@agent-native/core 0.118.0 → 0.118.1

package/corpus/core/src/mcp-client/oauth-routes.ts

@@ -4,10 +4,11 @@ import type { OAuthClientInformationMixed } from "@modelcontextprotocol/sdk/shar
 import {
   deleteCookie,
   defineEventHandler,
+  getChunkedCookie,
   getCookie,
   getMethod,
   getQuery,
-  setCookie,
+  setChunkedCookie,
   setResponseStatus,
   type H3Event,
 } from "h3";
@@ -32,6 +33,9 @@ import {
 
 const FLOW_COOKIE = "an_mcp_oauth_flow";
 const FLOW_TTL_SECONDS = 10 * 60;
+const FLOW_COOKIE_CHUNK_SIZE = 2_800;
+const FLOW_COOKIE_MAX_CHUNKS = 8;
+const CHUNKED_COOKIE_PREFIX = "__chunked__";
 
 export interface McpOAuthFlow {
   name: string;
@@ -189,13 +193,7 @@ async function handleMcpOAuthStart(
       ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),
       expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
     };
-    setCookie(event, FLOW_COOKIE, encryptSecretValue(JSON.stringify(flow)), {
-      httpOnly: true,
-      secure: redirectUri.startsWith("https://"),
-      sameSite: "lax",
-      path: "/",
-      maxAge: FLOW_TTL_SECONDS,
-    });
+    setMcpOAuthFlowCookie(event, flow, redirectUri.startsWith("https://"));
     return redirectWithStagedCookies(event, started.authorizationUrl.href);
   } catch {
     setResponseStatus(event, 400);
@@ -217,8 +215,8 @@ async function handleMcpOAuthCallback(
   const code = text(query.code);
   const state = text(query.state);
   const providerError = text(query.error);
-  const flow = readFlow(event);
-  deleteCookie(event, FLOW_COOKIE, { path: "/" });
+  const flow = readMcpOAuthFlowCookie(event);
+  clearMcpOAuthFlowCookies(event);
   if (providerError || !code || !state) {
     setResponseStatus(event, 400);
     return { error: "MCP OAuth authorization was not completed." };
@@ -275,8 +273,36 @@ async function handleMcpOAuthCallback(
   }
 }
 
-function readFlow(event: H3Event): McpOAuthFlow | null {
-  const encrypted = getCookie(event, FLOW_COOKIE);
+export function setMcpOAuthFlowCookie(
+  event: H3Event,
+  flow: McpOAuthFlow,
+  secure: boolean,
+): void {
+  const encrypted = encryptSecretValue(JSON.stringify(flow));
+  const chunkCount = Math.ceil(encrypted.length / FLOW_COOKIE_CHUNK_SIZE);
+  if (chunkCount > FLOW_COOKIE_MAX_CHUNKS) {
+    throw new Error("MCP OAuth flow state exceeds the cookie size limit.");
+  }
+  setChunkedCookie(event, FLOW_COOKIE, encrypted, {
+    httpOnly: true,
+    secure,
+    sameSite: "lax",
+    path: "/",
+    maxAge: FLOW_TTL_SECONDS,
+    chunkMaxLength: FLOW_COOKIE_CHUNK_SIZE,
+  });
+}
+
+export function readMcpOAuthFlowCookie(event: H3Event): McpOAuthFlow | null {
+  const primaryCookie = getCookie(event, FLOW_COOKIE);
+  if (!primaryCookie) return null;
+  if (primaryCookie.startsWith(CHUNKED_COOKIE_PREFIX)) {
+    const rawCount = primaryCookie.slice(CHUNKED_COOKIE_PREFIX.length);
+    if (!/^\d+$/.test(rawCount)) return null;
+    const chunkCount = Number(rawCount);
+    if (chunkCount < 2 || chunkCount > FLOW_COOKIE_MAX_CHUNKS) return null;
+  }
+  const encrypted = getChunkedCookie(event, FLOW_COOKIE);
   if (!encrypted) return null;
   try {
     const parsed = JSON.parse(decryptSecretValue(encrypted)) as McpOAuthFlow;
@@ -286,6 +312,13 @@ function readFlow(event: H3Event): McpOAuthFlow | null {
   }
 }
 
+export function clearMcpOAuthFlowCookies(event: H3Event): void {
+  deleteCookie(event, FLOW_COOKIE, { path: "/" });
+  for (let index = 1; index <= FLOW_COOKIE_MAX_CHUNKS; index += 1) {
+    deleteCookie(event, `${FLOW_COOKIE}.${index}`, { path: "/" });
+  }
+}
+
 export function isValidMcpOAuthFlow(
   flow: McpOAuthFlow,
   email: string,

package/corpus/core/src/server/realtime-voice.ts

@@ -201,7 +201,10 @@ export function resolveRealtimeVoiceReasoningEffort(
 ): "minimal" | "low" | "medium" {
   const normalized = value?.trim().toLowerCase();
   return normalized &&
-    Object.hasOwn(REALTIME_VOICE_REASONING_EFFORT, normalized)
+    Object.prototype.hasOwnProperty.call(
+      REALTIME_VOICE_REASONING_EFFORT,
+      normalized,
+    )
     ? REALTIME_VOICE_REASONING_EFFORT[
         normalized as keyof typeof REALTIME_VOICE_REASONING_EFFORT
       ]

package/corpus/core/src/templates/workspace-core/.agents/skills/voice-transcription/SKILL.md

@@ -57,11 +57,13 @@ action before requesting microphone permission.
   controls contain only settings and the separate end-session action.
 - The orb's compact waveform stays visible for the full session and reflects
   actual microphone or assistant audio activity. At silence it rests at its
-  baseline instead of turning into a loading spinner. While connecting, show a
-  distinct compact spinner; when the session becomes live, the assistant gives
-  one brief spoken greeting so readiness is unambiguous. Do not apply a
-  text-sized `max_output_tokens` cap to that audio greeting because audio tokens
-  can truncate it mid-sentence.
+  baseline instead of turning into a loading spinner. Once connected, a soft,
+  slowly rotating blue glow marks the live session; brighten and speed up the
+  glow while the agent is working, and keep it static under reduced motion.
+  While connecting, show a distinct compact spinner; when the session becomes
+  live, the assistant gives one brief spoken greeting so readiness is
+  unambiguous. Do not apply a text-sized `max_output_tokens` cap to that audio
+  greeting because audio tokens can truncate it mid-sentence.
 - The orb settings cog opens in place without ending voice mode or navigating
   away. Nested pickers must not dismiss the settings popover. Language and
   intelligence update the active Realtime session; the microphone picker swaps

package/corpus/core/src/terminal/cli-registry.ts

@@ -42,7 +42,7 @@ export const CLI_REGISTRY: Record<string, CliEntry> = {
 
 /** Check if a command name is in the CLI_REGISTRY allowlist */
 export function isAllowedCommand(cmd: string): boolean {
-  return Object.hasOwn(CLI_REGISTRY, cmd);
+  return Object.prototype.hasOwnProperty.call(CLI_REGISTRY, cmd);
 }
 
 /** Check if a CLI command exists on PATH (safe — no shell interpolation) */

package/corpus/core/src/vite/client.ts

@@ -732,7 +732,6 @@ function findCorePackageRoot(cwd: string): string | null {
   const candidates = [
     path.resolve(cwd, "../../packages/core"), // templates/<name>/
     path.resolve(cwd, "../core"), // packages/<name>/
-    path.resolve(cwd, "node_modules/@agent-native/core"),
   ];
   for (const candidate of candidates) {
     try {
@@ -2315,6 +2314,165 @@ function portExposer(): Plugin {
   };
 }
 
+function isNitroEnvironmentUnavailable(error: unknown): boolean {
+  const candidate = error as {
+    name?: unknown;
+    status?: unknown;
+    statusCode?: unknown;
+    message?: unknown;
+  };
+  return (
+    candidate?.name === "NitroViteError" &&
+    (candidate.status === 503 || candidate.statusCode === 503) &&
+    typeof candidate.message === "string" &&
+    /Vite environment .+ is unavailable/.test(candidate.message)
+  );
+}
+
+type NitroModuleNode = {
+  id: string | null;
+  ssrError?: Error | null;
+  transformResult: unknown | null;
+};
+
+type NitroModuleGraph = {
+  idToModuleMap: Map<string, NitroModuleNode>;
+};
+
+const NITRO_STARTUP_SETTLE_MS = 1_000;
+const NITRO_STARTUP_TIMEOUT_MS = 30_000;
+
+function nitroModuleGraphSignature(environment: unknown): string | null {
+  const graph = (environment as { moduleGraph?: NitroModuleGraph } | undefined)
+    ?.moduleGraph;
+  if (!graph) return null;
+
+  const modules = [...graph.idToModuleMap.values()];
+  const entry = modules.find((module) =>
+    module.id
+      ?.replaceAll("\\", "/")
+      .endsWith("/nitro/dist/runtime/internal/vite/dev-entry.mjs"),
+  );
+  if (!entry?.transformResult && !entry?.ssrError) return null;
+
+  let transformed = 0;
+  let errors = 0;
+  for (const module of modules) {
+    if (module.transformResult) transformed += 1;
+    if (module.ssrError) errors += 1;
+  }
+  return `${modules.length}:${transformed}:${errors}`;
+}
+
+function isHtmlDocumentRequest(req: IncomingMessage): boolean {
+  return (
+    (req.method === "GET" || req.method === "HEAD") &&
+    (req.headers.accept ?? "").includes("text/html")
+  );
+}
+
+function sendNitroStartingResponse(
+  req: IncomingMessage,
+  res: ServerResponse,
+): void {
+  res.statusCode = 503;
+  res.setHeader("cache-control", "no-store");
+  res.setHeader("content-type", "text/html; charset=utf-8");
+  res.setHeader("retry-after", "1");
+  if (req.method === "HEAD") {
+    res.end();
+    return;
+  }
+  res.end(
+    '<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="refresh" content="0.25"><title>Starting…</title></head><body></body></html>',
+  );
+}
+
+function nitroStartupGate(
+  options: {
+    now?: () => number;
+    settleMs?: number;
+    timeoutMs?: number;
+  } = {},
+): Plugin {
+  return {
+    name: "agent-native-nitro-startup-gate",
+    apply: "serve",
+    enforce: "pre",
+    configureServer(server) {
+      const now = options.now ?? Date.now;
+      const settleMs = options.settleMs ?? NITRO_STARTUP_SETTLE_MS;
+      const timeoutMs = options.timeoutMs ?? NITRO_STARTUP_TIMEOUT_MS;
+      const startedAt = now();
+      let graphSignature: string | null = null;
+      let graphStableAt: number | undefined;
+      let startupComplete = false;
+
+      server.middlewares.use((req, res, next) => {
+        if (startupComplete || !isHtmlDocumentRequest(req)) {
+          next();
+          return;
+        }
+
+        const timestamp = now();
+        if (timestamp - startedAt >= timeoutMs) {
+          startupComplete = true;
+          next();
+          return;
+        }
+
+        const nextGraphSignature = nitroModuleGraphSignature(
+          server.environments?.nitro,
+        );
+        if (nextGraphSignature) {
+          if (nextGraphSignature !== graphSignature) {
+            graphSignature = nextGraphSignature;
+            graphStableAt = timestamp;
+          } else if (
+            graphStableAt !== undefined &&
+            timestamp - graphStableAt >= settleMs
+          ) {
+            startupComplete = true;
+            next();
+            return;
+          }
+        } else {
+          graphSignature = null;
+          graphStableAt = undefined;
+        }
+
+        sendNitroStartingResponse(req, res);
+      });
+    },
+  };
+}
+
+function nitroStartupRecovery(): Plugin {
+  return {
+    name: "agent-native-nitro-startup-recovery",
+    apply: "serve",
+    configureServer(server) {
+      server.middlewares.use(function nitroStartupErrorRecovery(
+        error: unknown,
+        req: IncomingMessage,
+        res: ServerResponse,
+        next: (error?: unknown) => void,
+      ) {
+        if (
+          !isNitroEnvironmentUnavailable(error) ||
+          !isHtmlDocumentRequest(req) ||
+          res.headersSent
+        ) {
+          next(error);
+          return;
+        }
+
+        sendNitroStartingResponse(req, res);
+      });
+    },
+  };
+}
+
 /**
  * Silence benign connection-reset noise from Vite's dev middleware.
  * Fires when a browser closes/reloads/navigates mid-request — the peer has
@@ -2693,6 +2851,7 @@ function createAgentNativePlugins(
     embedDevFrameHeaders(),
     baseRedirectGuard(),
     portExposer(),
+    nitroStartupGate(),
     silenceConnectionResets(),
     rolldownInputFix(),
     // Nitro Vite plugin for dev-mode API route serving and HMR.
@@ -2702,6 +2861,9 @@ function createAgentNativePlugins(
       : includeNitro
         ? [nitroPlugin]
         : []),
+    // Nitro can reject the first document request while its Vite environment
+    // is still importing. This error handler must follow Nitro's middleware.
+    nitroStartupRecovery(),
     includeReactTransform ? createReactTransformPlugin() : null,
     createDesignSystemThemePlugin(options.designSystemTheme),
     createTailwindPlugin(options),
@@ -3096,5 +3258,8 @@ export {
   getDefaultOptimizeDeps as _getDefaultOptimizeDeps,
   findCorePackageRoot as _findCorePackageRoot,
   getReactRouterAliases as _getReactRouterAliases,
+  nitroStartupGate as _nitroStartupGate,
+  nitroStartupRecovery as _nitroStartupRecovery,
+  nitroModuleGraphSignature as _nitroModuleGraphSignature,
   debounceNitroFullReloadHotUpdate as _debounceNitroFullReloadHotUpdate,
 };

package/corpus/templates/analytics/app/hooks/use-dashboard-views.ts

@@ -23,6 +23,18 @@ async function fetchWithAuth(url: string, options?: RequestInit) {
   });
 }
 
+async function responseError(res: Response, fallback: string): Promise<Error> {
+  try {
+    const body = (await res.json()) as { error?: unknown };
+    if (typeof body.error === "string" && body.error.trim()) {
+      return new Error(body.error.trim());
+    }
+  } catch {
+    // Keep the status fallback when the server did not return JSON.
+  }
+  return new Error(`${fallback}: ${res.status}`);
+}
+
 export function useDashboardViews(dashboardId: string | undefined) {
   const queryClient = useQueryClient();
   const queryKey = ["dashboard-views", dashboardId];
@@ -53,7 +65,7 @@ export function useDashboardViews(dashboardId: string | undefined) {
           body: JSON.stringify(view),
         },
       );
-      if (!res.ok) throw new Error(`Save failed: ${res.status}`);
+      if (!res.ok) throw await responseError(res, "Save failed");
     },
     onSettled: () => {
       queryClient.invalidateQueries({ queryKey });

package/corpus/templates/analytics/app/pages/adhoc/sql-dashboard/ViewsMenu.tsx

@@ -7,6 +7,7 @@ import {
 } from "@tabler/icons-react";
 import { useMemo, useState } from "react";
 import { useSearchParams } from "react-router";
+import { toast } from "sonner";
 
 import { ResourceLoadError } from "@/components/ResourceLoadError";
 import {
@@ -147,6 +148,15 @@ export function ViewsMenu({ dashboardId, canEdit = true }: ViewsMenuProps) {
       });
       setViewName("");
       setSaveDialogOpen(false);
+    } catch (error) {
+      toast.error(
+        t("sqlDashboard.saveFailedWithMessage", {
+          message:
+            error instanceof Error
+              ? error.message
+              : t("sqlDashboard.saveFailed"),
+        }),
+      );
     } finally {
       setSavingView(false);
     }

package/corpus/templates/analytics/changelog/2026-07-22-show-a-useful-error-when-saving-a-dashboard-view-fails.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-22
+---
+
+Show a useful error when saving a dashboard view fails