+### Step 3 — Login / auth title (centralized layout only)
+
+If `server/plugins/auth.ts` exists it keeps its **own** duplicate `rawAppTitle`,
+used on the login/signup pages. Set it to the same **title** as
+`app/lib/app-config.ts`. (The inlined layout's `server/middleware/auth.ts`
+carries no app title — skip this step there.)
+
+### Step 4 — `public/manifest.json` (both layouts)
+
+This is a static file (not generated by a plugin). Update:
+
+- `name` → the **title** (full install name in OS app drawers).
+- `short_name` → a compact launcher label; keep it ≤12 characters, abbreviating
+  the title if needed.
+- `description` → the same **description** used in `package.json`.
+
+### Step 5 — Icon SVG files (both layouts)
+
+Replace the icon files with a new mark that reflects the app's identity. The set
+present depends on the template; update each one you find:
+
+| File | Purpose |
+| --- | --- |
+| `public/favicon.svg` | Browser tab favicon |
+| `public/icon-180.svg` | Apple touch icon (iOS home screen) |
+| `public/icon-192.svg` | PWA install icon (Android / Chrome) |
+| `public/icon-512.svg` | PWA install icon (large / splash) |
+
+Build the icon from **SVG primitives** — do not embed a base64-encoded PNG. All
+files should share the same visual design; only the `width` and `height`
+attributes differ. A simple, reliable approach: a filled rounded square in the
+brand color with the first letter (or a relevant glyph) centered in white.
+
+Template to adapt (change `fill`, the letter/glyph, and `rx` to suit the brand):
+
+```svg
+<svg xmlns="http://www.w3.org/2000/svg" width="192" height="192" viewBox="0 0 192 192">
+  <rect width="192" height="192" rx="40" fill="#2563EB"/>
+  <text x="96" y="130" font-family="system-ui, sans-serif" font-size="110"
+        font-weight="700" fill="white" text-anchor="middle">A</text>
+</svg>
+```
+
+Keep `width`/`height` at `180`, `192`, and `512` for the respective icon files;
+`favicon.svg` can use any of these sizes (the `viewBox` keeps it scalable).
+
+## What NOT to change
+
+These are stable identifiers or template-internal files, not user-facing brand:
+
+- `configureTracking({ app, template })` in `app/root.tsx` — analytics
+  identifiers seeded at scaffold time; leave them. This holds even in the inlined
+  layout, where `app` was seeded from the slug — changing it re-keys analytics
+  history.
+- `server/plugins/agent-chat.ts` `appId` (centralized layout) — a stable
+  platform analytics/routing key; leave it exactly as scaffolded.
+- `.github/workflows/*.yml` — template automation; references the repo/template
+  identity, not the running app.
+- `AGENTS.md` / `DEVELOPING.md` — developer docs for the template itself.
+
+## Verification
+
+- `pnpm typecheck` passes.
+- Grep for the old title/slug across `app/`, `server/`, `package.json`, and
+  `public/` — no unintended leftovers remain (except the intentional
+  "do not change" identifiers above).
+- The browser tab title, sidebar/header, and index heading all show the new
+  title.