@agent-native/core 0.121.2 → 0.122.0

package/src/a2a/activity.ts

@@ -37,6 +37,9 @@ export interface A2AAgentActivitySnapshot extends Record<string, unknown> {
   activePhase: A2AAgentActivityPhase;
   reasoning: string[];
   toolCalls: A2AAgentActivityToolCall[];
+  /** Response text segments, indexed by how many tool calls preceded them. */
+  response?: string[];
+  /** Tail segment only. Kept so peers predating `response` still render. */
   responseText?: string;
 }
 
@@ -47,7 +50,7 @@ export interface A2AAgentActivityState {
   activePhase: A2AAgentActivityPhase;
   reasoning: string[];
   toolCalls: A2AAgentActivityToolCall[];
-  responseText: string;
+  response: string[];
 }
 
 export function createA2AAgentActivityState(
@@ -60,7 +63,7 @@ export function createA2AAgentActivityState(
     activePhase: "reasoning",
     reasoning: [],
     toolCalls: [],
-    responseText: "",
+    response: [],
   };
 }
 
@@ -90,7 +93,6 @@ export function applyA2AAgentActivityEvent(
       break;
     case "tool_start":
       next.activePhase = "tool";
-      next.responseText = "";
       next.toolCalls = appendToolCall(next.toolCalls, toolFromEvent(event));
       changed = true;
       break;
@@ -101,10 +103,11 @@ export function applyA2AAgentActivityEvent(
       break;
     case "text":
       next.activePhase = "responding";
-      next.responseText = appendBoundedText(
-        next.responseText,
+      next.response = appendBoundedSegment(
+        next.response,
         event.text,
         MAX_A2A_ACTIVITY_RESPONSE_CHARS,
+        next.toolCalls.length,
       );
       changed = true;
       break;
@@ -117,7 +120,7 @@ export function applyA2AAgentActivityEvent(
       changed = true;
       break;
     case "clear":
-      next.responseText = "";
+      next.response = [];
       changed = true;
       break;
   }
@@ -138,10 +141,15 @@ export function buildA2AAgentActivitySnapshot(
     activePhase: state.activePhase,
     reasoning: state.reasoning,
     toolCalls: state.toolCalls,
-    ...(state.responseText ? { responseText: state.responseText } : {}),
+    ...(state.response.length ? { response: state.response } : {}),
+    ...(tailSegment(state) ? { responseText: tailSegment(state) } : {}),
   };
 }
 
+function tailSegment(state: A2AAgentActivityState): string {
+  return state.response[state.toolCalls.length] ?? "";
+}
+
 export function buildA2AAgentActivityPart(
   state: A2AAgentActivityState,
 ): DataPart {
@@ -165,8 +173,10 @@ export function parseA2AAgentActivityPart(
     !isPhase(data.activePhase) ||
     data.updatedAt < data.startedAt ||
     data.durationMs !== data.updatedAt - data.startedAt ||
-    !isSafeReasoning(data.reasoning) ||
+    !isSafeSegments(data.reasoning, MAX_A2A_ACTIVITY_REASONING_CHARS) ||
     !isSafeToolCalls(data.toolCalls) ||
+    (data.response !== undefined &&
+      !isSafeSegments(data.response, MAX_A2A_ACTIVITY_RESPONSE_CHARS)) ||
     (data.responseText !== undefined &&
       !isSafeText(data.responseText, MAX_A2A_ACTIVITY_RESPONSE_CHARS)) ||
     activityCharacterCount(data) > MAX_A2A_ACTIVITY_TOTAL_CHARS
@@ -193,14 +203,6 @@ function toolFromEvent(
   };
 }
 
-function appendBoundedText(
-  current: string,
-  addition: string,
-  maxChars: number,
-) {
-  return sanitizeText(`${current}${addition}`, maxChars);
-}
-
 function appendBoundedSegment(
   current: string[],
   addition: string,
@@ -293,7 +295,7 @@ function isPhase(value: unknown): value is A2AAgentActivityPhase {
   );
 }
 
-function isSafeReasoning(value: unknown): value is string[] {
+function isSafeSegments(value: unknown, maxChars: number): value is string[] {
   return (
     Array.isArray(value) &&
     value.length <= MAX_A2A_ACTIVITY_REASONING_SEGMENTS &&
@@ -301,8 +303,8 @@ function isSafeReasoning(value: unknown): value is string[] {
       (total, text) =>
         total + (typeof text === "string" ? text.length : Infinity),
       0,
-    ) <= MAX_A2A_ACTIVITY_REASONING_CHARS &&
-    value.every((text) => isSafeText(text, MAX_A2A_ACTIVITY_REASONING_CHARS))
+    ) <= maxChars &&
+    value.every((text) => isSafeText(text, maxChars))
   );
 }
 
@@ -349,14 +351,14 @@ function isSafeToolId(value: unknown): value is string {
 }
 
 function activityCharacterCount(data: Record<string, unknown>): number {
-  const reasoning = Array.isArray(data.reasoning)
-    ? data.reasoning.reduce(
-        (total, text) => total + (typeof text === "string" ? text.length : 0),
-        0,
-      )
-    : 0;
-  const response =
-    typeof data.responseText === "string" ? data.responseText.length : 0;
+  const reasoning = segmentCharacterCount(data.reasoning);
+  // `responseText` duplicates the tail of `response`; counting both would
+  // reject a snapshot that is within budget.
+  const response = Array.isArray(data.response)
+    ? segmentCharacterCount(data.response)
+    : typeof data.responseText === "string"
+      ? data.responseText.length
+      : 0;
   const tools = Array.isArray(data.toolCalls)
     ? data.toolCalls.reduce((total, tool) => {
         if (!isRecord(tool)) return total;
@@ -369,3 +371,12 @@ function activityCharacterCount(data: Record<string, unknown>): number {
     : 0;
   return reasoning + response + tools;
 }
+
+function segmentCharacterCount(value: unknown): number {
+  return Array.isArray(value)
+    ? value.reduce(
+        (total, text) => total + (typeof text === "string" ? text.length : 0),
+        0,
+      )
+    : 0;
+}

package/src/agent/engine/builder-engine.ts

@@ -71,6 +71,8 @@ const MAX_BACKGROUND_BUILDER_GATEWAY_TIMEOUT_MS = 14 * 60_000;
 const MAX_LOCAL_BUILDER_GATEWAY_TIMEOUT_MS =
   MAX_BACKGROUND_BUILDER_GATEWAY_TIMEOUT_MS;
 const BUILDER_GATEWAY_NETWORK_ERROR_CODE = "builder_gateway_network_error";
+export const BUILDER_MODEL_UNAUTHORIZED_ERROR_CODE =
+  "builder_model_unauthorized";
 
 export const BUILDER_DEFAULT_MODEL = BUILDER_MODEL_CONFIG.defaultModel;
 
@@ -669,8 +671,16 @@ async function* parseJsonlStream(
               explicitErrMsg ??
               `Gateway error (no detail; raw event: ${JSON.stringify(event)})`;
             const gatewayErrCode = event.errorCode ?? event.code;
+            // The gateway already authenticated this request before streaming,
+            // so a bare "Unauthorized" here means the account cannot use this
+            // model — not that the connection is broken. Only a message that
+            // names the credential may tear down the Builder connection.
             const isCredentialAuthError =
               Boolean(explicitErrMsg) &&
+              isBuilderCredentialAuthErrorInStream(String(errMsg));
+            const isModelAuthError =
+              Boolean(explicitErrMsg) &&
+              !isCredentialAuthError &&
               isBuilderCredentialAuthError(String(errMsg));
             // Anthropic's bare "Connection error." often arrives here with no
             // gateway code. Tag it as a network error so in-run retries and
@@ -680,10 +690,12 @@ async function* parseJsonlStream(
               isProviderConnectionErrorMessage(String(explicitErrMsg));
             const errCode = isCredentialAuthError
               ? "builder_auth_error"
-              : isProviderConnectionError
-                ? BUILDER_GATEWAY_NETWORK_ERROR_CODE
-                : (gatewayErrCode ??
-                  (!explicitErrMsg ? "builder_gateway_error" : undefined));
+              : isModelAuthError
+                ? BUILDER_MODEL_UNAUTHORIZED_ERROR_CODE
+                : isProviderConnectionError
+                  ? BUILDER_GATEWAY_NETWORK_ERROR_CODE
+                  : (gatewayErrCode ??
+                    (!explicitErrMsg ? "builder_gateway_error" : undefined));
             console.error(
               `[builder-engine] stop reason=error model=${model} code=${errCode ?? "(none)"} error=${errMsg}`,
             );
@@ -988,6 +1000,25 @@ function isBuilderCredentialAuthError(message: string): boolean {
   );
 }
 
+/**
+ * Stricter than {@link isBuilderCredentialAuthError} for errors that arrive
+ * inside an already-authenticated stream, where a bare "unauthorized" is far
+ * more likely to be a per-model entitlement rejection than a bad credential.
+ * Misreading one there disconnects Builder for every model, including the ones
+ * that still work.
+ */
+function isBuilderCredentialAuthErrorInStream(message: string): boolean {
+  if (!isBuilderCredentialAuthError(message)) return false;
+  const lowerMessage = message.toLowerCase();
+  return (
+    lowerMessage.includes("private key") ||
+    lowerMessage.includes("access token") ||
+    lowerMessage.includes("invalid token") ||
+    lowerMessage.includes("invalid_token") ||
+    lowerMessage.includes("token invalid")
+  );
+}
+
 function normalizeBuilderGatewayFetchError(
   err: unknown,
   timedOut: boolean,

package/src/agent/run-manager.ts

@@ -29,6 +29,7 @@ import {
   setRunError,
   setRunTerminalReason,
 } from "./run-store.js";
+import { isContinuationTerminalReason } from "./types.js";
 import type { AgentChatEvent, RunEvent, RunStatus } from "./types.js";
 
 export interface ActiveRun {
@@ -1429,10 +1430,28 @@ function subscribeFromSQL(
                   return;
                 }
               } else if (run?.status === "completed") {
+                // A chunk boundary is also status "completed" (with a
+                // continuation terminal_reason, and a chained successor run
+                // already carrying the turn). Synthesizing `done` here told the
+                // client the agent stopped while it was still working, which
+                // surfaced as a premature "stopped without sending a final
+                // message". Prefer the run's REAL terminal event, then the
+                // terminal_reason, before falling back to `done`.
+                const existing = await getLastTerminalRunEvent(runId).catch(
+                  () => null,
+                );
+                const terminalEvent = existing
+                  ? existing.event
+                  : isContinuationTerminalReason(run.terminalReason)
+                    ? { type: "auto_continue", reason: run.terminalReason }
+                    : { type: "done" };
                 try {
                   controller.enqueue(
                     encoder.encode(
-                      `data: ${JSON.stringify({ type: "done", seq: lastSeq })}\n\n`,
+                      `data: ${JSON.stringify({
+                        ...terminalEvent,
+                        seq: existing?.seq ?? lastSeq,
+                      })}\n\n`,
                     ),
                   );
                 } catch {

package/src/agent/run-store.ts

@@ -1929,11 +1929,12 @@ export async function getRunById(runId: string): Promise<{
   startedAt: number;
   errorCode: string | null;
   errorDetail: string | null;
+  terminalReason: string | null;
 } | null> {
   await ensureRunTables();
   const client = getDbExec();
   const { rows } = await client.execute({
-    sql: `SELECT id, thread_id, status, started_at, error_code, error_detail FROM agent_runs WHERE id = ?`,
+    sql: `SELECT id, thread_id, status, started_at, error_code, error_detail, terminal_reason FROM agent_runs WHERE id = ?`,
     args: [runId],
   });
   if (rows.length === 0) return null;
@@ -1944,6 +1945,7 @@ export async function getRunById(runId: string): Promise<{
     started_at: number | string;
     error_code?: string | null;
     error_detail?: string | null;
+    terminal_reason?: string | null;
   };
   return {
     id: r.id,
@@ -1952,6 +1954,7 @@ export async function getRunById(runId: string): Promise<{
     startedAt: Number(r.started_at),
     errorCode: r.error_code ?? null,
     errorDetail: r.error_detail ?? null,
+    terminalReason: r.terminal_reason ?? null,
   };
 }
 

package/src/agent/types.ts

@@ -369,18 +369,38 @@ export type AgentChatEvent =
     }
   | {
       type: "auto_continue";
-      reason:
-        | "run_timeout"
-        | "loop_limit"
-        | "max_tokens"
-        | "no_progress"
-        | "stream_ended"
-        | "gateway_timeout"
-        | "network_interrupted";
+      reason: ContinuationReason;
       maxIterations?: number;
     }
   | { type: "clear" };
 
+export const CONTINUATION_REASONS = [
+  "run_timeout",
+  "loop_limit",
+  "max_tokens",
+  "no_progress",
+  "stream_ended",
+  "gateway_timeout",
+  "network_interrupted",
+] as const;
+
+export type ContinuationReason = (typeof CONTINUATION_REASONS)[number];
+
+/**
+ * True when an `agent_runs.terminal_reason` marks a CHUNK boundary rather than
+ * the end of the turn. Both writers (`terminalReasonForRun` in run-manager and
+ * `markBackgroundContinuationChunkTerminal` in production-agent) record
+ * status='completed' with one of these while a chained successor run carries the
+ * turn on, so such a row must never be reported to a client as a plain `done`.
+ * Mirrored client-side by `BACKGROUND_CONTINUATION_TERMINAL_REASONS`.
+ */
+export function isContinuationTerminalReason(reason: unknown): boolean {
+  return (
+    reason === "auto_continue" ||
+    CONTINUATION_REASONS.includes(reason as ContinuationReason)
+  );
+}
+
 export interface RunEvent {
   seq: number;
   event: AgentChatEvent;

package/src/chat-threads/store.ts

@@ -1290,6 +1290,51 @@ export async function getThreadByShareToken(
   return null;
 }
 
+/**
+ * Grant a user an explicit share on a thread they don't own. Used by the
+ * messaging-integration path, where a channel conversation runs as the
+ * integration service principal and so creates a thread owned by
+ * `integration@<platform>` rather than the human who asked — without this the
+ * "Open thread" deep link resolves to a 404 for them.
+ *
+ * Idempotent, and never downgrades an existing stronger role.
+ */
+export async function grantThreadUserShare(
+  threadId: string,
+  userEmail: string,
+  role: ShareRole,
+  grantedBy: string,
+): Promise<void> {
+  const normalizedEmail = userEmail.trim().toLowerCase();
+  if (!threadId || !normalizedEmail.includes("@")) return;
+  await ensureTable();
+  const client = getDbExec();
+  const { rows } = await client.execute({
+    sql: `SELECT id, role FROM chat_thread_shares WHERE resource_id = ? AND principal_type = 'user' AND LOWER(principal_id) = ?`,
+    args: [threadId, normalizedEmail],
+  });
+  const existing = rows[0];
+  if (existing) {
+    if (roleSatisfies(existing.role as ShareRole, role)) return;
+    await client.execute({
+      sql: `UPDATE chat_thread_shares SET role = ? WHERE id = ?`,
+      args: [role, existing.id as string],
+    });
+    return;
+  }
+  await client.execute({
+    sql: `INSERT INTO chat_thread_shares (id, resource_id, principal_type, principal_id, role, created_by, created_at) VALUES (?, ?, 'user', ?, ?, ?, ?)`,
+    args: [
+      crypto.randomUUID(),
+      threadId,
+      normalizedEmail,
+      role,
+      grantedBy,
+      new Date().toISOString(),
+    ],
+  });
+}
+
 export async function deleteThread(id: string): Promise<boolean> {
   await ensureTable();
   const client = getDbExec();

package/src/checkpoints/index.ts

@@ -6,6 +6,8 @@ export {
   cleanupOldCheckpoints,
 } from "./store.js";
 
+export { isCheckpointRestorePath } from "./route-match.js";
+
 export {
   isGitRepo,
   hasUncommittedChanges,

package/src/checkpoints/route-match.ts

@@ -0,0 +1,13 @@
+/**
+ * The framework mount shim normally rewrites `event.path` to the mount-relative
+ * remainder ("/restore"), but it falls back to the unstripped request path when
+ * `event.url` is read-only on the host runtime. Accept both so a restore POST
+ * never silently 405s.
+ */
+export function isCheckpointRestorePath(path: string | undefined): boolean {
+  if (!path) return false;
+  return (
+    /(^|\/)checkpoints\/restore(?:[/?]|$)/.test(path) ||
+    /^\/?restore(?:[/?]|$)/.test(path)
+  );
+}

package/src/cli/create.ts

@@ -637,7 +637,7 @@ async function scaffoldOneAppIntoWorkspace(
   );
 
   try {
-    await scaffoldAppTemplate(appDir, templateName);
+    const resolution = await scaffoldAppTemplate(appDir, templateName);
     replacePlaceholders(
       appDir,
       appName,
@@ -655,7 +655,10 @@ async function scaffoldOneAppIntoWorkspace(
       dispatchDependencyVersion: getDispatchDependencyVersion(),
       toolkitDependencyVersion: getToolkitDependencyVersion(),
     });
-    fixPackageJsonName(appDir, appName, templateName);
+    fixPackageJsonName(appDir, appName, templateName, {
+      ...resolution,
+      shape: "workspace",
+    });
     fixWebManifestName(appDir, appName, templateName);
     rewriteNetlifyToml(appDir, appName, "workspace");
     renameGitignore(appDir);
@@ -736,9 +739,9 @@ async function createStandaloneApp(
       : `Downloading the ${template} template from GitHub...`,
   );
   try {
-    await scaffoldAppTemplate(targetDir, template);
+    const resolution = await scaffoldAppTemplate(targetDir, template);
     s.message(`Setting up ${name}…`);
-    postProcessStandalone(name, targetDir, template);
+    postProcessStandalone(name, targetDir, template, resolution);
     s.stop("App created!");
   } catch (err: any) {
     s.stop("Failed to create app.");
@@ -789,6 +792,17 @@ function cleanupOnFailure(targetDir: string): void {
  * Shared scaffolding helpers
  * ───────────────────────────────────────────────────────────────────────── */
 
+/** Where a scaffolded template's bytes came from, recorded so
+ *  `agent-native template sync` can reproduce them later. */
+export interface ScaffoldTemplateResolution {
+  templateRef?: string;
+  templateSource?: "github" | "bundled" | "local-checkout";
+}
+
+export interface ScaffoldProvenance extends ScaffoldTemplateResolution {
+  shape?: "workspace" | "standalone";
+}
+
 /**
  * Scaffold a single app template into `targetDir`. Resolves:
  *   - "headless" / legacy "blank" → bundled action-first template
@@ -799,7 +813,7 @@ function cleanupOnFailure(targetDir: string): void {
 async function scaffoldAppTemplate(
   targetDir: string,
   template: string,
-): Promise<void> {
+): Promise<ScaffoldTemplateResolution> {
   fs.mkdirSync(path.dirname(targetDir), { recursive: true });
 
   // Normalize legacy / renamed aliases.
@@ -814,13 +828,16 @@ async function scaffoldAppTemplate(
       );
     }
     copyDir(headlessDir, targetDir);
-    return;
+    return {
+      templateSource: "bundled",
+      templateRef: getGitHubTemplateRefCandidates()[0],
+    };
   }
 
   if (resolved.startsWith("github:")) {
     const repo = resolved.slice("github:".length);
     await downloadGitHubRepo(repo, targetDir);
-    return;
+    return {};
   }
 
   if (!getTemplate(resolved)) {
@@ -836,13 +853,29 @@ async function scaffoldAppTemplate(
   const localTemplate = findLocalTemplate(sourceTemplate);
   if (localTemplate) {
     copyDir(localTemplate, targetDir);
-  } else {
-    await downloadGitHubSubdir(
-      REPO,
-      `${TEMPLATES_DIR}/${sourceTemplate}`,
-      targetDir,
-    );
+    return {
+      templateSource: localTemplateSourceKind(localTemplate),
+      templateRef: getGitHubTemplateRefCandidates()[0],
+    };
   }
+  const templateRef = await downloadGitHubSubdir(
+    REPO,
+    `${TEMPLATES_DIR}/${sourceTemplate}`,
+    targetDir,
+  );
+  return { templateSource: "github", templateRef };
+}
+
+/** A template dir inside the installed core package ships with the CLI;
+ *  anything above it belongs to a framework checkout. */
+function localTemplateSourceKind(
+  localTemplate: string,
+): "bundled" | "local-checkout" {
+  const packageRoot = path.resolve(__dirname, "../..");
+  const rel = path.relative(packageRoot, path.resolve(localTemplate));
+  return rel && !rel.startsWith("..") && !path.isAbsolute(rel)
+    ? "bundled"
+    : "local-checkout";
 }
 
 function templateSourceName(name: string): string {
@@ -1000,6 +1033,17 @@ async function scaffoldRequiredPackages(
             }
           }
         }
+        // These packages' `exports` maps point at `./dist/*`, and `dist/` is
+        // gitignored (never committed), so a scaffolded workspace must build
+        // it on install. pnpm always runs `prepare` for workspace packages,
+        // unlike `postinstall`, so this is the reliable hook.
+        if (
+          pkg.scripts &&
+          typeof pkg.scripts.build === "string" &&
+          !pkg.scripts.prepare
+        ) {
+          pkg.scripts.prepare = "npm run build";
+        }
         fs.writeFileSync(pkgJsonPath, JSON.stringify(pkg, null, 2) + "\n");
       } catch {}
     }
@@ -1039,12 +1083,16 @@ function postProcessStandalone(
   name: string,
   targetDir: string,
   templateName?: string,
+  resolution?: ScaffoldTemplateResolution,
 ): void {
   const appTitle = appTitleForScaffold(name);
   replacePlaceholders(targetDir, name, appTitle);
   rewriteTrackingAppId(targetDir, name, templateName);
   rewriteAgentChatAppId(targetDir, name, templateName);
-  fixPackageJsonName(targetDir, name, templateName);
+  fixPackageJsonName(targetDir, name, templateName, {
+    ...resolution,
+    shape: "standalone",
+  });
   fixWebManifestName(targetDir, name, templateName);
   rewriteNetlifyToml(targetDir, name, "standalone");
 
@@ -1393,6 +1441,19 @@ export {
   startShapePromptOptions as _startShapePromptOptions,
   shouldSkipScaffoldEntry as _shouldSkipScaffoldEntry,
   tarExtractArgs as _tarExtractArgs,
+  downloadGitHubSubdir as _downloadGitHubSubdir,
+  findLocalTemplate as _findLocalTemplate,
+  templateSourceName as _templateSourceName,
+  normalizeTemplateName as _normalizeTemplateName,
+  appTitleForScaffold as _appTitleForScaffold,
+  replacePlaceholders as _replacePlaceholders,
+  rewriteTrackingAppId as _rewriteTrackingAppId,
+  rewriteAgentChatAppId as _rewriteAgentChatAppId,
+  fixWebManifestName as _fixWebManifestName,
+  copyDir as _copyDir,
+  localTemplateSourceKind as _localTemplateSourceKind,
+  REPO as _REPO,
+  TEMPLATES_DIR as _TEMPLATES_DIR,
 };
 
 /* ─────────────────────────────────────────────────────────────────────────
@@ -1479,13 +1540,17 @@ async function downloadAndExtract(
   }
 }
 
+/** Resolves to the ref that actually succeeded so callers can record it. */
 async function downloadGitHubSubdir(
   repo: string,
   subdir: string,
   targetDir: string,
-): Promise<void> {
+  refOverride?: string[],
+): Promise<string> {
   validateRepoName(repo);
-  const refs = getGitHubTemplateRefCandidates();
+  const refs = refOverride?.length
+    ? refOverride
+    : getGitHubTemplateRefCandidates();
   if (refs.length === 0) {
     throw new Error(
       "Cannot download first-party scaffold files without a versioned @agent-native/core package.",
@@ -1510,7 +1575,7 @@ async function downloadGitHubSubdir(
         );
       }
       copyDir(srcDir, targetDir);
-      return;
+      return ref;
     } catch (err) {
       errors.push(
         `  ${ref}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
@@ -1678,6 +1743,7 @@ function fixPackageJsonName(
   appDir: string,
   name: string,
   templateName?: string,
+  provenance?: ScaffoldProvenance,
 ): void {
   const pkgPath = path.join(appDir, "package.json");
   if (!fs.existsSync(pkgPath)) return;
@@ -1706,9 +1772,18 @@ function fixPackageJsonName(
         !Array.isArray(pkg["agent-native"])
           ? pkg["agent-native"]
           : {};
+      const coreVersion = getCorePackageVersion();
       agentNative.scaffold = {
         template: trackingTemplateName(templateName),
         frameworkSkills: scaffoldGuidance,
+        ...(provenance?.templateRef
+          ? { templateRef: provenance.templateRef }
+          : {}),
+        ...(provenance?.templateSource
+          ? { templateSource: provenance.templateSource }
+          : {}),
+        ...(coreVersion ? { coreVersion } : {}),
+        ...(provenance?.shape ? { shape: provenance.shape } : {}),
       };
       pkg["agent-native"] = agentNative;
     }
@@ -2286,6 +2361,19 @@ function shouldSkipScaffoldEntry(name: string, srcPath?: string): boolean {
   ) {
     return true;
   }
+  // `.generated/bridge` is committed source, not a build artifact: the design
+  // app imports it at module load, so skipping it yields a workspace that 500s
+  // on every page. Everything else under `.generated` is regenerated at dev time.
+  if (pathParts?.at(-2) === ".generated") {
+    return name !== "bridge";
+  }
+  if (
+    name === ".generated" &&
+    srcPath &&
+    fs.existsSync(path.join(srcPath, "bridge"))
+  ) {
+    return false;
+  }
   if (
     name === "node_modules" ||
     name === ".agent-native" ||