@agent-native/core 0.122.4 → 0.123.1

package/corpus/templates/slides/server/handlers/decks.ts

@@ -1,25 +1,6 @@
-import { readBody } from "@agent-native/core/server";
-import {
-  accessFilter,
-  resolveAccess,
-  assertAccess,
-  ForbiddenError,
-} from "@agent-native/core/sharing";
-import { and, eq, desc } from "drizzle-orm";
-import {
-  defineEventHandler,
-  getRouterParam,
-  setResponseStatus,
-  createEventStream,
-} from "h3";
+import { defineEventHandler, setResponseStatus, createEventStream } from "h3";
 
-import { ASPECT_RATIO_VALUES } from "../../shared/aspect-ratios.js";
-import { getDb, schema } from "../db";
-import { createDeckVersionSnapshot } from "../lib/deck-versions.js";
-import {
-  resolveSlidesRequestAuthContext,
-  withSlidesRequestContext,
-} from "./request-auth-context.js";
+import { resolveSlidesRequestAuthContext } from "./request-auth-context.js";
 
 // --- SSE for change notifications ---
 type SSEPush = (data: string) => void;
@@ -94,57 +75,6 @@ export function notifyClients(
   }
 }
 
-/**
- * Resolve the caller's auth context from the request and run `fn` inside a
- * `runWithRequestContext` scope so `accessFilter` / `resolveAccess` /
- * `assertAccess` can read it. ALL `/api/decks/*` handlers MUST go through
- * this — querying ownable tables without a request context is how data
- * leaks across users (see #SLI-2026-04-28).
- */
-function handleForbidden(event: any, err: unknown): { error: string } {
-  if (err instanceof ForbiddenError) {
-    setResponseStatus(event, err.statusCode);
-    return { error: err.message };
-  }
-  throw err;
-}
-
-function validateDeckAspectRatio(
-  event: any,
-  deck: Record<string, any>,
-): boolean {
-  if (
-    "aspectRatio" in deck &&
-    !ASPECT_RATIO_VALUES.includes(deck.aspectRatio)
-  ) {
-    setResponseStatus(event, 400);
-    return false;
-  }
-  return true;
-}
-
-function comparableDeckData(raw: unknown): string {
-  try {
-    const data = typeof raw === "string" ? JSON.parse(raw) : raw;
-    const clone = JSON.parse(JSON.stringify(data ?? {}));
-    delete clone.updatedAt;
-    return JSON.stringify(clone);
-  } catch {
-    return String(raw ?? "");
-  }
-}
-
-function shouldSnapshotDeckWrite(
-  current: { title?: string | null; data?: string | null },
-  nextTitle: string,
-  nextDeck: Record<string, unknown>,
-): boolean {
-  return (
-    (current.title ?? "Untitled") !== nextTitle ||
-    comparableDeckData(current.data ?? "") !== comparableDeckData(nextDeck)
-  );
-}
-
 // SSE endpoint — client subscribes for real-time change notifications.
 // Per-deckId notifications carry only the id, no row contents, so we don't
 // gate this — but we do require an authenticated session so anonymous
@@ -173,309 +103,3 @@ export const deckEvents = defineEventHandler(async (event) => {
 
   return eventStream.send();
 });
-
-// GET /api/decks — list decks the caller can see (own + shared + visibility match)
-export const listDecks = defineEventHandler(async (event) => {
-  return withSlidesRequestContext(event, async ({ email }) => {
-    // Without an authenticated email, `accessFilter` would short-circuit to
-    // `1=0` and return a 200/[] response — indistinguishable to the client
-    // from "this user genuinely has no decks." That fires the deck-list
-    // fallback poll's wipe-on-empty path and bounces the user out of the
-    // editor. Returning 401 lets the client preserve local state until the
-    // session is restored.
-    if (!email) {
-      setResponseStatus(event, 401);
-      return { error: "Unauthorized" };
-    }
-    const db = getDb();
-    const rows = await db
-      .select()
-      .from(schema.decks)
-      .where(accessFilter(schema.decks, schema.deckShares))
-      .orderBy(desc(schema.decks.updatedAt));
-
-    return rows.map((row) => {
-      let deck: Record<string, unknown> = {};
-      try {
-        if (row.data) deck = JSON.parse(row.data);
-      } catch {}
-      return {
-        ...deck,
-        id: row.id,
-        title: row.title,
-        visibility: row.visibility,
-        createdByMe: row.ownerEmail === email,
-        designSystemId: row.designSystemId ?? deck.designSystemId ?? null,
-        updatedAt: row.updatedAt,
-        slides: deck.slides || [],
-      };
-    });
-  });
-});
-
-// GET /api/decks/:id — get a specific deck (caller must have viewer+ access)
-export const getDeck = defineEventHandler(async (event) => {
-  const id = getRouterParam(event, "id");
-  if (!id) {
-    setResponseStatus(event, 400);
-    return { error: "Deck id is required" };
-  }
-
-  return withSlidesRequestContext(event, async ({ email }) => {
-    try {
-      const access = await assertAccess("deck", id, "viewer");
-      const row = access.resource;
-      const deck = JSON.parse(row.data);
-      return {
-        ...deck,
-        id: row.id,
-        title: row.title,
-        visibility: row.visibility,
-        createdByMe: row.ownerEmail === email,
-        designSystemId: row.designSystemId ?? deck.designSystemId ?? null,
-        updatedAt: row.updatedAt,
-      };
-    } catch (err) {
-      if (err instanceof ForbiddenError) {
-        // Return 404 (not 403) so we don't leak the existence of decks
-        // the caller has no access to.
-        setResponseStatus(event, 404);
-        return { error: "Deck not found" };
-      }
-      throw err;
-    }
-  });
-});
-
-// PUT /api/decks/:id — create or update a deck (must have editor+ access)
-export const updateDeck = defineEventHandler(async (event) => {
-  const id = getRouterParam(event, "id");
-  if (!id) {
-    setResponseStatus(event, 400);
-    return { error: "Deck id is required" };
-  }
-  const deck = await readBody(event);
-
-  if (!deck || typeof deck !== "object") {
-    setResponseStatus(event, 400);
-    return { error: "Invalid deck data" };
-  }
-  if (!validateDeckAspectRatio(event, deck)) {
-    return { error: "Invalid aspect ratio" };
-  }
-
-  return withSlidesRequestContext(event, async ({ email, orgId }) => {
-    const db = getDb();
-    const now = new Date().toISOString();
-
-    deck.id = id;
-    deck.updatedAt = now;
-    const title = deck.title || "Untitled";
-    const nextDesignSystemId =
-      typeof deck.designSystemId === "string" && deck.designSystemId
-        ? deck.designSystemId
-        : null;
-
-    // Resolve access first — this loads the row AND tells us the caller's
-    // effective role in one pass, so we never run an unscoped existence
-    // SELECT that would leak "this id exists" to non-owners.
-    const access = await resolveAccess("deck", id);
-
-    if (!access) {
-      // Either the deck does not exist OR the caller cannot see it. In
-      // both cases we treat this as a create-on-PUT for the caller. If
-      // the row actually exists but is owned by someone else, the INSERT
-      // below will fail on the primary key — we map that to a 404 so we
-      // never reveal that the id is taken.
-      if (!email) {
-        return handleForbidden(
-          event,
-          new ForbiddenError("Sign in to create a deck"),
-        );
-      }
-      if (nextDesignSystemId) {
-        try {
-          await assertAccess("design-system", nextDesignSystemId, "viewer");
-        } catch (err) {
-          if (err instanceof ForbiddenError) {
-            setResponseStatus(event, 400);
-            return { error: "Design system not accessible" };
-          }
-          throw err;
-        }
-      }
-      try {
-        await db.insert(schema.decks).values({
-          id,
-          title,
-          data: JSON.stringify(deck),
-          designSystemId: nextDesignSystemId,
-          ownerEmail: email,
-          orgId: orgId ?? null,
-          createdAt: now,
-          updatedAt: now,
-        });
-      } catch (err) {
-        // The common case is a primary-key collision with a deck the caller
-        // cannot access. Some DB adapters wrap duplicate-key failures in a
-        // generic query error that includes bound params, so never surface the
-        // raw error here.
-        setResponseStatus(event, 404);
-        return { error: "Deck not found" };
-      }
-    } else if (
-      access.role === "owner" ||
-      access.role === "admin" ||
-      access.role === "editor"
-    ) {
-      if (nextDesignSystemId) {
-        try {
-          await assertAccess("design-system", nextDesignSystemId, "viewer");
-        } catch (err) {
-          if (err instanceof ForbiddenError) {
-            setResponseStatus(event, 400);
-            return { error: "Design system not accessible" };
-          }
-          throw err;
-        }
-      }
-      // Caller has editor+ access — perform the update. The access check
-      // above already confirmed the row exists and the caller can write.
-      if (shouldSnapshotDeckWrite(access.resource, title, deck)) {
-        await createDeckVersionSnapshot(
-          {
-            id: access.resource.id,
-            title: access.resource.title,
-            data: access.resource.data,
-            ownerEmail: access.resource.ownerEmail as string,
-          },
-          { label: "Before editor save" },
-        );
-      }
-      await db
-        .update(schema.decks)
-        .set({
-          title,
-          data: JSON.stringify(deck),
-          designSystemId: nextDesignSystemId ?? access.resource.designSystemId,
-          updatedAt: now,
-        })
-        .where(eq(schema.decks.id, id));
-    } else {
-      // Viewer-only access — same 404 as no-access to avoid leaking that
-      // the deck exists with restricted permissions.
-      setResponseStatus(event, 404);
-      return { error: "Deck not found" };
-    }
-
-    notifyClients(id);
-    return deck;
-  });
-});
-
-// POST /api/decks — create a new deck owned by the caller
-export const createDeck = defineEventHandler(async (event) => {
-  const deck = await readBody(event);
-
-  if (!deck || !deck.id) {
-    setResponseStatus(event, 400);
-    return { error: "Deck must have an id" };
-  }
-  if (!validateDeckAspectRatio(event, deck)) {
-    return { error: "Invalid aspect ratio" };
-  }
-
-  return withSlidesRequestContext(event, async ({ email, orgId }) => {
-    if (!email) {
-      return handleForbidden(
-        event,
-        new ForbiddenError("Sign in to create a deck"),
-      );
-    }
-    deck.createdAt = deck.createdAt || new Date().toISOString();
-    deck.updatedAt = new Date().toISOString();
-
-    const db = getDb();
-    const now = new Date().toISOString();
-    const designSystemId =
-      typeof deck.designSystemId === "string" && deck.designSystemId
-        ? deck.designSystemId
-        : null;
-
-    if (designSystemId) {
-      try {
-        await assertAccess("design-system", designSystemId, "viewer");
-      } catch (err) {
-        if (err instanceof ForbiddenError) {
-          setResponseStatus(event, 400);
-          return { error: "Design system not accessible" };
-        }
-        throw err;
-      }
-    }
-
-    await db.insert(schema.decks).values({
-      id: deck.id,
-      title: deck.title || "Untitled",
-      data: JSON.stringify(deck),
-      designSystemId,
-      ownerEmail: email,
-      orgId: orgId ?? null,
-      createdAt: now,
-      updatedAt: now,
-    });
-
-    setResponseStatus(event, 201);
-    notifyClients(deck.id);
-    return deck;
-  });
-});
-
-// DELETE /api/decks/:id — delete a deck (admin or owner only)
-export const deleteDeck = defineEventHandler(async (event) => {
-  const id = getRouterParam(event, "id");
-  if (!id) {
-    setResponseStatus(event, 400);
-    return { error: "Deck id is required" };
-  }
-
-  return withSlidesRequestContext(event, async () => {
-    try {
-      // assertAccess loads the row and verifies the caller has admin
-      // role on this resource — it must run BEFORE the delete (and in
-      // the same scope) so we don't leak existence to callers who lack
-      // access.
-      const access = await assertAccess("deck", id, "admin");
-      const db = getDb();
-      await db
-        .delete(schema.deckVersions)
-        .where(
-          and(
-            eq(schema.deckVersions.deckId, id),
-            eq(
-              schema.deckVersions.ownerEmail,
-              access.resource.ownerEmail as string,
-            ),
-          ),
-        );
-      const result = await db
-        .delete(schema.decks)
-        .where(eq(schema.decks.id, id))
-        .returning();
-
-      if (result.length > 0) {
-        notifyClients(id, "deck-deleted");
-        return { success: true };
-      }
-      setResponseStatus(event, 404);
-      return { error: "Deck not found" };
-    } catch (err) {
-      if (err instanceof ForbiddenError) {
-        // 404 to avoid leaking existence
-        setResponseStatus(event, 404);
-        return { error: "Deck not found" };
-      }
-      throw err;
-    }
-  });
-});

package/corpus/templates/tasks/.agents/skills/action-reference/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: action-reference
+description: >-
+  Full reference for the 25 tasks actions: HTTP method, arguments, defaults,
+  and confirmation rules. Use when you need an action's method or exact
+  behavior beyond the compact index in AGENTS.md, or before adding an action.
+---
+
+# Tasks Action Reference
+
+The compact index in `AGENTS.md` lists action names and purposes. This is the
+full table, including the HTTP method each action is exposed under. The
+canonical descriptions and input schemas live in [`actions/`](../../../actions/).
+
+| Action                        | Method | Purpose                                                                                      |
+| ----------------------------- | ------ | -------------------------------------------------------------------------------------------- |
+| `list-tasks`                  | GET    | List current user's tasks; `includeDone` and `includeFields` default to false                |
+| `create-task`                 | POST   | Create a task with `title`                                                                   |
+| `update-task`                 | POST   | Patch `title`, `done`, and/or `fieldValues` by `taskId`                                      |
+| `delete-task`                 | POST   | Delete a task by `taskId` (confirm with user first)                                          |
+| `bulk-update-tasks`           | POST   | Patch `title` and/or `done` on multiple tasks by id                                          |
+| `bulk-delete-tasks`           | POST   | Delete multiple tasks by id (confirm with user first)                                        |
+| `reorder-tasks`               | POST   | Reorder visible tasks by id list top-to-bottom                                               |
+| `list-inbox-items`            | GET    | List current user's inbox items                                                              |
+| `create-inbox-item`           | POST   | Create a not-ready inbox item with `title` (default chat capture)                            |
+| `update-inbox-item`           | POST   | Patch inbox item `title` by `inboxItemId`                                                    |
+| `delete-inbox-item`           | POST   | Delete an inbox item (confirm with user first)                                               |
+| `bulk-delete-inbox-items`     | POST   | Delete multiple inbox items by id (confirm with user first)                                  |
+| `mark-inbox-item-ready`       | POST   | Promote inbox item to an incomplete task                                                     |
+| `bulk-mark-inbox-items-ready` | POST   | Promote multiple inbox items to incomplete tasks by id                                       |
+| `reorder-inbox-items`         | POST   | Reorder inbox items by id list top-to-bottom                                                 |
+| `list-custom-fields`          | GET    | List custom field definitions                                                                |
+| `create-custom-field`         | POST   | Create a custom field definition with `title`, `type`, and optional `config`                 |
+| `update-custom-field`         | POST   | Patch a field definition `title` and/or type-compatible `config`; type is immutable          |
+| `delete-custom-field`         | POST   | Delete a field definition and its values on every task (confirm with user first)             |
+| `reorder-custom-fields`       | POST   | Reorder custom field definitions by id list top-to-bottom                                    |
+| `list-visible-task-fields`    | GET    | List custom field ids shown on task cards for the current user                               |
+| `update-visible-task-fields`  | POST   | Replace which custom fields appear on task cards (max 3)                                     |
+| `view-screen`                 | —      | Read navigation, UI bulk selection, visible tasks, and inbox snapshot                        |
+| `navigate`                    | —      | Move UI to a view: `tasks`, `inbox`, `fields`, `extensions`, `team` (`home`/`ask` → `tasks`) |
+| `render-task-list-inline`     | —      | Render an interactive task-list widget inline in chat without leaving the current view       |
+
+## Related Skills
+
+- **task-inbox-workflow** — when to call the task and inbox actions.
+- **custom-fields** — the custom field definition, value, and visibility actions.
+- **actions** — how to create a new action with `defineAction`.

package/corpus/templates/tasks/.agents/skills/actions/SKILL.md

@@ -18,6 +18,8 @@ Actions in `actions/` are the **single source of truth** for app operations. The
 
 Before creating any custom REST/API route for app data, inspect `actions/` and the action table in `AGENTS.md`. If an action already exists, call it directly from the agent or with `useActionQuery` / `useActionMutation` from the UI. If the capability is missing, create or update a `defineAction`. Do not add `/api/*`, `server/routes/*`, or other pass-through endpoints whose main job is to call, repackage, or re-export an action.
 
+**Stop trigger:** the moment you are about to create a file under `server/routes/api/` — or add server middleware to guard one — stop and check it against the exception list in *When You Still Need Custom `/api/` Routes* below. If it is not on that list, write a `defineAction` instead. This applies even when you already started the route; abandoning a half-written action to hand-roll routes is the exact failure this rule exists to prevent.
+
 ## Why
 
 Actions give the agent callable tools with structured input/output, AND they give the frontend a typed client contract through hooks. One implementation serves both the agent and the UI. They keep the agent's chat context clean, they're reusable, and they can be tested independently.
@@ -390,12 +392,28 @@ This is the canonical approach for new apps. Action names must be lowercase with
 
 ## When You Still Need Custom `/api/` Routes
 
-Most operations should be actions. You only need custom routes in `server/routes/api/` for:
+This is the complete exception list. A route in `server/routes/api/` is only
+justified when the caller is not your own UI or agent, or when the payload is
+not JSON:
 
 - **File uploads** — actions receive JSON params, not multipart form data
 - **Streaming responses** — SSE or chunked responses that need direct H3 control
 - **Webhooks** — external services POST to a specific URL
 - **OAuth callbacks** — redirect-based flows that need specific URL patterns
+- **Public unauthenticated endpoints** — SEO/OG images, share links, and other
+  URLs opened directly by a browser or crawler
+- **Binary or non-JSON responses** — media, exports, generated assets
+
+Everything else is an action: CRUD, settings, search, list/detail reads, auth
+state, and anything the UI fetches as JSON. If a route needs new middleware to
+scope it to the current user, that is a signal it should be an action — actions
+already run inside request context with access checks.
+
+Existing first-party templates still contain a shrinking, explicitly
+grandfathered set of older `/api/*` CRUD routes for app data. The repository's
+`guard:no-action-twin-routes` CI check ratchets that baseline down across the
+first-party template route trees (with the separately owned Plan template
+fenced out); it is not a substitute for keeping generated apps action-first.
 
 When the agent needs a durable image or file URL, call the core `upload-image`
 action or use `uploadFile()` in server code. Do not write base64 into SQL,

package/corpus/templates/tasks/.agents/skills/adding-a-feature/SKILL.md

@@ -14,6 +14,8 @@ metadata:
 
 Every new feature MUST update all four areas. Skipping any one breaks the agent-native contract — the agent and UI must always be equal partners.
 
+Scope check first: this is the checklist for a feature that adds app data or a new capability. A restyle, a copy change, or a screen with no new data model and no new agent-visible operation only needs the areas it actually touches — do not manufacture actions, state keys, or a skill for it.
+
 ## Why
 
 Agent-native apps are defined by parity: everything the UI can do, the agent can do, and vice versa. A feature that only has UI is invisible to the agent. A feature that only has scripts is invisible to the user. A feature without app-state sync means the agent is blind to what the user is doing.

package/corpus/templates/tasks/.agents/skills/change-summary/SKILL.md

@@ -2,7 +2,9 @@
 name: change-summary
 description: >-
   End agent responses that include code changes with a Change summary table
-  (Code / Tests / Config / Docs) and per-file line counts from git diff.
+  (Code / Tests / Config / Docs) and per-file line counts from git diff, and
+  the commit message conventions for this app. Use after any code change and
+  before creating a commit.
 metadata:
   internal: true
 ---
@@ -81,3 +83,19 @@ Use line counts from `git diff --numstat` (added, removed). Do not approximate f
 - If the user asked only for a review with no changes, skip the summary.
 
 Place the change summary **before** the final 🟢/🟡/🔴 status line.
+
+## Commit Message Conventions
+
+- Never include `Made-with: Cursor` in commit messages. Remove it if it appears
+  in a generated message.
+- Use one of these prefixes:
+  - `feature: ...` or `feature(PROJECT): ...`
+  - `fix: ...` or `fix(PROJECT): ...`
+  - `refactor: ...` or `refactor(PROJECT): ...`
+  - `technical: ...` or `technical(PROJECT): ...`
+  - `chore: ...` or `chore(PROJECT): ...`
+- `PROJECT` is optional. If provided, it must be one of `generator` or `web`.
+- Before creating any commit, always:
+  - ask for confirmation,
+  - show the proposed commit message first,
+  - commit only after explicit user approval.

package/corpus/templates/tasks/.agents/skills/custom-fields/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: custom-fields
+description: >-
+  Custom field definitions, types, config, per-task values, and which fields
+  show on task cards. Use when the user asks to add, edit, reorder, show, hide,
+  or delete a custom field, set a field value on a task, or works on /fields.
+---
+
+# Custom Fields
+
+## Rule
+
+Field definitions, per-task values, and task-card visibility are three separate
+surfaces with their own actions. Use the definition actions for the schema, the
+`update-task` `fieldValues` patch for values, and the visible-field actions for
+what shows on cards.
+
+## Definitions
+
+- Use `list-custom-fields`, `create-custom-field`, `update-custom-field`, and
+  `delete-custom-field` for field definitions.
+- Use `reorder-custom-fields` with every field id in the desired order when
+  moving fields in the Fields list.
+- A field's `type` is immutable after creation; `update-custom-field` patches
+  the `title` and/or type-compatible `config` only.
+- `delete-custom-field` only after explicit user confirmation; warn that
+  deleting the definition removes its values on every task.
+
+## Field types and config
+
+- Custom field types are `text`, `rich_text`, `number`, `percent`, `currency`,
+  `single_select`, `multi_select`, and `date`.
+- Number, percent, and currency field `precision` limits decimal places;
+  `precision: 0` means whole numbers only. Number fields also support optional
+  `positiveOnly`.
+- Select option colors are named tokens: `red`, `orange`, `yellow`, `green`,
+  `blue`, `purple`, `pink`, and `gray`.
+
+## Values on tasks
+
+- Use `list-tasks` with `includeFields` to read per-task custom values and
+  `update-task` with `fieldValues` to set or clear them; empty values clear the
+  stored row.
+
+## Task-card visibility
+
+- Use `list-visible-task-fields` and `update-visible-task-fields` to read or
+  change which fields appear on task cards (max 3, persisted per user in SQL).
+
+## What `view-screen` returns
+
+- On `/tasks`, `view-screen` includes `visibleTaskFields` from stored prefs for
+  the custom fields currently shown on task cards and `selectedTaskFields` for
+  a highlighted task.
+- On `/fields`, `view-screen` returns the field-definition list and
+  `selectedItem` when a field is highlighted.
+- `navigation.fieldId` highlights a custom field when the Fields page is opened
+  from a deep link.
+
+## Related Skills
+
+- **task-inbox-workflow** — reading visible task context before editing.
+- **store-conventions** — how custom field value writes are shaped in the store.

package/corpus/templates/tasks/.agents/skills/frontend-design/SKILL.md

@@ -1,14 +1,17 @@
 ---
 name: frontend-design
 description: >-
-  Create distinctive, production-grade frontend interfaces with high design
-  quality. Use when building web components, pages, artifacts, posters, or
-  applications (websites, landing pages, dashboards, React components,
-  HTML/CSS layouts, or when styling/beautifying any web UI). Generates
-  creative, polished UI that avoids generic AI aesthetics.
+  Sets the visual direction for a new or redesigned surface, with production
+  quality that avoids generic AI aesthetics. Use when building a new page,
+  app, or marketing surface, defining visual identity, or doing a design pass
+  ("make this look good"). Do not load it for routine UI edits: adding a field
+  to an existing form, fixing spacing, wiring a button, or changing copy.
 scope: dev
 license: Complete terms in LICENSE.txt
 source: https://github.com/anthropics/skills/blob/main/skills/frontend-design/SKILL.md
+local-changes: >-
+  Description narrowed and Verification rescoped deliberately; an upstream sync
+  must not restore the broad auto-load triggers or screenshot-everything step.
 metadata:
   internal: true
 ---
@@ -141,11 +144,22 @@ Avoid:
 
 ## Verification
 
+Match verification effort to the size of the change. For one component, one
+form, one page, or a restyle, run the app's existing checks — formatter,
+`pnpm typecheck`, existing tests — and stop there.
+
+Escalate to browser verification only when the user asks for it, or when the
+change is a multi-step user-visible flow that cannot be confirmed any other
+way. Never author a new Playwright/Puppeteer script, add a browser-automation
+dependency, or stand up an e2e harness to check work the user did not ask you
+to test that way; use an available browser tool, or say what you could not
+verify.
+
 For substantial frontend work:
 
 1. Run the relevant formatter/checks.
 2. Start the dev server when the app needs one.
-3. Verify with browser screenshots at desktop and mobile widths.
+3. Verify with the available browser tooling at desktop and mobile widths.
 4. Check interactive states: hover, focus, loading, empty, error, and destructive confirmations.
 5. When registering or changing a company adapter, run
    `@agent-native/toolkit/conformance`, including mixed-overlay focus,

package/corpus/templates/tasks/.agents/skills/security/SKILL.md

@@ -127,6 +127,8 @@ Two more CI guards (also wired into `pnpm prep`) target the 2026-04 cross-tenant
 - `scripts/guard-no-env-mutation.mjs` — bans `process.env.<KEY> = …` (and bracket / compound forms) anywhere in production code. On serverless, every warm container handles many concurrent requests in one Node process, so `process.env` mutation leaks across in-flight requests (the "restore" line at the end of a handler races and never helps — most recently the Zoom webhook). Use `runWithRequestContext({ userEmail, orgId, timezone }, fn)` from `@agent-native/core/server` instead — it's AsyncLocalStorage-backed and per-request safe. Allowlisted paths: `scripts/`, `*.spec.ts` / `*.test.ts`, `packages/core/src/dev**`, `templates/*/test/`, anything under `/cli/` or `/scaffold/`. Per-line opt-out: `process.env.X = y // guard:allow-env-mutation — <reason>`.
 - `scripts/guard-no-localhost-fallback.mjs` — bans the literal `"local@localhost"` / `'local@localhost'` / `` `local@localhost` `` in production code. The bug class: `getRequestUserEmail() ?? "local@localhost"` silently pools every unauthenticated request into a single shared tenant, leaking credentials, tools, and `application_state` rows between accounts. The right behavior is to throw / 401 when there's no session. Allowlisted paths: the dev-mode auth shim (`packages/core/src/server/auth.ts`), `packages/core/src/dev**`, tests, `scripts/`, `seed/` / `seeds/`, plus a few framework helpers that intentionally inspect or migrate the dev identity. SQL DDL `DEFAULT 'local@localhost'` and the Drizzle helper `.default('local@localhost')` are skipped per-line — schema column defaults are intentional dev fixtures, not the dangerous fallback pattern. Per-line opt-out: `email ?? "local@localhost" // guard:allow-localhost-fallback — <reason>`.
 
+  The same guard also bans the **ambient process identity** as a request-scoped fallback: `?? process.env.AGENT_USER_EMAIL`, `|| process.env.WORKSPACE_OWNER_EMAIL`, and `?? getAmbientUserEmail()`. Those name the identity of the *deployment*, not the caller, so a handler reading one authorizes whoever the deploy env names rather than whoever signed in — it fails open toward more privilege. Exempt paths are the ones with no request by construction: `scripts/` (including `templates/*/scripts/`), `src/cli/`, `src/scripts/`, `script-helpers.ts` / `script-entries.ts`, tests, and seeds. It deliberately matches only the `??` / `||` fallback position, so reading the same env var to build an admin allowlist (`envEmails("WORKSPACE_OWNER_EMAIL").includes(email)`) is untouched. Known gaps, both requiring dataflow analysis the guard does not do: an env read aliased through a local (`const fallback = process.env.AGENT_USER_EMAIL; … ?? fallback`) and a destructured `const { AGENT_USER_EMAIL } = process.env`.
+
 ## Auth
 
 - All actions are protected by the auth guard automatically.

package/corpus/templates/tasks/.agents/skills/self-modifying-code/SKILL.md

@@ -1,9 +1,10 @@
 ---
 name: self-modifying-code
 description: >-
-  How the agent can modify the app's own source code. Use when the agent needs
-  to edit components, routes, styles, or scripts, when designing UI for agent
-  editability, or when deciding what the agent should and shouldn't modify.
+  Tiers, checkpoints, and off-limits paths for an agent editing the app's own
+  source. Use when designing UI for agent editability, deciding whether a file
+  is safe for the agent to change, or when tempted to patch config, `.env`, or
+  an `@agent-native/*` package. Do not load it for ordinary source edits.
 scope: dev
 metadata:
   internal: true