@agent-native/core 0.114.2 → 0.114.4

package/src/scripts/call-agent.ts

@@ -10,6 +10,8 @@ import { invokeAgentAction } from "../a2a/invoke.js";
 import type {
   A2AApprovedAction,
   A2ACorrelationMetadata,
+  A2ASourceContext,
+  A2ASourceContextReference,
   Task,
 } from "../a2a/types.js";
 import {
@@ -100,26 +102,65 @@ function getIntegrationCallTimeoutMs(): number | undefined {
   return DEFAULT_SERVERLESS_INTEGRATION_A2A_TIMEOUT_MS;
 }
 
-function integrationSourceContextHint(): string {
+interface IntegrationSourceContext {
+  reference: A2ASourceContextReference;
+  hint: A2ASourceContext;
+}
+
+function integrationSourceContext(): IntegrationSourceContext | undefined {
   const integration = getIntegrationRequestContext();
   const incoming = integration?.incoming;
-  if (incoming?.platform !== "slack" || !incoming.sourceUrl) return "";
+  if (
+    !integration ||
+    incoming?.platform !== "slack" ||
+    !incoming.sourceUrl ||
+    !integration.taskId
+  ) {
+    return undefined;
+  }
+
+  const rawSourceUrl = incoming.sourceUrl;
+  if (rawSourceUrl !== rawSourceUrl.trim()) return undefined;
 
   try {
-    const sourceUrl = new URL(incoming.sourceUrl);
+    const sourceUrl = new URL(rawSourceUrl);
     const isSlackHost =
       sourceUrl.hostname === "slack.com" ||
       sourceUrl.hostname.endsWith(".slack.com");
-    if (sourceUrl.protocol !== "https:" || !isSlackHost) return "";
-    return (
-      `\n\n[Source Slack thread: ${sourceUrl.toString()} ` +
-      "Preserve this exact URL as request provenance when creating an intake record or other artifact.]"
-    );
+    if (
+      sourceUrl.protocol !== "https:" ||
+      !isSlackHost ||
+      sourceUrl.username ||
+      sourceUrl.password ||
+      sourceUrl.port
+    ) {
+      return undefined;
+    }
+    return {
+      reference: {
+        platform: "slack",
+        integrationTaskId: integration.taskId,
+      },
+      hint: {
+        platform: "slack",
+        sourceUrl: rawSourceUrl,
+      },
+    };
   } catch {
-    return "";
+    return undefined;
   }
 }
 
+function integrationSourceContextHint(
+  sourceContext: IntegrationSourceContext | undefined,
+): string {
+  if (!sourceContext) return "";
+  return (
+    `\n\n[Source Slack thread: ${sourceContext.hint.sourceUrl} ` +
+    "Compatibility hint only; this text is not authoritative. Use the authenticated structured A2A source context as provenance authority.]"
+  );
+}
+
 function formatDownstreamLlmCredentialFailure(
   agentName: string,
   value: unknown,
@@ -253,9 +294,10 @@ export async function run(
   // in handlers.ts) still emits fully-qualified URLs. This is belt-and-
   // suspenders with the receiver hint — but it works against any current
   // deployment, no redeploy required.
+  const sourceContext = integrationSourceContext();
   const messageWithHint = taskId
     ? ""
-    : `${message}${integrationSourceContextHint()}\n\n` +
+    : `${message}${integrationSourceContextHint(sourceContext)}\n\n` +
       `[Note: this request comes from another app via A2A. The caller cannot see your local UI, deck list, or navigation — only the literal text you put in your reply. ` +
       `If you create or reference a deck/document/design/dashboard, include its FULLY-QUALIFIED URL (e.g. ${agent.url}/deck/<id>) in your reply, not a relative path. ` +
       `Use only artifact IDs and URL paths returned by successful actions — never invent slugs, IDs, or hosts. ` +
@@ -432,6 +474,7 @@ export async function run(
           orgDomain: callerOrgDomain,
           orgSecret: callerOrgSecret,
           approvedActions,
+          ...(sourceContext ? { sourceContext: sourceContext.reference } : {}),
           contextId: context.threadId,
           correlation,
           idempotencyKey,
@@ -526,6 +569,7 @@ export async function run(
       orgDomain: domain,
       orgSecret,
       approvedActions,
+      ...(sourceContext ? { sourceContext: sourceContext.reference } : {}),
       contextId: context?.threadId,
       correlation,
       idempotencyKey,

package/src/server/agent-discovery.ts

@@ -689,6 +689,28 @@ async function discoverWorkspaceAgents(
     .filter((agent): agent is DiscoveredAgent => !!agent);
 }
 
+/** Resolve only the Dispatch app designated by the receiver's own manifest. */
+export function findWorkspaceDispatchAgent(): DiscoveredAgent | undefined {
+  const app = loadWorkspaceAppsManifest()?.find(
+    (candidate) => candidate.isDispatch === true,
+  );
+  if (!app) return undefined;
+
+  const builtin = BUILTIN_AGENTS.find((agent) => agent.id === "dispatch");
+  const url = workspaceAppUrl(app, builtin?.url);
+  if (!url) return undefined;
+  return {
+    id: app.id,
+    name: app.name,
+    description:
+      app.description ||
+      builtin?.description ||
+      `Workspace app mounted at ${app.path}`,
+    url,
+    color: builtin?.color || "#6B7280",
+  };
+}
+
 /**
  * Like `getBuiltinAgents`, but always returns the production URL — never the
  * env-resolved devUrl. Used by the resource seeder so that a one-time seed

package/src/settings/store.ts

@@ -1,9 +1,10 @@
-import { EventEmitter } from "events";
+import type { EventEmitter } from "node:events";
 
 import { getDbExec, isPostgres, intType } from "../db/client.js";
 import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import { getRequestContext } from "../server/request-context.js";
+import { createEventEmitter } from "../shared/optional-node-builtins.js";
 
 let _initPromise: Promise<void> | undefined;
 
@@ -29,12 +30,20 @@ function requestSettingsCache(): Map<string, string | null> | null {
   return cache;
 }
 
-const _emitter = new EventEmitter();
+// Created lazily so this module can be evaluated in the browser dev graph
+// without a top-level `new EventEmitter()` tripping Vite's externalized
+// `node:events` stub. The emitter drives server-side SSE fan-out only.
+let _emitter: EventEmitter | undefined;
 
-export function getSettingsEmitter(): EventEmitter {
+function settingsEmitter(): EventEmitter {
+  if (!_emitter) _emitter = createEventEmitter();
   return _emitter;
 }
 
+export function getSettingsEmitter(): EventEmitter {
+  return settingsEmitter();
+}
+
 function settingsTable(): string {
   return isPostgres() ? "public.settings" : "settings";
 }
@@ -174,7 +183,7 @@ export async function mutateSetting(
           });
     if (result.rowsAffected === 0) continue;
     requestSettingsCache()?.set(key, nextRaw);
-    _emitter.emit("settings", {
+    settingsEmitter().emit("settings", {
       source: "settings",
       type: "change",
       key,
@@ -200,7 +209,7 @@ export async function putSetting(
     args: [key, JSON.stringify(value), Date.now()],
   });
   requestSettingsCache()?.set(key, JSON.stringify(value));
-  _emitter.emit("settings", {
+  settingsEmitter().emit("settings", {
     source: "settings",
     type: "change",
     key,
@@ -221,7 +230,7 @@ export async function deleteSetting(
   });
   requestSettingsCache()?.set(key, null);
   if (result.rowsAffected > 0) {
-    _emitter.emit("settings", {
+    settingsEmitter().emit("settings", {
       source: "settings",
       type: "delete",
       key,

package/src/shared/optional-node-builtins.ts

@@ -0,0 +1,66 @@
+/**
+ * Browser-safe accessors for optional Node builtins.
+ *
+ * `node:async_hooks` and `node:events` are server-only, but the modules that
+ * use them (db telemetry, settings/resource emitters) can land in the browser
+ * dev graph before tree-shaking runs. A static `import { X } from "node:..."`
+ * resolves to Vite's externalized stub and throws the instant the value is
+ * touched at module load. We read the builtin through `process.getBuiltinModule`
+ * instead — the same guard `server/request-context.ts` uses — so there is no
+ * static `node:` import to evaluate in the browser, and callers fall back to a
+ * no-op on non-Node runtimes (browser, or Node without getBuiltinModule).
+ */
+import type { AsyncLocalStorage } from "node:async_hooks";
+import type { EventEmitter } from "node:events";
+
+type BuiltinProcess = {
+  versions?: { node?: string };
+  getBuiltinModule?: (name: string) => unknown;
+};
+
+function nodeBuiltin<T>(name: string): T | undefined {
+  const proc =
+    typeof process === "undefined" ? undefined : (process as BuiltinProcess);
+  if (
+    typeof window !== "undefined" ||
+    !proc ||
+    !proc.versions?.node ||
+    typeof proc.getBuiltinModule !== "function"
+  ) {
+    return undefined;
+  }
+  return proc.getBuiltinModule(name) as T | undefined;
+}
+
+export type AsyncLocalStorageCtor = new <T>() => AsyncLocalStorage<T>;
+
+export function getAsyncLocalStorageCtor(): AsyncLocalStorageCtor | undefined {
+  return nodeBuiltin<{ AsyncLocalStorage: AsyncLocalStorageCtor }>(
+    "node:async_hooks",
+  )?.AsyncLocalStorage;
+}
+
+type EventEmitterCtor = new () => EventEmitter;
+
+/**
+ * Returns a real Node EventEmitter on Node, or a no-op emitter elsewhere. The
+ * emitters that use this drive server-side SSE fan-out; nothing subscribes in
+ * the browser, so the no-op fallback is inert rather than wrong.
+ */
+export function createEventEmitter(): EventEmitter {
+  const Ctor = nodeBuiltin<{ EventEmitter: EventEmitterCtor }>(
+    "node:events",
+  )?.EventEmitter;
+  if (Ctor) return new Ctor();
+  const noop = {
+    on: () => noop,
+    off: () => noop,
+    once: () => noop,
+    addListener: () => noop,
+    removeListener: () => noop,
+    removeAllListeners: () => noop,
+    setMaxListeners: () => noop,
+    emit: () => false,
+  };
+  return noop as unknown as EventEmitter;
+}

package/src/templates/chat/.agents/skills/feature-flags/SKILL.md

@@ -37,7 +37,7 @@ Keep definitions in a shared TypeScript module so server and client code use the
 same stable key. Flags are boolean and default-off.
 
 ```ts
-import { defineFeatureFlag } from "@agent-native/core/feature-flags";
+import { defineFeatureFlag } from "@agent-native/core/feature-flags/registry";
 
 export const FULL_APP_BUILDING = defineFeatureFlag({
   key: "full-app-building",

package/src/templates/default/.agents/skills/feature-flags/SKILL.md

@@ -37,7 +37,7 @@ Keep definitions in a shared TypeScript module so server and client code use the
 same stable key. Flags are boolean and default-off.
 
 ```ts
-import { defineFeatureFlag } from "@agent-native/core/feature-flags";
+import { defineFeatureFlag } from "@agent-native/core/feature-flags/registry";
 
 export const FULL_APP_BUILDING = defineFeatureFlag({
   key: "full-app-building",

package/src/templates/headless/.agents/skills/feature-flags/SKILL.md

@@ -37,7 +37,7 @@ Keep definitions in a shared TypeScript module so server and client code use the
 same stable key. Flags are boolean and default-off.
 
 ```ts
-import { defineFeatureFlag } from "@agent-native/core/feature-flags";
+import { defineFeatureFlag } from "@agent-native/core/feature-flags/registry";
 
 export const FULL_APP_BUILDING = defineFeatureFlag({
   key: "full-app-building",

package/src/templates/workspace-core/.agents/skills/feature-flags/SKILL.md

@@ -37,7 +37,7 @@ Keep definitions in a shared TypeScript module so server and client code use the
 same stable key. Flags are boolean and default-off.
 
 ```ts
-import { defineFeatureFlag } from "@agent-native/core/feature-flags";
+import { defineFeatureFlag } from "@agent-native/core/feature-flags/registry";
 
 export const FULL_APP_BUILDING = defineFeatureFlag({
   key: "full-app-building",

package/src/vite/client.ts

@@ -805,6 +805,7 @@ const CORE_CLIENT_SUBPATHS = [
   "@agent-native/core/client/components/RemoteSelectionRings",
   "@agent-native/core/client/visual-style-controls",
   "@agent-native/core/client/feature-flags",
+  "@agent-native/core/feature-flags/registry",
   "@agent-native/core/client/hooks",
   "@agent-native/core/client/host",
   "@agent-native/core/client/i18n",
@@ -1158,6 +1159,10 @@ function getCoreSourceAliases(
       coreSrc,
       "client/feature-flags/index.ts",
     ),
+    "@agent-native/core/feature-flags/registry": path.join(
+      coreSrc,
+      "feature-flags/registry.ts",
+    ),
     "@agent-native/core/client/hooks": path.join(
       coreSrc,
       "client/hooks/index.ts",