@agent-native/core 0.122.4 → 0.123.1

package/corpus/templates/design/app/i18n-data.ts

@@ -942,10 +942,10 @@ const enUS = {
       },
     },
     pendingVisualStyles: {
-      applyAria: "Apply pending visual style edits",
+      applyAria: "Apply design updates",
       applyButton: "Apply styles",
       previewLabel: "Pending visual preview",
-      applyWithAgent: "Apply with Design agent",
+      applyDesignUpdates: "Apply design updates",
       verifying: "Verifying source and runtime…",
       retryWithAgent: "Retry source verification",
       copyPrompt: "Copy prompt to your agent",
@@ -969,6 +969,17 @@ const enUS = {
       stay: "Stay here",
       leave: "Leave without applying",
     },
+    addLocalhostScreen: {
+      title: "Add a screen from your app",
+      description: "Pick a route to add as a new frame, or type a path.",
+      searchPlaceholder: "Search routes…",
+      noRoutes: "No matching routes",
+      useCustomPath: 'Add "{{path}}"',
+      viewportDesktop: "Desktop",
+      viewportMobile: "Mobile",
+      added: "Screen added",
+      addFailed: "Could not add screen",
+    },
     nodeRewrite: {
       composerTitle: "Ask or change selection",
       send: "Send",
@@ -11113,7 +11124,7 @@ const designPendingVisualStyleOverrides = {
         applyAria: "套用待處理的視覺樣式編輯",
         applyButton: "套用樣式",
         previewLabel: "待處理的視覺預覽",
-        applyWithAgent: "用 Design 代理套用",
+        applyDesignUpdates: "套用設計更新",
         verifying: "正在驗證來源與執行階段…",
         retryWithAgent: "重試來源驗證",
         copyPrompt: "將提示複製給您的代理",
@@ -11144,7 +11155,7 @@ const designPendingVisualStyleOverrides = {
         applyAria: "应用待处理的视觉样式编辑",
         applyButton: "应用样式",
         previewLabel: "待处理的视觉预览",
-        applyWithAgent: "用 Design 代理应用",
+        applyDesignUpdates: "应用设计更新",
         verifying: "正在验证源文件和运行时…",
         retryWithAgent: "重试源文件验证",
         copyPrompt: "将提示复制给你的代理",
@@ -11175,7 +11186,7 @@ const designPendingVisualStyleOverrides = {
         applyAria: "Aplicar ediciones visuales de estilo pendientes",
         applyButton: "Aplicar estilos",
         previewLabel: "Vista previa visual pendiente",
-        applyWithAgent: "Aplicar con el agente de Design",
+        applyDesignUpdates: "Aplicar actualizaciones de diseño",
         verifying: "Verificando el código y el runtime…",
         retryWithAgent: "Reintentar verificación del código",
         copyPrompt: "Copiar prompt a tu agente",
@@ -11208,7 +11219,7 @@ const designPendingVisualStyleOverrides = {
         applyAria: "Appliquer les modifications visuelles de style en attente",
         applyButton: "Appliquer les styles",
         previewLabel: "Aperçu visuel en attente",
-        applyWithAgent: "Appliquer avec l’agent Design",
+        applyDesignUpdates: "Appliquer les mises à jour du design",
         verifying: "Vérification de la source et du runtime…",
         retryWithAgent: "Réessayer la vérification de la source",
         copyPrompt: "Copier le prompt vers votre agent",
@@ -11241,7 +11252,7 @@ const designPendingVisualStyleOverrides = {
         applyAria: "Ausstehende visuelle Stiländerungen anwenden",
         applyButton: "Stile anwenden",
         previewLabel: "Ausstehende visuelle Vorschau",
-        applyWithAgent: "Mit Design-Agent anwenden",
+        applyDesignUpdates: "Design-Updates anwenden",
         verifying: "Quelle und Laufzeit werden überprüft…",
         retryWithAgent: "Quellprüfung wiederholen",
         copyPrompt: "Prompt an deinen Agent kopieren",
@@ -11274,7 +11285,7 @@ const designPendingVisualStyleOverrides = {
         applyAria: "保留中のビジュアルスタイル編集を適用",
         applyButton: "スタイルを適用",
         previewLabel: "保留中のビジュアルプレビュー",
-        applyWithAgent: "Design エージェントで適用",
+        applyDesignUpdates: "デザインの更新を適用",
         verifying: "ソースとランタイムを検証中…",
         retryWithAgent: "ソース検証を再試行",
         copyPrompt: "エージェントにプロンプトをコピー",
@@ -11307,7 +11318,7 @@ const designPendingVisualStyleOverrides = {
         applyAria: "보류 중인 시각 스타일 편집 적용",
         applyButton: "스타일 적용",
         previewLabel: "보류 중인 시각 미리보기",
-        applyWithAgent: "Design 에이전트로 적용",
+        applyDesignUpdates: "디자인 업데이트 적용",
         verifying: "소스와 런타임 확인 중…",
         retryWithAgent: "소스 확인 다시 시도",
         copyPrompt: "에이전트에 프롬프트 복사",
@@ -11339,7 +11350,7 @@ const designPendingVisualStyleOverrides = {
         applyAria: "Aplicar edições visuais de estilo pendentes",
         applyButton: "Aplicar estilos",
         previewLabel: "Prévia visual pendente",
-        applyWithAgent: "Aplicar com o agente Design",
+        applyDesignUpdates: "Aplicar atualizações de design",
         verifying: "Verificando origem e runtime…",
         retryWithAgent: "Tentar verificar a origem novamente",
         copyPrompt: "Copiar prompt para seu agente",
@@ -11372,7 +11383,7 @@ const designPendingVisualStyleOverrides = {
         applyAria: "लंबित visual style edits लागू करें",
         applyButton: "Styles लागू करें",
         previewLabel: "लंबित visual preview",
-        applyWithAgent: "Design agent से लागू करें",
+        applyDesignUpdates: "डिज़ाइन अपडेट लागू करें",
         verifying: "Source और runtime सत्यापित हो रहे हैं…",
         retryWithAgent: "Source verification फिर करें",
         copyPrompt: "Prompt अपने agent को कॉपी करें",
@@ -11403,7 +11414,7 @@ const designPendingVisualStyleOverrides = {
         applyAria: "تطبيق تعديلات النمط المرئية المعلقة",
         applyButton: "تطبيق الأنماط",
         previewLabel: "معاينة مرئية معلقة",
-        applyWithAgent: "تطبيق عبر وكيل Design",
+        applyDesignUpdates: "تطبيق تحديثات التصميم",
         verifying: "جارٍ التحقق من المصدر ووقت التشغيل…",
         retryWithAgent: "إعادة التحقق من المصدر",
         copyPrompt: "نسخ الموجه إلى وكيلك",
@@ -11431,6 +11442,165 @@ const designPendingVisualStyleOverrides = {
   },
 } satisfies Record<Exclude<LocaleCode, "en-US">, PartialMessages>;
 
+const designAddLocalhostScreenOverrides = {
+  "zh-TW": {
+    designEditor: {
+      addLocalhostScreen: {
+        title: "從您的應用程式新增畫面",
+        description: "選擇一個路由做為新畫面，或輸入路徑。",
+        searchPlaceholder: "搜尋路由…",
+        noRoutes: "找不到符合的路由",
+        useCustomPath: "新增「{{path}}」",
+        viewportDesktop: "桌面版",
+        viewportMobile: "行動版",
+        added: "已新增畫面",
+        addFailed: "無法新增畫面",
+      },
+    },
+  },
+  "zh-CN": {
+    designEditor: {
+      addLocalhostScreen: {
+        title: "从您的应用添加屏幕",
+        description: "选择一个路由作为新屏幕，或输入路径。",
+        searchPlaceholder: "搜索路由…",
+        noRoutes: "未找到匹配的路由",
+        useCustomPath: "添加“{{path}}”",
+        viewportDesktop: "桌面版",
+        viewportMobile: "移动版",
+        added: "已添加屏幕",
+        addFailed: "无法添加屏幕",
+      },
+    },
+  },
+  "es-ES": {
+    designEditor: {
+      addLocalhostScreen: {
+        title: "Añadir una pantalla desde tu app",
+        description:
+          "Elige una ruta para añadirla como nuevo marco, o escribe una ruta.",
+        searchPlaceholder: "Buscar rutas…",
+        noRoutes: "No hay rutas que coincidan",
+        useCustomPath: 'Añadir "{{path}}"',
+        viewportDesktop: "Escritorio",
+        viewportMobile: "Móvil",
+        added: "Pantalla añadida",
+        addFailed: "No se pudo añadir la pantalla",
+      },
+    },
+  },
+  "fr-FR": {
+    designEditor: {
+      addLocalhostScreen: {
+        title: "Ajouter un écran depuis votre application",
+        description:
+          "Choisissez une route à ajouter comme nouveau cadre, ou saisissez un chemin.",
+        searchPlaceholder: "Rechercher des routes…",
+        noRoutes: "Aucune route correspondante",
+        useCustomPath: "Ajouter « {{path}} »",
+        viewportDesktop: "Bureau",
+        viewportMobile: "Mobile",
+        added: "Écran ajouté",
+        addFailed: "Impossible d’ajouter l’écran",
+      },
+    },
+  },
+  "de-DE": {
+    designEditor: {
+      addLocalhostScreen: {
+        title: "Einen Screen aus deiner App hinzufügen",
+        description:
+          "Wähle eine Route als neuen Rahmen aus oder gib einen Pfad ein.",
+        searchPlaceholder: "Routen durchsuchen…",
+        noRoutes: "Keine passenden Routen",
+        useCustomPath: "„{{path}}“ hinzufügen",
+        viewportDesktop: "Desktop",
+        viewportMobile: "Mobil",
+        added: "Screen hinzugefügt",
+        addFailed: "Screen konnte nicht hinzugefügt werden",
+      },
+    },
+  },
+  "ja-JP": {
+    designEditor: {
+      addLocalhostScreen: {
+        title: "アプリから画面を追加",
+        description:
+          "新しいフレームとして追加するルートを選ぶか、パスを入力してください。",
+        searchPlaceholder: "ルートを検索…",
+        noRoutes: "一致するルートがありません",
+        useCustomPath: "「{{path}}」を追加",
+        viewportDesktop: "デスクトップ",
+        viewportMobile: "モバイル",
+        added: "画面を追加しました",
+        addFailed: "画面を追加できませんでした",
+      },
+    },
+  },
+  "ko-KR": {
+    designEditor: {
+      addLocalhostScreen: {
+        title: "앱에서 화면 추가",
+        description:
+          "새 프레임으로 추가할 경로를 선택하거나 경로를 입력하세요.",
+        searchPlaceholder: "경로 검색…",
+        noRoutes: "일치하는 경로가 없습니다",
+        useCustomPath: '"{{path}}" 추가',
+        viewportDesktop: "데스크톱",
+        viewportMobile: "모바일",
+        added: "화면이 추가되었습니다",
+        addFailed: "화면을 추가할 수 없습니다",
+      },
+    },
+  },
+  "pt-BR": {
+    designEditor: {
+      addLocalhostScreen: {
+        title: "Adicionar uma tela do seu app",
+        description:
+          "Escolha uma rota para adicionar como novo quadro, ou digite um caminho.",
+        searchPlaceholder: "Buscar rotas…",
+        noRoutes: "Nenhuma rota encontrada",
+        useCustomPath: 'Adicionar "{{path}}"',
+        viewportDesktop: "Desktop",
+        viewportMobile: "Celular",
+        added: "Tela adicionada",
+        addFailed: "Não foi possível adicionar a tela",
+      },
+    },
+  },
+  "hi-IN": {
+    designEditor: {
+      addLocalhostScreen: {
+        title: "अपनी app से screen जोड़ें",
+        description: "नए frame के रूप में जोड़ने के लिए एक route चुनें, या path टाइप करें।",
+        searchPlaceholder: "Routes खोजें…",
+        noRoutes: "कोई मेल खाता route नहीं मिला",
+        useCustomPath: '"{{path}}" जोड़ें',
+        viewportDesktop: "Desktop",
+        viewportMobile: "Mobile",
+        added: "Screen जोड़ी गई",
+        addFailed: "Screen नहीं जोड़ी जा सकी",
+      },
+    },
+  },
+  "ar-SA": {
+    designEditor: {
+      addLocalhostScreen: {
+        title: "إضافة شاشة من تطبيقك",
+        description: "اختر مسارًا لإضافته كإطار جديد، أو أدخل مسارًا.",
+        searchPlaceholder: "البحث في المسارات…",
+        noRoutes: "لا توجد مسارات مطابقة",
+        useCustomPath: 'إضافة "{{path}}"',
+        viewportDesktop: "سطح المكتب",
+        viewportMobile: "الجوال",
+        added: "تمت إضافة الشاشة",
+        addFailed: "تعذرت إضافة الشاشة",
+      },
+    },
+  },
+} satisfies Record<Exclude<LocaleCode, "en-US">, PartialMessages>;
+
 const designLeftRailOverrides = {
   "zh-TW": {
     designEditor: {
@@ -14881,6 +15051,7 @@ export const messagesByLocale = {
       designVisualEditOverrides["zh-TW"],
       designTemplateFeatureOverrides["zh-TW"],
       designPendingVisualStyleOverrides["zh-TW"],
+      designAddLocalhostScreenOverrides["zh-TW"],
       designFillStylesComingSoonOverrides["zh-TW"],
       breakpointBarOverrides["zh-TW"],
       motionDockOverrides["zh-TW"],
@@ -14903,6 +15074,7 @@ export const messagesByLocale = {
       designVisualEditOverrides["zh-CN"],
       designTemplateFeatureOverrides["zh-CN"],
       designPendingVisualStyleOverrides["zh-CN"],
+      designAddLocalhostScreenOverrides["zh-CN"],
       designFillStylesComingSoonOverrides["zh-CN"],
       designFramePresetsOverrides["zh-CN"],
       designAlignmentOverrides["zh-CN"],
@@ -14980,6 +15152,7 @@ export const messagesByLocale = {
       designVisualEditOverrides["es-ES"],
       designTemplateFeatureOverrides["es-ES"],
       designPendingVisualStyleOverrides["es-ES"],
+      designAddLocalhostScreenOverrides["es-ES"],
       designFillStylesComingSoonOverrides["es-ES"],
       designFramePresetsOverrides["es-ES"],
       designAlignmentOverrides["es-ES"],
@@ -15059,6 +15232,7 @@ export const messagesByLocale = {
       designVisualEditOverrides["fr-FR"],
       designTemplateFeatureOverrides["fr-FR"],
       designPendingVisualStyleOverrides["fr-FR"],
+      designAddLocalhostScreenOverrides["fr-FR"],
       designFillStylesComingSoonOverrides["fr-FR"],
       designFramePresetsOverrides["fr-FR"],
       designAlignmentOverrides["fr-FR"],
@@ -15138,6 +15312,7 @@ export const messagesByLocale = {
       designVisualEditOverrides["de-DE"],
       designTemplateFeatureOverrides["de-DE"],
       designPendingVisualStyleOverrides["de-DE"],
+      designAddLocalhostScreenOverrides["de-DE"],
       designFillStylesComingSoonOverrides["de-DE"],
       designFramePresetsOverrides["de-DE"],
       designAlignmentOverrides["de-DE"],
@@ -15217,6 +15392,7 @@ export const messagesByLocale = {
       designVisualEditOverrides["ja-JP"],
       designTemplateFeatureOverrides["ja-JP"],
       designPendingVisualStyleOverrides["ja-JP"],
+      designAddLocalhostScreenOverrides["ja-JP"],
       designFillStylesComingSoonOverrides["ja-JP"],
       designFramePresetsOverrides["ja-JP"],
       designAlignmentOverrides["ja-JP"],
@@ -15297,6 +15473,7 @@ export const messagesByLocale = {
       designVisualEditOverrides["ko-KR"],
       designTemplateFeatureOverrides["ko-KR"],
       designPendingVisualStyleOverrides["ko-KR"],
+      designAddLocalhostScreenOverrides["ko-KR"],
       designFillStylesComingSoonOverrides["ko-KR"],
       designFramePresetsOverrides["ko-KR"],
       designAlignmentOverrides["ko-KR"],
@@ -15375,6 +15552,7 @@ export const messagesByLocale = {
       designVisualEditOverrides["pt-BR"],
       designTemplateFeatureOverrides["pt-BR"],
       designPendingVisualStyleOverrides["pt-BR"],
+      designAddLocalhostScreenOverrides["pt-BR"],
       designFillStylesComingSoonOverrides["pt-BR"],
       designFramePresetsOverrides["pt-BR"],
       designAlignmentOverrides["pt-BR"],
@@ -15454,6 +15632,7 @@ export const messagesByLocale = {
       designVisualEditOverrides["hi-IN"],
       designTemplateFeatureOverrides["hi-IN"],
       designPendingVisualStyleOverrides["hi-IN"],
+      designAddLocalhostScreenOverrides["hi-IN"],
       designFillStylesComingSoonOverrides["hi-IN"],
       designFramePresetsOverrides["hi-IN"],
       designAlignmentOverrides["hi-IN"],
@@ -15533,6 +15712,7 @@ export const messagesByLocale = {
       designVisualEditOverrides["ar-SA"],
       designTemplateFeatureOverrides["ar-SA"],
       designPendingVisualStyleOverrides["ar-SA"],
+      designAddLocalhostScreenOverrides["ar-SA"],
       designFillStylesComingSoonOverrides["ar-SA"],
       designFramePresetsOverrides["ar-SA"],
       designAlignmentOverrides["ar-SA"],

package/corpus/templates/design/app/pages/Present.tsx

@@ -1,4 +1,3 @@
-import { agentNativePath } from "@agent-native/core/client/api-path";
 import { useActionQuery, useSession } from "@agent-native/core/client/hooks";
 import {
   injectSessionReplayIframeBootstrap,
@@ -9,6 +8,7 @@ import {
   ReviewStatusBadge,
   useReviewComments,
 } from "@agent-native/core/client/review";
+import { buildSignInReturnHref } from "@agent-native/core/client/ui";
 import { readDesignReviewSummary } from "@shared/review-summary";
 import { IconMessageCircle } from "@tabler/icons-react";
 import { useCallback, useEffect, useMemo, useState } from "react";
@@ -99,14 +99,11 @@ export default function Present() {
         )
         .map((comment) => comment.threadId),
     ).size;
-  const signInHref = (() => {
-    const base = agentNativePath("/_agent-native/sign-in");
-    if (typeof window === "undefined") return base;
-    const returnUrl = new URL(window.location.href);
-    returnUrl.search = "";
-    returnUrl.hash = "";
-    return `${base}?return=${encodeURIComponent(returnUrl.pathname)}`;
-  })();
+  const signInHref = buildSignInReturnHref(
+    typeof window === "undefined"
+      ? undefined
+      : { returnTo: window.location.pathname },
+  );
 
   // Keyboard navigation
   const handleKeyDown = useCallback(

package/corpus/templates/design/app/pages/VisualEdit.tsx

@@ -1,6 +1,6 @@
-import { agentNativePath } from "@agent-native/core/client/api-path";
 import { useSession } from "@agent-native/core/client/hooks";
 import { useT } from "@agent-native/core/client/i18n";
+import { buildSignInReturnHref } from "@agent-native/core/client/ui";
 import {
   IconArrowUpRight,
   IconBrush,
@@ -12,16 +12,13 @@ import { Link } from "react-router";
 
 import { Button } from "@/components/ui/button";
 
-function buildSignInHref(): string {
-  const ret = "/visual-edit?intent=save";
-  return `${agentNativePath("/_agent-native/sign-in")}?return=${encodeURIComponent(ret)}`;
-}
-
 export default function VisualEditPage() {
   const t = useT();
   const { session } = useSession();
   const hasSession = Boolean(session?.email);
-  const primaryHref = hasSession ? "/" : buildSignInHref();
+  const primaryHref = hasSession
+    ? "/"
+    : buildSignInReturnHref({ returnTo: "/visual-edit?intent=save" });
   const primaryAriaLabel = hasSession
     ? t("visualEdit.openDesign")
     : t("designEditor.signUpToSave");

package/corpus/templates/design/app/pages/design-editor/design-data-geometry-utils.ts

@@ -121,6 +121,26 @@ export function staleGeometryFrameIds(
   return stale;
 }
 
+/**
+ * Placement for a brand-new frame added alongside an existing canvas layout.
+ * add-localhost-screens falls back to (0, 0) for a new file with no explicit
+ * x/y, which lands it on top of whatever frame already occupies that spot —
+ * callers that add a single frame on demand (rather than laying out a whole
+ * canvas from empty) must supply an explicit position instead of relying on
+ * that fallback.
+ */
+export function nextLocalhostScreenPosition(
+  framesById: CanvasFrameGeometryById,
+): { x: number; y: number } {
+  const frames = Object.values(framesById);
+  if (frames.length === 0) return { x: 0, y: 0 };
+  const maxRight = Math.max(
+    ...frames.map((frame) => (frame.x ?? 0) + (frame.width ?? 0)),
+  );
+  const minTop = Math.min(...frames.map((frame) => frame.y ?? 0));
+  return { x: maxRight + 160, y: minTop };
+}
+
 export function viewportChangedFrameIds(
   before: CanvasFrameGeometryById,
   after: CanvasFrameGeometryById,

package/corpus/templates/design/changelog/2026-07-26-apply-design-updates-from-a-centered-top-toolbar-without-cov.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-26
+---
+
+Apply design updates from a centered top toolbar without covering the canvas tools

package/corpus/templates/dispatch/.agents/skills/actions/SKILL.md

@@ -18,6 +18,8 @@ Actions in `actions/` are the **single source of truth** for app operations. The
 
 Before creating any custom REST/API route for app data, inspect `actions/` and the action table in `AGENTS.md`. If an action already exists, call it directly from the agent or with `useActionQuery` / `useActionMutation` from the UI. If the capability is missing, create or update a `defineAction`. Do not add `/api/*`, `server/routes/*`, or other pass-through endpoints whose main job is to call, repackage, or re-export an action.
 
+**Stop trigger:** the moment you are about to create a file under `server/routes/api/` — or add server middleware to guard one — stop and check it against the exception list in *When You Still Need Custom `/api/` Routes* below. If it is not on that list, write a `defineAction` instead. This applies even when you already started the route; abandoning a half-written action to hand-roll routes is the exact failure this rule exists to prevent.
+
 ## Why
 
 Actions give the agent callable tools with structured input/output, AND they give the frontend a typed client contract through hooks. One implementation serves both the agent and the UI. They keep the agent's chat context clean, they're reusable, and they can be tested independently.
@@ -390,12 +392,28 @@ This is the canonical approach for new apps. Action names must be lowercase with
 
 ## When You Still Need Custom `/api/` Routes
 
-Most operations should be actions. You only need custom routes in `server/routes/api/` for:
+This is the complete exception list. A route in `server/routes/api/` is only
+justified when the caller is not your own UI or agent, or when the payload is
+not JSON:
 
 - **File uploads** — actions receive JSON params, not multipart form data
 - **Streaming responses** — SSE or chunked responses that need direct H3 control
 - **Webhooks** — external services POST to a specific URL
 - **OAuth callbacks** — redirect-based flows that need specific URL patterns
+- **Public unauthenticated endpoints** — SEO/OG images, share links, and other
+  URLs opened directly by a browser or crawler
+- **Binary or non-JSON responses** — media, exports, generated assets
+
+Everything else is an action: CRUD, settings, search, list/detail reads, auth
+state, and anything the UI fetches as JSON. If a route needs new middleware to
+scope it to the current user, that is a signal it should be an action — actions
+already run inside request context with access checks.
+
+Existing first-party templates still contain a shrinking, explicitly
+grandfathered set of older `/api/*` CRUD routes for app data. The repository's
+`guard:no-action-twin-routes` CI check ratchets that baseline down across the
+first-party template route trees (with the separately owned Plan template
+fenced out); it is not a substitute for keeping generated apps action-first.
 
 When the agent needs a durable image or file URL, call the core `upload-image`
 action or use `uploadFile()` in server code. Do not write base64 into SQL,

package/corpus/templates/dispatch/.agents/skills/frontend-design/SKILL.md

@@ -1,14 +1,17 @@
 ---
 name: frontend-design
 description: >-
-  Create distinctive, production-grade frontend interfaces with high design
-  quality. Use when building web components, pages, artifacts, posters, or
-  applications (websites, landing pages, dashboards, React components,
-  HTML/CSS layouts, or when styling/beautifying any web UI). Generates
-  creative, polished UI that avoids generic AI aesthetics.
+  Sets the visual direction for a new or redesigned surface, with production
+  quality that avoids generic AI aesthetics. Use when building a new page,
+  app, or marketing surface, defining visual identity, or doing a design pass
+  ("make this look good"). Do not load it for routine UI edits: adding a field
+  to an existing form, fixing spacing, wiring a button, or changing copy.
 scope: dev
 license: Complete terms in LICENSE.txt
 source: https://github.com/anthropics/skills/blob/main/skills/frontend-design/SKILL.md
+local-changes: >-
+  Description narrowed and Verification rescoped deliberately; an upstream sync
+  must not restore the broad auto-load triggers or screenshot-everything step.
 metadata:
   internal: true
 ---
@@ -141,11 +144,22 @@ Avoid:
 
 ## Verification
 
+Match verification effort to the size of the change. For one component, one
+form, one page, or a restyle, run the app's existing checks — formatter,
+`pnpm typecheck`, existing tests — and stop there.
+
+Escalate to browser verification only when the user asks for it, or when the
+change is a multi-step user-visible flow that cannot be confirmed any other
+way. Never author a new Playwright/Puppeteer script, add a browser-automation
+dependency, or stand up an e2e harness to check work the user did not ask you
+to test that way; use an available browser tool, or say what you could not
+verify.
+
 For substantial frontend work:
 
 1. Run the relevant formatter/checks.
 2. Start the dev server when the app needs one.
-3. Verify with browser screenshots at desktop and mobile widths.
+3. Verify with the available browser tooling at desktop and mobile widths.
 4. Check interactive states: hover, focus, loading, empty, error, and destructive confirmations.
 5. When registering or changing a company adapter, run
    `@agent-native/toolkit/conformance`, including mixed-overlay focus,

package/corpus/templates/dispatch/.agents/skills/security/SKILL.md

@@ -127,6 +127,8 @@ Two more CI guards (also wired into `pnpm prep`) target the 2026-04 cross-tenant
 - `scripts/guard-no-env-mutation.mjs` — bans `process.env.<KEY> = …` (and bracket / compound forms) anywhere in production code. On serverless, every warm container handles many concurrent requests in one Node process, so `process.env` mutation leaks across in-flight requests (the "restore" line at the end of a handler races and never helps — most recently the Zoom webhook). Use `runWithRequestContext({ userEmail, orgId, timezone }, fn)` from `@agent-native/core/server` instead — it's AsyncLocalStorage-backed and per-request safe. Allowlisted paths: `scripts/`, `*.spec.ts` / `*.test.ts`, `packages/core/src/dev**`, `templates/*/test/`, anything under `/cli/` or `/scaffold/`. Per-line opt-out: `process.env.X = y // guard:allow-env-mutation — <reason>`.
 - `scripts/guard-no-localhost-fallback.mjs` — bans the literal `"local@localhost"` / `'local@localhost'` / `` `local@localhost` `` in production code. The bug class: `getRequestUserEmail() ?? "local@localhost"` silently pools every unauthenticated request into a single shared tenant, leaking credentials, tools, and `application_state` rows between accounts. The right behavior is to throw / 401 when there's no session. Allowlisted paths: the dev-mode auth shim (`packages/core/src/server/auth.ts`), `packages/core/src/dev**`, tests, `scripts/`, `seed/` / `seeds/`, plus a few framework helpers that intentionally inspect or migrate the dev identity. SQL DDL `DEFAULT 'local@localhost'` and the Drizzle helper `.default('local@localhost')` are skipped per-line — schema column defaults are intentional dev fixtures, not the dangerous fallback pattern. Per-line opt-out: `email ?? "local@localhost" // guard:allow-localhost-fallback — <reason>`.
 
+  The same guard also bans the **ambient process identity** as a request-scoped fallback: `?? process.env.AGENT_USER_EMAIL`, `|| process.env.WORKSPACE_OWNER_EMAIL`, and `?? getAmbientUserEmail()`. Those name the identity of the *deployment*, not the caller, so a handler reading one authorizes whoever the deploy env names rather than whoever signed in — it fails open toward more privilege. Exempt paths are the ones with no request by construction: `scripts/` (including `templates/*/scripts/`), `src/cli/`, `src/scripts/`, `script-helpers.ts` / `script-entries.ts`, tests, and seeds. It deliberately matches only the `??` / `||` fallback position, so reading the same env var to build an admin allowlist (`envEmails("WORKSPACE_OWNER_EMAIL").includes(email)`) is untouched. Known gaps, both requiring dataflow analysis the guard does not do: an env read aliased through a local (`const fallback = process.env.AGENT_USER_EMAIL; … ?? fallback`) and a destructured `const { AGENT_USER_EMAIL } = process.env`.
+
 ## Auth
 
 - All actions are protected by the auth guard automatically.

package/corpus/templates/dispatch/.agents/skills/self-modifying-code/SKILL.md

@@ -1,9 +1,10 @@
 ---
 name: self-modifying-code
 description: >-
-  How the agent can modify the app's own source code. Use when the agent needs
-  to edit components, routes, styles, or scripts, when designing UI for agent
-  editability, or when deciding what the agent should and shouldn't modify.
+  Tiers, checkpoints, and off-limits paths for an agent editing the app's own
+  source. Use when designing UI for agent editability, deciding whether a file
+  is safe for the agent to change, or when tempted to patch config, `.env`, or
+  an `@agent-native/*` package. Do not load it for ordinary source edits.
 scope: dev
 metadata:
   internal: true

package/corpus/templates/dispatch/.agents/skills/shadcn-ui/SKILL.md

@@ -1,11 +1,15 @@
 ---
 name: shadcn-ui
 description: >-
-  Use when adding, updating, debugging, styling, or composing shadcn/ui
-  components, forms, dialogs, menus, charts, sidebars, themes, registries, or
-  any project with a components.json file.
+  The shadcn CLI, component composition, theming, and registry workflow. Use
+  when adding, replacing, upgrading, or debugging a shadcn/ui primitive itself,
+  or when changing a theme or registry. Do not load it for ordinary edits to a
+  file that happens to import a shadcn component.
 scope: dev
 source: https://ui.shadcn.com/docs/skills
+local-changes: >-
+  Description narrowed deliberately; an upstream sync must not restore the
+  "any project with a components.json file" trigger.
 metadata:
   internal: true
 ---