@agent-native/core 0.121.2 → 0.122.1

package/src/server/agents-bundle.ts

@@ -60,6 +60,16 @@ export interface Skill {
    * `ls` call. Empty array if the skill is single-file.
    */
   extraFiles: string[];
+  /**
+   * Text content of eligible sub-files (progressive-disclosure references),
+   * keyed by the same skill-dir-relative path used in `extraFiles`. Only
+   * populated for text extensions under the per-file/per-skill caps in
+   * `readSkillsDir` — files that exist but were skipped for size still show
+   * up in `extraFiles`, just not here. This is what makes reference content
+   * actually readable by the runtime agent (via docs-search); it is never
+   * injected into a prompt.
+   */
+  files: Record<string, string>;
 }
 
 export interface AgentsBundle {
@@ -176,6 +186,23 @@ const TEMPLATE_SKILLS_DIRS = [
   path.join(".agent", "skills"),
 ] as const;
 
+/**
+ * Extensions eligible to have their content inlined into `Skill.files`.
+ * Binary/asset sub-files (images, scripts, etc.) are always listed in
+ * `extraFiles` but never read into memory.
+ */
+const READABLE_SUBFILE_EXTENSIONS = new Set([".md", ".txt", ".json"]);
+/**
+ * Per-file and per-skill caps on inlined reference content. This content is
+ * bundled into the virtual module (and therefore the server bundle) for
+ * every deployment target, so it must stay small even though it's never
+ * added to a prompt — only fetched on demand via docs-search. Measured
+ * against this repo's skills (largest single sub-file ~20KB, largest
+ * per-skill sub-file total ~83KB), these caps have generous headroom.
+ */
+const MAX_SUBFILE_BYTES = 64 * 1024;
+const MAX_SKILL_FILES_BYTES = 256 * 1024;
+
 /**
  * Paths to a workspace-core's agent resources, for merging into a template's
  * bundle. All fields optional — pass null for any missing piece.
@@ -217,6 +244,8 @@ function readSkillsDir(
       if (skipExistingNames && out[name]) continue; // Template wins
 
       const extraFiles: string[] = [];
+      const files: Record<string, string> = {};
+      let skillFilesBytes = 0;
       try {
         const walk = (subdir: string, prefix: string) => {
           for (const e of fs.readdirSync(subdir, { withFileTypes: true })) {
@@ -229,6 +258,17 @@ function readSkillsDir(
               } catch {}
             } else if (e.isFile() && e.name !== "SKILL.md") {
               extraFiles.push(rel);
+              const ext = path.extname(e.name).toLowerCase();
+              if (!READABLE_SUBFILE_EXTENSIONS.has(ext)) continue;
+              try {
+                const stat = fs.statSync(abs);
+                if (stat.size > MAX_SUBFILE_BYTES) continue;
+                if (skillFilesBytes + stat.size > MAX_SKILL_FILES_BYTES) {
+                  continue;
+                }
+                files[rel] = fs.readFileSync(abs, "utf-8");
+                skillFilesBytes += stat.size;
+              } catch {}
             }
           }
         };
@@ -245,6 +285,7 @@ function readSkillsDir(
         content,
         dir: path.relative(rootForRelative, skillDirAbs).replace(/\\/g, "/"),
         extraFiles,
+        files,
       };
     } catch {
       // Skip unreadable skills
@@ -397,7 +438,7 @@ export function getDevelopmentSkills(bundle: AgentsBundle): Skill[] {
   );
 }
 
-function skillDocsSlug(name: string): string {
+export function skillDocsSlug(name: string): string {
   return `skill-${name
     .trim()
     .toLowerCase()
@@ -405,6 +446,28 @@ function skillDocsSlug(name: string): string {
     .replace(/^-+|-+$/g, "")}`;
 }
 
+function subfileSlugSuffix(relPath: string): string {
+  return relPath
+    .replace(/\.[^./]+$/, "")
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+}
+
+/**
+ * Slug docs-search resolves a skill sub-file (reference) content by. Kept in
+ * sync with the `skill-<name>--<subpath-slug>` docs it emits in
+ * `scripts/docs/search.ts` so the prompt hint always points at something the
+ * agent can actually read.
+ */
+export function skillSubfileDocsSlug(
+  skillName: string,
+  relPath: string,
+): string {
+  return `${skillDocsSlug(skillName)}--${subfileSlugSuffix(relPath)}`;
+}
+
 function generateSkillsPromptBlockForEntries(
   entries: Skill[],
   mode: "runtime" | "development",
@@ -412,10 +475,26 @@ function generateSkillsPromptBlockForEntries(
   if (entries.length === 0) return "";
 
   const lines = entries.map((s) => {
-    const extras =
-      s.extraFiles.length > 0
-        ? ` (also contains: ${s.extraFiles.join(", ")})`
-        : "";
+    let extras = "";
+    if (s.extraFiles.length > 0) {
+      if (mode === "runtime") {
+        const readable = s.extraFiles.filter((f) => f in s.files);
+        const unreadable = s.extraFiles.filter((f) => !(f in s.files));
+        const parts: string[] = [];
+        if (readable.length > 0) {
+          const refIds = readable.map((f) => subfileSlugSuffix(f)).join(", ");
+          parts.push(
+            `refs via docs-search --slug "${skillDocsSlug(s.meta.name)}--<ref>": ${refIds}`,
+          );
+        }
+        if (unreadable.length > 0) {
+          parts.push(`also contains: ${unreadable.join(", ")}`);
+        }
+        extras = ` (${parts.join("; ")})`;
+      } else {
+        extras = ` (also contains: ${s.extraFiles.join(", ")})`;
+      }
+    }
     const runtimeHint =
       mode === "runtime"
         ? ` Read with \`docs-search --slug "${skillDocsSlug(s.meta.name)}"\` before starting a task it applies to.`

package/src/server/auth.ts

@@ -81,7 +81,7 @@ import {
 } from "../mcp/route-paths.js";
 import { readBody } from "../server/h3-helpers.js";
 import { putSetting } from "../settings/store.js";
-import { DEFAULT_SSR_CACHE_HEADERS } from "../shared/cache-control.js";
+import { resolveSsrCacheHeaders } from "../shared/cache-control.js";
 import { extractOAuthStateAppId } from "../shared/oauth-state.js";
 import {
   AGENT_NATIVE_SOCIAL_IMAGE_ALT,
@@ -1658,8 +1658,9 @@ function loginHtmlResponse(loginHtml: string, event: H3Event): Response {
         // template roots do not invoke origin just to render anonymous login UI.
         // The login markup is env-INDEPENDENT (a Google-only app always renders
         // a working button); the analytics script is public build configuration,
-        // not user/session state. Never downgrade this to private/no-store.
-        ...DEFAULT_SSR_CACHE_HEADERS,
+        // not user/session state. Never vary this per request — the
+        // deployment-wide override inside the resolver is the only knob.
+        ...resolveSsrCacheHeaders(),
         "X-Robots-Tag": "noindex, nofollow",
       },
     },

package/src/server/builder-browser.ts

@@ -1630,8 +1630,16 @@ export async function runBuilderAgent(
       "Builder project ID is not configured. Set DISPATCH_BUILDER_PROJECT_ID, BUILDER_BRANCH_PROJECT_ID, or BUILDER_PROJECT_ID.",
     );
   }
-  const builderUserId = args.userId || creds.userId || undefined;
-  const builderUserEmail = builderUserId ? undefined : args.userEmail;
+  // The requesting user's email must win over any stored BUILDER_USER_ID.
+  // The connect flow always persists BUILDER_USER_ID, so preferring it here
+  // attributed every branch to whoever connected the credential — at org scope
+  // that is the admin, not the person who asked. Builder resolves userEmail
+  // against Space membership, so fall back to the credential's user id when
+  // there is no session email or the email is not a member.
+  const requestedEmail = args.userEmail?.trim() || undefined;
+  const fallbackUserId = args.userId || creds.userId || undefined;
+  const builderUserEmail = requestedEmail;
+  const builderUserId = requestedEmail ? undefined : fallbackUserId;
   if (!builderUserEmail && !builderUserId) {
     throw new Error("userEmail or userId is required");
   }
@@ -1639,27 +1647,47 @@ export async function runBuilderAgent(
   const url = new URL("/agents/run", getBuilderApiHost());
   url.searchParams.set("apiKey", creds.publicKey);
 
-  const body: Record<string, unknown> = {
-    userMessage: { userPrompt: args.prompt },
-    projectId,
+  const postRun = async (actor: { userEmail?: string; userId?: string }) => {
+    const body: Record<string, unknown> = {
+      userMessage: { userPrompt: args.prompt },
+      projectId,
+    };
+    if (args.branchName) body.branchName = args.branchName;
+    if (actor.userEmail) body.userEmail = actor.userEmail;
+    if (actor.userId) body.userId = actor.userId;
+
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${creds.privateKey}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(body),
+    });
+    const parsed = (await response.json().catch(() => ({}))) as Record<
+      string,
+      unknown
+    >;
+    return { response, parsed };
   };
-  if (args.branchName) body.branchName = args.branchName;
-  if (builderUserEmail) body.userEmail = builderUserEmail;
-  if (builderUserId) body.userId = builderUserId;
 
-  const response = await fetch(url, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${creds.privateKey}`,
-      "Content-Type": "application/json",
-    },
-    body: JSON.stringify(body),
+  let { response, parsed } = await postRun({
+    userEmail: builderUserEmail,
+    userId: builderUserId,
   });
 
-  const parsed = (await response.json().catch(() => ({}))) as Record<
-    string,
-    unknown
-  >;
+  // Builder rejects an email that is not a member of the Space (403/404). Retry
+  // once as the connected credential's user so a non-member still gets a branch,
+  // rather than losing the run entirely.
+  if (
+    !response.ok &&
+    (response.status === 403 || response.status === 404) &&
+    builderUserEmail &&
+    fallbackUserId
+  ) {
+    ({ response, parsed } = await postRun({ userId: fallbackUserId }));
+  }
+
   if (!response.ok) {
     const msg =
       typeof parsed.error === "string"

package/src/server/core-routes-plugin.ts

@@ -86,8 +86,8 @@ import {
   deleteUserSetting,
 } from "../settings/user-settings.js";
 import {
-  DEFAULT_SSR_CACHE_HEADERS,
   EMPTY_SPECULATION_RULES,
+  resolveSsrCacheHeaders,
 } from "../shared/cache-control.js";
 import { EMBED_TARGET_HEADER } from "../shared/embed-auth.js";
 import { llmConnectionTrackingProperties } from "../shared/llm-connection.js";
@@ -1614,7 +1614,7 @@ export function createCoreRoutesPlugin(
             "application/speculationrules+json; charset=utf-8",
           );
           for (const [name, value] of Object.entries(
-            DEFAULT_SSR_CACHE_HEADERS,
+            resolveSsrCacheHeaders(),
           )) {
             setResponseHeader(event, name, value);
           }