@agent-native/core 0.115.4 → 0.116.0

package/src/guards/explicit-collab-access.ts

@@ -0,0 +1,229 @@
+/**
+ * Require generated apps to choose how collaboration events are scoped.
+ * Legacy `resourceType` callers remain valid during the access-option
+ * migration; this guard only reports implicit createCollabPlugin configs.
+ */
+
+import {
+  lineColForOffset,
+  readFileSafe,
+  relPosix,
+  walk,
+} from "./scan-utils.js";
+import type { GuardFinding, GuardResult, GuardScanOptions } from "./types.js";
+
+const SOURCE_FILE = /\.(?:[cm]?[jt]s|[jt]sx)$/;
+const CALL = /\bcreateCollabPlugin\s*\(/g;
+const EXPLICIT_ACCESS_KEYS = new Set(["access", "resourceType"]);
+const FINDING_MESSAGE =
+  'createCollabPlugin must declare access explicitly. Use access: { mode: "resource", resourceType: "..." } for scoped resources or access: { mode: "all-authenticated" } when deployment-wide delivery is intentional. Legacy resourceType is also accepted during migration.';
+
+function maskCommentsAndStrings(contents: string): string {
+  const masked = contents.split("");
+  for (let i = 0; i < contents.length; i++) {
+    const char = contents[i];
+    if (char === '"' || char === "'" || char === "`") {
+      const end = skipQuoted(contents, i);
+      for (let cursor = i; cursor < end; cursor++) {
+        if (masked[cursor] !== "\n") masked[cursor] = " ";
+      }
+      i = end - 1;
+      continue;
+    }
+    if (contents.startsWith("//", i)) {
+      const newline = contents.indexOf("\n", i + 2);
+      const end = newline === -1 ? contents.length : newline;
+      for (let cursor = i; cursor < end; cursor++) masked[cursor] = " ";
+      i = end - 1;
+      continue;
+    }
+    if (contents.startsWith("/*", i)) {
+      const commentEnd = contents.indexOf("*/", i + 2);
+      const end = commentEnd === -1 ? contents.length : commentEnd + 2;
+      for (let cursor = i; cursor < end; cursor++) {
+        if (masked[cursor] !== "\n") masked[cursor] = " ";
+      }
+      i = end - 1;
+    }
+  }
+  return masked.join("");
+}
+
+function skipQuoted(contents: string, start: number): number {
+  const quote = contents[start];
+  let escaped = false;
+  for (let i = start + 1; i < contents.length; i++) {
+    const char = contents[i];
+    if (escaped) {
+      escaped = false;
+    } else if (char === "\\") {
+      escaped = true;
+    } else if (char === quote) {
+      return i + 1;
+    }
+  }
+  return contents.length;
+}
+
+function skipTrivia(contents: string, start: number): number {
+  let i = start;
+  while (i < contents.length) {
+    if (/\s/.test(contents[i] ?? "")) {
+      i++;
+      continue;
+    }
+    if (contents.startsWith("//", i)) {
+      const newline = contents.indexOf("\n", i + 2);
+      i = newline === -1 ? contents.length : newline + 1;
+      continue;
+    }
+    if (contents.startsWith("/*", i)) {
+      const end = contents.indexOf("*/", i + 2);
+      i = end === -1 ? contents.length : end + 2;
+      continue;
+    }
+    break;
+  }
+  return i;
+}
+
+function findObjectEnd(contents: string, start: number): number | null {
+  let depth = 0;
+  for (let i = start; i < contents.length; i++) {
+    const char = contents[i];
+    if (char === '"' || char === "'" || char === "`") {
+      i = skipQuoted(contents, i) - 1;
+      continue;
+    }
+    if (contents.startsWith("//", i)) {
+      const newline = contents.indexOf("\n", i + 2);
+      i = newline === -1 ? contents.length : newline;
+      continue;
+    }
+    if (contents.startsWith("/*", i)) {
+      const end = contents.indexOf("*/", i + 2);
+      i = end === -1 ? contents.length : end + 1;
+      continue;
+    }
+    if (char === "{") depth++;
+    if (char === "}" && --depth === 0) return i;
+  }
+  return null;
+}
+
+function hasExplicitAccessProperty(
+  contents: string,
+  objectStart: number,
+  objectEnd: number,
+): boolean {
+  let braceDepth = 0;
+  let bracketDepth = 0;
+  let parenDepth = 0;
+  let expectingProperty = true;
+
+  for (let i = objectStart + 1; i < objectEnd; i++) {
+    i = skipTrivia(contents, i);
+    if (i >= objectEnd) break;
+    const char = contents[i];
+
+    if (expectingProperty && (char === '"' || char === "'")) {
+      const tokenEnd = skipQuoted(contents, i);
+      const key = contents.slice(i + 1, tokenEnd - 1);
+      const afterKey = skipTrivia(contents, tokenEnd);
+      if (EXPLICIT_ACCESS_KEYS.has(key) && contents[afterKey] === ":") {
+        return true;
+      }
+      i = tokenEnd - 1;
+      expectingProperty = false;
+      continue;
+    }
+
+    if (expectingProperty && /[A-Za-z_$]/.test(char ?? "")) {
+      let tokenEnd = i + 1;
+      while (/[A-Za-z0-9_$]/.test(contents[tokenEnd] ?? "")) tokenEnd++;
+      const key = contents.slice(i, tokenEnd);
+      const afterKey = skipTrivia(contents, tokenEnd);
+      const delimiter = contents[afterKey];
+      if (
+        EXPLICIT_ACCESS_KEYS.has(key) &&
+        (delimiter === ":" || delimiter === "," || afterKey >= objectEnd)
+      ) {
+        return true;
+      }
+      i = tokenEnd - 1;
+      expectingProperty = false;
+      continue;
+    }
+
+    if (char === '"' || char === "'" || char === "`") {
+      i = skipQuoted(contents, i) - 1;
+      continue;
+    }
+    if (contents.startsWith("//", i) || contents.startsWith("/*", i)) {
+      i = skipTrivia(contents, i) - 1;
+      continue;
+    }
+
+    if (char === "{") braceDepth++;
+    else if (char === "}") braceDepth--;
+    else if (char === "[") bracketDepth++;
+    else if (char === "]") bracketDepth--;
+    else if (char === "(") parenDepth++;
+    else if (char === ")") parenDepth--;
+    else if (
+      char === "," &&
+      braceDepth === 0 &&
+      bracketDepth === 0 &&
+      parenDepth === 0
+    ) {
+      expectingProperty = true;
+    }
+  }
+
+  return false;
+}
+
+export function scanExplicitCollabAccess(
+  options: GuardScanOptions,
+): GuardResult {
+  const { root } = options;
+  const findings: GuardFinding[] = [];
+
+  for (const file of walk(root)) {
+    if (!SOURCE_FILE.test(file) || file.endsWith(".d.ts")) continue;
+    const contents = readFileSafe(file);
+    if (contents === null || !contents.includes("createCollabPlugin")) continue;
+    const searchable = maskCommentsAndStrings(contents);
+
+    CALL.lastIndex = 0;
+    let match: RegExpExecArray | null;
+    while ((match = CALL.exec(searchable)) !== null) {
+      const callStart = match.index;
+      const objectStart = skipTrivia(contents, CALL.lastIndex);
+      if (contents[objectStart] !== "{") {
+        if (contents[objectStart] === ")") {
+          const { line } = lineColForOffset(contents, callStart);
+          findings.push({
+            file: relPosix(root, file),
+            line,
+            message: FINDING_MESSAGE,
+          });
+        }
+        continue;
+      }
+      const objectEnd = findObjectEnd(contents, objectStart);
+      if (objectEnd === null) continue;
+      CALL.lastIndex = objectEnd + 1;
+
+      if (hasExplicitAccessProperty(contents, objectStart, objectEnd)) continue;
+      const { line } = lineColForOffset(contents, callStart);
+      findings.push({
+        file: relPosix(root, file),
+        line,
+        message: FINDING_MESSAGE,
+      });
+    }
+  }
+
+  return { name: "explicit-collab-access", findings };
+}

package/src/guards/index.ts

@@ -12,6 +12,7 @@
 
 export { scanDbToolScoping } from "./db-tool-scoping.js";
 export type { DbToolScopingOptions } from "./db-tool-scoping.js";
+export { scanExplicitCollabAccess } from "./explicit-collab-access.js";
 export { scanDrizzlePush } from "./no-drizzle-push.js";
 export { scanEnvCredentials } from "./no-env-credentials.js";
 export { scanEnvMutation } from "./no-env-mutation.js";

package/src/localization/default-messages.ts

@@ -33,6 +33,47 @@ const messages = {
     openResourceSettings: "Open resource settings",
     backHome: "Back to home",
   },
+  agentResources: {
+    openDocs: "Open {{section}} documentation",
+    backToResources: "Back to agent resources",
+    createFile: {
+      nameLabel: "File name",
+      namePlaceholder: "notes/ideas",
+      menuDescription: "Add a new file by name",
+    },
+    files: {
+      title: "Files",
+      description: "Files the agent can read and write.",
+    },
+    instructions: {
+      title: "Instructions",
+      description:
+        "The rules, preferences, and project guidance that steer the agent.",
+    },
+    agents: {
+      title: "Agents",
+      description:
+        "Reusable profiles for focused sub-agents and delegated work.",
+    },
+    memory: {
+      title: "Memory",
+      description: "Durable notes the agent can retrieve across conversations.",
+    },
+    skills: {
+      title: "Skills",
+      description:
+        "Specialized instructions that give the agent repeatable abilities.",
+    },
+    learnings: {
+      title: "Learnings",
+      description:
+        "Corrections and patterns worth carrying forward for future work.",
+    },
+    remoteAgents: {
+      title: "Remote agents",
+      description: "Other agents this agent can call through A2A.",
+    },
+  },
   featureFlags: {
     title: "Feature flags",
     description: "Control staged capabilities without changing a deployment.",
@@ -276,7 +317,7 @@ const messages = {
     checkingAiConnection: "Checking AI connection...",
     voiceMode: {
       entryButtonLabel: "Use microphone",
-      promptTitle: "Talk to your app",
+      promptTitle: "Use your voice",
       promptDescription:
         "Voice mode keeps listening while the agent navigates and takes actions.",
       setupTitle: "Set up voice mode",
@@ -285,8 +326,9 @@ const messages = {
       connectBuilder: "Connect Builder.io",
       useOpenAiKey: "Add your own keys",
       startWithOpenAiKey: "Start with OpenAI key",
-      start: "Start voice mode",
-      keepDictating: "Keep dictating",
+      start: "Real-time voice",
+      keepDictating: "Dictate",
+      rememberPreference: "Remember my preference",
       showChat: "Show chat",
       hideChat: "Hide chat",
       end: "End voice mode",
@@ -744,9 +786,9 @@ const messages = {
     connect: "Connect",
     connectWithOAuth: "Connect with OAuth",
     useApiToken: "Use API token",
-    connectSuggestion: "Connect {{name}} to use this link in chat",
+    connectSuggestion: "Connect {{name}} to use it in chat",
     connectSuggestionWithApiToken:
-      "Connect {{name}} with an API token to use this link in chat",
+      "Connect {{name}} with an API token to use it in chat",
     dismissSuggestion: "Dismiss integration suggestion",
     backToIntegrations: "Back to integrations",
     customTitle: "Add custom MCP server",
@@ -795,6 +837,13 @@ const messages = {
         setupNote:
           "Notion MCP uses user OAuth. Enterprise workspaces can audit MCP usage and allow or block clients; reconnect after admin policy changes.",
       },
+      granola: {
+        description: "Search meeting notes, transcripts, and action items.",
+        useCase:
+          "Meeting notes, recordings, transcripts, action items, follow-ups",
+        setupNote:
+          "Granola MCP uses browser OAuth. Authorize the signed-in Granola account and review which meeting notes and transcripts the agent can access.",
+      },
       semgrep: {
         description: "Scan code for security findings.",
         useCase: "Security scanning, vulnerability detection, code analysis",

package/src/mcp/connect-route.ts

@@ -467,10 +467,6 @@ function renderConnectPage(params: {
   });
   const safeMcpUrl = escapeHtml(mcpUrl);
   const connectTemplateValues = { appName, appUrl, mcpUrl, serverId };
-  const brandMarkSvg = agentNativeMarkSvg(
-    "brand-mark",
-    "agent-native-connect-brand-gradient",
-  );
   const flowMarkSvg = agentNativeMarkSvg(
     "flow-mark",
     "agent-native-connect-flow-gradient",
@@ -561,21 +557,6 @@ function renderConnectPage(params: {
       0 30px 90px rgba(0,0,0,0.5);
     padding: 1.25rem;
   }
-  .topbar {
-    display: flex; align-items: center; justify-content: space-between;
-    gap: 0.75rem; margin-bottom: 1.75rem;
-  }
-  .brand-lockup {
-    display: flex; align-items: center; gap: 0.55rem;
-    color: var(--muted); font-size: 0.78rem; font-weight: 600;
-  }
-  .brand-mark { width: 18px; height: auto; display: block; }
-  .app-pill {
-    max-width: 50%; border: 1px solid var(--border);
-    border-radius: 999px; padding: 0.28rem 0.55rem;
-    color: var(--subtle); font-size: 0.72rem; line-height: 1;
-    overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
-  }
   .hero { padding: 0 0.75rem; text-align: center; }
   .flow {
     display: flex; align-items: center; justify-content: center;
@@ -597,11 +578,6 @@ function renderConnectPage(params: {
     background: linear-gradient(90deg, transparent, var(--border-strong), transparent);
     background-position: center;
   }
-  .eyebrow {
-    text-align: center; font-size: 0.72rem; font-weight: 600;
-    letter-spacing: 0.08em; text-transform: uppercase;
-    color: var(--subtle); margin-bottom: 0.55rem;
-  }
   h1 {
     text-align: center; font-size: 1.45rem; font-weight: 680;
     line-height: 1.25; margin-bottom: 0.7rem;
@@ -714,8 +690,7 @@ function renderConnectPage(params: {
   .connections-title { font-weight: 600; color: var(--muted); }
   .connections-state {
     margin-left: auto; color: var(--subtle); font-size: 0.73rem;
-    border: 1px solid var(--border); border-radius: 999px;
-    padding: 0.18rem 0.45rem; line-height: 1;
+    line-height: 1;
   }
   .connections .chev {
     width: 7px; height: 7px; border-right: 1.5px solid currentColor;
@@ -738,8 +713,16 @@ function renderConnectPage(params: {
     margin-bottom: 0.9rem; display: none; line-height: 1.4; }
   .msg.err { display: block; color: var(--error); background: var(--error-bg);
     border: 1px solid rgba(252,165,165,0.16); }
-  .msg.ok { display: block; color: var(--ok); background: var(--ok-bg);
+  .msg.ok { display: block; background: var(--ok-bg);
     border: 1px solid var(--ok-border); }
+  .msg-title {
+    display: block; color: var(--ok); font-size: 0.95rem;
+    font-weight: 700; line-height: 1.25;
+  }
+  .msg-copy {
+    display: block; color: rgba(134,239,172,0.72); font-size: 0.78rem;
+    line-height: 1.4; margin-top: 0.2rem;
+  }
   .result-panel { padding-top: 0.15rem; }
   .result-title {
     color: var(--text); font-size: 0.95rem; font-weight: 650;
@@ -757,9 +740,7 @@ function renderConnectPage(params: {
     body { align-items: flex-start; padding: 0.75rem; }
     .card { padding: 1rem; }
     .hero { padding: 0; }
-    .topbar { margin-bottom: 1.35rem; }
     h1 { font-size: 1.3rem; }
-    .app-pill { max-width: 46%; }
     pre { font-size: 0.72rem; }
   }
   /* MCP URL display + per-host tabs (the non-dev path). */
@@ -861,9 +842,6 @@ function renderConnectPage(params: {
     border-color: var(--ok-border) !important;
   }
   .static-token-mint .static-token-body { padding-top: 0.5rem; }
-  .static-token-mint > summary .connections-state {
-    font-style: normal;
-  }
   @media (min-width: 560px) {
     .card { max-width: 580px; }
   }
@@ -872,17 +850,8 @@ function renderConnectPage(params: {
 </head>
 <body>
 <div class="card">
-  <div class="topbar">
-    <div class="brand-lockup">
-      ${brandMarkSvg}
-      <span>Agent Native</span>
-    </div>
-    <div class="app-pill" title="${safeApp}">${safeApp}</div>
-  </div>
-
   <div class="hero">
-    <!-- "Connect an external agent" is kept as the accessible consent label. -->
-    <div class="flow" role="img" aria-label="Connect an external agent to ${safeApp}">
+    <div class="flow" role="img" aria-label="Authorize ${safeApp}">
       <span class="tile" aria-hidden="true">
         ${flowMarkSvg}
       </span>
@@ -892,7 +861,6 @@ function renderConnectPage(params: {
       </span>
     </div>
 
-    <div class="eyebrow">Connect an external agent</div>
     <h1>${safeUserCode ? `Authorize ${safeApp} from your terminal?` : `Use ${safeApp} from your AI assistant`}</h1>
     <p class="identity">
       <span>Signed in as <strong>${safeEmail}</strong></span>
@@ -909,7 +877,6 @@ function renderConnectPage(params: {
   <details id="staticTokenMint" class="connections static-token-mint"${safeUserCode ? " open" : ""}>
     <summary>
       <span class="connections-title">${safeUserCode ? "Authorize this device" : MCP_STATIC_TOKEN_FALLBACK.title}</span>
-      <span class="connections-state">${safeUserCode ? "From your terminal" : MCP_STATIC_TOKEN_FALLBACK.state}</span>
       <span class="chev" aria-hidden="true"></span>
     </summary>
     <div class="static-token-body">
@@ -939,7 +906,7 @@ function renderConnectPage(params: {
   <details id="connections" class="connections">
     <summary>
       <span class="connections-title">Existing connections</span>
-      <span id="connectionsState" class="connections-state">Checking</span>
+      <span id="connectionsState" class="connections-state hidden" aria-live="polite"></span>
       <span class="chev" aria-hidden="true"></span>
     </summary>
     <div id="tokenList" class="token-list"><div class="empty-state">Checking connections...</div></div>
@@ -990,8 +957,20 @@ function renderConnectPage(params: {
       }, 1400);
     });
   });
-  function showMsg(text, kind) {
-    msgEl.textContent = text;
+  function showMsg(text, kind, title) {
+    msgEl.textContent = "";
+    if (title) {
+      var titleEl = document.createElement("strong");
+      titleEl.className = "msg-title";
+      titleEl.textContent = title;
+      msgEl.appendChild(titleEl);
+      var copyEl = document.createElement("span");
+      copyEl.className = "msg-copy";
+      copyEl.textContent = text;
+      msgEl.appendChild(copyEl);
+    } else {
+      msgEl.textContent = text;
+    }
     msgEl.className = "msg " + (kind || "err");
   }
   function clearMsg() { msgEl.className = "msg"; msgEl.textContent = ""; }
@@ -1039,19 +1018,22 @@ function renderConnectPage(params: {
       var res = await fetch(BASE + "/tokens", { credentials: "same-origin" });
       if (!res.ok) {
         connectionsStateEl.textContent = "Unavailable";
+        connectionsStateEl.classList.remove("hidden");
         listEl.innerHTML = '<div class="empty-state">Could not load connections.</div>';
         return;
       }
       var data = await res.json();
       var tokens = (data && data.tokens) || [];
       if (!tokens.length) {
-        connectionsStateEl.textContent = "None";
+        connectionsStateEl.textContent = "";
+        connectionsStateEl.classList.add("hidden");
         connectionsEl.open = false;
         listEl.innerHTML = '<div class="empty-state">Created connections will appear here for revoking later.</div>';
         return;
       }
       var activeCount = tokens.filter(function (t) { return !t.revokedAt; }).length;
-      connectionsStateEl.textContent = activeCount === 1 ? "1 active" : activeCount + " active";
+      connectionsStateEl.textContent = activeCount ? String(activeCount) : "";
+      connectionsStateEl.classList.toggle("hidden", activeCount === 0);
       listEl.innerHTML = "";
       tokens.forEach(function (t) {
         var div = document.createElement("div");
@@ -1082,6 +1064,7 @@ function renderConnectPage(params: {
       });
     } catch (e) {
       connectionsStateEl.textContent = "Unavailable";
+      connectionsStateEl.classList.remove("hidden");
       listEl.innerHTML = '<div class="empty-state">Could not load connections.</div>';
     }
   }
@@ -1098,7 +1081,7 @@ function renderConnectPage(params: {
           showMsg((a.data && a.data.error) || "Could not authorize this device code.");
           return;
         }
-        showMsg("Device authorized — finishing connection… you can return to your terminal.", "ok");
+        showMsg("Finishing connection… you can return to your terminal.", "ok", "Device authorized");
         btn.classList.add("hidden");
         document.getElementById("mintForm").classList.add("hidden");
         var cc = document.getElementById("codeCallout");
@@ -1133,7 +1116,7 @@ function renderConnectPage(params: {
               });
               if (fresh.length > 0) {
                 clearInterval(iv);
-                showMsg("Connected. This device can now act as you — manage or revoke it below.", "ok");
+                showMsg("This device can now act as you — manage or revoke it below.", "ok", "Connected");
                 loadTokens();
                 return;
               }

package/src/provider-api/index.ts

@@ -1100,7 +1100,7 @@ const PROVIDER_CONFIGS: Record<ProviderApiId, ProviderApiConfig> = {
     docsUrls: ["https://developers.google.com/drive/api/reference/rest/v3"],
     specUrls: ["https://www.googleapis.com/discovery/v1/apis/drive/v3/rest"],
     allowedHostSuffixes: ["googleapis.com"],
-    templateUses: ["brain", "content", "slides", "dispatch"],
+    templateUses: ["brain", "content", "slides", "dispatch", "analytics"],
     examples: [
       { label: "List files", method: "GET", path: "/files" },
       { label: "Get file metadata", method: "GET", path: "/files/{fileId}" },