@agent-native/core 0.122.0 → 0.122.2

package/README.md

@@ -1,8 +1,9 @@
 # Agent-Native
 
+
 ## The framework for agentic apps
 
-Agent-Native is an open-source framework for rapidly building robust applications with agents at their core.
+Don't pick between apps or agents. Agent-Native apps are both.
 
 ```ts
 // One action powers every app surface: UI, agent, HTTP, MCP, A2A, and CLI.
@@ -22,16 +23,7 @@ export default defineAction({
 - **[Backend agnostic](https://agent-native.com/docs/database)**: Plug in any Drizzle-supported SQL database and Nitro-compatible host.
 - **[Toolkits](https://agent-native.com/docs/agent-native-toolkit)**: Reusable building blocks for collaboration, sharing, settings, teams, and observability.
 
-## Don't pick between apps or agents.
-
-Agent-native apps are both
-
-|                   | SaaS Tools         | Raw AI Agents           | Internal Tools             | Agent-Native App        |
-| ----------------- | ------------------ | ----------------------- | -------------------------- | ----------------------- |
-| **UI**            | Polished but rigid | None                    | Mixed quality              | Full UI, fork & go      |
-| **AI**            | Bolted on          | Powerful                | Shallowly connected        | Agent-first, integrated |
-| **Customization** | Can't              | Instructions and skills | Full, but high maintenance | Agent modifies the app  |
-| **Ownership**     | Rented             | Somewhat yours          | You own the code           | You own the code        |
+https://github.com/user-attachments/assets/ef51644b-6506-46d8-8083-0af7b7e5b65c
 
 ## Try an Agent-Native app
 
@@ -47,8 +39,6 @@ Fork a working app and let the agent evolve it. **You can customize everything.*
 
 **Agent-Native Loom**
 
-Record your screen with auto-transcripts and captured browser debug logs, share a link, and let an agent read the transcript, see timestamped frames, and fix the bug.
-
 </td>
 <td width="33%" align="center" valign="top">
 
@@ -58,8 +48,6 @@ Record your screen with auto-transcripts and captured browser debug logs, share
 
 **Visual plan mode for coding agents**
 
-Install `/visual-plan` and `/visual-recap` so your coding agent can plan before it builds and recap changes after they land. High-level code reviews with diagrams, wireframes, annotations, and review links.
-
 </td>
 <td width="33%" align="center" valign="top">
 
@@ -69,8 +57,6 @@ Install `/visual-plan` and `/visual-recap` so your coding agent can plan before
 
 **Agent-Native Figma**
 
-Generate interactive HTML prototypes, compare variants, refine controls, and export the result.
-
 </td>
 </tr>
 <tr>
@@ -82,8 +68,6 @@ Generate interactive HTML prototypes, compare variants, refine controls, and exp
 
 **Agent-Native Notion/Obsidian**
 
-Edit local Markdown/MDX files, generate rich interactive custom blocks, and draft, rewrite, or publish with an agent.
-
 </td>
 <td width="33%" align="center" valign="top">
 
@@ -93,8 +77,6 @@ Edit local Markdown/MDX files, generate rich interactive custom blocks, and draf
 
 **Open-Source Alternative to Amplitude and FullStory**
 
-Connect analytics data sources, prompt for real charts, and build reusable dashboards.
-
 </td>
 <td width="33%" align="center" valign="top">
 
@@ -104,13 +86,11 @@ Connect analytics data sources, prompt for real charts, and build reusable dashb
 
 **A minimal ChatGPT-style app for your own agent**
 
-Chat-first app scaffold with durable threads, actions, auth, live sync, and a clean path to add screens or plug in your own agent backend.
-
 </td>
 </tr>
 </table>
 
-View the full app gallery at **[agent-native.com/apps](https://agent-native.com/apps)**, or build from scratch with the **[framework guide](https://agent-native.com/docs/getting-started)**.
+View the [full gallery](https://agent-native.com/apps), or build from scratch with the **[framework guide](https://agent-native.com/docs/getting-started)**.
 
 ## Quick Start
 
@@ -123,7 +103,7 @@ pnpm install
 pnpm dev
 ```
 
-Prefer flags? `create my-app --template mail`, `--headless`, or `--standalone` skip the prompt.
+Prefer flags? `create my-app --template chat`, `--headless`, or `--standalone` skip the prompt.
 
 See the full [getting started docs](https://agent-native.com/docs).
 

package/corpus/README.md

@@ -30,4 +30,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 - core files: 1671
 - toolkit files: 160
-- template files: 6433
+- template files: 6470

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @agent-native/core
 
+## 0.122.2
+
+### Patch Changes
+
+- 905bdba: Improve tool-input recovery, stale-run handling, and design-system routing reliability.
+
+## 0.122.1
+
+### Patch Changes
+
+- c8a0bcf: Sign the A2A identity token's audience as the target's origin. Receivers derive their expected audience from `APP_URL`, which carries no app path, so a path-qualified audience could never match — every direct `actions/invoke` between workspace apps failed with "Invalid or expired A2A token".
+- c8a0bcf: Allow agent-to-agent calls between apps in a locally running workspace. The gateway serves every app on loopback, so sibling A2A targets are private addresses by construction and `ssrfSafeFetch` rejected them as SSRF — making cross-app delegation fail locally with "refusing to fetch private/internal address". `ssrfSafeFetch` now accepts an `allowedPrivateOrigins` list and the A2A client passes the deployment's own gateway origin (never a request-supplied value).
+- c8a0bcf: Bound Nitro dev-server startup recovery so a failed restart stops refreshing forever.
+- c8a0bcf: Keep Manage agent as a dedicated linked destination at the bottom of settings navigation.
+
 ## 0.122.0
 
 ### Minor Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.122.0",
+  "version": "0.122.2",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/a2a/client.ts

@@ -1,6 +1,50 @@
 import * as jose from "jose";
 
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
+
+/**
+ * A workspace serves every app from one gateway on loopback, so sibling A2A
+ * targets are private addresses by construction and the SSRF guard cannot tell
+ * them apart from an attack. Trust only origins this deployment configured for
+ * itself — never a value that arrived on a request.
+ */
+function workspacePrivateOrigins(): string[] {
+  const origins = [
+    process.env.WORKSPACE_GATEWAY_URL,
+    process.env.APP_URL,
+    process.env.BETTER_AUTH_URL,
+    // Escape hatch for contexts that never receive the gateway manifest (the
+    // action CLI, one-off scripts). Comma-separated origins.
+    ...(process.env.AGENT_NATIVE_A2A_ALLOWED_ORIGINS ?? "").split(","),
+  ]
+    .map((value) => value?.trim())
+    .filter((value): value is string => !!value);
+
+  // The gateway also hands each child the sibling manifest, and siblings are
+  // reached on their own loopback ports rather than through the gateway.
+  const raw = process.env.AGENT_NATIVE_WORKSPACE_APPS_JSON;
+  if (raw) {
+    try {
+      const parsed = JSON.parse(raw);
+      const apps = Array.isArray(parsed?.apps)
+        ? parsed.apps
+        : Array.isArray(parsed)
+          ? parsed
+          : [];
+      for (const app of apps) {
+        const url = app?.url ?? app?.origin ?? app?.baseUrl;
+        if (typeof url === "string" && url) origins.push(url);
+        const port = app?.port;
+        if (typeof port === "number" && Number.isFinite(port)) {
+          origins.push(`http://127.0.0.1:${port}`);
+        }
+      }
+    } catch {
+      // A malformed manifest must not disable the SSRF guard.
+    }
+  }
+  return origins;
+}
 import { sanitizeA2ACorrelationMetadata } from "./correlation.js";
 import type {
   A2AApprovedAction,
@@ -138,7 +182,7 @@ export class A2AClient {
         const res = await ssrfSafeFetch(
           endpoint,
           { method: "OPTIONS" },
-          { maxRedirects: 3 },
+          { maxRedirects: 3, allowedPrivateOrigins: workspacePrivateOrigins() },
         );
         if (res.status !== 404 && res.status !== 405) {
           this.endpointCandidates = [endpoint];
@@ -237,7 +281,7 @@ export class A2AClient {
     const res = await ssrfSafeFetch(
       `${this.baseUrl}/.well-known/agent-card.json`,
       {},
-      { maxRedirects: 3 },
+      { maxRedirects: 3, allowedPrivateOrigins: workspacePrivateOrigins() },
     );
     if (!res.ok) {
       throw new Error(`Failed to fetch agent card (${res.status})`);
@@ -548,7 +592,7 @@ export class A2AClient {
           body: JSON.stringify(body),
           signal: controller?.signal,
         },
-        { maxRedirects: 3 },
+        { maxRedirects: 3, allowedPrivateOrigins: workspacePrivateOrigins() },
       );
     } finally {
       if (timer) clearTimeout(timer);
@@ -883,7 +927,16 @@ async function buildA2AApiKeyAttempts(
 
 function normalizeA2AAudience(url: string): string {
   const explicit = splitExplicitA2AEndpoint(url.replace(/\/$/, ""));
-  return (explicit?.baseUrl ?? url).replace(/\/$/, "");
+  const base = (explicit?.baseUrl ?? url).replace(/\/$/, "");
+  // Receivers derive their expected audience from APP_URL, which carries no
+  // app path. In a workspace every app is mounted under one gateway origin, so
+  // signing the path-qualified URL yields an audience the receiver can never
+  // match. The origin is the identifier both sides agree on.
+  try {
+    return new URL(base).origin;
+  } catch {
+    return base;
+  }
 }
 
 function isA2AAuthRejection(err: unknown): boolean {

package/corpus/core/src/agent/production-agent.ts

@@ -3369,6 +3369,59 @@ function normalizeOptionalToolPlaceholders(
   return { input: normalized, changed: true };
 }
 
+/**
+ * Models routinely JSON-encode a field's value into a string when the tool
+ * schema wants an object/array — e.g. `config: "{\"name\":...}"` instead of
+ * `config: {name:...}`, or `operations: "[...]"` instead of `operations: [...]`.
+ * Seen across every app profiled in the 2026-07-25 reliability sweep
+ * (brain's `update-source` config, analytics' `mutate-dashboard`/
+ * `update-dashboard` operations/ops/config) and the model does NOT
+ * self-correct across repeated identical retries — it burns the full
+ * `MAX_IDENTICAL_TOOL_ERRORS` retry budget on the same wrong shape every
+ * time. Evidence-gated exactly like `normalizeOptionalToolPlaceholders`:
+ * only coerce a field whose CURRENT value fails schema validation (so a
+ * legitimate string value is never touched — a field schema-valid as a
+ * string is never also schema-valid as object/array) and whose parsed form
+ * passes. Never touches values that are already the right shape.
+ */
+function coerceStringifiedJsonToolValues(
+  schema: RawJsonSchema | undefined,
+  input: unknown,
+): { input: unknown; changed: boolean } {
+  if (!schema?.properties || !input || typeof input !== "object") {
+    return { input, changed: false };
+  }
+  if (Array.isArray(input)) return { input, changed: false };
+
+  let normalized: Record<string, unknown> | null = null;
+  for (const [key, value] of Object.entries(input as Record<string, unknown>)) {
+    if (typeof value !== "string" || value.trim().length === 0) continue;
+    const propertySchema = schema.properties[key];
+    if (!propertySchema || typeof propertySchema !== "object") continue;
+    const expectedType = (propertySchema as { type?: unknown }).type;
+    const expectsObjectOrArray =
+      expectedType === "object" ||
+      expectedType === "array" ||
+      (Array.isArray(expectedType) &&
+        (expectedType.includes("object") || expectedType.includes("array")));
+    if (!expectsObjectOrArray) continue;
+    if (schemaAcceptsToolValue(propertySchema, value)) continue;
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(value);
+    } catch {
+      continue;
+    }
+    if (typeof parsed !== "object" || parsed === null) continue;
+    if (!schemaAcceptsToolValue(propertySchema, parsed)) continue;
+    normalized ??= { ...(input as Record<string, unknown>) };
+    normalized[key] = parsed;
+  }
+  return normalized
+    ? { input: normalized, changed: true }
+    : { input, changed: false };
+}
+
 function getRawToolInputValidator(schema: RawJsonSchema): ValidateFunction {
   const cached = rawToolInputValidatorCache.get(schema);
   if (cached) return cached;
@@ -4354,6 +4407,17 @@ export async function runAgentLoop(opts: {
       if (placeholderNormalization.changed) {
         toolCall = { ...toolCall, input: placeholderNormalization.input };
       }
+      const jsonStringCoercion = actionEntry
+        ? coerceStringifiedJsonToolValues(
+            actionEntry.tool.parameters,
+            toolCall.input,
+          )
+        : { input: toolCall.input, changed: false };
+      if (jsonStringCoercion.changed) {
+        toolCall = { ...toolCall, input: jsonStringCoercion.input };
+      }
+      const toolInputNormalized =
+        placeholderNormalization.changed || jsonStringCoercion.changed;
       const wireToolInput = JSON.stringify(toolCall.input ?? {});
       const normalizedToolInput = normalizeToolCallInputForHistory(
         toolCall.input,
@@ -4776,7 +4840,7 @@ export async function runAgentLoop(opts: {
       });
 
       const toolCallSchemaError = toolCallErrors.get(toolCall.id);
-      if (toolCallSchemaError && !placeholderNormalization.changed) {
+      if (toolCallSchemaError && !toolInputNormalized) {
         const result = finalizeToolErrorResult(
           toolInputSchemaErrorResult(
             toolCall.name,

package/corpus/core/src/agent/run-store.ts

@@ -173,6 +173,34 @@ export const UNCLAIMED_BACKGROUND_RUN_FAST_SWEEP_MS = 20_000;
  */
 const STALE_RUN_RECOVERY_MAX_TURN_RUNS = 25;
 
+/**
+ * Circuit breaker for a DETERMINISTIC dead-on-arrival loop: some request
+ * shapes make the worker hang almost immediately every single time (e.g. an
+ * un-timed-out provider fetch that blocks the event loop) rather than merely
+ * hitting a transient blip. Because `attemptStaleRunRecovery` replays the
+ * SAME captured `dispatch_payload` on every successor (never a fresh
+ * request), such a turn was retrying an unwinnable request up to
+ * `STALE_RUN_RECOVERY_MAX_TURN_RUNS` (25) times — ~25 * 53s ≈ 22 minutes,
+ * each cycle re-billing the full input context — before finally giving up.
+ * Confirmed live in prod (assets: one turn cycled 24x, each attempt an
+ * identical ~32K-token request that made a token of real progress around
+ * ~8s in then went completely silent for the rest of its life until the 45s
+ * reap). Stop recovering after this many CONSECUTIVE stale_run reaps that
+ * each made near-zero real progress — a single blip never trips it (needs
+ * 3 in a row), and a run that's genuinely grinding through long work right
+ * up to its heartbeat window is untouched (see `hasNoForwardProgress`).
+ */
+const STALE_RUN_RECOVERY_CONSECUTIVE_NO_PROGRESS_LIMIT = 3;
+
+/**
+ * A reaped run counts as having made no forward progress if it never
+ * emitted a real event (`last_progress_at` unset) or died within this many
+ * ms of starting — well short of the 45s background reap window, so a run
+ * that was legitimately working almost up to the reap boundary is not
+ * penalized. See `STALE_RUN_RECOVERY_CONSECUTIVE_NO_PROGRESS_LIMIT`.
+ */
+const STALE_RUN_RECOVERY_NO_PROGRESS_WINDOW_MS = 20_000;
+
 /**
  * Maximum time the stale reapers (`reapIfStale`, `reapAllStaleRuns`,
  * `cleanupOldRuns`'s heartbeat-stale pass) will suspend reaping a "running"
@@ -1361,7 +1389,8 @@ type StaleRunRecoveryOutcome =
   | { outcome: "not_background" }
   | { outcome: "payload_missing" }
   | { outcome: "newer_run_exists" }
-  | { outcome: "budget_exhausted" };
+  | { outcome: "budget_exhausted" }
+  | { outcome: "repeated_no_progress" };
 
 /**
  * Mirrors `production-agent.ts`'s `generateRunId` — duplicated (not
@@ -1477,6 +1506,37 @@ async function attemptStaleRunRecovery(
     return { outcome: "budget_exhausted" };
   }
 
+  // See `STALE_RUN_RECOVERY_CONSECUTIVE_NO_PROGRESS_LIMIT`: a run whose last
+  // N attempts (including the one just reaped, already written by the
+  // caller's UPDATE earlier in this same transaction) all died as stale_run
+  // having made essentially no real progress is retrying an unwinnable
+  // request, not recovering from a blip. Stop far short of the 25-run/~22min
+  // budget above instead of grinding through it.
+  const { rows: recentRows } = await db.execute({
+    sql: `SELECT error_code, started_at, last_progress_at FROM agent_runs WHERE turn_id = ? ORDER BY started_at DESC LIMIT ?`,
+    args: [turnId, STALE_RUN_RECOVERY_CONSECUTIVE_NO_PROGRESS_LIMIT],
+  });
+  const recent = (recentRows ?? []) as Array<{
+    error_code?: string | null;
+    started_at: number | string;
+    last_progress_at: number | string | null;
+  }>;
+  const allDeadOnArrival =
+    recent.length === STALE_RUN_RECOVERY_CONSECUTIVE_NO_PROGRESS_LIMIT &&
+    recent.every((r) => {
+      if (r.error_code !== STALE_RUN_ERROR_EVENT.errorCode) return false;
+      const started = Number(r.started_at) || 0;
+      const progress =
+        r.last_progress_at == null ? null : Number(r.last_progress_at);
+      return (
+        progress === null ||
+        progress - started < STALE_RUN_RECOVERY_NO_PROGRESS_WINDOW_MS
+      );
+    });
+  if (allDeadOnArrival) {
+    return { outcome: "repeated_no_progress" };
+  }
+
   const successorRunId = generateRecoveryRunId();
   const now = Date.now();
   await db.execute({

package/corpus/core/src/client/settings/SettingsPanel.tsx

@@ -3001,18 +3001,10 @@ export function useAgentSettingsTabs(): SettingsTabItem[] {
     const organization = searchTab("organization");
     const workspace = searchTab("workspace");
     return [
-      {
-        ...agent,
-        icon: IconHierarchy2,
-        group: "agent",
-        href: "/agent#settings",
-        searchEntries: undefined,
-        content: <Navigate to="/agent#settings" replace />,
-      },
       {
         ...connections,
         icon: IconPlugConnected,
-        group: "agent",
+        group: "workspace",
         content: <ConnectionsSettingsContent settingsPanelProps={baseProps} />,
       },
       {
@@ -3047,6 +3039,14 @@ export function useAgentSettingsTabs(): SettingsTabItem[] {
         keywords: "extensions widgets mini apps tools sandboxed apps",
         content: <ExtensionsSettingsContent />,
       },
+      {
+        ...agent,
+        icon: IconHierarchy2,
+        group: "manage-agent",
+        href: "/agent#settings",
+        searchEntries: undefined,
+        content: <Navigate to="/agent#settings" replace />,
+      },
     ];
   }, [baseProps]);
 }

package/corpus/core/src/client/settings/SettingsTabsPage.tsx

@@ -1,5 +1,6 @@
 import { Tabs, useDesignSystem } from "@agent-native/toolkit/design-system";
 import {
+  IconArrowUpRight,
   IconHistory,
   IconSearch,
   IconSettings,
@@ -216,6 +217,8 @@ export function SettingsTabsPage({
     const hasOrganizationTab = extraTabs.some(
       (tab) => tab.id === "organization",
     );
+    const inlineTabs = extraTabs.filter((tab) => !tab.href);
+    const linkedTabs = extraTabs.filter((tab) => tab.href);
     const next: SettingsTabItem[] = [
       {
         id: "general",
@@ -234,7 +237,7 @@ export function SettingsTabsPage({
         keywords: "profile photo avatar identity signed in email name",
       });
     }
-    next.push(...extraTabs);
+    next.push(...inlineTabs);
     if (team && !hasOrganizationTab) {
       next.push({
         id: "team",
@@ -249,10 +252,11 @@ export function SettingsTabsPage({
         id: "whats-new",
         label: whatsNewLabel,
         icon: IconHistory,
-        group: "updates",
+        group: next.at(-1)?.group ?? "app",
         content: whatsNew,
       });
     }
+    next.push(...linkedTabs);
     return next;
   }, [
     account,
@@ -615,6 +619,12 @@ export function SettingsTabsPage({
                           />
                         ) : null}
                         <span className="truncate">{tab.label}</span>
+                        {tab.href ? (
+                          <IconArrowUpRight
+                            aria-hidden="true"
+                            className="size-3.5 shrink-0 text-muted-foreground/80"
+                          />
+                        ) : null}
                       </>
                     );
                     if (tab.href) {

package/corpus/core/src/extensions/url-safety.ts

@@ -163,7 +163,32 @@ export async function isBlockedExtensionUrlWithDns(
  * runtimes); the caller should fall back to the regular `fetch` path —
  * `isBlockedExtensionUrlWithDns` will still have caught most rebinding cases.
  */
-export async function createSsrfSafeDispatcher(): Promise<unknown | null> {
+function normalizeLookupHostname(hostname: string): string {
+  return hostname.toLowerCase().replace(/^\[|\]$/g, "");
+}
+
+function normalizeAllowedPrivateOriginKeys(
+  origins: readonly string[],
+): Set<string> {
+  const keys = new Set<string>();
+  for (const origin of origins) {
+    try {
+      const parsed = new URL(origin);
+      if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        continue;
+      }
+      const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+      keys.add(`${normalizeLookupHostname(parsed.hostname)}:${port}`);
+    } catch {
+      // Ignore malformed deployment configuration and retain the private-IP guard.
+    }
+  }
+  return keys;
+}
+
+export async function createSsrfSafeDispatcher(
+  allowedPrivateOrigins: readonly string[] = [],
+): Promise<unknown | null> {
   // Keep the optional undici import opaque to Vite/Rolldown. A static
   // `import("undici")` makes browser builds try to resolve and bundle undici
   // even though this dispatcher is only useful in Node server runtimes.
@@ -182,6 +207,9 @@ export async function createSsrfSafeDispatcher(): Promise<unknown | null> {
 
   const { Agent } = undici;
   const { lookup } = dnsModule;
+  const allowedPrivateOriginKeys = normalizeAllowedPrivateOriginKeys(
+    allowedPrivateOrigins,
+  );
   if (!Agent || !lookup) return null;
 
   return new Agent({
@@ -209,7 +237,10 @@ export async function createSsrfSafeDispatcher(): Promise<unknown | null> {
               ? addresses
               : [{ address: addresses, family: 4 }];
             for (const record of list) {
-              if (isPrivateHost(record.address)) {
+              const allowedOrigin = allowedPrivateOriginKeys.has(
+                `${normalizeLookupHostname(hostname)}:${String(options?.port ?? "")}`,
+              );
+              if (isPrivateHost(record.address) && !allowedOrigin) {
                 const e = new Error(
                   `Connect blocked: ${hostname} resolved to private address ${record.address}`,
                 ) as NodeJS.ErrnoException;
@@ -264,10 +295,39 @@ export async function ssrfSafeFetch(
     maxRedirects?: number;
     httpsOnly?: boolean;
     assertUrlAllowed?: (url: string) => void | Promise<void>;
+    /**
+     * Exact origins that may resolve to a private address. A workspace runs
+     * every app on loopback behind one gateway, so sibling A2A calls are
+     * private by construction; without this they are indistinguishable from an
+     * SSRF attempt and get blocked. Only ever pass origins the deployment
+     * itself configured (never a request-supplied value).
+     */
+    allowedPrivateOrigins?: readonly string[];
   } = {},
 ): Promise<Response> {
   const maxRedirects = options.maxRedirects ?? 3;
-  const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;
+  const dispatcher =
+    (await createSsrfSafeDispatcher(options.allowedPrivateOrigins)) ??
+    undefined;
+  const allowedPrivateOrigins = new Set(
+    (options.allowedPrivateOrigins ?? [])
+      .map((origin) => {
+        try {
+          return new URL(origin).origin;
+        } catch {
+          return "";
+        }
+      })
+      .filter(Boolean),
+  );
+  const isAllowedPrivateOrigin = (candidate: string): boolean => {
+    if (allowedPrivateOrigins.size === 0) return false;
+    try {
+      return allowedPrivateOrigins.has(new URL(candidate).origin);
+    } catch {
+      return false;
+    }
+  };
 
   let currentUrl = url;
   for (let hop = 0; hop <= maxRedirects; hop++) {
@@ -277,7 +337,10 @@ export async function ssrfSafeFetch(
         `SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`,
       );
     }
-    if (await isBlockedExtensionUrlWithDns(currentUrl)) {
+    if (
+      !isAllowedPrivateOrigin(currentUrl) &&
+      (await isBlockedExtensionUrlWithDns(currentUrl))
+    ) {
       throw new Error(
         `SSRF blocked: refusing to fetch private/internal address (${currentUrl})`,
       );

package/corpus/core/src/server/builder-design-systems.ts

@@ -140,7 +140,7 @@ function trimTrailingSlash(value: string): string {
 export function getBuilderDesignSystemsBaseUrl(): string {
   return (
     process.env.BUILDER_DESIGN_SYSTEMS_BASE_URL ||
-    `${trimTrailingSlash(getBuilderProxyOrigin())}/design-systems/v1`
+    `${trimTrailingSlash(getBuilderProxyOrigin())}/agent-native/design-systems/v1`
   );
 }
 

package/corpus/core/src/templates/chat/app/components/layout/Sidebar.tsx

@@ -14,7 +14,6 @@ import {
   type ChatHistoryItem,
 } from "@agent-native/toolkit/chat-history";
 import {
-  IconHierarchy2,
   IconLayoutSidebarLeftCollapse,
   IconLayoutSidebarLeftExpand,
   IconMessageCircle,
@@ -43,12 +42,6 @@ const navItems = [
 ];
 
 const bottomNavItems = [
-  {
-    icon: IconHierarchy2,
-    labelKey: "settings.agentTitle",
-    href: "/agent",
-    view: "agent",
-  },
   {
     icon: IconSettings,
     labelKey: "navigation.settings",

package/corpus/core/src/templates/default/app/root.tsx

@@ -327,7 +327,7 @@ export function ErrorBoundary() {
           {copy.goHome}
         </Link>
         <ErrorReportActions
-          appName="Agent Native"
+          appName="{{APP_TITLE}}"
           title={title}
           details={details}
           status={status}

package/corpus/core/src/templates/default/public/manifest.json

@@ -1,6 +1,6 @@
 {
-  "name": "Agent Native App",
-  "short_name": "App",
+  "name": "{{APP_TITLE}}",
+  "short_name": "{{APP_TITLE}}",
   "description": "Agent-native application",
   "start_url": "/",
   "display": "standalone",