@agent-native/core 0.122.3 → 0.123.0

package/corpus/templates/content/AGENTS.md

@@ -1,11 +1,23 @@
 # Documents — Agent Guide
 
-Documents is an agent-native editor for docs, comments, media blocks, sharing,
-and Notion-connected content. The agent edits documents through actions and
-application state shared with the UI.
+Documents is an agent-native editor for docs, comments, media blocks, databases,
+sharing, and Notion-connected content; the agent and the UI share the same
+actions and application state.
 
-Detailed document editing, Notion, storage, and UI rules live in
-`.agents/skills/`.
+## Skills
+
+Read the relevant skill before deeper work:
+
+- `content` — Markdown/MDX authoring, local folder sources, databases, intake
+  forms, and Slack/A2A artifact replies.
+- `document-editing` — document and comment actions, screen context and IDs,
+  common tasks, the data model, and the databases reference.
+- `notion-integration` — connected Notion workflows and the raw Notion provider
+  API path.
+- `creative-context` — cross-app source reuse, pinned packs, provenance, and
+  context opt-out.
+- `storing-data`, `real-time-sync`, `security`, `actions`, `frontend-design`,
+  and `shadcn-ui` for framework work.
 
 Before building common workspace or agent UI, read `agent-native-toolkit` to
 inventory existing public kits and installed package seams. Use
@@ -14,145 +26,65 @@ ladder.
 
 ## Core Rules
 
-- Store large file/blob payloads in configured file/blob storage, not SQL: no
-  base64, `data:` URLs, images, video/audio, PDFs, ZIPs, screenshots,
-  thumbnails, or replay chunks in app tables, `application_state`, `settings`,
-  or `resources`; persist URLs, ids, or handles instead.
-- Never hardcode API keys, tokens, webhook URLs, signing secrets, private Builder/internal data, customer data, or credential-looking literals. Use secrets/OAuth/runtime configuration and obvious placeholders in examples.
 - Use actions for documents, blocks, comments, media, sharing, navigation, and
   Notion integration. Do not mutate document rows directly unless a skill says to
-  and access checks are preserved.
-- Notion workspace access is per-user OAuth only. Never read `NOTION_API_KEY`
-  from `process.env`, never save a user-entered Notion token through
-  `/_agent-native/env-vars`, and require editor access for routes that pull or
-  push Notion content.
-- Treat Notion workflow actions as shortcuts, not capability limits. When the
-  exact Notion endpoint/filter/pagination/API version matters, use
-  `provider-api-catalog`, `provider-api-docs`, and `provider-api-request`
-  against the real Notion API. The provider API resolves auth from the user's
-  Notion OAuth connection, never from `NOTION_API_KEY`. For large scans, stage
-  results with `stageAs` and analyze them with `query-staged-dataset`.
-- Preserve user-authored content. Prefer targeted edits over wholesale rewrites
-  unless requested.
-- Screen context is auto-included as a `<current-screen>` block on every
-  message — check it before acting instead of calling `view-screen` by
-  default. Call `view-screen` explicitly only when that snapshot is truncated
-  or doesn't yet reflect something that changed earlier in the same turn (for
-  example, right after `create-document` or `navigate`).
-- Keep public/exported content server-renderable where relevant.
+  and access checks are preserved. Never use `curl`, raw HTTP requests, or
+  `db-exec` with raw SQL for document operations.
 - The editor uses live Yjs collaboration — raw SQL writes to `documents` won't
   appear in an open editor. Always use `edit-document` or `update-document`,
   and prefer `edit-document` for small changes (it sends only the changed
   text and syncs live via CRDT instead of regenerating the whole document).
+- Preserve user-authored content. Prefer targeted edits over wholesale rewrites
+  unless requested.
 - `create-document`, `update-document`, and `delete-document` already signal
   a UI refresh; only call `refresh-list` directly if you mutate documents
   another way and the UI doesn't update.
+- Screen context is auto-included as a `<current-screen>` block on every
+  message — check it before acting instead of calling `view-screen` by default.
+  IDs for edits always come from `<current-screen>` or a prior action result,
+  never guessed.
+- Documents are **private by default**; use `share-resource` /
+  `set-resource-visibility` (`resourceType document`) to change access. Keep
+  public/exported content server-renderable where relevant.
+- Notion workspace access is per-user OAuth only: never read `NOTION_API_KEY`
+  from `process.env`, never save a user-entered token, and require editor access
+  to pull or push. Notion actions are shortcuts, not capability limits — see
+  `notion-integration` for the `provider-api-*` path when an exact endpoint,
+  filter, pagination mode, or API version matters.
+- Store large file/blob payloads in configured file/blob storage, not SQL: no
+  base64, `data:` URLs, images, video/audio, PDFs, ZIPs, screenshots,
+  thumbnails, or replay chunks in app tables, `application_state`, `settings`,
+  or `resources`; persist URLs, ids, or handles instead.
+- Never hardcode API keys, tokens, webhook URLs, signing secrets, private Builder/internal data, customer data, or credential-looking literals. Use secrets/OAuth/runtime configuration and obvious placeholders in examples.
 
 ## Application State
 
-- Before generation, follow the creative-context reuse ladder in
-  `.agents/skills/creative-context/SKILL.md`: explicit request and current
-  document first, then a pinned/current pack, then narrow library search.
-  Respect `creative-context.contextMode: "off"` without silently restoring a
-  pack.
-- To submit a document to a governed Creative Context, use the Context tab or
-  `manage-context-membership`; the app flushes live collaboration and captures
-  one immutable Markdown version. Reuse only its opaque native clone reference.
-  Use `operation="submit-latest"` with a Library membership id when its native
-  update status reports `update-available`.
-
-- `navigation` exposes document, selected block, comment, media, and Notion view
-  context.
-- `navigate` moves the UI to documents, comments, media, and settings surfaces.
+- `navigation` — `{ "view": "list" | "editor", "documentId": "abc123" }`, plus
+  selected block, comment, media, and Notion view context. `list` is the
+  document tree; `editor` is one open document. **Do NOT write to
+  `navigation`** — it is overwritten by the UI. Use `navigate` to control the UI.
+- `creative-context` — `contextMode`, `selectedContextId`, `currentPackId`,
+  `pinnedPackId`. Follow the `creative-context` reuse ladder before generating,
+  and respect `contextMode: "off"` without silently restoring a pack.
 - Use actions for full document content and comment context.
 
-## Skills
-
-- `creative-context` for cross-app source reuse, pinned packs, provenance, and
-  context opt-out.
-
-Read the relevant skill before deeper work:
-
-- `document-editing` for structured document updates.
-- `notion-integration` for connected Notion workflows.
-- `storing-data`, `real-time-sync`, `security`, `actions`, `frontend-design`,
-  and `shadcn-ui` for framework work.
-
-## Navigation State
-
-```json
-{
-  "view": "editor",
-  "documentId": "abc123"
-}
-```
-
-Views: `list` (document tree), `editor` (viewing/editing a document).
-
-**Do NOT write to `navigation`** — it is overwritten by the UI. Use `navigate` to control the UI.
-
 ## Actions
 
-In dev, call actions with `pnpm action <name>`; in production, call native
-tools. Never use `curl`, raw HTTP requests, or `db-exec` with raw SQL for
-document operations. `.env` is loaded automatically — never manually set
-`DATABASE_URL` or other env vars.
-
-`view-screen`, `navigate`, and `refresh-list` handle context and UI control.
-`list-documents`, `search-documents`, `get-document`, `pull-document`,
-`create-document`, `edit-document`, `update-document`, and `delete-document`
-cover the core document workflow. Every action carries its own schema. Other
-app-specific tools, including `remove-local-file-source`, are registered; use
-`tool-search` instead of scanning a table here.
-
-### Cross-App A2A / Slack Artifact Rule
-
-Create or update the document through the normal action path (never a bespoke route) so the artifact stays visible and shareable. When a request arrives from Slack, Dispatch, or another app via A2A, the caller cannot see Content's local UI or navigation state: reply with the concrete document ID and URL/path only after the action succeeds. Use `/page/<id>` for private app documents (or `/p/<id>` only for documents you explicitly made public). Never say a document is ready without including the exact ID or URL/path returned by the action.
-
-### Deeper Behavior (Read On Demand)
-
-- `references/document-behavior.md` (`document-editing` skill) — description
-  ownership, `pull-document`'s collab-flush handshake vs `get-document`,
-  versions, image blocks, sharing/visibility (`/page/<id>` vs `/p/<id>`,
-  discoverability, the read-only public chat).
-- `references/local-file-mode.md` (`content` skill) — local folder sources,
-  Builder Symbol/source-component preservation, local MDX components.
-- `notion-integration` skill — connecting, sync, conflicts, the read-only
-  database-source pilot.
-- `document-editing` skill's Comments section — inline anchor-tracked
-  threads, @mentions, resolve/reopen.
-
-Documents are **private by default**; use `share-resource` /
-`set-resource-visibility` (`resourceType document`) to change access.
-
-## Common Tasks
-
-| User request              | What to do                                                                        |
-| ------------------------- | --------------------------------------------------------------------------------- |
-| "What am I looking at?"   | Answer from `<current-screen>` (call `view-screen` only if truncated)             |
-| "Create a page about X"   | `create-document --title "X" --content "# X\n\n..."`                              |
-| "Fix a typo / small edit" | ID from `<current-screen>`, `edit-document --id ... --find "old" --replace "new"` |
-| "Delete this page"        | ID from `<current-screen>`, `delete-document --id ...`                            |
-
-IDs for edits always come from `<current-screen>` or a prior action result —
-never guessed.
-
-## Data Model
-
-Documents live in the SQL `documents` table via Drizzle; the framework
-injects the live column schema separately, so this section only covers
-semantics the schema can't convey:
-
-- `document_shares` holds per-user/per-org grants with a `viewer`, `editor`,
-  or `admin` role.
-- `document_versions`, `document_comments`, and `document_sync_links` all
-  carry `owner_email` so a workspace can upgrade from local mode to a real
-  account without losing history, comments, or Notion links.
-- A database is a normal document (`content_databases` +
-  `document_property_definitions`) whose rows are also documents, linked
-  through `content_database_items`. Row pages are omitted from the ordinary
-  sidebar tree — they're reached through the database view.
-
-See `references/databases.md` in the `document-editing` skill for the full
-database behavior reference: property types, Blocks fields, and every view
-type (table, list, gallery, board, calendar, timeline, form).
+| Action | Purpose |
+| --- | --- |
+| `view-screen` | Re-read the current screen when `<current-screen>` is stale |
+| `navigate` | Move the UI to a document, comments, media, or settings |
+| `refresh-list` | Repaint the sidebar after an out-of-band mutation |
+| `list-documents` | Document metadata tree, without bodies |
+| `search-documents` | Title and content search with snippets |
+| `get-document` | One document with full content |
+| `pull-document` | Flush live collab state, then read (external edits) |
+| `create-document` | Create a page, optionally under a parent |
+| `edit-document` | Find/replace edit — preferred for small changes |
+| `update-document` | Full rewrite of title, content, or description |
+| `delete-document` | Move a page and its children to Trash |
+
+Every action carries its own schema, and the rest of the app-specific surface
+(comments, sharing, databases, Notion, local file sources such as
+`remove-local-file-source`) is registered too — use `tool-search` instead of
+scanning a table here.

package/corpus/templates/content/app/routes/_app.tsx

@@ -1,6 +1,6 @@
 import { Outlet } from "react-router";
 
-import { AppLayout } from "@/components/layout/AppLayout";
+import { Layout } from "@/components/layout/Layout";
 import { messagesByLocale } from "@/i18n-data";
 
 export function meta() {
@@ -15,12 +15,12 @@ export function meta() {
   ];
 }
 
-// Pathless layout route — wraps all protected routes with AppLayout so the
+// Pathless layout route — wraps all protected routes with Layout so the
 // agent sidebar and document tree persist across client-side navigations.
 export default function AppLayoutRoute() {
   return (
-    <AppLayout>
+    <Layout>
       <Outlet />
-    </AppLayout>
+    </Layout>
   );
 }

package/corpus/templates/content/server/routes/api/notion/callback.get.ts

@@ -7,17 +7,16 @@
  * verbatim is an open-redirect primitive: an attacker can craft a state
  * blob that points the post-callback redirect at `//evil.example/phish`.
  *
- * To close that hole without depending on the lib's internal helpers (the
- * lib is in concurrent flight elsewhere), this handler:
+ * To close that hole, this handler:
  *
  *   1. Parses the state JSON exactly the way the lib does.
  *   2. Verifies an HMAC signature in `state.sig` against
  *      `BETTER_AUTH_SECRET` (or `AUTH_SECRET`). If absent or wrong, we
  *      ignore the carried `redirectPath` entirely.
  *   3. Even when the HMAC verifies, the resulting `redirectPath` is run
- *      through a same-origin path-only check (modeled on
- *      `safeReturnPath`) before being passed to `sendRedirect` — so a
- *      protocol-relative URL like `//host/evil` falls back to `/`.
+ *      through the framework's shared `safeReturnPath` before being passed
+ *      to `sendRedirect` — so a protocol-relative URL like `//host/evil`
+ *      falls back to `/`.
  *
  * Separately, before ANY token exchange/save happens, this handler verifies
  * the `notion_oauth_state` HttpOnly cookie set by `buildNotionAuthUrl`
@@ -31,6 +30,7 @@
 import crypto from "node:crypto";
 
 import { OAuthAccountOwnedByOtherUserError } from "@agent-native/core/oauth-tokens";
+import { safeReturnPath } from "@agent-native/core/server";
 import {
   defineEventHandler,
   deleteCookie,
@@ -103,24 +103,6 @@ function verifyStateSignature(state: Record<string, any>): {
   return { ok: true, redirectPath: claimed };
 }
 
-/**
- * Mirror of `safeReturnPath` from `@agent-native/core/server` — duplicated
- * here so this fix doesn't depend on a yet-unreleased core export. Rejects
- * absolute URLs, protocol-relative `//host` URLs, backslash bypasses, and
- * data:/javascript: schemes by parsing against a sentinel origin.
- */
-function safeReturnPathLocal(raw: string | null | undefined): string {
-  if (!raw) return "/";
-  if (/[\x00-\x1f]/.test(raw)) return "/";
-  try {
-    const parsed = new URL(raw, "http://safe-base.invalid");
-    if (parsed.origin !== "http://safe-base.invalid") return "/";
-    return parsed.pathname + parsed.search + parsed.hash;
-  } catch {
-    return "/";
-  }
-}
-
 export default defineEventHandler(async (event) => {
   const query = getQuery(event);
   const code = query.code as string | undefined;
@@ -141,7 +123,7 @@ export default defineEventHandler(async (event) => {
   // target regardless of how the rest of the handler exits.
   const state = decodeStateJson(stateParam);
   const verified = verifyStateSignature(state);
-  const target = verified.ok ? safeReturnPathLocal(verified.redirectPath) : "/";
+  const target = verified.ok ? safeReturnPath(verified.redirectPath) : "/";
 
   // CSRF binding: the nonce in `state.n` must match the HttpOnly cookie set
   // by buildNotionAuthUrl for the session that started this flow. Reject

package/corpus/templates/design/.agents/skills/actions/SKILL.md

@@ -18,6 +18,8 @@ Actions in `actions/` are the **single source of truth** for app operations. The
 
 Before creating any custom REST/API route for app data, inspect `actions/` and the action table in `AGENTS.md`. If an action already exists, call it directly from the agent or with `useActionQuery` / `useActionMutation` from the UI. If the capability is missing, create or update a `defineAction`. Do not add `/api/*`, `server/routes/*`, or other pass-through endpoints whose main job is to call, repackage, or re-export an action.
 
+**Stop trigger:** the moment you are about to create a file under `server/routes/api/` — or add server middleware to guard one — stop and check it against the exception list in *When You Still Need Custom `/api/` Routes* below. If it is not on that list, write a `defineAction` instead. This applies even when you already started the route; abandoning a half-written action to hand-roll routes is the exact failure this rule exists to prevent.
+
 ## Why
 
 Actions give the agent callable tools with structured input/output, AND they give the frontend a typed client contract through hooks. One implementation serves both the agent and the UI. They keep the agent's chat context clean, they're reusable, and they can be tested independently.
@@ -390,12 +392,28 @@ This is the canonical approach for new apps. Action names must be lowercase with
 
 ## When You Still Need Custom `/api/` Routes
 
-Most operations should be actions. You only need custom routes in `server/routes/api/` for:
+This is the complete exception list. A route in `server/routes/api/` is only
+justified when the caller is not your own UI or agent, or when the payload is
+not JSON:
 
 - **File uploads** — actions receive JSON params, not multipart form data
 - **Streaming responses** — SSE or chunked responses that need direct H3 control
 - **Webhooks** — external services POST to a specific URL
 - **OAuth callbacks** — redirect-based flows that need specific URL patterns
+- **Public unauthenticated endpoints** — SEO/OG images, share links, and other
+  URLs opened directly by a browser or crawler
+- **Binary or non-JSON responses** — media, exports, generated assets
+
+Everything else is an action: CRUD, settings, search, list/detail reads, auth
+state, and anything the UI fetches as JSON. If a route needs new middleware to
+scope it to the current user, that is a signal it should be an action — actions
+already run inside request context with access checks.
+
+Existing first-party templates still contain a shrinking, explicitly
+grandfathered set of older `/api/*` CRUD routes for app data. The repository's
+`guard:no-action-twin-routes` CI check ratchets that baseline down across the
+first-party template route trees (with the separately owned Plan template
+fenced out); it is not a substitute for keeping generated apps action-first.
 
 When the agent needs a durable image or file URL, call the core `upload-image`
 action or use `uploadFile()` in server code. Do not write base64 into SQL,

package/corpus/templates/design/.agents/skills/design-generation/SKILL.md

@@ -171,6 +171,16 @@ defaults. The banned-defaults list above still applies, plus:
   your colors". Keep structure and layout genuinely varied per screen while the
   palette, type, and components stay on-brand.
 
+## Generation Application State
+
+- `design-generation-session:<designId>` — multi-screen generation planning
+  state from `generate-screens` (canvas region assignments, per-frame
+  instructions consumed by `generate-design`).
+- `show-design-questions` opens pre-generation questions in the main canvas
+  (`show-questions` state).
+- `guided-questions` may hold a one-click chat choice for the current variant
+  set.
+
 ## Generation Workflow — the canonical 5-phase flow
 
 This flow mirrors Claude Design's UX: clarify only what's unclear → show variants → user picks → refine. Don't collapse phases into one shot for new, open-ended designs.
@@ -680,6 +690,12 @@ the prototype. **Never link screens with real URLs.** Use one of:
 External links (`https://…`) are allowed — the editor opens them in a new tab.
 Never use `target="_top"` or relative paths expecting a real page load.
 
+## Locked subtrees
+
+Treat `data-agent-native-locked="true"` as authoritative: locked elements and
+their descendants stay byte-for-byte unchanged, and the server enforces this.
+Ask the user to unlock the layer in the Layers panel if they want it changed.
+
 ## Making edits — minimal, scoped "smart" diffs
 
 When refining an existing design, change the **smallest** amount possible. Full

package/corpus/templates/design/.agents/skills/design-systems/SKILL.md

@@ -456,6 +456,21 @@ When the user provides multiple sources, call all applicable import actions in p
 7. **Call `create-design-system`** with the combined result
 8. **Link to design** via `update-design --designSystemId`
 
+## Fidelity Limits And Open-Ended Figma/GitHub API Access
+
+Figma import/read/paste and design-system/token workflows
+(`import-figma-frame`, `get-figma-design-context`,
+`list-figma-library-assets`, clipboard paste, `.fig` upload) are covered above —
+read them before guessing the calling convention.
+
+Never claim universal lossless Figma import/export; consult
+`FIGMA_INTEROPERABILITY.md` for the real fidelity contract.
+
+For open-ended GitHub/Figma API questions, use
+`provider-api-catalog`/`provider-api-docs`/`provider-api-request` rather than
+treating provider actions as a capability ceiling. Non-read Figma requests need
+human approval.
+
 ## Applying Design System to Generated HTML
 
 When generating a design that has a linked design system, replace all default CSS custom properties with the design system tokens.

package/corpus/templates/design/.agents/skills/frontend-design/SKILL.md

@@ -1,14 +1,17 @@
 ---
 name: frontend-design
 description: >-
-  Create distinctive, production-grade frontend interfaces with high design
-  quality. Use when building web components, pages, artifacts, posters, or
-  applications (websites, landing pages, dashboards, React components,
-  HTML/CSS layouts, or when styling/beautifying any web UI). Generates
-  creative, polished UI that avoids generic AI aesthetics.
+  Sets the visual direction for a new or redesigned surface, with production
+  quality that avoids generic AI aesthetics. Use when building a new page,
+  app, or marketing surface, defining visual identity, or doing a design pass
+  ("make this look good"). Do not load it for routine UI edits: adding a field
+  to an existing form, fixing spacing, wiring a button, or changing copy.
 scope: dev
 license: Complete terms in LICENSE.txt
 source: https://github.com/anthropics/skills/blob/main/skills/frontend-design/SKILL.md
+local-changes: >-
+  Description narrowed and Verification rescoped deliberately; an upstream sync
+  must not restore the broad auto-load triggers or screenshot-everything step.
 metadata:
   internal: true
 ---
@@ -141,11 +144,22 @@ Avoid:
 
 ## Verification
 
+Match verification effort to the size of the change. For one component, one
+form, one page, or a restyle, run the app's existing checks — formatter,
+`pnpm typecheck`, existing tests — and stop there.
+
+Escalate to browser verification only when the user asks for it, or when the
+change is a multi-step user-visible flow that cannot be confirmed any other
+way. Never author a new Playwright/Puppeteer script, add a browser-automation
+dependency, or stand up an e2e harness to check work the user did not ask you
+to test that way; use an available browser tool, or say what you could not
+verify.
+
 For substantial frontend work:
 
 1. Run the relevant formatter/checks.
 2. Start the dev server when the app needs one.
-3. Verify with browser screenshots at desktop and mobile widths.
+3. Verify with the available browser tooling at desktop and mobile widths.
 4. Check interactive states: hover, focus, loading, empty, error, and destructive confirmations.
 5. When registering or changing a company adapter, run
    `@agent-native/toolkit/conformance`, including mixed-overlay focus,

package/corpus/templates/design/.agents/skills/full-app-build/SKILL.md

@@ -18,6 +18,18 @@ design. Screens are URL-backed iframes of that container's dev server, the
 same model as `/visual-edit` localhost screens (`sourceType: "fusion"`), but
 the container runs remotely instead of on the user's machine.
 
+## Design Source Modes
+
+A design's source mode is one of:
+
+- `inline` — the current SQL-backed default (HTML prototype files).
+- `localhost` — a running local app bridged as URL-backed screens (see
+  `visual-edit`).
+- `fusion` — flag-gated Builder Fusion cloud container (this skill).
+
+Preserve a design's `fusionApp` / localhost connection data verbatim; never
+invent it.
+
 ## Flag Gate
 
 This feature is gated by the code boolean `FULL_APP_BUILDING_ENABLED` in

package/corpus/templates/design/.agents/skills/security/SKILL.md

@@ -127,6 +127,8 @@ Two more CI guards (also wired into `pnpm prep`) target the 2026-04 cross-tenant
 - `scripts/guard-no-env-mutation.mjs` — bans `process.env.<KEY> = …` (and bracket / compound forms) anywhere in production code. On serverless, every warm container handles many concurrent requests in one Node process, so `process.env` mutation leaks across in-flight requests (the "restore" line at the end of a handler races and never helps — most recently the Zoom webhook). Use `runWithRequestContext({ userEmail, orgId, timezone }, fn)` from `@agent-native/core/server` instead — it's AsyncLocalStorage-backed and per-request safe. Allowlisted paths: `scripts/`, `*.spec.ts` / `*.test.ts`, `packages/core/src/dev**`, `templates/*/test/`, anything under `/cli/` or `/scaffold/`. Per-line opt-out: `process.env.X = y // guard:allow-env-mutation — <reason>`.
 - `scripts/guard-no-localhost-fallback.mjs` — bans the literal `"local@localhost"` / `'local@localhost'` / `` `local@localhost` `` in production code. The bug class: `getRequestUserEmail() ?? "local@localhost"` silently pools every unauthenticated request into a single shared tenant, leaking credentials, tools, and `application_state` rows between accounts. The right behavior is to throw / 401 when there's no session. Allowlisted paths: the dev-mode auth shim (`packages/core/src/server/auth.ts`), `packages/core/src/dev**`, tests, `scripts/`, `seed/` / `seeds/`, plus a few framework helpers that intentionally inspect or migrate the dev identity. SQL DDL `DEFAULT 'local@localhost'` and the Drizzle helper `.default('local@localhost')` are skipped per-line — schema column defaults are intentional dev fixtures, not the dangerous fallback pattern. Per-line opt-out: `email ?? "local@localhost" // guard:allow-localhost-fallback — <reason>`.
 
+  The same guard also bans the **ambient process identity** as a request-scoped fallback: `?? process.env.AGENT_USER_EMAIL`, `|| process.env.WORKSPACE_OWNER_EMAIL`, and `?? getAmbientUserEmail()`. Those name the identity of the *deployment*, not the caller, so a handler reading one authorizes whoever the deploy env names rather than whoever signed in — it fails open toward more privilege. Exempt paths are the ones with no request by construction: `scripts/` (including `templates/*/scripts/`), `src/cli/`, `src/scripts/`, `script-helpers.ts` / `script-entries.ts`, tests, and seeds. It deliberately matches only the `??` / `||` fallback position, so reading the same env var to build an admin allowlist (`envEmails("WORKSPACE_OWNER_EMAIL").includes(email)`) is untouched. Known gaps, both requiring dataflow analysis the guard does not do: an env read aliased through a local (`const fallback = process.env.AGENT_USER_EMAIL; … ?? fallback`) and a destructured `const { AGENT_USER_EMAIL } = process.env`.
+
 ## Auth
 
 - All actions are protected by the auth guard automatically.

package/corpus/templates/design/.agents/skills/self-modifying-code/SKILL.md

@@ -1,9 +1,10 @@
 ---
 name: self-modifying-code
 description: >-
-  How the agent can modify the app's own source code. Use when the agent needs
-  to edit components, routes, styles, or scripts, when designing UI for agent
-  editability, or when deciding what the agent should and shouldn't modify.
+  Tiers, checkpoints, and off-limits paths for an agent editing the app's own
+  source. Use when designing UI for agent editability, deciding whether a file
+  is safe for the agent to change, or when tempted to patch config, `.env`, or
+  an `@agent-native/*` package. Do not load it for ordinary source edits.
 scope: dev
 metadata:
   internal: true

package/corpus/templates/design/.agents/skills/shadcn-ui/SKILL.md

@@ -1,11 +1,15 @@
 ---
 name: shadcn-ui
 description: >-
-  Use when adding, updating, debugging, styling, or composing shadcn/ui
-  components, forms, dialogs, menus, charts, sidebars, themes, registries, or
-  any project with a components.json file.
+  The shadcn CLI, component composition, theming, and registry workflow. Use
+  when adding, replacing, upgrading, or debugging a shadcn/ui primitive itself,
+  or when changing a theme or registry. Do not load it for ordinary edits to a
+  file that happens to import a shadcn component.
 scope: dev
 source: https://ui.shadcn.com/docs/skills
+local-changes: >-
+  Description narrowed deliberately; an upstream sync must not restore the
+  "any project with a components.json file" trigger.
 metadata:
   internal: true
 ---