@agent-native/core 0.128.4 → 0.129.0

package/corpus/templates/clips/desktop/src/styles.css

@@ -812,10 +812,14 @@ body[data-clips-route="recording-pill"] #root {
   vector-effect: non-scaling-stroke;
 }
 
+/* One variable owns the meter's height and the bars scale off it — every rule
+   that resizes the meter sets `--meter-height`, not `height`. Two rules setting
+   `height` independently is how the box and the bars drifted apart before. */
 .live-audio-bars {
+  --meter-height: 26px;
   display: inline-flex;
   width: 48px;
-  height: 26px;
+  height: var(--meter-height);
   align-items: center;
   justify-content: center;
   gap: 4px;
@@ -823,15 +827,14 @@ body[data-clips-route="recording-pill"] #root {
 }
 
 .live-audio-bars-compact {
-  width: 24px;
-  height: 24px;
-  gap: 3.5px;
+  --meter-height: 22px;
+  width: 21px;
+  gap: 3px;
 }
 
 .live-audio-bar {
   display: block;
-  width: 3.5px;
-  min-height: 3.5px;
+  width: 3px;
   border-radius: 999px;
   background: rgba(132, 204, 22, 0.98);
   box-shadow: 0 0 5px rgba(132, 204, 22, 0.35);
@@ -5577,7 +5580,7 @@ body[data-clips-route="recording-pill"] #root {
   gap: 6px;
   height: auto;
   width: auto;
-  padding: 12px 10px;
+  padding: 10px 8px;
   cursor: pointer;
 }
 
@@ -5592,8 +5595,8 @@ body[data-clips-route="recording-pill"] #root {
 }
 
 .pill-vertical .pill-wave-meter {
-  height: 24px;
-  width: 24px;
+  --meter-height: 22px;
+  width: 21px;
 }
 
 /* Wrapper around logo + waveform. */
@@ -5617,7 +5620,7 @@ body[data-clips-route="recording-pill"] #root {
 /* Layout only. `display` must stay flex here — a `block` override collapses
    the meter's bars into a single stacked column instead of a waveform. */
 .pill-wave-meter {
-  height: 26px;
+  --meter-height: 26px;
   width: 48px;
   flex-shrink: 0;
 }

package/corpus/templates/clips/desktop/src-tauri/src/recording_indicator.rs

@@ -66,7 +66,7 @@ static PILL_HOVER_TRACKING: AtomicBool = AtomicBool::new(false);
 /// Collapsed dimensions (logical px). The collapsed pill is a vertical capsule
 /// — clips logo on top, waveform below — so it is taller than it is wide. The
 /// expanded form stretches horizontally to fit the live-transcript area.
-const PILL_W_LOGICAL: u32 = 44;
+const PILL_W_LOGICAL: u32 = 38;
 const PILL_W_EXPANDED_LOGICAL: u32 = 480;
 /// Meeting mode uses the same focused transcript width as other recordings;
 /// live notes are intentionally kept out of this compact overlay.
@@ -74,7 +74,7 @@ const PILL_W_EXPANDED_MEETING_LOGICAL: u32 = 480;
 /// Keep this close to the rendered capsule's height. The window frame is what
 /// hover is polled against, so slack here makes the pill light up while the
 /// cursor is still nowhere near it.
-const PILL_H_LOGICAL: u32 = 64;
+const PILL_H_LOGICAL: u32 = 60;
 const PILL_H_EXPANDED_LOGICAL: u32 = 340;
 /// Bottom margin from the screen edge, logical px. Granola uses ~24.
 const PILL_BOTTOM_MARGIN_LOGICAL: u32 = 24;

package/corpus/templates/clips/desktop/src-tauri/src/whisper_speech.rs

@@ -157,6 +157,38 @@ mod macos {
 
     const MEETING_AUDIO_OWNER: &str = "meeting-whisper";
 
+    /// Emit every Nth shared-bus buffer as a meter level. Buffers land every
+    /// ~10-20 ms; the overlay only needs ~20 Hz to look live.
+    const SHARED_LEVEL_EVERY: u32 = 3;
+
+    /// Meter levels for the shared-producer path. Each physical capture path
+    /// emits `voice:audio-level` from its own tap, but a meeting that subscribes
+    /// to the Rewind audio bus opens none of those taps — the samples arrive
+    /// already mixed. Without this the recording pill's waveform reports silence
+    /// for the entire call while transcription runs perfectly.
+    fn shared_level_tap(
+        app: AppHandle,
+        source: &'static str,
+    ) -> impl Fn(&[f32]) + Send + Sync + 'static {
+        let tick = Arc::new(AtomicU32::new(0));
+        move |samples: &[f32]| {
+            if tick.fetch_add(1, Ordering::Relaxed) % SHARED_LEVEL_EVERY != 0 {
+                return;
+            }
+            // Sparse peak — a meter does not need every frame.
+            let step = (samples.len() / 64).max(1);
+            let level = samples
+                .iter()
+                .step_by(step)
+                .fold(0.0f32, |peak, sample| peak.max(sample.abs()))
+                .min(1.0);
+            let _ = app.emit(
+                "voice:audio-level",
+                serde_json::json!({ "level": level, "source": source }),
+            );
+        }
+    }
+
     /// One transcript segment with real timestamps from whisper, already
     /// offset onto the meeting timeline (ms since capture start).
     #[derive(Serialize, Clone)]
@@ -1056,15 +1088,19 @@ mod macos {
         // RawMicCapture, or raw system capture is opened.
         let shared_audio = if owner == SessionOwner::Meeting {
             let mic_for_shared = mic_stream.clone();
+            let mic_level = shared_level_tap(app.clone(), "mic");
             let shared_mic = Arc::new(move |samples: &[f32], sample_rate: f64| {
                 mic_for_shared.set_src_rate(sample_rate);
                 mic_for_shared.push(samples);
+                mic_level(samples);
             });
             let shared_system = sys_stream.as_ref().map(|stream| {
                 let stream = stream.clone();
+                let system_level = shared_level_tap(app.clone(), "system");
                 Arc::new(move |samples: &[f32], sample_rate: f64| {
                     stream.set_src_rate(sample_rate);
                     stream.push(samples);
+                    system_level(samples);
                 }) as crate::capture_audio_bus::AudioCallback
             });
             match try_subscribe(

package/corpus/templates/content/.agents/skills/security/SKILL.md

@@ -163,7 +163,9 @@ private UI after the shell loads. See the `authentication` skill and
 proves *someone* is signed in. To restrict an operation to some teammates, set
 `authorize` on the `defineAction`. It wraps `run`, so it applies at every
 dispatch site (agent tool, HTTP, frontend, MCP, A2A, CLI) — unlike
-`needsApproval`, which is honoured only in the agent loop.
+`needsApproval`, which is honored by the agent loop and MCP 2026 hosts that
+support elicitation, but is not an authorization boundary for every dispatch
+site.
 
 ```ts
 import { coachAccess } from "../lib/access.js"; // defineAppRoles(...)
@@ -203,7 +205,16 @@ export default defineAction({
 });
 ```
 
-When the gate is truthy and the call is not yet approved, the loop emits an `approval_required` event and **stops the turn — `run()` never executes**. The human approves via the chat UI's Approve affordance, which re-issues the turn with the call's stable `approvalKey`; only then does the action run. A predicate gates conditionally (e.g. only external recipients) and **fails closed** — a throw is treated as "approval required".
+When the gate is truthy and the call is not yet approved, the agent loop emits
+an `approval_required` event and **stops the turn — `run()` never executes**.
+The human approves via the chat UI's Approve affordance, which re-issues the
+turn with the call's stable `approvalKey`; only then does the action run. MCP
+2026 hosts receive an `input_required` approval request bound to the exact
+caller, action, and arguments. The signed response state is backed by a durable,
+single-use grant, so denial, expiry, replay, missing host support, or invalid
+state fails closed before `run()`. A predicate gates conditionally (e.g. only
+external recipients) and **fails closed** — a throw is treated as "approval
+required".
 
 Rules:
 

package/corpus/templates/content/actions/_builder-cms-read-client.ts

@@ -439,19 +439,43 @@ async function postBuilderMcp(args: {
   endpoint: string;
   privateKey: string;
   payload: Record<string, unknown>;
-  sessionId?: string | null;
+  connection?: BuilderMcpConnection;
+  modernClientName?: string;
   fetchImpl: FetchLike;
 }) {
+  const method =
+    typeof args.payload.method === "string" ? args.payload.method : "";
+  const modernClientName =
+    args.modernClientName ??
+    (args.connection?.protocolVersion === "2026-07-28"
+      ? "agent-native-content-template"
+      : undefined);
+  const payload = modernClientName
+    ? withModernBuilderMcpEnvelope(args.payload, modernClientName)
+    : args.payload;
   const headers: Record<string, string> = {
     accept: "application/json, text/event-stream",
     authorization: `Bearer ${args.privateKey}`,
     "content-type": "application/json",
   };
-  if (args.sessionId) headers["mcp-session-id"] = args.sessionId;
+  if (args.connection?.sessionId) {
+    headers["mcp-session-id"] = args.connection.sessionId;
+  }
+  if (modernClientName) {
+    headers["mcp-protocol-version"] = "2026-07-28";
+    headers["mcp-method"] = method;
+    const params = args.payload.params as Record<string, unknown> | undefined;
+    if (typeof params?.name === "string") {
+      headers["mcp-name"] = params.name;
+    }
+    if (method === "resources/read" && typeof params?.uri === "string") {
+      headers["mcp-name"] = params.uri;
+    }
+  }
   const response = await args.fetchImpl(args.endpoint, {
     method: "POST",
     headers,
-    body: JSON.stringify(args.payload),
+    body: JSON.stringify(payload),
   });
   const text = await response.text();
   if (!response.ok) {
@@ -463,6 +487,44 @@ async function postBuilderMcp(args: {
   };
 }
 
+interface BuilderMcpConnection {
+  protocolVersion: "2026-07-28" | "2025-11-25" | "2024-11-05";
+  sessionId: string | null;
+}
+
+function withModernBuilderMcpEnvelope(
+  payload: Record<string, unknown>,
+  clientName: string,
+): Record<string, unknown> {
+  const params =
+    payload.params &&
+    typeof payload.params === "object" &&
+    !Array.isArray(payload.params)
+      ? (payload.params as Record<string, unknown>)
+      : {};
+  const meta =
+    params._meta &&
+    typeof params._meta === "object" &&
+    !Array.isArray(params._meta)
+      ? (params._meta as Record<string, unknown>)
+      : {};
+  return {
+    ...payload,
+    params: {
+      ...params,
+      _meta: {
+        ...meta,
+        "io.modelcontextprotocol/protocolVersion": "2026-07-28",
+        "io.modelcontextprotocol/clientInfo": {
+          name: clientName,
+          version: "0.1.0",
+        },
+        "io.modelcontextprotocol/clientCapabilities": {},
+      },
+    },
+  };
+}
+
 function builderMcpEntriesFromToolResponse(
   response: unknown,
   model: string,
@@ -593,39 +655,98 @@ async function initializeBuilderMcp(args: {
   privateKey: string;
   fetchImpl: FetchLike;
 }) {
-  const initialized = await postBuilderMcp({
-    endpoint: args.endpoint,
-    privateKey: args.privateKey,
-    fetchImpl: args.fetchImpl,
-    payload: {
-      jsonrpc: "2.0",
-      id: 1,
-      method: "initialize",
-      params: {
-        protocolVersion: "2024-11-05",
-        capabilities: {},
-        clientInfo: {
-          name: "agent-native-content-template",
-          version: "0.1.0",
-        },
-      },
-    },
-  });
-  const sessionId = initialized.sessionId;
-  if (sessionId) {
-    await postBuilderMcp({
+  try {
+    const discovered = await postBuilderMcp({
       endpoint: args.endpoint,
       privateKey: args.privateKey,
       fetchImpl: args.fetchImpl,
-      sessionId,
       payload: {
         jsonrpc: "2.0",
-        method: "notifications/initialized",
+        id: 1,
+        method: "server/discover",
         params: {},
       },
-    }).catch(() => null);
+    });
+    const result = discovered.json.result;
+    if (
+      result &&
+      typeof result === "object" &&
+      Array.isArray((result as Record<string, unknown>).supportedVersions) &&
+      (
+        (result as Record<string, unknown>).supportedVersions as unknown[]
+      ).includes("2026-07-28")
+    ) {
+      return {
+        protocolVersion: "2026-07-28",
+        sessionId: null,
+      } satisfies BuilderMcpConnection;
+    }
+  } catch (error) {
+    // A legacy server may reject server/discover before initialize.
+    if (
+      !(error instanceof Error) ||
+      !/HTTP (?:400|404|405)\./.test(error.message)
+    ) {
+      throw error;
+    }
+  }
+
+  const initializeLegacyProtocol = async (
+    protocolVersion: "2025-11-25" | "2024-11-05",
+  ) => {
+    const initialized = await postBuilderMcp({
+      endpoint: args.endpoint,
+      privateKey: args.privateKey,
+      fetchImpl: args.fetchImpl,
+      payload: {
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion,
+          capabilities: {},
+          clientInfo: {
+            name: "agent-native-content-template",
+            version: "0.1.0",
+          },
+        },
+      },
+    });
+    if (initialized.json.error) {
+      throw new Error(
+        `Builder MCP initialize rejected protocol ${protocolVersion}.`,
+      );
+    }
+    const sessionId = initialized.sessionId;
+    if (sessionId) {
+      await postBuilderMcp({
+        endpoint: args.endpoint,
+        privateKey: args.privateKey,
+        fetchImpl: args.fetchImpl,
+        connection: { protocolVersion, sessionId },
+        payload: {
+          jsonrpc: "2.0",
+          method: "notifications/initialized",
+          params: {},
+        },
+      }).catch(() => null);
+    }
+    return {
+      protocolVersion,
+      sessionId,
+    } satisfies BuilderMcpConnection;
+  };
+
+  try {
+    return await initializeLegacyProtocol("2025-11-25");
+  } catch (error) {
+    const isProtocolRejection =
+      error instanceof Error &&
+      (/HTTP (?:400|404|405|422)\./.test(error.message) ||
+        error.message.includes("initialize rejected protocol"));
+    if (!isProtocolRejection) throw error;
+    return await initializeLegacyProtocol("2024-11-05");
   }
-  return sessionId;
 }
 
 async function readBuilderCmsContentEntriesViaMcp(args: {
@@ -640,7 +761,7 @@ async function readBuilderCmsContentEntriesViaMcp(args: {
 }): Promise<BuilderCmsReadResult> {
   const fetchedAt = new Date().toISOString();
   const endpoint = builderMcpEndpoint();
-  const sessionId = await initializeBuilderMcp({
+  const connection = await initializeBuilderMcp({
     endpoint,
     privateKey: args.privateKey,
     fetchImpl: args.fetchImpl,
@@ -668,7 +789,7 @@ async function readBuilderCmsContentEntriesViaMcp(args: {
       endpoint,
       privateKey: args.privateKey,
       fetchImpl: args.fetchImpl,
-      sessionId,
+      connection,
       payload: {
         jsonrpc: "2.0",
         id: `content-${offset}`,
@@ -747,7 +868,7 @@ async function readBuilderCmsContentEntriesViaMcp(args: {
     endpoint,
     privateKey: args.privateKey,
     fetchImpl: args.fetchImpl,
-    sessionId,
+    connection,
     payload: {
       jsonrpc: "2.0",
       id: 3,
@@ -775,7 +896,7 @@ async function readBuilderCmsContentEntriesViaMcp(args: {
       endpoint,
       privateKey: args.privateKey,
       fetchImpl: args.fetchImpl,
-      sessionId,
+      connection,
       payload: {
         jsonrpc: "2.0",
         id: `entry-${entry.id}`,
@@ -1046,7 +1167,7 @@ export async function listBuilderCmsModels(
 
   try {
     const endpoint = builderMcpEndpoint();
-    const sessionId = await initializeBuilderMcp({
+    const connection = await initializeBuilderMcp({
       endpoint,
       privateKey,
       fetchImpl,
@@ -1055,7 +1176,7 @@ export async function listBuilderCmsModels(
       endpoint,
       privateKey,
       fetchImpl,
-      sessionId,
+      connection,
       payload: {
         jsonrpc: "2.0",
         id: 2,

package/corpus/templates/content/actions/_builder-docs-client.ts

@@ -194,19 +194,43 @@ async function postBuilderMcp(args: {
   endpoint: string;
   privateKey: string;
   payload: Record<string, unknown>;
-  sessionId?: string | null;
+  connection?: BuilderMcpConnection;
+  modernClientName?: string;
   fetchImpl: FetchLike;
 }) {
+  const method =
+    typeof args.payload.method === "string" ? args.payload.method : "";
+  const modernClientName =
+    args.modernClientName ??
+    (args.connection?.protocolVersion === "2026-07-28"
+      ? "agent-native-content-builder-mdx"
+      : undefined);
+  const payload = modernClientName
+    ? withModernBuilderMcpEnvelope(args.payload, modernClientName)
+    : args.payload;
   const headers: Record<string, string> = {
     accept: "application/json, text/event-stream",
     authorization: `Bearer ${args.privateKey}`,
     "content-type": "application/json",
   };
-  if (args.sessionId) headers["mcp-session-id"] = args.sessionId;
+  if (args.connection?.sessionId) {
+    headers["mcp-session-id"] = args.connection.sessionId;
+  }
+  if (modernClientName) {
+    headers["mcp-protocol-version"] = "2026-07-28";
+    headers["mcp-method"] = method;
+    const params = args.payload.params as Record<string, unknown> | undefined;
+    if (typeof params?.name === "string") {
+      headers["mcp-name"] = params.name;
+    }
+    if (method === "resources/read" && typeof params?.uri === "string") {
+      headers["mcp-name"] = params.uri;
+    }
+  }
   const response = await args.fetchImpl(args.endpoint, {
     method: "POST",
     headers,
-    body: JSON.stringify(args.payload),
+    body: JSON.stringify(payload),
   });
   const text = await response.text();
   if (!response.ok) {
@@ -218,44 +242,141 @@ async function postBuilderMcp(args: {
   };
 }
 
+interface BuilderMcpConnection {
+  protocolVersion: "2026-07-28" | "2025-11-25" | "2024-11-05";
+  sessionId: string | null;
+}
+
+function withModernBuilderMcpEnvelope(
+  payload: Record<string, unknown>,
+  clientName: string,
+): Record<string, unknown> {
+  const params =
+    payload.params &&
+    typeof payload.params === "object" &&
+    !Array.isArray(payload.params)
+      ? (payload.params as Record<string, unknown>)
+      : {};
+  const meta =
+    params._meta &&
+    typeof params._meta === "object" &&
+    !Array.isArray(params._meta)
+      ? (params._meta as Record<string, unknown>)
+      : {};
+  return {
+    ...payload,
+    params: {
+      ...params,
+      _meta: {
+        ...meta,
+        "io.modelcontextprotocol/protocolVersion": "2026-07-28",
+        "io.modelcontextprotocol/clientInfo": {
+          name: clientName,
+          version: "0.1.0",
+        },
+        "io.modelcontextprotocol/clientCapabilities": {},
+      },
+    },
+  };
+}
+
 async function initializeBuilderMcp(args: {
   endpoint: string;
   privateKey: string;
   fetchImpl: FetchLike;
 }) {
-  const initialized = await postBuilderMcp({
-    endpoint: args.endpoint,
-    privateKey: args.privateKey,
-    fetchImpl: args.fetchImpl,
-    payload: {
-      jsonrpc: "2.0",
-      id: 1,
-      method: "initialize",
-      params: {
-        protocolVersion: "2024-11-05",
-        capabilities: {},
-        clientInfo: {
-          name: "agent-native-content-builder-mdx",
-          version: "0.1.0",
-        },
-      },
-    },
-  });
-  const sessionId = initialized.sessionId;
-  if (sessionId) {
-    await postBuilderMcp({
+  try {
+    const discovered = await postBuilderMcp({
       endpoint: args.endpoint,
       privateKey: args.privateKey,
       fetchImpl: args.fetchImpl,
-      sessionId,
       payload: {
         jsonrpc: "2.0",
-        method: "notifications/initialized",
+        id: 1,
+        method: "server/discover",
         params: {},
       },
-    }).catch(() => null);
+    });
+    const result = discovered.json.result;
+    if (
+      result &&
+      typeof result === "object" &&
+      Array.isArray((result as Record<string, unknown>).supportedVersions) &&
+      (
+        (result as Record<string, unknown>).supportedVersions as unknown[]
+      ).includes("2026-07-28")
+    ) {
+      return {
+        protocolVersion: "2026-07-28",
+        sessionId: null,
+      } satisfies BuilderMcpConnection;
+    }
+  } catch (error) {
+    // A legacy server may reject server/discover before initialize.
+    if (
+      !(error instanceof Error) ||
+      !/HTTP (?:400|404|405)\./.test(error.message)
+    ) {
+      throw error;
+    }
+  }
+
+  const initializeLegacyProtocol = async (
+    protocolVersion: "2025-11-25" | "2024-11-05",
+  ) => {
+    const initialized = await postBuilderMcp({
+      endpoint: args.endpoint,
+      privateKey: args.privateKey,
+      fetchImpl: args.fetchImpl,
+      payload: {
+        jsonrpc: "2.0",
+        id: 1,
+        method: "initialize",
+        params: {
+          protocolVersion,
+          capabilities: {},
+          clientInfo: {
+            name: "agent-native-content-builder-mdx",
+            version: "0.1.0",
+          },
+        },
+      },
+    });
+    if (initialized.json.error) {
+      throw new Error(
+        `Builder MCP initialize rejected protocol ${protocolVersion}.`,
+      );
+    }
+    const sessionId = initialized.sessionId;
+    if (sessionId) {
+      await postBuilderMcp({
+        endpoint: args.endpoint,
+        privateKey: args.privateKey,
+        fetchImpl: args.fetchImpl,
+        connection: { protocolVersion, sessionId },
+        payload: {
+          jsonrpc: "2.0",
+          method: "notifications/initialized",
+          params: {},
+        },
+      }).catch(() => null);
+    }
+    return {
+      protocolVersion,
+      sessionId,
+    } satisfies BuilderMcpConnection;
+  };
+
+  try {
+    return await initializeLegacyProtocol("2025-11-25");
+  } catch (error) {
+    const isProtocolRejection =
+      error instanceof Error &&
+      (/HTTP (?:400|404|405|422)\./.test(error.message) ||
+        error.message.includes("initialize rejected protocol"));
+    if (!isProtocolRejection) throw error;
+    return await initializeLegacyProtocol("2024-11-05");
   }
-  return sessionId;
 }
 
 function fullEntryFromToolResponse(value: unknown, model: string) {
@@ -363,7 +484,7 @@ async function readFullBuilderDocsEntryViaMcp(args: {
   privateKey: string;
 }) {
   const endpoint = builderMcpEndpoint();
-  const sessionId = await initializeBuilderMcp({
+  const connection = await initializeBuilderMcp({
     endpoint,
     privateKey: args.privateKey,
     fetchImpl: args.fetchImpl,
@@ -372,7 +493,7 @@ async function readFullBuilderDocsEntryViaMcp(args: {
     endpoint,
     privateKey: args.privateKey,
     fetchImpl: args.fetchImpl,
-    sessionId,
+    connection,
     payload: {
       jsonrpc: "2.0",
       id: `builder-mdx-${args.model}-${args.entryId}`,

package/corpus/templates/content/actions/stage-builder-source-bulk-update.ts

@@ -39,6 +39,7 @@ const supportedBulkPropertyTypes = new Set<DocumentPropertyType>([
   "url",
   "email",
   "phone",
+  "files_media",
 ]);
 
 function parseSourceValues(
@@ -577,7 +578,9 @@ const fieldSchema = z.object({
         .passthrough(),
       z.null(),
     ])
-    .describe("Value to set on the mapped Builder-backed field."),
+    .describe(
+      "Value to set on the mapped Builder-backed field. Builder File fields accept one http(s) URL as a string or one-item array; no media-picker upload is required.",
+    ),
 });
 
 export const stageBuilderSourceBulkUpdateSchema = z
@@ -645,7 +648,7 @@ export { stageBuilderSourceBulkUpdateWithDeps };
 
 export default defineAction({
   description:
-    "Preview or stage one bounded bulk update across selected source-backed Builder CMS rows. This only stages local reviewable diffs; Builder writeback still goes through the existing review and execution actions.",
+    "Preview or stage one bounded bulk update across selected source-backed Builder CMS rows, including Builder File fields backed by Content Files & media properties. This only stages local reviewable diffs; Builder writeback still goes through the existing review and execution actions.",
   schema: stageBuilderSourceBulkUpdateSchema,
   run: async (
     args: StageBuilderSourceBulkUpdateRequest,