@agent-native/core 0.115.4 → 0.117.0

package/corpus/core/src/db/ddl-guard.ts

@@ -46,8 +46,14 @@ const PLAIN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
 export async function pgTableExists(
   table: string,
   injectedClient?: DbExec,
+  dialectIsPostgres?: boolean,
 ): Promise<boolean> {
-  if (!isPostgres() || !PLAIN_IDENTIFIER.test(table)) return false;
+  // The dialect override travels with an injected client: a multi-app process
+  // (the hosted Realtime Gateway) probes a per-app Postgres DB even when its
+  // own process-global DB is absent or SQLite.
+  if (!(dialectIsPostgres ?? isPostgres()) || !PLAIN_IDENTIFIER.test(table)) {
+    return false;
+  }
   const client = injectedClient ?? getDbExec();
   try {
     const { rows } = await client.execute({
@@ -106,8 +112,14 @@ export async function pgColumnExists(
 export async function pgIndexExists(
   indexName: string,
   injectedClient?: DbExec,
+  dialectIsPostgres?: boolean,
 ): Promise<boolean> {
-  if (!isPostgres() || !PLAIN_IDENTIFIER.test(indexName)) return false;
+  if (
+    !(dialectIsPostgres ?? isPostgres()) ||
+    !PLAIN_IDENTIFIER.test(indexName)
+  ) {
+    return false;
+  }
   const client = injectedClient ?? getDbExec();
   try {
     const { rows } = await client.execute({
@@ -158,10 +170,17 @@ export async function ensureSchemaObject(options: {
   lockTimeout?: string;
   /** Injectable client for tests. */
   injectedClient?: DbExec;
+  /** Dialect override for injected per-app clients; defaults to the global. */
+  dialectIsPostgres?: boolean;
 }): Promise<boolean> {
-  const { probe, ddl, label, lockTimeout, injectedClient } = options;
+  const { probe, ddl, label, lockTimeout, injectedClient, dialectIsPostgres } =
+    options;
   if (await probe()) return false;
-  const ran = await runGuardedDdl(ddl, { lockTimeout, injectedClient });
+  const ran = await runGuardedDdl(ddl, {
+    lockTimeout,
+    injectedClient,
+    dialectIsPostgres,
+  });
   if (ran) return true;
   // The DDL was swallowed by a lock-timeout. The object is virtually always
   // already correct by the time a contended boot retries (a concurrent
@@ -185,14 +204,20 @@ export async function ensureSchemaObject(options: {
 export async function ensureTableExists(
   table: string,
   createSql: string,
-  options: { lockTimeout?: string; injectedClient?: DbExec } = {},
+  options: {
+    lockTimeout?: string;
+    injectedClient?: DbExec;
+    dialectIsPostgres?: boolean;
+  } = {},
 ): Promise<boolean> {
   return ensureSchemaObject({
-    probe: () => pgTableExists(table, options.injectedClient),
+    probe: () =>
+      pgTableExists(table, options.injectedClient, options.dialectIsPostgres),
     ddl: createSql,
     label: `table ${table}`,
     lockTimeout: options.lockTimeout,
     injectedClient: options.injectedClient,
+    dialectIsPostgres: options.dialectIsPostgres,
   });
 }
 
@@ -222,14 +247,24 @@ export async function ensureColumnExists(
 export async function ensureIndexExists(
   indexName: string,
   createIndexSql: string,
-  options: { lockTimeout?: string; injectedClient?: DbExec } = {},
+  options: {
+    lockTimeout?: string;
+    injectedClient?: DbExec;
+    dialectIsPostgres?: boolean;
+  } = {},
 ): Promise<boolean> {
   return ensureSchemaObject({
-    probe: () => pgIndexExists(indexName, options.injectedClient),
+    probe: () =>
+      pgIndexExists(
+        indexName,
+        options.injectedClient,
+        options.dialectIsPostgres,
+      ),
     ddl: createIndexSql,
     label: `index ${indexName}`,
     lockTimeout: options.lockTimeout,
     injectedClient: options.injectedClient,
+    dialectIsPostgres: options.dialectIsPostgres,
   });
 }
 
@@ -263,10 +298,14 @@ export function isLockTimeoutError(err: unknown): boolean {
  */
 export async function runGuardedDdl(
   ddl: string,
-  options: { lockTimeout?: string; injectedClient?: DbExec } = {},
+  options: {
+    lockTimeout?: string;
+    injectedClient?: DbExec;
+    dialectIsPostgres?: boolean;
+  } = {},
 ): Promise<boolean> {
   const client = options.injectedClient ?? getDbExec();
-  if (!isPostgres()) {
+  if (!(options.dialectIsPostgres ?? isPostgres())) {
     await client.execute(ddl);
     return true;
   }

package/corpus/core/src/deploy/build.ts

@@ -951,6 +951,26 @@ function getSentryClientConfigScript() {
   );
 }
 
+function getRealtimeClientConfigScript() {
+  // MUST stay byte-for-byte consistent with resolveRealtimeClientConfig in
+  // server/sentry-config.ts (worker bundles a string copy; it can't import it).
+  // Fail closed: require BOTH hosted transport AND an explicit gateway URL — no
+  // production default, since this ships into the CDN-cached shell.
+  const env = globalThis.process?.env || {};
+  if (firstNonEmpty(env.AGENT_NATIVE_REALTIME_TRANSPORT) !== "hosted") {
+    return null;
+  }
+  const gatewayBaseUrl = firstNonEmpty(env.AGENT_NATIVE_REALTIME_GATEWAY_URL);
+  if (!gatewayBaseUrl) return null;
+  const config = { realtime: { transport: "hosted", gatewayBaseUrl } };
+  return (
+    '<script data-agent-native-realtime-config>' +
+    'window.__AGENT_NATIVE_CONFIG__=Object.assign({},window.__AGENT_NATIVE_CONFIG__,' +
+    JSON.stringify(config) +
+    ");</script>"
+  );
+}
+
 function injectHeadScript(html, script) {
   if (!script) return html;
   const headCloseIdx = html.indexOf("</head>");
@@ -1102,7 +1122,10 @@ function applyImmutableAssetCacheHeaders(response, request) {
 }
 
 async function rewriteMountedResponse(response, basePath, pathname, request) {
-  const sentryClientConfigScript = getSentryClientConfigScript();
+  const clientConfigScript =
+    [getSentryClientConfigScript(), getRealtimeClientConfigScript()]
+      .filter(Boolean)
+      .join("") || null;
   const headers = new Headers(response.headers);
   applyDefaultSsrCacheHeader(headers, response.status, pathname);
   applyDefaultSpeculationRulesHeader(headers, response.status, basePath);
@@ -1129,7 +1152,7 @@ async function rewriteMountedResponse(response, basePath, pathname, request) {
         prefixMountedHtml(html, basePath),
         defaultSocialImageUrl(request, basePath),
       ),
-      sentryClientConfigScript,
+      clientConfigScript,
     ),
     {
       status: response.status,

package/corpus/core/src/eject/remote-mcp-presets.ts

@@ -18,17 +18,49 @@ import { createElement, type ComponentType, type ReactElement } from "react";
 export * from "@agent-native/core/client/resources/runtime";
 
 function preset(id: string): DefaultMcpIntegration {
-  return {
-    ...RUNTIME_DEFAULT_MCP_INTEGRATIONS.find(
-      (integration) => integration.id === id,
-    )!,
-  };
+  const runtimePreset = RUNTIME_DEFAULT_MCP_INTEGRATIONS.find(
+    (integration) => integration.id === id,
+  );
+  if (runtimePreset) return { ...runtimePreset };
+
+  if (id === "granola") {
+    return {
+      id: "granola",
+      name: "Granola",
+      provider: "granola",
+      description: "Search meeting notes, transcripts, and action items.",
+      descriptionKey: "mcpIntegrations.catalog.granola.description",
+      useCase:
+        "meeting notes, recordings, transcripts, action items, follow-ups",
+      useCaseKey: "mcpIntegrations.catalog.granola.useCase",
+      url: "https://mcp.granola.ai/mcp",
+      authMode: "oauth",
+      connectionMode: "oauth",
+      availability: "ready",
+      verification: "preflight-only",
+      logoUrl: "",
+      docsUrl: "https://docs.granola.ai/help-center/sharing/integrations/mcp",
+      setupNoteKey: "mcpIntegrations.catalog.granola.setupNote",
+      keywords: [
+        "meetings",
+        "meeting notes",
+        "recordings",
+        "transcripts",
+        "action items",
+        "follow-ups",
+        "decisions",
+      ],
+    };
+  }
+
+  throw new Error(`MCP preset ${id} is missing from the runtime catalog.`);
 }
 
 export const DEFAULT_MCP_INTEGRATIONS: DefaultMcpIntegration[] = [
   preset("context7"),
   preset("sentry"),
   preset("notion"),
+  preset("granola"),
   preset("semgrep"),
   preset("linear"),
   preset("atlassian"),

package/corpus/core/src/guards/explicit-collab-access.ts

@@ -0,0 +1,229 @@
+/**
+ * Require generated apps to choose how collaboration events are scoped.
+ * Legacy `resourceType` callers remain valid during the access-option
+ * migration; this guard only reports implicit createCollabPlugin configs.
+ */
+
+import {
+  lineColForOffset,
+  readFileSafe,
+  relPosix,
+  walk,
+} from "./scan-utils.js";
+import type { GuardFinding, GuardResult, GuardScanOptions } from "./types.js";
+
+const SOURCE_FILE = /\.(?:[cm]?[jt]s|[jt]sx)$/;
+const CALL = /\bcreateCollabPlugin\s*\(/g;
+const EXPLICIT_ACCESS_KEYS = new Set(["access", "resourceType"]);
+const FINDING_MESSAGE =
+  'createCollabPlugin must declare access explicitly. Use access: { mode: "resource", resourceType: "..." } for scoped resources or access: { mode: "all-authenticated" } when deployment-wide delivery is intentional. Legacy resourceType is also accepted during migration.';
+
+function maskCommentsAndStrings(contents: string): string {
+  const masked = contents.split("");
+  for (let i = 0; i < contents.length; i++) {
+    const char = contents[i];
+    if (char === '"' || char === "'" || char === "`") {
+      const end = skipQuoted(contents, i);
+      for (let cursor = i; cursor < end; cursor++) {
+        if (masked[cursor] !== "\n") masked[cursor] = " ";
+      }
+      i = end - 1;
+      continue;
+    }
+    if (contents.startsWith("//", i)) {
+      const newline = contents.indexOf("\n", i + 2);
+      const end = newline === -1 ? contents.length : newline;
+      for (let cursor = i; cursor < end; cursor++) masked[cursor] = " ";
+      i = end - 1;
+      continue;
+    }
+    if (contents.startsWith("/*", i)) {
+      const commentEnd = contents.indexOf("*/", i + 2);
+      const end = commentEnd === -1 ? contents.length : commentEnd + 2;
+      for (let cursor = i; cursor < end; cursor++) {
+        if (masked[cursor] !== "\n") masked[cursor] = " ";
+      }
+      i = end - 1;
+    }
+  }
+  return masked.join("");
+}
+
+function skipQuoted(contents: string, start: number): number {
+  const quote = contents[start];
+  let escaped = false;
+  for (let i = start + 1; i < contents.length; i++) {
+    const char = contents[i];
+    if (escaped) {
+      escaped = false;
+    } else if (char === "\\") {
+      escaped = true;
+    } else if (char === quote) {
+      return i + 1;
+    }
+  }
+  return contents.length;
+}
+
+function skipTrivia(contents: string, start: number): number {
+  let i = start;
+  while (i < contents.length) {
+    if (/\s/.test(contents[i] ?? "")) {
+      i++;
+      continue;
+    }
+    if (contents.startsWith("//", i)) {
+      const newline = contents.indexOf("\n", i + 2);
+      i = newline === -1 ? contents.length : newline + 1;
+      continue;
+    }
+    if (contents.startsWith("/*", i)) {
+      const end = contents.indexOf("*/", i + 2);
+      i = end === -1 ? contents.length : end + 2;
+      continue;
+    }
+    break;
+  }
+  return i;
+}
+
+function findObjectEnd(contents: string, start: number): number | null {
+  let depth = 0;
+  for (let i = start; i < contents.length; i++) {
+    const char = contents[i];
+    if (char === '"' || char === "'" || char === "`") {
+      i = skipQuoted(contents, i) - 1;
+      continue;
+    }
+    if (contents.startsWith("//", i)) {
+      const newline = contents.indexOf("\n", i + 2);
+      i = newline === -1 ? contents.length : newline;
+      continue;
+    }
+    if (contents.startsWith("/*", i)) {
+      const end = contents.indexOf("*/", i + 2);
+      i = end === -1 ? contents.length : end + 1;
+      continue;
+    }
+    if (char === "{") depth++;
+    if (char === "}" && --depth === 0) return i;
+  }
+  return null;
+}
+
+function hasExplicitAccessProperty(
+  contents: string,
+  objectStart: number,
+  objectEnd: number,
+): boolean {
+  let braceDepth = 0;
+  let bracketDepth = 0;
+  let parenDepth = 0;
+  let expectingProperty = true;
+
+  for (let i = objectStart + 1; i < objectEnd; i++) {
+    i = skipTrivia(contents, i);
+    if (i >= objectEnd) break;
+    const char = contents[i];
+
+    if (expectingProperty && (char === '"' || char === "'")) {
+      const tokenEnd = skipQuoted(contents, i);
+      const key = contents.slice(i + 1, tokenEnd - 1);
+      const afterKey = skipTrivia(contents, tokenEnd);
+      if (EXPLICIT_ACCESS_KEYS.has(key) && contents[afterKey] === ":") {
+        return true;
+      }
+      i = tokenEnd - 1;
+      expectingProperty = false;
+      continue;
+    }
+
+    if (expectingProperty && /[A-Za-z_$]/.test(char ?? "")) {
+      let tokenEnd = i + 1;
+      while (/[A-Za-z0-9_$]/.test(contents[tokenEnd] ?? "")) tokenEnd++;
+      const key = contents.slice(i, tokenEnd);
+      const afterKey = skipTrivia(contents, tokenEnd);
+      const delimiter = contents[afterKey];
+      if (
+        EXPLICIT_ACCESS_KEYS.has(key) &&
+        (delimiter === ":" || delimiter === "," || afterKey >= objectEnd)
+      ) {
+        return true;
+      }
+      i = tokenEnd - 1;
+      expectingProperty = false;
+      continue;
+    }
+
+    if (char === '"' || char === "'" || char === "`") {
+      i = skipQuoted(contents, i) - 1;
+      continue;
+    }
+    if (contents.startsWith("//", i) || contents.startsWith("/*", i)) {
+      i = skipTrivia(contents, i) - 1;
+      continue;
+    }
+
+    if (char === "{") braceDepth++;
+    else if (char === "}") braceDepth--;
+    else if (char === "[") bracketDepth++;
+    else if (char === "]") bracketDepth--;
+    else if (char === "(") parenDepth++;
+    else if (char === ")") parenDepth--;
+    else if (
+      char === "," &&
+      braceDepth === 0 &&
+      bracketDepth === 0 &&
+      parenDepth === 0
+    ) {
+      expectingProperty = true;
+    }
+  }
+
+  return false;
+}
+
+export function scanExplicitCollabAccess(
+  options: GuardScanOptions,
+): GuardResult {
+  const { root } = options;
+  const findings: GuardFinding[] = [];
+
+  for (const file of walk(root)) {
+    if (!SOURCE_FILE.test(file) || file.endsWith(".d.ts")) continue;
+    const contents = readFileSafe(file);
+    if (contents === null || !contents.includes("createCollabPlugin")) continue;
+    const searchable = maskCommentsAndStrings(contents);
+
+    CALL.lastIndex = 0;
+    let match: RegExpExecArray | null;
+    while ((match = CALL.exec(searchable)) !== null) {
+      const callStart = match.index;
+      const objectStart = skipTrivia(contents, CALL.lastIndex);
+      if (contents[objectStart] !== "{") {
+        if (contents[objectStart] === ")") {
+          const { line } = lineColForOffset(contents, callStart);
+          findings.push({
+            file: relPosix(root, file),
+            line,
+            message: FINDING_MESSAGE,
+          });
+        }
+        continue;
+      }
+      const objectEnd = findObjectEnd(contents, objectStart);
+      if (objectEnd === null) continue;
+      CALL.lastIndex = objectEnd + 1;
+
+      if (hasExplicitAccessProperty(contents, objectStart, objectEnd)) continue;
+      const { line } = lineColForOffset(contents, callStart);
+      findings.push({
+        file: relPosix(root, file),
+        line,
+        message: FINDING_MESSAGE,
+      });
+    }
+  }
+
+  return { name: "explicit-collab-access", findings };
+}

package/corpus/core/src/guards/index.ts

@@ -12,6 +12,7 @@
 
 export { scanDbToolScoping } from "./db-tool-scoping.js";
 export type { DbToolScopingOptions } from "./db-tool-scoping.js";
+export { scanExplicitCollabAccess } from "./explicit-collab-access.js";
 export { scanDrizzlePush } from "./no-drizzle-push.js";
 export { scanEnvCredentials } from "./no-env-credentials.js";
 export { scanEnvMutation } from "./no-env-mutation.js";

package/corpus/core/src/localization/default-messages.ts

@@ -33,6 +33,47 @@ const messages = {
     openResourceSettings: "Open resource settings",
     backHome: "Back to home",
   },
+  agentResources: {
+    openDocs: "Open {{section}} documentation",
+    backToResources: "Back to agent resources",
+    createFile: {
+      nameLabel: "File name",
+      namePlaceholder: "notes/ideas",
+      menuDescription: "Add a new file by name",
+    },
+    files: {
+      title: "Files",
+      description: "Files the agent can read and write.",
+    },
+    instructions: {
+      title: "Instructions",
+      description:
+        "The rules, preferences, and project guidance that steer the agent.",
+    },
+    agents: {
+      title: "Agents",
+      description:
+        "Reusable profiles for focused sub-agents and delegated work.",
+    },
+    memory: {
+      title: "Memory",
+      description: "Durable notes the agent can retrieve across conversations.",
+    },
+    skills: {
+      title: "Skills",
+      description:
+        "Specialized instructions that give the agent repeatable abilities.",
+    },
+    learnings: {
+      title: "Learnings",
+      description:
+        "Corrections and patterns worth carrying forward for future work.",
+    },
+    remoteAgents: {
+      title: "Remote agents",
+      description: "Other agents this agent can call through A2A.",
+    },
+  },
   featureFlags: {
     title: "Feature flags",
     description: "Control staged capabilities without changing a deployment.",
@@ -276,7 +317,7 @@ const messages = {
     checkingAiConnection: "Checking AI connection...",
     voiceMode: {
       entryButtonLabel: "Use microphone",
-      promptTitle: "Talk to your app",
+      promptTitle: "Use your voice",
       promptDescription:
         "Voice mode keeps listening while the agent navigates and takes actions.",
       setupTitle: "Set up voice mode",
@@ -285,8 +326,9 @@ const messages = {
       connectBuilder: "Connect Builder.io",
       useOpenAiKey: "Add your own keys",
       startWithOpenAiKey: "Start with OpenAI key",
-      start: "Start voice mode",
-      keepDictating: "Keep dictating",
+      start: "Real-time voice",
+      keepDictating: "Dictate",
+      rememberPreference: "Remember my preference",
       showChat: "Show chat",
       hideChat: "Hide chat",
       end: "End voice mode",
@@ -744,9 +786,9 @@ const messages = {
     connect: "Connect",
     connectWithOAuth: "Connect with OAuth",
     useApiToken: "Use API token",
-    connectSuggestion: "Connect {{name}} to use this link in chat",
+    connectSuggestion: "Connect {{name}} to use it in chat",
     connectSuggestionWithApiToken:
-      "Connect {{name}} with an API token to use this link in chat",
+      "Connect {{name}} with an API token to use it in chat",
     dismissSuggestion: "Dismiss integration suggestion",
     backToIntegrations: "Back to integrations",
     customTitle: "Add custom MCP server",
@@ -795,6 +837,13 @@ const messages = {
         setupNote:
           "Notion MCP uses user OAuth. Enterprise workspaces can audit MCP usage and allow or block clients; reconnect after admin policy changes.",
       },
+      granola: {
+        description: "Search meeting notes, transcripts, and action items.",
+        useCase:
+          "Meeting notes, recordings, transcripts, action items, follow-ups",
+        setupNote:
+          "Granola MCP uses browser OAuth. Authorize the signed-in Granola account and review which meeting notes and transcripts the agent can access.",
+      },
       semgrep: {
         description: "Scan code for security findings.",
         useCase: "Security scanning, vulnerability detection, code analysis",