@agent-native/core 0.129.2 → 0.130.0

package/corpus/core/src/cli/create.ts

@@ -91,6 +91,12 @@ const HEADLESS_OPTION = {
   hint: "Action-first app with one hello primitive and no UI shell",
 };
 
+const COMMUNITY_OPTION = {
+  name: "community",
+  label: "Community template",
+  hint: "Install a third-party Agent Native app from a public GitHub repository",
+};
+
 export interface CreateAppOptions {
   /** Pre-select these templates in the picker. Comma-separated string or array. */
   template?: string;
@@ -183,6 +189,11 @@ export async function createApp(
       await createStandaloneApp(name, { ...opts, template: shape }, clack);
       return;
     }
+    if (shape === "community") {
+      const template = await promptCommunityTemplate(clack);
+      await createStandaloneApp(name, { ...opts, template }, clack);
+      return;
+    }
     // shape === "template" → full app(s) in a workspace.
     await createWorkspaceInteractive(name, opts, clack);
     return;
@@ -197,6 +208,7 @@ export async function createApp(
  * choice made here implies the project structure, so we deliberately avoid a
  * separate "workspace or standalone?" question:
  *   - "template" → full app(s) in a workspace (the multi-select picker)
+ *   - "community" → a single standalone app from a public GitHub repository
  *   - "chat"     → a single standalone chat UI app
  *   - "headless" → a single standalone action-first app with no UI shell
  * Chat and headless are standalone on purpose: a monorepo is unnecessary
@@ -205,13 +217,13 @@ export async function createApp(
  */
 async function promptStartShape(
   clack: typeof import("@clack/prompts"),
-): Promise<"template" | "chat" | "headless"> {
+): Promise<"template" | "chat" | "community" | "headless"> {
   const choice = await clack.select(startShapePromptOptions());
   if (clack.isCancel(choice)) {
     clack.cancel("Cancelled.");
     process.exit(0);
   }
-  return choice as "template" | "chat" | "headless";
+  return choice as "template" | "chat" | "community" | "headless";
 }
 
 function startShapePromptOptions() {
@@ -226,8 +238,13 @@ function startShapePromptOptions() {
       },
       {
         value: "template",
-        label: "Full template(s)",
-        hint: "Clone complete apps (Mail, Calendar, Slides, ...) into a workspace",
+        label: "First-party template(s)",
+        hint: "Clone official apps (Mail, Calendar, Slides, ...) into a workspace",
+      },
+      {
+        value: COMMUNITY_OPTION.name,
+        label: COMMUNITY_OPTION.label,
+        hint: COMMUNITY_OPTION.hint,
       },
       {
         value: "headless",
@@ -238,6 +255,70 @@ function startShapePromptOptions() {
   };
 }
 
+async function promptCommunityTemplate(
+  clack: typeof import("@clack/prompts"),
+): Promise<string> {
+  const selection = await clack.text({
+    message: "Which community template do you want to install?",
+    placeholder: "https://github.com/owner/repo[?app=id][#ref]",
+    validate(value) {
+      try {
+        parseCommunityPromptValue(String(value ?? ""));
+      } catch (error) {
+        return error instanceof Error ? error.message : String(error);
+      }
+    },
+  });
+  if (clack.isCancel(selection)) {
+    clack.cancel("Cancelled.");
+    process.exit(0);
+  }
+  return parseCommunityPromptValue(String(selection)).canonical;
+}
+
+interface CommunityWorkspaceAppOption {
+  name: string;
+  label: string;
+}
+
+async function promptCommunityWorkspaceApp(
+  apps: CommunityWorkspaceAppOption[],
+  clack: typeof import("@clack/prompts"),
+): Promise<string> {
+  const selection = await clack.select({
+    message: "Which app from this community workspace do you want to install?",
+    options: apps.map((app) => ({
+      value: app.name,
+      label: app.label,
+      hint: app.label === app.name ? undefined : app.name,
+    })),
+  });
+  if (clack.isCancel(selection)) {
+    clack.cancel("Cancelled.");
+    process.exit(0);
+  }
+  return String(selection);
+}
+
+function communityScaffoldOptions(
+  clack: typeof import("@clack/prompts"),
+  shape: "standalone" | "workspace",
+  destinationAppName: string,
+  targetWorkspaceCoreName?: string,
+): ScaffoldAppTemplateOptions {
+  return {
+    shape,
+    destinationAppName,
+    targetWorkspaceCoreName,
+    ...(process.stdin.isTTY && process.stdout.isTTY
+      ? {
+          selectCommunityWorkspaceApp: (apps: CommunityWorkspaceAppOption[]) =>
+            promptCommunityWorkspaceApp(apps, clack),
+        }
+      : {}),
+  };
+}
+
 /**
  * Validate a project name supplied on the command line. Mirrors the rule in
  * `promptNameIfMissing` so an invalid name is rejected before any interactive
@@ -304,6 +385,9 @@ async function createWorkspaceInteractive(
   }
 
   const s = clack.spinner();
+  for (const template of templates) {
+    showCommunityTemplateTrustNote(template, clack);
+  }
   s.start(`Scaffolding workspace "${name}"...`);
   const appNames = new Set<string>();
   const scaffoldedApps: string[] = [];
@@ -330,21 +414,39 @@ async function createWorkspaceInteractive(
       // GitHub fetch doesn't look like a frozen "Scaffolding..." message.
       // Mirrors the local-vs-remote decision inside scaffoldAppTemplate.
       const willDownload =
-        templateName !== "headless" && templateName.startsWith("github:")
-          ? true
-          : !findLocalTemplate(normalizeTemplateName(templateName));
+        templateName !== "headless" &&
+        (isCommunityTemplateSelection(templateName) ||
+          !findLocalTemplate(normalizeTemplateName(templateName)));
       s.message(
         willDownload
           ? `Downloading ${titleCase(appName)} template (${i + 1}/${templates.length})...`
           : `Scaffolding ${titleCase(appName)} (${i + 1}/${templates.length})...`,
       );
       const appDir = path.join(targetDir, "apps", appName);
-      await scaffoldAppTemplate(appDir, templateName);
+      const resolution = await scaffoldAppTemplate(
+        appDir,
+        templateName,
+        communityScaffoldOptions(
+          clack,
+          "workspace",
+          appName,
+          workspaceCoreName,
+        ),
+      );
       s.message(
         `Configuring ${titleCase(appName)} (${i + 1}/${templates.length})...`,
       );
       replacePlaceholders(appDir, appName, appTitleForScaffold(appName), name);
-      rewriteTrackingAppId(appDir, appName, templateName);
+      if (resolution.sourceIdentity) {
+        applyScaffoldIdentity(
+          appDir,
+          appName,
+          templateName,
+          resolution.sourceIdentity,
+        );
+      } else {
+        rewriteTrackingAppId(appDir, appName, templateName);
+      }
       workspacifyApp({
         appDir,
         appName,
@@ -355,8 +457,16 @@ async function createWorkspaceInteractive(
         dispatchDependencyVersion: getDispatchDependencyVersion(),
         toolkitDependencyVersion: getToolkitDependencyVersion(),
       });
-      fixPackageJsonName(appDir, appName, templateName);
-      fixWebManifestName(appDir, appName, templateName);
+      fixPackageJsonName(appDir, appName, templateName, {
+        ...resolution,
+        shape: "workspace",
+      });
+      fixWebManifestName(
+        appDir,
+        appName,
+        templateName,
+        resolution.sourceIdentity,
+      );
       rewriteNetlifyToml(appDir, appName, "workspace");
       renameGitignore(appDir);
       // Each app owns its own .claude / .agents symlinks.
@@ -432,9 +542,9 @@ async function createWorkspaceInteractive(
 
 function workspaceAppNameForTemplateSelection(templateName: string): string {
   const normalized = normalizeTemplateName(templateName);
-  if (!normalized.startsWith("github:")) return templateName;
-  const repo = normalized.slice("github:".length).trim();
-  const repoName = repo.split("/").filter(Boolean).pop() ?? "app";
+  const community = parseCommunityTemplateSelection(normalized, false);
+  if (!community) return templateName;
+  const repoName = community.app ?? community.repo.split("/").pop() ?? "app";
   let appName = repoName
     .toLowerCase()
     .replace(/[^a-z0-9-]+/g, "-")
@@ -636,19 +746,38 @@ async function scaffoldOneAppIntoWorkspace(
   }
 
   const s = clack.spinner();
+  showCommunityTemplateTrustNote(templateName, clack);
   s.start(
     `Working... no action needed. Scaffolding apps/${appName} from ${templateName}.`,
   );
 
   try {
-    const resolution = await scaffoldAppTemplate(appDir, templateName);
+    const resolution = await scaffoldAppTemplate(
+      appDir,
+      templateName,
+      communityScaffoldOptions(
+        clack,
+        "workspace",
+        appName,
+        workspace.workspaceCoreName,
+      ),
+    );
     replacePlaceholders(
       appDir,
       appName,
       appTitleForScaffold(appName),
       path.basename(workspace.workspaceRoot),
     );
-    rewriteTrackingAppId(appDir, appName, templateName);
+    if (resolution.sourceIdentity) {
+      applyScaffoldIdentity(
+        appDir,
+        appName,
+        templateName,
+        resolution.sourceIdentity,
+      );
+    } else {
+      rewriteTrackingAppId(appDir, appName, templateName);
+    }
     workspacifyApp({
       appDir,
       appName,
@@ -663,7 +792,12 @@ async function scaffoldOneAppIntoWorkspace(
       ...resolution,
       shape: "workspace",
     });
-    fixWebManifestName(appDir, appName, templateName);
+    fixWebManifestName(
+      appDir,
+      appName,
+      templateName,
+      resolution.sourceIdentity,
+    );
     rewriteNetlifyToml(appDir, appName, "workspace");
     renameGitignore(appDir);
     setupAgentSymlinks(appDir);
@@ -713,20 +847,7 @@ async function createStandaloneApp(
   if (!template) {
     const picked = await clack.select({
       message: "Which template would you like to use?",
-      options: [
-        {
-          value: HEADLESS_OPTION.name,
-          label: HEADLESS_OPTION.label,
-          hint: HEADLESS_OPTION.hint,
-        },
-        ...onRampFirst(coreTemplates())
-          .filter((t) => t.name !== HEADLESS_OPTION.name)
-          .map((t) => ({
-            value: t.name,
-            label: t.label,
-            hint: t.hint,
-          })),
-      ],
+      options: standaloneTemplatePromptOptions(),
     });
     if (clack.isCancel(picked)) {
       clack.cancel("Cancelled.");
@@ -735,15 +856,24 @@ async function createStandaloneApp(
     template = picked as string;
   }
   template = normalizeTemplateName(template);
+  if (template === COMMUNITY_OPTION.name) {
+    template = await promptCommunityTemplate(clack);
+  }
 
   const s = clack.spinner();
+  showCommunityTemplateTrustNote(template, clack);
   s.start(
     template === "headless"
       ? "Scaffolding the headless agent app..."
-      : `Downloading the ${template} template from GitHub...`,
+      : (communityTemplateDownloadMessage(template) ??
+          `Downloading the ${template} template from GitHub...`),
   );
   try {
-    const resolution = await scaffoldAppTemplate(targetDir, template);
+    const resolution = await scaffoldAppTemplate(
+      targetDir,
+      template,
+      communityScaffoldOptions(clack, "standalone", name),
+    );
     s.message(`Setting up ${name}…`);
     postProcessStandalone(name, targetDir, template, resolution);
     s.stop("App created!");
@@ -776,6 +906,28 @@ async function createStandaloneApp(
   }
 }
 
+function standaloneTemplatePromptOptions() {
+  return [
+    {
+      value: HEADLESS_OPTION.name,
+      label: HEADLESS_OPTION.label,
+      hint: HEADLESS_OPTION.hint,
+    },
+    ...onRampFirst(coreTemplates())
+      .filter((t) => t.name !== HEADLESS_OPTION.name)
+      .map((t) => ({
+        value: t.name,
+        label: t.label,
+        hint: t.hint,
+      })),
+    {
+      value: COMMUNITY_OPTION.name,
+      label: COMMUNITY_OPTION.label,
+      hint: COMMUNITY_OPTION.hint,
+    },
+  ];
+}
+
 /**
  * Remove a partially-scaffolded target directory after a scaffold failure so a
  * retry doesn't hit the "Directory already exists" guard. Best-effort — the
@@ -801,6 +953,26 @@ function cleanupOnFailure(targetDir: string): void {
 export interface ScaffoldTemplateResolution {
   templateRef?: string;
   templateSource?: "github" | "bundled" | "local-checkout";
+  sourceIdentity?: ScaffoldSourceIdentity;
+  communityTemplate?: {
+    source: string;
+    ref: string;
+    app?: string;
+  };
+}
+
+interface ScaffoldSourceIdentity {
+  appName: string;
+  appTitle: string;
+}
+
+interface ScaffoldAppTemplateOptions {
+  shape?: "standalone" | "workspace";
+  destinationAppName?: string;
+  targetWorkspaceCoreName?: string;
+  selectCommunityWorkspaceApp?: (
+    apps: CommunityWorkspaceAppOption[],
+  ) => Promise<string>;
 }
 
 export interface ScaffoldProvenance extends ScaffoldTemplateResolution {
@@ -810,13 +982,15 @@ export interface ScaffoldProvenance extends ScaffoldTemplateResolution {
 /**
  * Scaffold a single app template into `targetDir`. Resolves:
  *   - "headless" / legacy "blank" → bundled action-first template
- *   - "github:user/repo" → download the whole repo
+ *   - "community:user/repo[#ref]" → download and validate the whole repo
+ *   - legacy "github:user/repo[#ref]" and clean GitHub HTTPS URLs → community
  *   - first-party template name → use a bundled copy or download its subdir
  *     from BuilderIO/agent-native
  */
 async function scaffoldAppTemplate(
   targetDir: string,
   template: string,
+  options: ScaffoldAppTemplateOptions = {},
 ): Promise<ScaffoldTemplateResolution> {
   fs.mkdirSync(path.dirname(targetDir), { recursive: true });
 
@@ -838,15 +1012,55 @@ async function scaffoldAppTemplate(
     };
   }
 
-  if (resolved.startsWith("github:")) {
-    const repo = resolved.slice("github:".length);
-    await downloadGitHubRepo(repo, targetDir);
-    return {};
+  const community = parseCommunityTemplateSelection(resolved, false);
+  if (community) {
+    const stagingDir = path.join(
+      path.dirname(targetDir),
+      `.agent-native-community-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+    );
+    try {
+      const ref = await downloadGitHubRepo(
+        community.repo,
+        stagingDir,
+        community.ref,
+      );
+      const source = await resolveCommunityTemplateSource(
+        stagingDir,
+        community,
+        options,
+      );
+      copyDir(source.sourceDir, targetDir);
+      if (source.workspaceRoot) {
+        normalizeCommunityWorkspaceAppDependencies(
+          targetDir,
+          source.workspaceRoot,
+          {
+            shape: options.shape,
+            destinationAppName:
+              options.destinationAppName ?? path.basename(targetDir),
+            targetWorkspaceCoreName: options.targetWorkspaceCoreName,
+            sourceIdentity: source.sourceIdentity,
+          },
+        );
+      }
+      return {
+        templateSource: "github",
+        templateRef: ref,
+        sourceIdentity: source.sourceIdentity,
+        communityTemplate: {
+          source: `https://github.com/${community.repo}`,
+          ref,
+          ...(source.app ? { app: source.app } : {}),
+        },
+      };
+    } finally {
+      fs.rmSync(stagingDir, { recursive: true, force: true });
+    }
   }
 
   if (!getTemplate(resolved)) {
     throw new Error(
-      `Unknown template "${template}". Known: ${allTemplateNames().join(", ")} — or use github:user/repo for community templates.`,
+      `Unknown template "${template}". Known first-party templates: ${allTemplateNames().join(", ")}. For a community template, use community:owner/repo.`,
     );
   }
 
@@ -921,9 +1135,202 @@ function normalizeTemplateName(template: string): string {
   if (template === "image" || template === "images" || template === "asset") {
     return "assets";
   }
+  const community = parseCommunityTemplateSelection(template, false);
+  if (community) return community.canonical;
   return template;
 }
 
+interface CommunityTemplateSelection {
+  repo: string;
+  app?: string;
+  ref?: string;
+  canonical: string;
+}
+
+function parseCommunityTemplateSelection(
+  selection: string,
+): CommunityTemplateSelection;
+function parseCommunityTemplateSelection(
+  selection: string,
+  required: true,
+): CommunityTemplateSelection;
+function parseCommunityTemplateSelection(
+  selection: string,
+  required: false,
+): CommunityTemplateSelection | undefined;
+function parseCommunityTemplateSelection(
+  selection: string,
+  required = true,
+): CommunityTemplateSelection | undefined {
+  const value = selection.trim();
+  let raw: string | undefined;
+  if (value.startsWith("community:")) {
+    raw = value.slice("community:".length).trim();
+  } else if (value.startsWith("github:")) {
+    raw = value.slice("github:".length).trim();
+  } else if (value.startsWith("https://github.com/")) {
+    raw = value;
+  } else {
+    if (!required) return undefined;
+    throw new ValidationError(
+      `Invalid community template "${selection}". Use community:owner/repo, optionally with #branch, #tag, or #commit.`,
+    );
+  }
+
+  if (!raw) {
+    throw new ValidationError(
+      "A community template repository is required. Use owner/repo or a GitHub URL.",
+    );
+  }
+
+  let repo: string;
+  let app: string | undefined;
+  let ref: string | undefined;
+  if (raw.includes("://")) {
+    let url: URL;
+    try {
+      url = new URL(raw);
+    } catch {
+      throw new ValidationError(
+        `Invalid GitHub repository URL "${raw}". Expected https://github.com/owner/repo.`,
+      );
+    }
+    const parts = url.pathname.split("/").filter(Boolean);
+    if (
+      url.protocol !== "https:" ||
+      url.hostname !== "github.com" ||
+      url.port ||
+      url.username ||
+      url.password ||
+      parts.length !== 2
+    ) {
+      throw new ValidationError(
+        `Invalid GitHub repository URL "${raw}". Expected https://github.com/owner/repo with an optional #ref.`,
+      );
+    }
+    repo = `${parts[0]}/${parts[1]!.replace(/\.git$/, "")}`;
+    app = parseCommunityAppSearchParams(url.searchParams, raw);
+    if (url.hash.length > 1) {
+      try {
+        ref = decodeURIComponent(url.hash.slice(1));
+      } catch {
+        throw new ValidationError(`Invalid encoded Git ref in "${raw}".`);
+      }
+    }
+  } else {
+    const hash = raw.indexOf("#");
+    const beforeHash = hash === -1 ? raw : raw.slice(0, hash);
+    const query = beforeHash.indexOf("?");
+    repo = (query === -1 ? beforeHash : beforeHash.slice(0, query)).replace(
+      /\.git$/,
+      "",
+    );
+    if (query !== -1) {
+      app = parseCommunityAppSearchParams(
+        new URLSearchParams(beforeHash.slice(query + 1)),
+        raw,
+      );
+    }
+    ref = hash === -1 ? undefined : raw.slice(hash + 1);
+  }
+
+  validateRepoName(repo);
+  if (app !== undefined) validateCommunityAppSelector(app);
+  if (ref !== undefined) validateGitRef(ref);
+  return {
+    repo,
+    ...(app ? { app } : {}),
+    ...(ref ? { ref } : {}),
+    canonical: `community:${repo}${app ? `?app=${app}` : ""}${ref ? `#${ref}` : ""}`,
+  };
+}
+
+function parseCommunityAppSearchParams(
+  params: URLSearchParams,
+  source: string,
+): string | undefined {
+  const entries = [...params.entries()];
+  if (entries.length === 0) return undefined;
+  if (entries.length !== 1 || entries[0]?.[0] !== "app" || !entries[0][1]) {
+    throw new ValidationError(
+      `Invalid community template selector in "${source}". Only ?app=<app-name> is supported.`,
+    );
+  }
+  return entries[0][1];
+}
+
+function validateCommunityAppSelector(app: string): void {
+  if (app === "dispatch") {
+    throw new ValidationError(
+      "Dispatch cannot be installed from a community workspace.",
+    );
+  }
+  const error = getWorkspaceAppIdValidationError(app);
+  if (error) throw new ValidationError(error);
+}
+
+function isCommunityTemplateSelection(selection: string): boolean {
+  return parseCommunityTemplateSelection(selection, false) !== undefined;
+}
+
+function parseCommunityPromptValue(value: string): CommunityTemplateSelection {
+  const trimmed = value.trim();
+  const selection =
+    trimmed.startsWith("community:") ||
+    trimmed.startsWith("github:") ||
+    trimmed.startsWith("https://github.com/")
+      ? trimmed
+      : `community:${trimmed}`;
+  return parseCommunityTemplateSelection(selection);
+}
+
+function validateGitRef(ref: string): void {
+  if (
+    !ref ||
+    !/^[a-zA-Z0-9][a-zA-Z0-9._/+-]*$/.test(ref) ||
+    ref.includes("..") ||
+    ref.includes("//") ||
+    ref.includes("@{") ||
+    ref.endsWith("/") ||
+    ref.endsWith(".") ||
+    ref.split("/").some((part) => !part || part.endsWith(".lock"))
+  ) {
+    throw new ValidationError(
+      `Invalid Git ref "${ref}". Use a branch, tag, or commit SHA without spaces or Git ref control characters.`,
+    );
+  }
+}
+
+function communityTemplateTrustMessage(selection: string): string | undefined {
+  const community = parseCommunityTemplateSelection(selection, false);
+  if (!community) return undefined;
+  return [
+    `${community.repo} is third-party code and is not reviewed or maintained by Agent Native.`,
+    "The CLI downloads source only; it does not install dependencies or run template scripts.",
+    "Review the generated files before running pnpm install.",
+    community.ref
+      ? `Requested ref: ${community.ref}`
+      : "No ref supplied; the CLI will try main, then master.",
+  ].join("\n");
+}
+
+function communityTemplateDownloadMessage(
+  selection: string,
+): string | undefined {
+  const community = parseCommunityTemplateSelection(selection, false);
+  return community
+    ? `Downloading community template ${community.repo} from GitHub...`
+    : undefined;
+}
+
+function showCommunityTemplateTrustNote(
+  selection: string,
+  clack: typeof import("@clack/prompts"),
+): void {
+  const message = communityTemplateTrustMessage(selection);
+  if (message) clack.note(message, "Community template — review before use");
+}
+
 /**
  * Find a local packages/<name> directory (for framework development).
  * Returns undefined when running as a published npm package.
@@ -1091,13 +1498,17 @@ function postProcessStandalone(
 ): void {
   const appTitle = appTitleForScaffold(name);
   replacePlaceholders(targetDir, name, appTitle);
-  rewriteTrackingAppId(targetDir, name, templateName);
-  rewriteAgentChatAppId(targetDir, name, templateName);
+  applyScaffoldIdentity(
+    targetDir,
+    name,
+    templateName,
+    resolution?.sourceIdentity,
+  );
   fixPackageJsonName(targetDir, name, templateName, {
     ...resolution,
     shape: "standalone",
   });
-  fixWebManifestName(targetDir, name, templateName);
+  fixWebManifestName(targetDir, name, templateName, resolution?.sourceIdentity);
   rewriteNetlifyToml(targetDir, name, "standalone");
 
   for (const base of ["learnings"]) {
@@ -1443,6 +1854,16 @@ export {
   findLocalTemplateFrom as _findLocalTemplateFrom,
   workspaceAppNameForTemplateSelection as _workspaceAppNameForTemplateSelection,
   startShapePromptOptions as _startShapePromptOptions,
+  standaloneTemplatePromptOptions as _standaloneTemplatePromptOptions,
+  parseCommunityTemplateSelection as _parseCommunityTemplateSelection,
+  communityTemplateTrustMessage as _communityTemplateTrustMessage,
+  communityTemplateTarballUrl as _communityTemplateTarballUrl,
+  assertCommunityTemplateRoot as _assertCommunityTemplateRoot,
+  assertSafeCommunityArchiveListing as _assertSafeCommunityArchiveListing,
+  validateCommunityArchive as _validateCommunityArchive,
+  resolveCommunityTemplateSource as _resolveCommunityTemplateSource,
+  discoverCommunityWorkspaceApps as _discoverCommunityWorkspaceApps,
+  normalizeCommunityWorkspaceAppDependencies as _normalizeCommunityWorkspaceAppDependencies,
   shouldSkipScaffoldEntry as _shouldSkipScaffoldEntry,
   tarExtractArgs as _tarExtractArgs,
   downloadGitHubSubdir as _downloadGitHubSubdir,
@@ -1453,6 +1874,7 @@ export {
   replacePlaceholders as _replacePlaceholders,
   rewriteTrackingAppId as _rewriteTrackingAppId,
   rewriteAgentChatAppId as _rewriteAgentChatAppId,
+  applyScaffoldIdentity as _applyScaffoldIdentity,
   fixWebManifestName as _fixWebManifestName,
   copyDir as _copyDir,
   localTemplateSourceKind as _localTemplateSourceKind,
@@ -1465,7 +1887,11 @@ export {
  * ───────────────────────────────────────────────────────────────────────── */
 
 function validateRepoName(repo: string): void {
-  if (!/^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/.test(repo)) {
+  const parts = repo.split("/");
+  if (
+    !/^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/.test(repo) ||
+    parts.some((part) => part === "." || part === "..")
+  ) {
     throw new ValidationError(
       `Invalid repository name "${repo}". Expected format: user/repo`,
     );
@@ -1475,7 +1901,10 @@ function validateRepoName(repo: string): void {
 function tarExtractArgs(
   tarPath: string,
   destDir: string,
-  options: { skipAgentSymlinks?: boolean } = {},
+  options: {
+    skipAgentSymlinks?: boolean;
+    untrustedCommunityArchive?: boolean;
+  } = {},
 ): string[] {
   const excludes = options.skipAgentSymlinks
     ? FIRST_PARTY_TARBALL_SYMLINK_EXCLUDES.flatMap((pattern) => [
@@ -1483,7 +1912,18 @@ function tarExtractArgs(
         pattern,
       ])
     : [];
-  return ["xzf", tarPath, "--strip-components=1", ...excludes, "-C", destDir];
+  const safeOwnership = options.untrustedCommunityArchive
+    ? ["--no-same-owner", "--no-same-permissions"]
+    : [];
+  return [
+    "xzf",
+    tarPath,
+    "--strip-components=1",
+    ...safeOwnership,
+    ...excludes,
+    "-C",
+    destDir,
+  ];
 }
 
 function execFileBuffer(
@@ -1512,7 +1952,10 @@ function execFileBuffer(
 async function downloadAndExtract(
   url: string,
   destDir: string,
-  options: { skipAgentSymlinks?: boolean } = {},
+  options: {
+    skipAgentSymlinks?: boolean;
+    untrustedCommunityArchive?: boolean;
+  } = {},
 ): Promise<void> {
   fs.mkdirSync(destDir, { recursive: true });
   // --fail-with-body so curl exits non-zero on HTTP 4xx/5xx instead of writing
@@ -1536,6 +1979,9 @@ async function downloadAndExtract(
   const tarPath = path.join(destDir, ".download.tar.gz");
   fs.writeFileSync(tarPath, tarball);
   try {
+    if (options.untrustedCommunityArchive) {
+      validateCommunityArchive(tarPath);
+    }
     execFileSync("tar", tarExtractArgs(tarPath, destDir, options), {
       stdio: "pipe",
     });
@@ -1544,6 +1990,48 @@ async function downloadAndExtract(
   }
 }
 
+function validateCommunityArchive(tarPath: string): void {
+  const listing = execFileSync("tar", ["tvzf", tarPath], {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+  assertSafeCommunityArchiveListing(listing);
+}
+
+function assertSafeCommunityArchiveListing(listing: string): void {
+  const unsafeEntry = listing.split(/\r?\n/).find((line) => {
+    if (line.startsWith("h")) return true;
+    if (!line.startsWith("l")) return false;
+    return !isCanonicalAgentSymlinkListing(line);
+  });
+  if (unsafeEntry) {
+    throw new ValidationError(
+      "Community template archives may only contain Agent Native's canonical internal symlinks (CLAUDE.md and .claude/skills). Remove other symbolic or hard links and try again.",
+    );
+  }
+}
+
+function isCanonicalAgentSymlinkListing(line: string): boolean {
+  const match = line.match(/\s(\S+)\s+->\s+(\S+)\s*$/);
+  if (!match) return false;
+  const archivePath = match[1]!;
+  const target = match[2]!;
+  const parts = archivePath.split("/");
+  if (
+    parts.some(
+      (part) => !part || part === "." || part === ".." || part.includes("\\"),
+    )
+  ) {
+    return false;
+  }
+  return (
+    (parts.at(-1) === "CLAUDE.md" && target === "AGENTS.md") ||
+    (parts.at(-2) === ".claude" &&
+      parts.at(-1) === "skills" &&
+      target === "../.agents/skills")
+  );
+}
+
 /** Resolves to the ref that actually succeeded so callers can record it. */
 async function downloadGitHubSubdir(
   repo: string,
@@ -1596,10 +2084,480 @@ async function downloadGitHubSubdir(
 async function downloadGitHubRepo(
   repo: string,
   targetDir: string,
-): Promise<void> {
+  requestedRef?: string,
+): Promise<string> {
   validateRepoName(repo);
-  const tarUrl = githubTarballUrl(repo, "main", "branch");
-  await downloadAndExtract(tarUrl, targetDir);
+  const refs = requestedRef ? [requestedRef] : ["main", "master"];
+  const errors: string[] = [];
+  for (const ref of refs) {
+    try {
+      await downloadAndExtract(
+        communityTemplateTarballUrl(repo, ref),
+        targetDir,
+        { untrustedCommunityArchive: true },
+      );
+      return ref;
+    } catch (error) {
+      errors.push(
+        `  ${ref}: ${error instanceof Error ? error.message.split("\n")[0] : String(error)}`,
+      );
+      cleanupOnFailure(targetDir);
+    }
+  }
+  throw new Error(
+    `Failed to download community template ${repo}. Tried refs:\n${errors.join("\n")}\nThe repository must be public, and the requested branch, tag, or commit must exist.`,
+  );
+}
+
+function communityTemplateTarballUrl(repo: string, ref: string): string {
+  return `https://codeload.github.com/${repo}/tar.gz/${encodeURIComponent(ref)}`;
+}
+
+function assertCommunityTemplateRoot(targetDir: string, repo: string): void {
+  const packagePath = path.join(targetDir, "package.json");
+  if (!fs.existsSync(packagePath)) {
+    throw new ValidationError(
+      `Community template ${repo} is not an Agent Native app at the repository root: package.json was not found. Point to a repository whose root is the app.`,
+    );
+  }
+
+  let pkg: Record<string, unknown>;
+  try {
+    pkg = JSON.parse(fs.readFileSync(packagePath, "utf-8"));
+  } catch {
+    throw new ValidationError(
+      `Community template ${repo} has an unreadable package.json at the repository root.`,
+    );
+  }
+  const dependencyGroups = [
+    pkg.dependencies,
+    pkg.devDependencies,
+    pkg.peerDependencies,
+  ];
+  const usesAgentNativeCore = dependencyGroups.some(
+    (group) =>
+      group !== null &&
+      typeof group === "object" &&
+      !Array.isArray(group) &&
+      typeof (group as Record<string, unknown>)["@agent-native/core"] ===
+        "string",
+  );
+  if (!usesAgentNativeCore) {
+    throw new ValidationError(
+      `Community template ${repo} is not an Agent Native app at the repository root. Its package.json must directly depend on @agent-native/core in dependencies, devDependencies, or peerDependencies.`,
+    );
+  }
+}
+
+interface ResolvedCommunityTemplateSource {
+  sourceDir: string;
+  sourceIdentity: ScaffoldSourceIdentity;
+  app?: string;
+  workspaceRoot?: string;
+}
+
+async function resolveCommunityTemplateSource(
+  stagingDir: string,
+  selection: CommunityTemplateSelection,
+  options: ScaffoldAppTemplateOptions = {},
+): Promise<ResolvedCommunityTemplateSource> {
+  const rootPkg = readPackageJsonObject(path.join(stagingDir, "package.json"));
+  const agentNative =
+    rootPkg?.["agent-native"] &&
+    typeof rootPkg["agent-native"] === "object" &&
+    !Array.isArray(rootPkg["agent-native"])
+      ? (rootPkg["agent-native"] as Record<string, unknown>)
+      : undefined;
+  const hasWorkspaceCoreMarker =
+    agentNative && Object.hasOwn(agentNative, "workspaceCore");
+  const workspaceCore = agentNative?.workspaceCore;
+  if (
+    hasWorkspaceCoreMarker &&
+    (typeof workspaceCore !== "string" || !workspaceCore.trim())
+  ) {
+    throw new ValidationError(
+      `Community repository ${selection.repo} has invalid agent-native.workspaceCore metadata. Expected a non-empty workspace package name.`,
+    );
+  }
+  const isWorkspace = typeof workspaceCore === "string";
+
+  if (!isWorkspace) {
+    assertCommunityTemplateRoot(stagingDir, selection.repo);
+    const sourceIdentity = readCommunitySourceIdentity(
+      stagingDir,
+      selection.repo,
+    );
+    if (selection.app) {
+      throw new ValidationError(
+        `Community repository ${selection.repo} is a single app at its root. Remove ?app=${selection.app}; app selectors are only for workspace repositories.`,
+      );
+    }
+    return { sourceDir: stagingDir, sourceIdentity };
+  }
+
+  const workspaceApps = discoverCommunityWorkspaceApps(stagingDir);
+  if (workspaceApps.length === 0) {
+    throw new ValidationError(
+      `Community workspace ${selection.repo} has no installable apps. Dispatch cannot be installed from a community workspace, and apps must directly depend on @agent-native/core.`,
+    );
+  }
+
+  let selectedApp = selection.app;
+  if (!selectedApp) {
+    if (!options.selectCommunityWorkspaceApp) {
+      throw new ValidationError(
+        `Community workspace ${selection.repo} requires an app selection, but no interactive terminal is available. Select one with ?app=<app-name>. Available apps: ${workspaceApps.map((app) => app.name).join(", ")}.`,
+      );
+    } else {
+      selectedApp = await options.selectCommunityWorkspaceApp(
+        workspaceApps.map(({ name, label }) => ({ name, label })),
+      );
+      validateCommunityAppSelector(selectedApp);
+    }
+  }
+  const selected = workspaceApps.find((app) => app.name === selectedApp);
+  if (!selected) {
+    throw new ValidationError(
+      `App "${selectedApp}" was not found in community workspace ${selection.repo}. Available apps: ${workspaceApps.map((app) => app.name).join(", ")}.`,
+    );
+  }
+  return {
+    sourceDir: selected.dir,
+    sourceIdentity: selected.sourceIdentity,
+    app: selected.name,
+    workspaceRoot: stagingDir,
+  };
+}
+
+interface DiscoveredCommunityWorkspaceApp extends CommunityWorkspaceAppOption {
+  dir: string;
+  sourceIdentity: ScaffoldSourceIdentity;
+}
+
+function discoverCommunityWorkspaceApps(
+  workspaceRoot: string,
+): DiscoveredCommunityWorkspaceApp[] {
+  const appsDir = path.join(workspaceRoot, "apps");
+  if (!fs.existsSync(appsDir)) return [];
+  return fs
+    .readdirSync(appsDir, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .flatMap((entry): DiscoveredCommunityWorkspaceApp[] => {
+      const appDir = path.join(appsDir, entry.name);
+      const packagePath = path.join(appDir, "package.json");
+      if (!fs.existsSync(packagePath)) return [];
+      const pkg = readPackageJsonObject(packagePath);
+      if (!pkg) {
+        throw new ValidationError(
+          `Community workspace app "${entry.name}" has an unreadable package.json.`,
+        );
+      }
+      if (getWorkspaceAppIdValidationError(entry.name)) return [];
+      if (!packageDirectlyDependsOnAgentNativeCore(pkg)) return [];
+      const sourceIdentity = readCommunitySourceIdentity(
+        appDir,
+        `${path.basename(workspaceRoot)}/${entry.name}`,
+      );
+      const packageName =
+        sourceIdentity.appName.split("/").pop() ?? sourceIdentity.appName;
+      if (packageName === "dispatch") return [];
+      return [
+        {
+          name: entry.name,
+          label: sourceIdentity.appTitle,
+          dir: appDir,
+          sourceIdentity,
+        },
+      ];
+    })
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+function readPackageJsonObject(
+  packagePath: string,
+): Record<string, unknown> | undefined {
+  try {
+    const value = JSON.parse(fs.readFileSync(packagePath, "utf-8"));
+    return value && typeof value === "object" && !Array.isArray(value)
+      ? value
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function packageDirectlyDependsOnAgentNativeCore(
+  pkg: Record<string, unknown>,
+): boolean {
+  return [pkg.dependencies, pkg.devDependencies, pkg.peerDependencies].some(
+    (group) =>
+      group !== null &&
+      typeof group === "object" &&
+      !Array.isArray(group) &&
+      typeof (group as Record<string, unknown>)["@agent-native/core"] ===
+        "string",
+  );
+}
+
+function normalizeCommunityWorkspaceAppDependencies(
+  appDir: string,
+  sourceWorkspaceRoot: string,
+  options: {
+    shape?: "standalone" | "workspace";
+    destinationAppName: string;
+    targetWorkspaceCoreName?: string;
+    sourceIdentity: ScaffoldSourceIdentity;
+  },
+): void {
+  const appPackagePath = path.join(appDir, "package.json");
+  const pkg = readPackageJsonObject(appPackagePath);
+  if (!pkg) {
+    throw new ValidationError(
+      "Selected community workspace app has an unreadable package.json.",
+    );
+  }
+  const rootPkg = readPackageJsonObject(
+    path.join(sourceWorkspaceRoot, "package.json"),
+  );
+  const agentNative =
+    rootPkg?.["agent-native"] &&
+    typeof rootPkg["agent-native"] === "object" &&
+    !Array.isArray(rootPkg["agent-native"])
+      ? (rootPkg["agent-native"] as Record<string, unknown>)
+      : undefined;
+  const sourceWorkspaceCore =
+    typeof agentNative?.workspaceCore === "string"
+      ? agentNative.workspaceCore
+      : undefined;
+  const catalog = loadCommunityWorkspaceCatalog(sourceWorkspaceRoot);
+  const supportedWorkspacePackages = new Set([
+    "@agent-native/core",
+    "@agent-native/dispatch",
+    "@agent-native/toolkit",
+  ]);
+
+  for (const depType of [
+    "dependencies",
+    "devDependencies",
+    "peerDependencies",
+  ] as const) {
+    const deps = pkg[depType];
+    if (!deps || typeof deps !== "object" || Array.isArray(deps)) continue;
+    for (const [key, value] of Object.entries(
+      deps as Record<string, unknown>,
+    )) {
+      if (key === sourceWorkspaceCore) {
+        delete (deps as Record<string, unknown>)[key];
+        continue;
+      }
+      if (value === "catalog:") {
+        const resolved = catalog[key];
+        if (!resolved) {
+          throw new ValidationError(
+            `Community workspace app dependency "${key}" uses catalog:, but no value was found in the source pnpm-workspace.yaml catalog.`,
+          );
+        }
+        (deps as Record<string, unknown>)[key] = resolved;
+        continue;
+      }
+      if (typeof value === "string" && value.startsWith("catalog:")) {
+        throw new ValidationError(
+          `Community workspace app dependency "${key}" uses unsupported named catalog reference "${value}". Use a concrete version or the default catalog.`,
+        );
+      }
+      if (
+        typeof value === "string" &&
+        value.startsWith("workspace:") &&
+        supportedWorkspacePackages.has(key)
+      ) {
+        (deps as Record<string, unknown>)[key] =
+          key === "@agent-native/core"
+            ? getCoreDependencyVersion()
+            : key === "@agent-native/dispatch"
+              ? getDispatchDependencyVersion()
+              : getToolkitDependencyVersion();
+        continue;
+      }
+      if (typeof value === "string" && value.startsWith("workspace:")) {
+        throw new ValidationError(
+          `Community workspace app dependency "${key}" uses "${value}", but that source workspace package is not included when installing one app. Publish it with a concrete version or remove the dependency.`,
+        );
+      }
+    }
+  }
+  fs.writeFileSync(appPackagePath, JSON.stringify(pkg, null, 2) + "\n");
+  if (sourceWorkspaceCore) {
+    rewriteCanonicalCommunityWorkspacePlugins(
+      appDir,
+      sourceWorkspaceCore,
+      options,
+    );
+  }
+  if (
+    sourceWorkspaceCore &&
+    findSourceImportSpecifier(appDir, sourceWorkspaceCore)
+  ) {
+    throw new ValidationError(
+      `Community workspace app imports its source shared package "${sourceWorkspaceCore}", which is not included when installing one app. Move that code into the app or publish it as a concrete dependency.`,
+    );
+  }
+}
+
+function rewriteCanonicalCommunityWorkspacePlugins(
+  appDir: string,
+  sourceWorkspaceCore: string,
+  options: {
+    shape?: "standalone" | "workspace";
+    destinationAppName: string;
+    targetWorkspaceCoreName?: string;
+    sourceIdentity: ScaffoldSourceIdentity;
+  },
+): void {
+  const authPath = path.join(appDir, "server", "plugins", "auth.ts");
+  const agentChatPath = path.join(appDir, "server", "plugins", "agent-chat.ts");
+  if (options.shape === "standalone") {
+    if (fs.existsSync(authPath)) {
+      const auth = fs.readFileSync(authPath, "utf-8");
+      if (
+        containsModuleSpecifier(auth, sourceWorkspaceCore) &&
+        auth.includes("defaultAuthPlugin") &&
+        auth.includes("workspaceServer")
+      ) {
+        fs.writeFileSync(
+          authPath,
+          'export { defaultAuthPlugin as default } from "@agent-native/core/server";\n',
+        );
+      }
+    }
+    if (fs.existsSync(agentChatPath)) {
+      const agentChat = fs.readFileSync(agentChatPath, "utf-8");
+      if (
+        containsModuleSpecifier(agentChat, sourceWorkspaceCore) &&
+        agentChat.includes("createWorkspaceAgentChatPlugin") &&
+        agentChat.includes("actionsRegistry")
+      ) {
+        fs.writeFileSync(
+          agentChatPath,
+          [
+            'import { createAgentChatPlugin, loadActionsFromStaticRegistry } from "@agent-native/core/server";',
+            'import actionsRegistry from "../../.generated/actions-registry.js";',
+            "",
+            "export default createAgentChatPlugin({",
+            `  appId: ${JSON.stringify(options.destinationAppName)},`,
+            "  actions: loadActionsFromStaticRegistry(actionsRegistry),",
+            "});",
+            "",
+          ].join("\n"),
+        );
+      }
+    }
+    return;
+  }
+
+  if (options.shape === "workspace" && options.targetWorkspaceCoreName) {
+    for (const pluginPath of [authPath, agentChatPath]) {
+      if (!fs.existsSync(pluginPath)) continue;
+      const content = fs.readFileSync(pluginPath, "utf-8");
+      const next = replaceModuleSpecifierPrefix(
+        content,
+        sourceWorkspaceCore,
+        options.targetWorkspaceCoreName,
+      );
+      if (next !== content) fs.writeFileSync(pluginPath, next);
+    }
+  }
+}
+
+function containsModuleSpecifier(content: string, moduleName: string): boolean {
+  return new RegExp(`(["'])${escapeRegExp(moduleName)}(?:/[^"']*)?\\1`).test(
+    content,
+  );
+}
+
+function replaceModuleSpecifierPrefix(
+  content: string,
+  sourceModule: string,
+  targetModule: string,
+): string {
+  return content.replace(
+    new RegExp(`(["'])${escapeRegExp(sourceModule)}((?:/[^"']*)?)\\1`, "g"),
+    (_match, quote: string, suffix: string) =>
+      `${quote}${targetModule}${suffix}${quote}`,
+  );
+}
+
+function findSourceImportSpecifier(
+  dir: string,
+  moduleName: string,
+): string | undefined {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isSymbolicLink()) continue;
+    const filePath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      const nested = findSourceImportSpecifier(filePath, moduleName);
+      if (nested) return nested;
+      continue;
+    }
+    if (!/\.(?:[cm]?[jt]sx?)$/.test(entry.name)) continue;
+    try {
+      const content = fs.readFileSync(filePath, "utf-8");
+      const escaped = escapeRegExp(moduleName);
+      if (
+        new RegExp(
+          `(?:from\\s*|import\\s*\\(\\s*|import\\s*|require\\s*\\(\\s*)(["'])${escaped}(?:/[^"']*)?\\1`,
+        ).test(content)
+      ) {
+        return filePath;
+      }
+    } catch {
+      // Ignore unreadable source files; package validation reports main issues.
+    }
+  }
+  return undefined;
+}
+
+function loadCommunityWorkspaceCatalog(
+  workspaceRoot: string,
+): Record<string, string> {
+  const workspacePath = path.join(workspaceRoot, "pnpm-workspace.yaml");
+  if (!fs.existsSync(workspacePath)) return {};
+  const result: Record<string, string> = {};
+  let inCatalog = false;
+  for (const line of fs.readFileSync(workspacePath, "utf-8").split("\n")) {
+    if (/^catalog:\s*$/.test(line)) {
+      inCatalog = true;
+      continue;
+    }
+    if (!inCatalog) continue;
+    if (/^\S/.test(line)) break;
+    const match = line.match(/^\s+"?([^":]+)"?\s*:\s*"?([^"]+)"?\s*$/);
+    if (match) result[match[1]!] = match[2]!;
+  }
+  return result;
+}
+
+function readCommunitySourceIdentity(
+  targetDir: string,
+  repo: string,
+): ScaffoldSourceIdentity {
+  const fallbackName = repo.split("/").pop() ?? "app";
+  try {
+    const pkg = JSON.parse(
+      fs.readFileSync(path.join(targetDir, "package.json"), "utf-8"),
+    );
+    const appName =
+      typeof pkg.name === "string" && pkg.name.trim()
+        ? pkg.name.trim()
+        : fallbackName;
+    const unscopedName = appName.split("/").pop() ?? appName;
+    const appTitle =
+      typeof pkg.displayName === "string" && pkg.displayName.trim()
+        ? pkg.displayName.trim()
+        : titleCase(unscopedName);
+    return { appName, appTitle };
+  } catch {
+    return { appName: fallbackName, appTitle: titleCase(fallbackName) };
+  }
 }
 
 function githubTarballUrl(
@@ -1730,6 +2688,9 @@ function isChatOnRampTemplate(templateName: string | undefined): boolean {
 function trackingTemplateName(
   templateName: string | undefined,
 ): string | undefined {
+  if (templateName && isCommunityTemplateSelection(templateName)) {
+    return undefined;
+  }
   return templateName === "starter" ? "chat" : templateName;
 }
 
@@ -1767,28 +2728,44 @@ function fixPackageJsonName(
       (isChatOnRampTemplate(templateName) && name !== templateName)
     ) {
       pkg.description = defaultPackageDescriptionForScaffold(name);
+    } else if (
+      provenance?.sourceIdentity &&
+      typeof pkg.description === "string"
+    ) {
+      pkg.description = replaceSourceIdentityText(
+        pkg.description,
+        provenance.sourceIdentity,
+        name,
+        appTitle,
+      );
     }
     const scaffoldGuidance = scaffoldGuidanceForTemplate(templateName);
-    if (scaffoldGuidance) {
+    if (scaffoldGuidance || provenance?.communityTemplate) {
       const agentNative =
         pkg["agent-native"] &&
         typeof pkg["agent-native"] === "object" &&
         !Array.isArray(pkg["agent-native"])
           ? pkg["agent-native"]
           : {};
-      const coreVersion = getCorePackageVersion();
-      agentNative.scaffold = {
-        template: trackingTemplateName(templateName),
-        frameworkSkills: scaffoldGuidance,
-        ...(provenance?.templateRef
-          ? { templateRef: provenance.templateRef }
-          : {}),
-        ...(provenance?.templateSource
-          ? { templateSource: provenance.templateSource }
-          : {}),
-        ...(coreVersion ? { coreVersion } : {}),
-        ...(provenance?.shape ? { shape: provenance.shape } : {}),
-      };
+      if (scaffoldGuidance) {
+        const coreVersion = getCorePackageVersion();
+        agentNative.scaffold = {
+          template: trackingTemplateName(templateName),
+          frameworkSkills: scaffoldGuidance,
+          ...(provenance?.templateRef
+            ? { templateRef: provenance.templateRef }
+            : {}),
+          ...(provenance?.templateSource
+            ? { templateSource: provenance.templateSource }
+            : {}),
+          ...(coreVersion ? { coreVersion } : {}),
+          ...(provenance?.shape ? { shape: provenance.shape } : {}),
+        };
+      }
+      if (provenance?.communityTemplate) {
+        delete agentNative.scaffold;
+        agentNative.communityTemplate = provenance.communityTemplate;
+      }
       pkg["agent-native"] = agentNative;
     }
     fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
@@ -1808,8 +2785,14 @@ function fixWebManifestName(
   appDir: string,
   name: string,
   templateName?: string,
+  sourceIdentity?: ScaffoldSourceIdentity,
 ): void {
-  if (!isChatOnRampTemplate(templateName) || name === templateName) return;
+  if (
+    (!isChatOnRampTemplate(templateName) || name === templateName) &&
+    !sourceIdentity
+  ) {
+    return;
+  }
   const manifestPath = path.join(appDir, "public", "manifest.json");
   if (!fs.existsSync(manifestPath)) return;
   try {
@@ -1817,7 +2800,14 @@ function fixWebManifestName(
     const appTitle = titleCase(name);
     manifest.name = appTitle;
     manifest.short_name = appTitle;
-    if (
+    if (sourceIdentity && typeof manifest.description === "string") {
+      manifest.description = replaceSourceIdentityText(
+        manifest.description,
+        sourceIdentity,
+        name,
+        appTitle,
+      );
+    } else if (
       typeof manifest.description !== "string" ||
       /\b(blank app|starter|chat-first)\b/i.test(manifest.description)
     ) {
@@ -1827,6 +2817,27 @@ function fixWebManifestName(
   } catch {}
 }
 
+function replaceSourceIdentityText(
+  value: string,
+  sourceIdentity: ScaffoldSourceIdentity,
+  appName: string,
+  appTitle: string,
+): string {
+  const unscopedSourceName =
+    sourceIdentity.appName.split("/").pop() ?? sourceIdentity.appName;
+  const replacements = new Map<string, string>([
+    [sourceIdentity.appTitle, appTitle],
+    [sourceIdentity.appName, appName],
+    [unscopedSourceName, appName],
+  ]);
+  const sourceValues = [...replacements.keys()]
+    .filter(Boolean)
+    .sort((a, b) => b.length - a.length);
+  if (sourceValues.length === 0) return value;
+  const pattern = new RegExp(sourceValues.map(escapeRegExp).join("|"), "g");
+  return value.replace(pattern, (match) => replacements.get(match) ?? match);
+}
+
 function getCoreDependencyVersion(): string {
   if (process.env.AGENT_NATIVE_CREATE_USE_LOCAL_CORE === "1") {
     const localCore = findLocalPackage("core");
@@ -2158,16 +3169,43 @@ function rewriteNetlifyToml(
   } catch {}
 }
 
+function applyScaffoldIdentity(
+  appDir: string,
+  appName: string,
+  templateName?: string,
+  sourceIdentity?: ScaffoldSourceIdentity,
+): void {
+  rewriteTrackingAppId(appDir, appName, templateName, sourceIdentity);
+  rewriteAgentChatAppId(appDir, appName, templateName, sourceIdentity);
+  rewriteAppConfigIdentity(appDir, appName, sourceIdentity);
+}
+
 function rewriteAgentChatAppId(
   appDir: string,
   appName: string,
   templateName?: string,
+  sourceIdentity?: ScaffoldSourceIdentity,
 ): void {
   const pluginPath = path.join(appDir, "server", "plugins", "agent-chat.ts");
   if (!fs.existsSync(pluginPath)) return;
 
   try {
     const content = fs.readFileSync(pluginPath, "utf-8");
+    if (sourceIdentity) {
+      const next = content
+        .replace(
+          /(createAgentChatPlugin\(\{[\s\S]*?\bappId:\s*)(["'])[^"']+\2/,
+          (_match, prefix: string, quote: string) =>
+            `${prefix}${quote}${appName}${quote}`,
+        )
+        .replace(
+          /(const\s+options\s*=\s*\{[\s\S]*?\bappId:\s*)(["'])[^"']+\2/,
+          (_match, prefix: string, quote: string) =>
+            `${prefix}${quote}${appName}${quote}`,
+        );
+      if (next !== content) fs.writeFileSync(pluginPath, next);
+      return;
+    }
     const sourceAppIds = ["chat", "starter"];
     if (templateName && templateName !== appName) {
       sourceAppIds.push(templateName);
@@ -2192,6 +3230,7 @@ function rewriteTrackingAppId(
   appDir: string,
   appName: string,
   templateName?: string,
+  sourceIdentity?: ScaffoldSourceIdentity,
 ): void {
   const rootPath = path.join(appDir, "app", "root.tsx");
   if (!fs.existsSync(rootPath)) return;
@@ -2199,6 +3238,15 @@ function rewriteTrackingAppId(
   try {
     const content = fs.readFileSync(rootPath, "utf-8");
     const trackedTemplateName = trackingTemplateName(templateName);
+    if (sourceIdentity) {
+      const next = content.replace(
+        /(configureTracking\(\{[\s\S]*?\bapp:\s*)(["'])[^"']+\2/,
+        (_match, prefix: string, quote: string) =>
+          `${prefix}${quote}${appName}${quote}`,
+      );
+      if (next !== content) fs.writeFileSync(rootPath, next);
+      return;
+    }
     const sourceAppIds = ["agent-native-[^\"']+", "\\{\\{APP_NAME\\}\\}"];
     if (templateName && templateName !== appName) {
       sourceAppIds.push(escapeRegExp(templateName));
@@ -2236,6 +3284,32 @@ function rewriteTrackingAppId(
   } catch {}
 }
 
+function rewriteAppConfigIdentity(
+  appDir: string,
+  appName: string,
+  sourceIdentity?: ScaffoldSourceIdentity,
+): void {
+  if (!sourceIdentity) return;
+  const configPath = path.join(appDir, "app", "lib", "app-config.ts");
+  if (!fs.existsSync(configPath)) return;
+  try {
+    const content = fs.readFileSync(configPath, "utf-8");
+    const appTitle = appTitleForScaffold(appName);
+    const next = content
+      .replace(
+        /(const\s+rawAppName\s*=\s*)(["'])[^"']*\2/,
+        (_match, prefix: string, quote: string) =>
+          `${prefix}${quote}${appName}${quote}`,
+      )
+      .replace(
+        /(const\s+rawAppTitle\s*=\s*)(["'])[^"']*\2/,
+        (_match, prefix: string, quote: string) =>
+          `${prefix}${quote}${appTitle}${quote}`,
+      );
+    if (next !== content) fs.writeFileSync(configPath, next);
+  } catch {}
+}
+
 function escapeRegExp(value: string): string {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }