@agent-native/core 0.130.2 → 0.131.3

package/dist/server/agent-chat/framework-prompts.js

@@ -22,7 +22,7 @@ import { lazyFs } from "./lazy-fs.js";
 export function buildFrameworkPrompts(examples, options) {
     const FRAMEWORK_CORE = buildFrameworkCore(examples, options);
     const FRAMEWORK_CORE_COMPACT = buildFrameworkCoreCompact(examples, options);
-    const extensionToolsEnabled = options?.extensionTools !== false;
+    const extensionToolsEnabled = options?.extensionTools === true;
     const planModeArtifactList = extensionToolsEnabled
         ? "source-code handoffs and app-created artifacts such as extensions, widgets, dashboards, calculators, mini-apps, documents, designs, slides, or videos"
         : "source-code handoffs and app-created artifacts such as documents, designs, slides, or videos";
@@ -30,38 +30,34 @@ export function buildFrameworkPrompts(examples, options) {
         ? "`render-inline-extension`, `create-extension`, `update-extension`, `connect-builder`, or any action that creates, updates, deletes, sends, publishes, or persists data"
         : "`connect-builder`, or any action that creates, updates, deletes, sends, publishes, or persists data";
     const extensionConnectBuilderGuard = extensionToolsEnabled
-        ? "If the complete request can be satisfied by a self-contained extension or an existing named slot, use `render-inline-extension`, `create-extension`, `show-extension-inline`, or `update-extension` instead. If the exact placement or behavior requires changing the host UI or no suitable slot exists, continue with the normal `connect-builder` source-change flow even if the user called it an extension; never stop at saying extensions cannot do it."
-        : "Because extension tools are disabled, do NOT invent an extension workflow. Only use `connect-builder` when the request genuinely requires changing the host app's source code.";
+        ? "Prefer native app artifacts and actions. Use an extension only when the user explicitly requests one, or when the result is clearly bespoke and one-off and the native format cannot express it. Reusable or product-wide behavior belongs in app code. If the exact placement or behavior requires changing the host UI or no suitable slot exists, continue with the normal `connect-builder` source-change flow even if the user called it an extension; never stop at saying extensions cannot do it."
+        : "";
     const extensionInstructionsFull = extensionToolsEnabled
         ? `### Generative UI and Extensions (Mini-Apps)
 
 In Act mode, if the user asks for generated interactive UI in chat, choose the smallest extension action for the lifetime: \`render-inline-extension\` (one-off, chat-only), \`create-extension\` (saved/reusable), \`show-extension-inline\` (reopen a saved one), or \`update-extension\` (edit an existing one) — call the right one directly, without a "let me build…" preamble. Each tool's own description covers its exact use case, arguments, and available helpers (appAction, dbQuery, extensionData, agentNative.ui.output, etc.). Extensions are sandboxed mini-apps, not source-code changes, and never go through \`connect-builder\`.
 
-If the app exposes native actions or instructions for dashboards, reports, analyses, charts, documents, decks, or other domain artifacts, use those app-native actions first. Choose an extension only when the user explicitly asks for an extension/custom mini-app, or when the app's native artifact format cannot faithfully express the requested interaction.
+If the app exposes native actions or instructions for dashboards, reports, analyses, charts, documents, decks, or other domain artifacts, use those app-native actions first. Choose an extension only when the user explicitly asks for an extension/custom mini-app, or when the result is clearly bespoke and one-off and the app's native artifact format cannot faithfully express the requested interaction. Reusable or product-wide behavior belongs in app code.
 
 Editing an existing extension (fix, restyle, rename, add behavior) is a SQL data update — call \`update-extension\` directly using the extensionId from \`<current-screen>\`/\`<current-url>\` when present; never call \`connect-builder\` for it.
 
 Extensions render only on their own page or inside an existing named slot; they cannot inject UI into arbitrary native components. If an extension could only approximate the request in a different location, do not silently downgrade the requirement and do not end with "extensions cannot do that." Briefly explain the boundary, then follow the normal source-code handoff so the app can still be customized fully.
 
 For helper APIs, Alpine.js patterns, the extension-vs-code-change boundary, and worked examples, read the \`extensions\` and \`generative-ui\` skills.`
-        : `### Extensions Disabled
-
-Extension creation and management tools are disabled for this app. Do not claim you can create, edit, hide, or delete Agent-Native extensions unless the template exposes its own typed action for that workflow. For requests that would otherwise be handled as an extension/widget/dashboard/calculator mini-app, explain that this app has disabled extension tools and use the app's available actions instead.`;
+        : "";
     const extensionInstructionsCompact = extensionToolsEnabled
         ? `### Generative UI and Extensions (Mini-Apps)
 
 In Act mode, choose the smallest extension action for the lifetime: \`render-inline-extension\` (one-off, chat-only), \`create-extension\` (saved/reusable), \`show-extension-inline\` (reopen a saved one), or \`update-extension\` (edit an existing one) — each tool's own description covers its use case and helpers. These are sandboxed mini-apps, not code changes; never route them through \`connect-builder\`. Do not preface with "let me build…" — just call the right extension action.
 
-Use app-native artifact actions first when they exist for dashboards, reports, analyses, charts, documents, decks, or similar domain artifacts. Pick \`create-extension\` only for explicit extension/custom mini-app requests or for behavior the native artifact format cannot support.
+Use app-native artifact actions first when they exist for dashboards, reports, analyses, charts, documents, decks, or similar domain artifacts. Pick \`create-extension\` only for explicit extension/custom mini-app requests, or when the result is clearly bespoke and one-off and the native artifact format cannot support it. Reusable or product-wide behavior belongs in app code.
 
 Editing an existing extension is a data update — call \`update-extension\` directly using the extensionId from \`<current-screen>\`/\`<current-url>\` when present; never \`connect-builder\`.
 
 Extensions can render only on their own page or in an existing named slot; they cannot inject UI into arbitrary native components. If the exact request changes host chrome, native components, layout, styles, routes, business logic, or needs placement where no slot exists, treat it as a source-code change and use the normal \`connect-builder\` flow even if the user called it an extension. Never stop at "extensions cannot do that" or silently offer a different placement; explain the boundary briefly and continue the code-change handoff.
 
 See the \`extensions\` and \`generative-ui\` skills for helper APIs, Alpine.js patterns, and worked examples.`
-        : `### Extensions Disabled
-
-Extension creation and management tools are disabled for this app. Do not claim you can create, edit, hide, or delete Agent-Native extensions unless the template exposes its own typed action for that workflow.`;
+        : "";
     const PROD_FRAMEWORK_PROMPT = `## Agent-Native Framework — Production Mode
 
 You are an AI agent in an agent-native application, running in **production mode**.

package/dist/server/agent-chat/framework-prompts.js.map

@@ -1 +1 @@
-{"version":3,"file":"framework-prompts.js","sourceRoot":"","sources":["../../../src/server/agent-chat/framework-prompts.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AAIjC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAyB,EACzB,OAA2E;IAS3E,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5E,MAAM,qBAAqB,GAAG,OAAO,EAAE,cAAc,KAAK,KAAK,CAAC;IAChE,MAAM,oBAAoB,GAAG,qBAAqB;QAChD,CAAC,CAAC,uJAAuJ;QACzJ,CAAC,CAAC,8FAA8F,CAAC;IACnG,MAAM,oBAAoB,GAAG,qBAAqB;QAChD,CAAC,CAAC,wKAAwK;QAC1K,CAAC,CAAC,qGAAqG,CAAC;IAC1G,MAAM,4BAA4B,GAAG,qBAAqB;QACxD,CAAC,CAAC,gcAAgc;QAClc,CAAC,CAAC,gLAAgL,CAAC;IACrL,MAAM,yBAAyB,GAAG,qBAAqB;QACrD,CAAC,CAAC;;;;;;;;;;uJAUiJ;QACnJ,CAAC,CAAC;;qZAE+Y,CAAC;IACpZ,MAAM,4BAA4B,GAAG,qBAAqB;QACxD,CAAC,CAAC;;;;;;;;;;8GAUwG;QAC1G,CAAC,CAAC;;kNAE4M,CAAC;IAEjN,MAAM,qBAAqB,GAAG;;;;;;;;;;0FAU0D,oBAAoB,kHAAkH,oBAAoB;;EAElP,yBAAyB;;;;EAIzB,4BAA4B;;;;;;;;;;;EAW5B,cAAc,EAAE,CAAC;IAEjB,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB7B,cAAc,EAAE,CAAC;IAEjB,MAAM,6BAA6B,GAAG;;;;;;;;;;6EAUqC,oBAAoB,8CAA8C,oBAAoB;;EAEjK,4BAA4B;;;;;EAK5B,sBAAsB,EAAE,CAAC;IAEzB,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;EAerC,sBAAsB,EAAE,CAAC;IAEzB,OAAO;QACL,cAAc;QACd,sBAAsB;QACtB,qBAAqB;QACrB,oBAAoB;QACpB,6BAA6B;QAC7B,4BAA4B;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,EAAE;IACpD,yEAAyE;IACzE,MAAM,EACJ,cAAc,EAAE,aAAa,EAC7B,sBAAsB,EAAE,oBAAoB,GAC7C,GAAG,qBAAqB,EAAE,CAAC;IAC5B,OAAO;QACL,aAAa;QACb,oBAAoB;QACpB,wBAAwB,EAAE,0BAA0B;QACpD,qBAAqB;QACrB,qBAAqB;QACrB,uBAAuB;QACvB,6BAA6B;KAC9B,CAAC;AACJ,CAAC,CAAC,EAAE,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,aAAa,GAAwB,MAAM;IAE3C,IAAI,CAAC;QACH,OAAO,MAAM,qBAAqB,CAAC;YACjC,KAAK;YACL,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;YAChC,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAqC,EACrC,IAAI,GAAmB,MAAM,EAC7B,gBAA2B;IAE3B,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/D,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,aAAa,GAAG,YAAY;QAChC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC,CAAC,gBAAgB,CAAC;IACrB,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;IAC1E,MAAM,gBAAgB,GAAG,CAAC,KAAkB,EAAE,EAAE,CAC9C,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACvD,CAAC,CAAC,0BAA0B,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK;QACtD,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,WAAW,GAAG,aAAa;aAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;aACjE,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,OAAO,IAAI,8BAA8B,KAAK,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,KAAK,CAC7E,CAAC;QAEJ,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CACX,gJAAgJ,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzK,CAAC;QACJ,CAAC;QACD,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CACX,GAAG,kBAAkB,0BAA0B,kBAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,sHAAsH,CAChN,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAErC,OAAO,+BAA+B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC;QACjD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QAEtE,4EAA4E;QAC5E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,mBAAmB,IAAI,QAAQ,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,8DAA8D;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACxB,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAI,CAAuB,CAAC,IAAI,IAAI,KAAK,CAAC;YACpD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC;YAChC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,cAAc,GAAG,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxE,MAAM,YAAY,GAChB,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,OAAO,GAAG,QAAQ,IAAI,IAAI,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,OAAO;;;;;;EAMP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG;IACxB,sBAAsB;IACtB,mBAAmB;IACnB,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;IACtB,UAAU;CACF,CAAC;AAEX,MAAM,UAAU,6BAA6B,CAC3C,QAAqC;IAErC,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAAqC;IAErC,MAAM,cAAc,GAAG,sBAAsB,IAAI,QAAQ,CAAC;IAC1D,MAAM,oBAAoB,GAAG,qBAAqB,IAAI,QAAQ,CAAC;IAC/D,MAAM,sBAAsB,GAAG;QAC7B,sBAAsB,IAAI,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI;QACpE,mBAAmB,IAAI,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI;KAC/D,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,UAAU,GAAG,UAAU,IAAI,QAAQ,CAAC;IAC1C,MAAM,gBAAgB,GAAG,sBAAsB,IAAI,QAAQ,CAAC;IAC5D,IACE,CAAC,cAAc;QACf,CAAC,oBAAoB;QACrB,CAAC,UAAU;QACX,CAAC,gBAAgB;QAEjB,OAAO,EAAE,CAAC;IAEZ,MAAM,SAAS,GAAG;QAChB,GAAG,sBAAsB;QACzB,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI;QAChD,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI;QACrD,gBAAgB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI;QAClD,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KACjC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElB,OAAO;;kCAEyB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;6wBAMutB,CAAC;AAC9wB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,MAAc,EACd,KAAa,EACb,OAAuE;IAEvE,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;QACnB,cAAc;QACd,MAAM;QACN,OAAO;QACP,SAAS;QACT,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IACH,IAAI,OAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1B,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACjE,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;SAChC,CAAC,CAAC;QACH,IAAI,KAAK;YACP,MAAM,YAAY,CAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAC9B,OAAO,EACP,KAAK,GAAG,CAAC,EACT,OAAO,CACR,CAAC;IACN,CAAC;AACH,CAAC","sourcesContent":["import nodePath from \"node:path\";\n\nimport type { ActionEntry } from \"../../agent/production-agent.js\";\nimport type { DatabaseToolsOption } from \"../../scripts/db/tool-mode.js\";\nimport {\n  buildFrameworkCore,\n  buildFrameworkCoreCompact,\n  type PromptExamples,\n} from \"../prompts/index.js\";\nimport { getRequestOrgId } from \"../request-context.js\";\nimport { loadSchemaPromptBlock } from \"../schema-prompt.js\";\nimport { resolveInitialToolNames } from \"./action-filters-a2a.js\";\nimport {\n  createDataWidgetActionEntries,\n  FRAMEWORK_CONTEXT_SECTIONS,\n} from \"./context-tools.js\";\nimport { lazyFs } from \"./lazy-fs.js\";\n\n// ---------------------------------------------------------------------------\n// Framework-level system prompt assembly (production/dev, full/compact),\n// the \"Available Actions\" and corpus-tools prompt sections, the SQL schema\n// block, and the codebase file-tree walker used by a few dev-mode tools.\n// ---------------------------------------------------------------------------\n\n/**\n * Framework-level instructions injected into every agent's system prompt.\n * Prompt text lives in packages/core/src/server/prompts/ so this file stays\n * focused on routing and assembly logic.\n *\n * buildFrameworkPrompts() is called once per plugin instantiation (not per\n * request) with the template's promptExamples, producing the four assembled\n * prompt strings used at request time.\n */\nexport function buildFrameworkPrompts(\n  examples?: PromptExamples,\n  options?: { databaseTools?: DatabaseToolsOption; extensionTools?: boolean },\n): {\n  FRAMEWORK_CORE: string;\n  FRAMEWORK_CORE_COMPACT: string;\n  PROD_FRAMEWORK_PROMPT: string;\n  DEV_FRAMEWORK_PROMPT: string;\n  PROD_FRAMEWORK_PROMPT_COMPACT: string;\n  DEV_FRAMEWORK_PROMPT_COMPACT: string;\n} {\n  const FRAMEWORK_CORE = buildFrameworkCore(examples, options);\n  const FRAMEWORK_CORE_COMPACT = buildFrameworkCoreCompact(examples, options);\n  const extensionToolsEnabled = options?.extensionTools !== false;\n  const planModeArtifactList = extensionToolsEnabled\n    ? \"source-code handoffs and app-created artifacts such as extensions, widgets, dashboards, calculators, mini-apps, documents, designs, slides, or videos\"\n    : \"source-code handoffs and app-created artifacts such as documents, designs, slides, or videos\";\n  const planModeBlockedTools = extensionToolsEnabled\n    ? \"`render-inline-extension`, `create-extension`, `update-extension`, `connect-builder`, or any action that creates, updates, deletes, sends, publishes, or persists data\"\n    : \"`connect-builder`, or any action that creates, updates, deletes, sends, publishes, or persists data\";\n  const extensionConnectBuilderGuard = extensionToolsEnabled\n    ? \"If the complete request can be satisfied by a self-contained extension or an existing named slot, use `render-inline-extension`, `create-extension`, `show-extension-inline`, or `update-extension` instead. If the exact placement or behavior requires changing the host UI or no suitable slot exists, continue with the normal `connect-builder` source-change flow even if the user called it an extension; never stop at saying extensions cannot do it.\"\n    : \"Because extension tools are disabled, do NOT invent an extension workflow. Only use `connect-builder` when the request genuinely requires changing the host app's source code.\";\n  const extensionInstructionsFull = extensionToolsEnabled\n    ? `### Generative UI and Extensions (Mini-Apps)\n\nIn Act mode, if the user asks for generated interactive UI in chat, choose the smallest extension action for the lifetime: \\`render-inline-extension\\` (one-off, chat-only), \\`create-extension\\` (saved/reusable), \\`show-extension-inline\\` (reopen a saved one), or \\`update-extension\\` (edit an existing one) — call the right one directly, without a \"let me build…\" preamble. Each tool's own description covers its exact use case, arguments, and available helpers (appAction, dbQuery, extensionData, agentNative.ui.output, etc.). Extensions are sandboxed mini-apps, not source-code changes, and never go through \\`connect-builder\\`.\n\nIf the app exposes native actions or instructions for dashboards, reports, analyses, charts, documents, decks, or other domain artifacts, use those app-native actions first. Choose an extension only when the user explicitly asks for an extension/custom mini-app, or when the app's native artifact format cannot faithfully express the requested interaction.\n\nEditing an existing extension (fix, restyle, rename, add behavior) is a SQL data update — call \\`update-extension\\` directly using the extensionId from \\`<current-screen>\\`/\\`<current-url>\\` when present; never call \\`connect-builder\\` for it.\n\nExtensions render only on their own page or inside an existing named slot; they cannot inject UI into arbitrary native components. If an extension could only approximate the request in a different location, do not silently downgrade the requirement and do not end with \"extensions cannot do that.\" Briefly explain the boundary, then follow the normal source-code handoff so the app can still be customized fully.\n\nFor helper APIs, Alpine.js patterns, the extension-vs-code-change boundary, and worked examples, read the \\`extensions\\` and \\`generative-ui\\` skills.`\n    : `### Extensions Disabled\n\nExtension creation and management tools are disabled for this app. Do not claim you can create, edit, hide, or delete Agent-Native extensions unless the template exposes its own typed action for that workflow. For requests that would otherwise be handled as an extension/widget/dashboard/calculator mini-app, explain that this app has disabled extension tools and use the app's available actions instead.`;\n  const extensionInstructionsCompact = extensionToolsEnabled\n    ? `### Generative UI and Extensions (Mini-Apps)\n\nIn Act mode, choose the smallest extension action for the lifetime: \\`render-inline-extension\\` (one-off, chat-only), \\`create-extension\\` (saved/reusable), \\`show-extension-inline\\` (reopen a saved one), or \\`update-extension\\` (edit an existing one) — each tool's own description covers its use case and helpers. These are sandboxed mini-apps, not code changes; never route them through \\`connect-builder\\`. Do not preface with \"let me build…\" — just call the right extension action.\n\nUse app-native artifact actions first when they exist for dashboards, reports, analyses, charts, documents, decks, or similar domain artifacts. Pick \\`create-extension\\` only for explicit extension/custom mini-app requests or for behavior the native artifact format cannot support.\n\nEditing an existing extension is a data update — call \\`update-extension\\` directly using the extensionId from \\`<current-screen>\\`/\\`<current-url>\\` when present; never \\`connect-builder\\`.\n\nExtensions can render only on their own page or in an existing named slot; they cannot inject UI into arbitrary native components. If the exact request changes host chrome, native components, layout, styles, routes, business logic, or needs placement where no slot exists, treat it as a source-code change and use the normal \\`connect-builder\\` flow even if the user called it an extension. Never stop at \"extensions cannot do that\" or silently offer a different placement; explain the boundary briefly and continue the code-change handoff.\n\nSee the \\`extensions\\` and \\`generative-ui\\` skills for helper APIs, Alpine.js patterns, and worked examples.`\n    : `### Extensions Disabled\n\nExtension creation and management tools are disabled for this app. Do not claim you can create, edit, hide, or delete Agent-Native extensions unless the template exposes its own typed action for that workflow.`;\n\n  const PROD_FRAMEWORK_PROMPT = `## Agent-Native Framework — Production Mode\n\nYou are an AI agent in an agent-native application, running in **production mode**.\n\nThe agent and the UI are equal partners — everything the UI can do, you can do via your tools, and vice versa. They share the same SQL database and stay in sync automatically.\n\n**In production mode, you operate through registered actions exposed as tools.** These are your capabilities — use them to read data, take actions, and help the user. You cannot edit source code or access the filesystem directly. Your tools are the app's API.\n\n### Plan Mode\n\nIf the current turn is in Plan mode, plan before anything gets written. This applies to ${planModeArtifactList}. Use only read-only tools, clarify the goal when needed, and return a concrete plan for approval. Do not call ${planModeBlockedTools} until the user switches back to Act mode.\n\n${extensionInstructionsFull}\n\n### Code Changes — Hand Off With \\`connect-builder\\`\n\n${extensionConnectBuilderGuard}\n\nIn Act mode, a request that needs source-file edits — the UI chrome, a component, a route, styles, a hook, an integration, or a bug in the app itself — is a handoff, not a task you plan. Builder plans and edits in its own sandbox, so the exploration, file-mapping, and code all happen there rather than here.\n\nKeep the whole turn to three beats:\n\n1. One short clause acknowledging what they asked for in their own terms (\"Got it — wider subject lines in the email list.\"), skipped entirely when they already know you're handing off. No generic preamble, no promised outcomes.\n2. The \\`connect-builder\\` call, with the user's request verbatim as \\`prompt\\`.\n3. One sentence framing the next click around what they asked for rather than pitching Builder. Read \\`builderEnabled\\` from the result first; the tool's own description defines what each value lets you claim and offer.\n\nNothing else belongs in that turn: no code exploration, no implementation plan, no \\`resources\\` write of a spec, and no sub-agents (they have no code-editing tools either). You don't need filesystem access to hand off, so don't reach for it or list tools you lack.\n${FRAMEWORK_CORE}`;\n\n  const DEV_FRAMEWORK_PROMPT = `## Agent-Native Framework — Development Mode\n\nYou are an AI agent in an agent-native application, running in **development mode**.\n\nThe agent and the UI are equal partners — everything the UI can do, you can do via tools/scripts, and vice versa. They share the same SQL database and stay in sync automatically.\n\n**In development mode, you have full local access — use it with senior-engineer judgment** (read before you edit, keep changes scoped, verify before you claim done):\n- Run any shell command via the \\`bash\\` tool (node, curl, pnpm, rg, git, etc.), including arbitrary code\n- Read and write any file on the filesystem; edit source, install packages, modify the app\n- Query and modify the database\n- Call external APIs (via bash with curl, or via scripts)\n\nWhen no dedicated tool/action exists for what you need, reach for \\`bash\\`.\n\n**Template-specific actions are invoked via bash, NOT as direct tools.** In dev mode, the only tools registered as native tool calls are framework-level utilities (bash, read, edit, write, database, resources, chat, teams, jobs). Anything from the template's \\`actions/\\` directory must be run through bash: \\`bash({ command: 'pnpm action <name> --arg value' })\\`. The \"Available Actions\" section below shows the exact CLI syntax for each one — copy that command verbatim and pass it to \\`bash\\`. Do not try to call template actions by name as if they were tools; they will not appear in your tool list.\n\nWhen editing code, follow the agent-native architecture:\n- Every feature needs all four areas: UI + scripts + skills/instructions + application-state sync\n- All SQL must be dialect-agnostic (works on SQLite and Postgres)\n- No Node.js-specific APIs in server routes (must work on Cloudflare Workers, etc.)\n- Use shadcn/ui components and Tabler Icons for all UI work\n${FRAMEWORK_CORE}`;\n\n  const PROD_FRAMEWORK_PROMPT_COMPACT = `## Agent-Native Framework — Production Mode\n\nYou are an AI agent in an agent-native application, running in **production mode**.\n\nThe agent and the UI are equal partners — everything the UI can do, you can do via your tools, and vice versa. They share the same SQL database and stay in sync automatically.\n\n**In production mode, you operate through registered actions exposed as tools.** These are your capabilities — use them to read data, take actions, and help the user. You cannot edit source code or access the filesystem directly. Your tools are the app's API.\n\n### Plan Mode\n\nIf the turn is in Plan mode, plan before anything gets written — including ${planModeArtifactList}. Use read-only tools only and do not call ${planModeBlockedTools} until the user switches back to Act mode.\n\n${extensionInstructionsCompact}\n\n### Code Changes — Hand Off With \\`connect-builder\\`\n\nIn Act mode, a request that genuinely needs a source-code edit (per the rules above) is a handoff, not a task you plan. Keep the turn to three beats: (1) one short clause acknowledging their specific ask in their own terms, no preamble; (2) the \\`connect-builder\\` call with their request verbatim as \\`prompt\\`; (3) one sentence framing the next click around what they asked for, not a Builder pitch — read \\`builderEnabled\\` from the result first, and let the tool's own description tell you what each value lets you claim. Nothing else belongs in that turn: no code, no file lists, no plans, no sub-agents.\n${FRAMEWORK_CORE_COMPACT}`;\n\n  const DEV_FRAMEWORK_PROMPT_COMPACT = `## Agent-Native Framework — Development Mode\n\nYou are an AI agent in an agent-native application, running in **development mode**.\n\nThe agent and the UI are equal partners — everything the UI can do, you can do via tools/scripts, and vice versa. They share the same SQL database and stay in sync automatically.\n\n**In development mode, you have full local access** — shell, filesystem, database, external APIs, source edits, and package installs. Use it with senior-engineer judgment: read before you edit, keep changes scoped, verify before you claim done.\n\n**Template-specific actions are invoked via bash, NOT as direct tools.** Run them with: \\`bash({ command: 'pnpm action <name> --arg value' })\\`. See the \"Available Actions\" section below for CLI syntax.\n\nWhen editing code, follow the agent-native architecture:\n- Every feature needs all four areas: UI + scripts + skills/instructions + application-state sync\n- All SQL must be dialect-agnostic (works on SQLite and Postgres)\n- No Node.js-specific APIs in server routes (must work on Cloudflare Workers, etc.)\n- Use shadcn/ui components and Tabler Icons for all UI work\n${FRAMEWORK_CORE_COMPACT}`;\n\n  return {\n    FRAMEWORK_CORE,\n    FRAMEWORK_CORE_COMPACT,\n    PROD_FRAMEWORK_PROMPT,\n    DEV_FRAMEWORK_PROMPT,\n    PROD_FRAMEWORK_PROMPT_COMPACT,\n    DEV_FRAMEWORK_PROMPT_COMPACT,\n  };\n}\n\nexport const _agentChatPromptSectionsForTests = (() => {\n  // Built with default (no template-specific) examples for test stability.\n  const {\n    FRAMEWORK_CORE: frameworkCore,\n    FRAMEWORK_CORE_COMPACT: frameworkCoreCompact,\n  } = buildFrameworkPrompts();\n  return {\n    frameworkCore,\n    frameworkCoreCompact,\n    frameworkContextSections: FRAMEWORK_CONTEXT_SECTIONS,\n    buildFrameworkPrompts,\n    generateActionsPrompt,\n    resolveInitialToolNames,\n    createDataWidgetActionEntries,\n  };\n})();\n\n/**\n * Build the per-request SQL-schema context block. Reads AGENT_ORG_ID live\n * from the environment so scheduler/A2A/HTTP call sites all see whatever\n * org was just resolved for this request.\n */\nexport async function buildSchemaBlock(\n  owner: string,\n  databaseTools: DatabaseToolsOption = \"read\",\n): Promise<string> {\n  try {\n    return await loadSchemaPromptBlock({\n      owner,\n      orgId: getRequestOrgId() ?? null,\n      databaseTools,\n    });\n  } catch {\n    return \"\";\n  }\n}\n\n/**\n * Generates a system prompt section describing registered template actions.\n *\n * Two output modes:\n *\n *   - `\"tool\"` — used in production, where template actions are registered\n *     as native Anthropic tools. The native tool schema already carries each\n *     action's name, full description, and parameters, so this mode does NOT\n *     re-list every action — it only surfaces what the tool list can't:\n *     native-chat-widget annotations and a `tool-search` pointer for actions\n *     omitted from the initial tool set.\n *   - `\"cli\"` — used in dev, where template actions are NOT registered as\n *     native tools and must be invoked via `bash(command=\"pnpm action ...\")`.\n *     This listing is load-bearing here (there is no tool schema to fall\n *     back on), so it still emits the full\n *     `pnpm action name --arg <type> [--opt <type>] — desc` line per action.\n */\nexport function generateActionsPrompt(\n  registry: Record<string, ActionEntry>,\n  mode: \"cli\" | \"tool\" = \"tool\",\n  initialToolNames?: string[],\n): string {\n  if (!registry || Object.keys(registry).length === 0) return \"\";\n\n  const allActionEntries = Object.entries(registry);\n  const initialNames = initialToolNames ? new Set(initialToolNames) : undefined;\n  const actionEntries = initialNames\n    ? allActionEntries.filter(([name]) => initialNames.has(name))\n    : allActionEntries;\n  const omittedActionCount = allActionEntries.length - actionEntries.length;\n  const nativeWidgetNote = (entry: ActionEntry) =>\n    entry.chatUI && typeof entry.chatUI.renderer === \"string\"\n      ? ` Native chat widget: \\`${entry.chatUI.renderer}\\`.`\n      : \"\";\n\n  if (mode === \"tool\") {\n    // Native tool schemas already carry name + full description + params\n    // for every action, so this section only needs to surface what the tool\n    // list itself can't: which actions render a native chat widget, and\n    // which actions exist but aren't loaded as initial tools yet.\n    const widgetLines = actionEntries\n      .filter(([, entry]) => typeof entry.chatUI?.renderer === \"string\")\n      .map(\n        ([name, entry]) =>\n          `- \\`${name}\\` — Native chat widget: \\`${entry.chatUI?.renderer ?? \"\"}\\`.`,\n      );\n\n    const sections: string[] = [];\n    if (widgetLines.length > 0) {\n      sections.push(\n        `**Actions that render a native chat widget** — call these directly for their table/chart/insights view instead of recreating it in prose:\\n\\n${widgetLines.join(\"\\n\")}`,\n      );\n    }\n    if (omittedActionCount > 0) {\n      sections.push(\n        `${omittedActionCount} less-common app action${omittedActionCount === 1 ? \" is\" : \"s are\"} available on demand. Use \\`tool-search\\` with a specific capability query to load the matching schemas when needed.`,\n      );\n    }\n    if (sections.length === 0) return \"\";\n\n    return `\\n\\n## Available Actions\\n\\n${sections.join(\"\\n\\n\")}`;\n  }\n\n  const lines = actionEntries.map(([name, entry]) => {\n    const desc = entry.tool.description;\n    const params = entry.tool.parameters?.properties;\n    const requiredFields = new Set(entry.tool.parameters?.required ?? []);\n\n    // CLI mode: emit `pnpm action <name> --required <type> [--optional <type>]`\n    if (!params || Object.keys(params).length === 0) {\n      return `- \\`pnpm action ${name}\\` — ${desc}${nativeWidgetNote(entry)}`;\n    }\n    const entries = Object.entries(params);\n    // Required first (alphabetical), then optional (alphabetical)\n    entries.sort(([a], [b]) => {\n      const ar = requiredFields.has(a) ? 0 : 1;\n      const br = requiredFields.has(b) ? 0 : 1;\n      if (ar !== br) return ar - br;\n      return a.localeCompare(b);\n    });\n    const required: string[] = [];\n    const optional: string[] = [];\n    const requiredNames: string[] = [];\n    for (const [k, v] of entries) {\n      const type = (v as { type?: string }).type ?? \"any\";\n      const flag = `--${k} <${type}>`;\n      if (requiredFields.has(k)) {\n        required.push(flag);\n        requiredNames.push(`--${k}`);\n      } else {\n        optional.push(`[${flag}]`);\n      }\n    }\n    const cmd = [\"pnpm action \" + name, ...required, ...optional].join(\" \");\n    const requiredNote =\n      requiredNames.length > 0 ? ` Required: ${requiredNames.join(\", \")}.` : \"\";\n    return `- \\`${cmd}\\` — ${desc}.${requiredNote}${nativeWidgetNote(entry)}`;\n  });\n\n  return `\\n\\n## Available Actions\n\n**These template actions are NOT exposed as direct tools in dev mode. To run any of them, use the \\`bash\\` tool with the exact command shown below.** Example: \\`bash(command=\"pnpm action add-slide --deckId abc --content 'Hello'\")\\`.\n\nDo NOT try to call these by name as if they were tools — they will not exist in your tool list. Always go through \\`bash\\`.\n\n${lines.join(\"\\n\")}`;\n}\n\n/**\n * Tool names `generateCorpusToolsPrompt` teaches BY NAME, in the same order\n * it lists them. Exported so callers that build a request's initial\n * engine-tool set can fold in exactly the subset present in a given\n * registry — keeping \"what the prompt just told the model exists\" and\n * \"what tools are actually callable on the first request\" in sync. See the\n * corpus-prompt/initial-tools note at this function's call site in\n * agent-chat-plugin.ts.\n */\nconst CORPUS_TOOL_NAMES = [\n  \"provider-api-catalog\",\n  \"provider-api-docs\",\n  \"provider-api-request\",\n  \"provider-corpus-job\",\n  \"query-staged-dataset\",\n  \"run-code\",\n] as const;\n\nexport function corpusToolNamesTaughtByPrompt(\n  registry: Record<string, ActionEntry>,\n): string[] {\n  return CORPUS_TOOL_NAMES.filter((name) => name in registry);\n}\n\nexport function generateCorpusToolsPrompt(\n  registry: Record<string, ActionEntry>,\n): string {\n  const hasProviderApi = \"provider-api-request\" in registry;\n  const hasProviderCorpusJob = \"provider-corpus-job\" in registry;\n  const providerDiscoveryTools = [\n    \"provider-api-catalog\" in registry ? \"`provider-api-catalog`\" : null,\n    \"provider-api-docs\" in registry ? \"`provider-api-docs`\" : null,\n  ].filter(Boolean);\n  const hasRunCode = \"run-code\" in registry;\n  const hasStagedDataset = \"query-staged-dataset\" in registry;\n  if (\n    !hasProviderApi &&\n    !hasProviderCorpusJob &&\n    !hasRunCode &&\n    !hasStagedDataset\n  )\n    return \"\";\n\n  const available = [\n    ...providerDiscoveryTools,\n    hasProviderApi ? \"`provider-api-request`\" : null,\n    hasProviderCorpusJob ? \"`provider-corpus-job`\" : null,\n    hasStagedDataset ? \"`query-staged-dataset`\" : null,\n    hasRunCode ? \"`run-code`\" : null,\n  ].filter(Boolean);\n\n  return `\\n\\n## Broad Provider And Corpus Workflows\n\nAvailable corpus-capable tools: ${available.join(\", \")}.\n\nThis workflow does not apply to ordinary structured lookups, bounded aggregates, or counts grouped over one known source. For those requests, use the single most directly authoritative source, run one bounded query, and answer as soon as it succeeds. Do not cross-check or expand into a corpus workflow unless the user asks for multiple sources, exhaustive unstructured-record coverage, or an absence claim.\n\nFor broad provider searches, raw API access, multi-page cohorts, cross-source joins, classification over unstructured records, or absence-sensitive answers, do not stop at a bounded shortcut action. Use the provider's broad API/search/list surface, fetch every relevant page or an explicit bounded cohort, stage/save large responses when needed, and reduce the corpus with durable corpus jobs, staged-dataset queries, or code execution.\n\nWhen \\`provider-corpus-job\\` is available, prefer it for transcript/message/ticket/issue/document scans that may exceed one turn, need provider-side backoff, or need a defensible \"not found\" conclusion. Use operation=\"start\" with mode=\"paginated-search\" for any paginated provider endpoint, or mode=\"batch-search\" when a prior cohort of ids/records must feed a second provider endpoint. Continue paused jobs with operation=\"continue\" until status is completed or quota_wait, then read operation=\"results\". In run-code, prefer providerFetchAll() for short cursor/page/offset pagination and providerRequest() when response status, headers, or truncation metadata matters. Report source, filters, row counts, pagination/truncation, failed pages, quota_wait times, and remaining gaps.`;\n}\n\n/**\n * Walks the local filesystem (dev mode only) to build a bounded file/folder\n * tree, used by a couple of dev-mode workspace-inspection tools.\n */\nexport async function collectFiles(\n  dir: string,\n  prefix: string,\n  depth: number,\n  results: Array<{ path: string; name: string; type: \"file\" | \"folder\" }>,\n): Promise<void> {\n  if (depth > 4 || results.length >= 500) return;\n  const skip = new Set([\n    \"node_modules\",\n    \".git\",\n    \".next\",\n    \".output\",\n    \"dist\",\n    \".cache\",\n    \".turbo\",\n    \"data\",\n  ]);\n  let entries: import(\"fs\").Dirent[];\n  try {\n    const fs = await lazyFs();\n    entries = fs.readdirSync(dir, { withFileTypes: true });\n  } catch {\n    return;\n  }\n  for (const entry of entries) {\n    if (results.length >= 500) return;\n    if (skip.has(entry.name) || entry.name.startsWith(\".\")) continue;\n    const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;\n    const isDir = entry.isDirectory();\n    results.push({\n      path: relPath,\n      name: entry.name,\n      type: isDir ? \"folder\" : \"file\",\n    });\n    if (isDir)\n      await collectFiles(\n        nodePath.join(dir, entry.name),\n        relPath,\n        depth + 1,\n        results,\n      );\n  }\n}\n"]}
+{"version":3,"file":"framework-prompts.js","sourceRoot":"","sources":["../../../src/server/agent-chat/framework-prompts.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AAIjC,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEtC,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAyB,EACzB,OAA2E;IAS3E,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,sBAAsB,GAAG,yBAAyB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5E,MAAM,qBAAqB,GAAG,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;IAC/D,MAAM,oBAAoB,GAAG,qBAAqB;QAChD,CAAC,CAAC,uJAAuJ;QACzJ,CAAC,CAAC,8FAA8F,CAAC;IACnG,MAAM,oBAAoB,GAAG,qBAAqB;QAChD,CAAC,CAAC,wKAAwK;QAC1K,CAAC,CAAC,qGAAqG,CAAC;IAC1G,MAAM,4BAA4B,GAAG,qBAAqB;QACxD,CAAC,CAAC,2eAA2e;QAC7e,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,yBAAyB,GAAG,qBAAqB;QACrD,CAAC,CAAC;;;;;;;;;;uJAUiJ;QACnJ,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,4BAA4B,GAAG,qBAAqB;QACxD,CAAC,CAAC;;;;;;;;;;8GAUwG;QAC1G,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,qBAAqB,GAAG;;;;;;;;;;0FAU0D,oBAAoB,kHAAkH,oBAAoB;;EAElP,yBAAyB;;;;EAIzB,4BAA4B;;;;;;;;;;;EAW5B,cAAc,EAAE,CAAC;IAEjB,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB7B,cAAc,EAAE,CAAC;IAEjB,MAAM,6BAA6B,GAAG;;;;;;;;;;6EAUqC,oBAAoB,8CAA8C,oBAAoB;;EAEjK,4BAA4B;;;;;EAK5B,sBAAsB,EAAE,CAAC;IAEzB,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;EAerC,sBAAsB,EAAE,CAAC;IAEzB,OAAO;QACL,cAAc;QACd,sBAAsB;QACtB,qBAAqB;QACrB,oBAAoB;QACpB,6BAA6B;QAC7B,4BAA4B;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,GAAG,EAAE;IACpD,yEAAyE;IACzE,MAAM,EACJ,cAAc,EAAE,aAAa,EAC7B,sBAAsB,EAAE,oBAAoB,GAC7C,GAAG,qBAAqB,EAAE,CAAC;IAC5B,OAAO;QACL,aAAa;QACb,oBAAoB;QACpB,wBAAwB,EAAE,0BAA0B;QACpD,qBAAqB;QACrB,qBAAqB;QACrB,uBAAuB;QACvB,6BAA6B;KAC9B,CAAC;AACJ,CAAC,CAAC,EAAE,CAAC;AAEL;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,aAAa,GAAwB,MAAM;IAE3C,IAAI,CAAC;QACH,OAAO,MAAM,qBAAqB,CAAC;YACjC,KAAK;YACL,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI;YAChC,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAqC,EACrC,IAAI,GAAmB,MAAM,EAC7B,gBAA2B;IAE3B,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/D,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,aAAa,GAAG,YAAY;QAChC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC,CAAC,gBAAgB,CAAC;IACrB,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;IAC1E,MAAM,gBAAgB,GAAG,CAAC,KAAkB,EAAE,EAAE,CAC9C,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACvD,CAAC,CAAC,0BAA0B,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK;QACtD,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,WAAW,GAAG,aAAa;aAC9B,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;aACjE,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,OAAO,IAAI,8BAA8B,KAAK,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,KAAK,CAC7E,CAAC;QAEJ,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CACX,gJAAgJ,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzK,CAAC;QACJ,CAAC;QACD,IAAI,kBAAkB,GAAG,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CACX,GAAG,kBAAkB,0BAA0B,kBAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,sHAAsH,CAChN,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAErC,OAAO,+BAA+B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC;QACjD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;QAEtE,4EAA4E;QAC5E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,mBAAmB,IAAI,QAAQ,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,8DAA8D;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACxB,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAC9B,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,GAAI,CAAuB,CAAC,IAAI,IAAI,KAAK,CAAC;YACpD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC;YAChC,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/B,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,cAAc,GAAG,IAAI,EAAE,GAAG,QAAQ,EAAE,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxE,MAAM,YAAY,GAChB,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,OAAO,GAAG,QAAQ,IAAI,IAAI,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,OAAO;;;;;;EAMP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAG;IACxB,sBAAsB;IACtB,mBAAmB;IACnB,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;IACtB,UAAU;CACF,CAAC;AAEX,MAAM,UAAU,6BAA6B,CAC3C,QAAqC;IAErC,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,QAAqC;IAErC,MAAM,cAAc,GAAG,sBAAsB,IAAI,QAAQ,CAAC;IAC1D,MAAM,oBAAoB,GAAG,qBAAqB,IAAI,QAAQ,CAAC;IAC/D,MAAM,sBAAsB,GAAG;QAC7B,sBAAsB,IAAI,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI;QACpE,mBAAmB,IAAI,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI;KAC/D,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,MAAM,UAAU,GAAG,UAAU,IAAI,QAAQ,CAAC;IAC1C,MAAM,gBAAgB,GAAG,sBAAsB,IAAI,QAAQ,CAAC;IAC5D,IACE,CAAC,cAAc;QACf,CAAC,oBAAoB;QACrB,CAAC,UAAU;QACX,CAAC,gBAAgB;QAEjB,OAAO,EAAE,CAAC;IAEZ,MAAM,SAAS,GAAG;QAChB,GAAG,sBAAsB;QACzB,cAAc,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI;QAChD,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI;QACrD,gBAAgB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI;QAClD,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;KACjC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAElB,OAAO;;kCAEyB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;6wBAMutB,CAAC;AAC9wB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,MAAc,EACd,KAAa,EACb,OAAuE;IAEvE,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC;QACnB,cAAc;QACd,MAAM;QACN,OAAO;QACP,SAAS;QACT,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,MAAM;KACP,CAAC,CAAC;IACH,IAAI,OAA8B,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QAC1B,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACjE,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAChE,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;SAChC,CAAC,CAAC;QACH,IAAI,KAAK;YACP,MAAM,YAAY,CAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAC9B,OAAO,EACP,KAAK,GAAG,CAAC,EACT,OAAO,CACR,CAAC;IACN,CAAC;AACH,CAAC","sourcesContent":["import nodePath from \"node:path\";\n\nimport type { ActionEntry } from \"../../agent/production-agent.js\";\nimport type { DatabaseToolsOption } from \"../../scripts/db/tool-mode.js\";\nimport {\n  buildFrameworkCore,\n  buildFrameworkCoreCompact,\n  type PromptExamples,\n} from \"../prompts/index.js\";\nimport { getRequestOrgId } from \"../request-context.js\";\nimport { loadSchemaPromptBlock } from \"../schema-prompt.js\";\nimport { resolveInitialToolNames } from \"./action-filters-a2a.js\";\nimport {\n  createDataWidgetActionEntries,\n  FRAMEWORK_CONTEXT_SECTIONS,\n} from \"./context-tools.js\";\nimport { lazyFs } from \"./lazy-fs.js\";\n\n// ---------------------------------------------------------------------------\n// Framework-level system prompt assembly (production/dev, full/compact),\n// the \"Available Actions\" and corpus-tools prompt sections, the SQL schema\n// block, and the codebase file-tree walker used by a few dev-mode tools.\n// ---------------------------------------------------------------------------\n\n/**\n * Framework-level instructions injected into every agent's system prompt.\n * Prompt text lives in packages/core/src/server/prompts/ so this file stays\n * focused on routing and assembly logic.\n *\n * buildFrameworkPrompts() is called once per plugin instantiation (not per\n * request) with the template's promptExamples, producing the four assembled\n * prompt strings used at request time.\n */\nexport function buildFrameworkPrompts(\n  examples?: PromptExamples,\n  options?: { databaseTools?: DatabaseToolsOption; extensionTools?: boolean },\n): {\n  FRAMEWORK_CORE: string;\n  FRAMEWORK_CORE_COMPACT: string;\n  PROD_FRAMEWORK_PROMPT: string;\n  DEV_FRAMEWORK_PROMPT: string;\n  PROD_FRAMEWORK_PROMPT_COMPACT: string;\n  DEV_FRAMEWORK_PROMPT_COMPACT: string;\n} {\n  const FRAMEWORK_CORE = buildFrameworkCore(examples, options);\n  const FRAMEWORK_CORE_COMPACT = buildFrameworkCoreCompact(examples, options);\n  const extensionToolsEnabled = options?.extensionTools === true;\n  const planModeArtifactList = extensionToolsEnabled\n    ? \"source-code handoffs and app-created artifacts such as extensions, widgets, dashboards, calculators, mini-apps, documents, designs, slides, or videos\"\n    : \"source-code handoffs and app-created artifacts such as documents, designs, slides, or videos\";\n  const planModeBlockedTools = extensionToolsEnabled\n    ? \"`render-inline-extension`, `create-extension`, `update-extension`, `connect-builder`, or any action that creates, updates, deletes, sends, publishes, or persists data\"\n    : \"`connect-builder`, or any action that creates, updates, deletes, sends, publishes, or persists data\";\n  const extensionConnectBuilderGuard = extensionToolsEnabled\n    ? \"Prefer native app artifacts and actions. Use an extension only when the user explicitly requests one, or when the result is clearly bespoke and one-off and the native format cannot express it. Reusable or product-wide behavior belongs in app code. If the exact placement or behavior requires changing the host UI or no suitable slot exists, continue with the normal `connect-builder` source-change flow even if the user called it an extension; never stop at saying extensions cannot do it.\"\n    : \"\";\n  const extensionInstructionsFull = extensionToolsEnabled\n    ? `### Generative UI and Extensions (Mini-Apps)\n\nIn Act mode, if the user asks for generated interactive UI in chat, choose the smallest extension action for the lifetime: \\`render-inline-extension\\` (one-off, chat-only), \\`create-extension\\` (saved/reusable), \\`show-extension-inline\\` (reopen a saved one), or \\`update-extension\\` (edit an existing one) — call the right one directly, without a \"let me build…\" preamble. Each tool's own description covers its exact use case, arguments, and available helpers (appAction, dbQuery, extensionData, agentNative.ui.output, etc.). Extensions are sandboxed mini-apps, not source-code changes, and never go through \\`connect-builder\\`.\n\nIf the app exposes native actions or instructions for dashboards, reports, analyses, charts, documents, decks, or other domain artifacts, use those app-native actions first. Choose an extension only when the user explicitly asks for an extension/custom mini-app, or when the result is clearly bespoke and one-off and the app's native artifact format cannot faithfully express the requested interaction. Reusable or product-wide behavior belongs in app code.\n\nEditing an existing extension (fix, restyle, rename, add behavior) is a SQL data update — call \\`update-extension\\` directly using the extensionId from \\`<current-screen>\\`/\\`<current-url>\\` when present; never call \\`connect-builder\\` for it.\n\nExtensions render only on their own page or inside an existing named slot; they cannot inject UI into arbitrary native components. If an extension could only approximate the request in a different location, do not silently downgrade the requirement and do not end with \"extensions cannot do that.\" Briefly explain the boundary, then follow the normal source-code handoff so the app can still be customized fully.\n\nFor helper APIs, Alpine.js patterns, the extension-vs-code-change boundary, and worked examples, read the \\`extensions\\` and \\`generative-ui\\` skills.`\n    : \"\";\n  const extensionInstructionsCompact = extensionToolsEnabled\n    ? `### Generative UI and Extensions (Mini-Apps)\n\nIn Act mode, choose the smallest extension action for the lifetime: \\`render-inline-extension\\` (one-off, chat-only), \\`create-extension\\` (saved/reusable), \\`show-extension-inline\\` (reopen a saved one), or \\`update-extension\\` (edit an existing one) — each tool's own description covers its use case and helpers. These are sandboxed mini-apps, not code changes; never route them through \\`connect-builder\\`. Do not preface with \"let me build…\" — just call the right extension action.\n\nUse app-native artifact actions first when they exist for dashboards, reports, analyses, charts, documents, decks, or similar domain artifacts. Pick \\`create-extension\\` only for explicit extension/custom mini-app requests, or when the result is clearly bespoke and one-off and the native artifact format cannot support it. Reusable or product-wide behavior belongs in app code.\n\nEditing an existing extension is a data update — call \\`update-extension\\` directly using the extensionId from \\`<current-screen>\\`/\\`<current-url>\\` when present; never \\`connect-builder\\`.\n\nExtensions can render only on their own page or in an existing named slot; they cannot inject UI into arbitrary native components. If the exact request changes host chrome, native components, layout, styles, routes, business logic, or needs placement where no slot exists, treat it as a source-code change and use the normal \\`connect-builder\\` flow even if the user called it an extension. Never stop at \"extensions cannot do that\" or silently offer a different placement; explain the boundary briefly and continue the code-change handoff.\n\nSee the \\`extensions\\` and \\`generative-ui\\` skills for helper APIs, Alpine.js patterns, and worked examples.`\n    : \"\";\n\n  const PROD_FRAMEWORK_PROMPT = `## Agent-Native Framework — Production Mode\n\nYou are an AI agent in an agent-native application, running in **production mode**.\n\nThe agent and the UI are equal partners — everything the UI can do, you can do via your tools, and vice versa. They share the same SQL database and stay in sync automatically.\n\n**In production mode, you operate through registered actions exposed as tools.** These are your capabilities — use them to read data, take actions, and help the user. You cannot edit source code or access the filesystem directly. Your tools are the app's API.\n\n### Plan Mode\n\nIf the current turn is in Plan mode, plan before anything gets written. This applies to ${planModeArtifactList}. Use only read-only tools, clarify the goal when needed, and return a concrete plan for approval. Do not call ${planModeBlockedTools} until the user switches back to Act mode.\n\n${extensionInstructionsFull}\n\n### Code Changes — Hand Off With \\`connect-builder\\`\n\n${extensionConnectBuilderGuard}\n\nIn Act mode, a request that needs source-file edits — the UI chrome, a component, a route, styles, a hook, an integration, or a bug in the app itself — is a handoff, not a task you plan. Builder plans and edits in its own sandbox, so the exploration, file-mapping, and code all happen there rather than here.\n\nKeep the whole turn to three beats:\n\n1. One short clause acknowledging what they asked for in their own terms (\"Got it — wider subject lines in the email list.\"), skipped entirely when they already know you're handing off. No generic preamble, no promised outcomes.\n2. The \\`connect-builder\\` call, with the user's request verbatim as \\`prompt\\`.\n3. One sentence framing the next click around what they asked for rather than pitching Builder. Read \\`builderEnabled\\` from the result first; the tool's own description defines what each value lets you claim and offer.\n\nNothing else belongs in that turn: no code exploration, no implementation plan, no \\`resources\\` write of a spec, and no sub-agents (they have no code-editing tools either). You don't need filesystem access to hand off, so don't reach for it or list tools you lack.\n${FRAMEWORK_CORE}`;\n\n  const DEV_FRAMEWORK_PROMPT = `## Agent-Native Framework — Development Mode\n\nYou are an AI agent in an agent-native application, running in **development mode**.\n\nThe agent and the UI are equal partners — everything the UI can do, you can do via tools/scripts, and vice versa. They share the same SQL database and stay in sync automatically.\n\n**In development mode, you have full local access — use it with senior-engineer judgment** (read before you edit, keep changes scoped, verify before you claim done):\n- Run any shell command via the \\`bash\\` tool (node, curl, pnpm, rg, git, etc.), including arbitrary code\n- Read and write any file on the filesystem; edit source, install packages, modify the app\n- Query and modify the database\n- Call external APIs (via bash with curl, or via scripts)\n\nWhen no dedicated tool/action exists for what you need, reach for \\`bash\\`.\n\n**Template-specific actions are invoked via bash, NOT as direct tools.** In dev mode, the only tools registered as native tool calls are framework-level utilities (bash, read, edit, write, database, resources, chat, teams, jobs). Anything from the template's \\`actions/\\` directory must be run through bash: \\`bash({ command: 'pnpm action <name> --arg value' })\\`. The \"Available Actions\" section below shows the exact CLI syntax for each one — copy that command verbatim and pass it to \\`bash\\`. Do not try to call template actions by name as if they were tools; they will not appear in your tool list.\n\nWhen editing code, follow the agent-native architecture:\n- Every feature needs all four areas: UI + scripts + skills/instructions + application-state sync\n- All SQL must be dialect-agnostic (works on SQLite and Postgres)\n- No Node.js-specific APIs in server routes (must work on Cloudflare Workers, etc.)\n- Use shadcn/ui components and Tabler Icons for all UI work\n${FRAMEWORK_CORE}`;\n\n  const PROD_FRAMEWORK_PROMPT_COMPACT = `## Agent-Native Framework — Production Mode\n\nYou are an AI agent in an agent-native application, running in **production mode**.\n\nThe agent and the UI are equal partners — everything the UI can do, you can do via your tools, and vice versa. They share the same SQL database and stay in sync automatically.\n\n**In production mode, you operate through registered actions exposed as tools.** These are your capabilities — use them to read data, take actions, and help the user. You cannot edit source code or access the filesystem directly. Your tools are the app's API.\n\n### Plan Mode\n\nIf the turn is in Plan mode, plan before anything gets written — including ${planModeArtifactList}. Use read-only tools only and do not call ${planModeBlockedTools} until the user switches back to Act mode.\n\n${extensionInstructionsCompact}\n\n### Code Changes — Hand Off With \\`connect-builder\\`\n\nIn Act mode, a request that genuinely needs a source-code edit (per the rules above) is a handoff, not a task you plan. Keep the turn to three beats: (1) one short clause acknowledging their specific ask in their own terms, no preamble; (2) the \\`connect-builder\\` call with their request verbatim as \\`prompt\\`; (3) one sentence framing the next click around what they asked for, not a Builder pitch — read \\`builderEnabled\\` from the result first, and let the tool's own description tell you what each value lets you claim. Nothing else belongs in that turn: no code, no file lists, no plans, no sub-agents.\n${FRAMEWORK_CORE_COMPACT}`;\n\n  const DEV_FRAMEWORK_PROMPT_COMPACT = `## Agent-Native Framework — Development Mode\n\nYou are an AI agent in an agent-native application, running in **development mode**.\n\nThe agent and the UI are equal partners — everything the UI can do, you can do via tools/scripts, and vice versa. They share the same SQL database and stay in sync automatically.\n\n**In development mode, you have full local access** — shell, filesystem, database, external APIs, source edits, and package installs. Use it with senior-engineer judgment: read before you edit, keep changes scoped, verify before you claim done.\n\n**Template-specific actions are invoked via bash, NOT as direct tools.** Run them with: \\`bash({ command: 'pnpm action <name> --arg value' })\\`. See the \"Available Actions\" section below for CLI syntax.\n\nWhen editing code, follow the agent-native architecture:\n- Every feature needs all four areas: UI + scripts + skills/instructions + application-state sync\n- All SQL must be dialect-agnostic (works on SQLite and Postgres)\n- No Node.js-specific APIs in server routes (must work on Cloudflare Workers, etc.)\n- Use shadcn/ui components and Tabler Icons for all UI work\n${FRAMEWORK_CORE_COMPACT}`;\n\n  return {\n    FRAMEWORK_CORE,\n    FRAMEWORK_CORE_COMPACT,\n    PROD_FRAMEWORK_PROMPT,\n    DEV_FRAMEWORK_PROMPT,\n    PROD_FRAMEWORK_PROMPT_COMPACT,\n    DEV_FRAMEWORK_PROMPT_COMPACT,\n  };\n}\n\nexport const _agentChatPromptSectionsForTests = (() => {\n  // Built with default (no template-specific) examples for test stability.\n  const {\n    FRAMEWORK_CORE: frameworkCore,\n    FRAMEWORK_CORE_COMPACT: frameworkCoreCompact,\n  } = buildFrameworkPrompts();\n  return {\n    frameworkCore,\n    frameworkCoreCompact,\n    frameworkContextSections: FRAMEWORK_CONTEXT_SECTIONS,\n    buildFrameworkPrompts,\n    generateActionsPrompt,\n    resolveInitialToolNames,\n    createDataWidgetActionEntries,\n  };\n})();\n\n/**\n * Build the per-request SQL-schema context block. Reads AGENT_ORG_ID live\n * from the environment so scheduler/A2A/HTTP call sites all see whatever\n * org was just resolved for this request.\n */\nexport async function buildSchemaBlock(\n  owner: string,\n  databaseTools: DatabaseToolsOption = \"read\",\n): Promise<string> {\n  try {\n    return await loadSchemaPromptBlock({\n      owner,\n      orgId: getRequestOrgId() ?? null,\n      databaseTools,\n    });\n  } catch {\n    return \"\";\n  }\n}\n\n/**\n * Generates a system prompt section describing registered template actions.\n *\n * Two output modes:\n *\n *   - `\"tool\"` — used in production, where template actions are registered\n *     as native Anthropic tools. The native tool schema already carries each\n *     action's name, full description, and parameters, so this mode does NOT\n *     re-list every action — it only surfaces what the tool list can't:\n *     native-chat-widget annotations and a `tool-search` pointer for actions\n *     omitted from the initial tool set.\n *   - `\"cli\"` — used in dev, where template actions are NOT registered as\n *     native tools and must be invoked via `bash(command=\"pnpm action ...\")`.\n *     This listing is load-bearing here (there is no tool schema to fall\n *     back on), so it still emits the full\n *     `pnpm action name --arg <type> [--opt <type>] — desc` line per action.\n */\nexport function generateActionsPrompt(\n  registry: Record<string, ActionEntry>,\n  mode: \"cli\" | \"tool\" = \"tool\",\n  initialToolNames?: string[],\n): string {\n  if (!registry || Object.keys(registry).length === 0) return \"\";\n\n  const allActionEntries = Object.entries(registry);\n  const initialNames = initialToolNames ? new Set(initialToolNames) : undefined;\n  const actionEntries = initialNames\n    ? allActionEntries.filter(([name]) => initialNames.has(name))\n    : allActionEntries;\n  const omittedActionCount = allActionEntries.length - actionEntries.length;\n  const nativeWidgetNote = (entry: ActionEntry) =>\n    entry.chatUI && typeof entry.chatUI.renderer === \"string\"\n      ? ` Native chat widget: \\`${entry.chatUI.renderer}\\`.`\n      : \"\";\n\n  if (mode === \"tool\") {\n    // Native tool schemas already carry name + full description + params\n    // for every action, so this section only needs to surface what the tool\n    // list itself can't: which actions render a native chat widget, and\n    // which actions exist but aren't loaded as initial tools yet.\n    const widgetLines = actionEntries\n      .filter(([, entry]) => typeof entry.chatUI?.renderer === \"string\")\n      .map(\n        ([name, entry]) =>\n          `- \\`${name}\\` — Native chat widget: \\`${entry.chatUI?.renderer ?? \"\"}\\`.`,\n      );\n\n    const sections: string[] = [];\n    if (widgetLines.length > 0) {\n      sections.push(\n        `**Actions that render a native chat widget** — call these directly for their table/chart/insights view instead of recreating it in prose:\\n\\n${widgetLines.join(\"\\n\")}`,\n      );\n    }\n    if (omittedActionCount > 0) {\n      sections.push(\n        `${omittedActionCount} less-common app action${omittedActionCount === 1 ? \" is\" : \"s are\"} available on demand. Use \\`tool-search\\` with a specific capability query to load the matching schemas when needed.`,\n      );\n    }\n    if (sections.length === 0) return \"\";\n\n    return `\\n\\n## Available Actions\\n\\n${sections.join(\"\\n\\n\")}`;\n  }\n\n  const lines = actionEntries.map(([name, entry]) => {\n    const desc = entry.tool.description;\n    const params = entry.tool.parameters?.properties;\n    const requiredFields = new Set(entry.tool.parameters?.required ?? []);\n\n    // CLI mode: emit `pnpm action <name> --required <type> [--optional <type>]`\n    if (!params || Object.keys(params).length === 0) {\n      return `- \\`pnpm action ${name}\\` — ${desc}${nativeWidgetNote(entry)}`;\n    }\n    const entries = Object.entries(params);\n    // Required first (alphabetical), then optional (alphabetical)\n    entries.sort(([a], [b]) => {\n      const ar = requiredFields.has(a) ? 0 : 1;\n      const br = requiredFields.has(b) ? 0 : 1;\n      if (ar !== br) return ar - br;\n      return a.localeCompare(b);\n    });\n    const required: string[] = [];\n    const optional: string[] = [];\n    const requiredNames: string[] = [];\n    for (const [k, v] of entries) {\n      const type = (v as { type?: string }).type ?? \"any\";\n      const flag = `--${k} <${type}>`;\n      if (requiredFields.has(k)) {\n        required.push(flag);\n        requiredNames.push(`--${k}`);\n      } else {\n        optional.push(`[${flag}]`);\n      }\n    }\n    const cmd = [\"pnpm action \" + name, ...required, ...optional].join(\" \");\n    const requiredNote =\n      requiredNames.length > 0 ? ` Required: ${requiredNames.join(\", \")}.` : \"\";\n    return `- \\`${cmd}\\` — ${desc}.${requiredNote}${nativeWidgetNote(entry)}`;\n  });\n\n  return `\\n\\n## Available Actions\n\n**These template actions are NOT exposed as direct tools in dev mode. To run any of them, use the \\`bash\\` tool with the exact command shown below.** Example: \\`bash(command=\"pnpm action add-slide --deckId abc --content 'Hello'\")\\`.\n\nDo NOT try to call these by name as if they were tools — they will not exist in your tool list. Always go through \\`bash\\`.\n\n${lines.join(\"\\n\")}`;\n}\n\n/**\n * Tool names `generateCorpusToolsPrompt` teaches BY NAME, in the same order\n * it lists them. Exported so callers that build a request's initial\n * engine-tool set can fold in exactly the subset present in a given\n * registry — keeping \"what the prompt just told the model exists\" and\n * \"what tools are actually callable on the first request\" in sync. See the\n * corpus-prompt/initial-tools note at this function's call site in\n * agent-chat-plugin.ts.\n */\nconst CORPUS_TOOL_NAMES = [\n  \"provider-api-catalog\",\n  \"provider-api-docs\",\n  \"provider-api-request\",\n  \"provider-corpus-job\",\n  \"query-staged-dataset\",\n  \"run-code\",\n] as const;\n\nexport function corpusToolNamesTaughtByPrompt(\n  registry: Record<string, ActionEntry>,\n): string[] {\n  return CORPUS_TOOL_NAMES.filter((name) => name in registry);\n}\n\nexport function generateCorpusToolsPrompt(\n  registry: Record<string, ActionEntry>,\n): string {\n  const hasProviderApi = \"provider-api-request\" in registry;\n  const hasProviderCorpusJob = \"provider-corpus-job\" in registry;\n  const providerDiscoveryTools = [\n    \"provider-api-catalog\" in registry ? \"`provider-api-catalog`\" : null,\n    \"provider-api-docs\" in registry ? \"`provider-api-docs`\" : null,\n  ].filter(Boolean);\n  const hasRunCode = \"run-code\" in registry;\n  const hasStagedDataset = \"query-staged-dataset\" in registry;\n  if (\n    !hasProviderApi &&\n    !hasProviderCorpusJob &&\n    !hasRunCode &&\n    !hasStagedDataset\n  )\n    return \"\";\n\n  const available = [\n    ...providerDiscoveryTools,\n    hasProviderApi ? \"`provider-api-request`\" : null,\n    hasProviderCorpusJob ? \"`provider-corpus-job`\" : null,\n    hasStagedDataset ? \"`query-staged-dataset`\" : null,\n    hasRunCode ? \"`run-code`\" : null,\n  ].filter(Boolean);\n\n  return `\\n\\n## Broad Provider And Corpus Workflows\n\nAvailable corpus-capable tools: ${available.join(\", \")}.\n\nThis workflow does not apply to ordinary structured lookups, bounded aggregates, or counts grouped over one known source. For those requests, use the single most directly authoritative source, run one bounded query, and answer as soon as it succeeds. Do not cross-check or expand into a corpus workflow unless the user asks for multiple sources, exhaustive unstructured-record coverage, or an absence claim.\n\nFor broad provider searches, raw API access, multi-page cohorts, cross-source joins, classification over unstructured records, or absence-sensitive answers, do not stop at a bounded shortcut action. Use the provider's broad API/search/list surface, fetch every relevant page or an explicit bounded cohort, stage/save large responses when needed, and reduce the corpus with durable corpus jobs, staged-dataset queries, or code execution.\n\nWhen \\`provider-corpus-job\\` is available, prefer it for transcript/message/ticket/issue/document scans that may exceed one turn, need provider-side backoff, or need a defensible \"not found\" conclusion. Use operation=\"start\" with mode=\"paginated-search\" for any paginated provider endpoint, or mode=\"batch-search\" when a prior cohort of ids/records must feed a second provider endpoint. Continue paused jobs with operation=\"continue\" until status is completed or quota_wait, then read operation=\"results\". In run-code, prefer providerFetchAll() for short cursor/page/offset pagination and providerRequest() when response status, headers, or truncation metadata matters. Report source, filters, row counts, pagination/truncation, failed pages, quota_wait times, and remaining gaps.`;\n}\n\n/**\n * Walks the local filesystem (dev mode only) to build a bounded file/folder\n * tree, used by a couple of dev-mode workspace-inspection tools.\n */\nexport async function collectFiles(\n  dir: string,\n  prefix: string,\n  depth: number,\n  results: Array<{ path: string; name: string; type: \"file\" | \"folder\" }>,\n): Promise<void> {\n  if (depth > 4 || results.length >= 500) return;\n  const skip = new Set([\n    \"node_modules\",\n    \".git\",\n    \".next\",\n    \".output\",\n    \"dist\",\n    \".cache\",\n    \".turbo\",\n    \"data\",\n  ]);\n  let entries: import(\"fs\").Dirent[];\n  try {\n    const fs = await lazyFs();\n    entries = fs.readdirSync(dir, { withFileTypes: true });\n  } catch {\n    return;\n  }\n  for (const entry of entries) {\n    if (results.length >= 500) return;\n    if (skip.has(entry.name) || entry.name.startsWith(\".\")) continue;\n    const relPath = prefix ? `${prefix}/${entry.name}` : entry.name;\n    const isDir = entry.isDirectory();\n    results.push({\n      path: relPath,\n      name: entry.name,\n      type: isDir ? \"folder\" : \"file\",\n    });\n    if (isDir)\n      await collectFiles(\n        nodePath.join(dir, entry.name),\n        relPath,\n        depth + 1,\n        results,\n      );\n  }\n}\n"]}

package/dist/server/agent-chat/plugin-options.d.ts

@@ -249,9 +249,9 @@ export interface AgentChatPluginOptions {
     /**
      * Expose framework extension management actions (`create-extension`,
      * `update-extension`, `list-extensions`, etc.) to the app agent. Defaults to
-     * true. Set to false for apps that do not want the LLM to create or manage
-     * sandboxed extension mini-apps, even though the core extension routes may
-     * still be mounted for other surfaces.
+     * false. Set to true for apps that intentionally let the LLM create or
+     * manage sandboxed extension mini-apps. Core extension routes may still be
+     * mounted for compatibility and app-owned surfaces.
      */
     extensionTools?: boolean;
     /**

package/dist/server/agent-chat/plugin-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-options.js","sourceRoot":"","sources":["../../../src/server/agent-chat/plugin-options.ts"],"names":[],"mappings":"","sourcesContent":["import type { ActionEntry } from \"../../agent/production-agent.js\";\nimport type { AgentLoopFinalResponseGuard } from \"../../agent/production-agent.js\";\nimport type {\n  AgentChatAttachment,\n  AgentChatReference,\n  MentionProvider,\n} from \"../../agent/types.js\";\nimport type { ExternalAgentPolicy } from \"../../mcp/external-agent-policy.js\";\nimport type { DatabaseToolsOption } from \"../../scripts/db/tool-mode.js\";\nimport type { PromptExamples } from \"../prompts/index.js\";\n\n/** Shape of a Nitro plugin function: receives the Nitro app instance at\n * startup and may register routes/hooks synchronously or asynchronously. */\nexport type NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\nexport interface AgentChatPluginOptions {\n  /** Template-specific actions (email ops, booking ops, etc.) */\n  actions?:\n    | Record<string, ActionEntry>\n    | (() =>\n        | Record<string, ActionEntry>\n        | Promise<Record<string, ActionEntry>>);\n  /** @deprecated Use `actions` instead */\n  scripts?:\n    | Record<string, ActionEntry>\n    | (() =>\n        | Record<string, ActionEntry>\n        | Promise<Record<string, ActionEntry>>);\n  /** System prompt for the agent. A sensible default is provided. */\n  systemPrompt?: string;\n  /** Additional system prompt prepended in dev mode */\n  devSystemPrompt?: string;\n  /** Model to use. Defaults to the resolved engine's default model. */\n  model?: string;\n  /** Optional per-app agent run chunk budget in milliseconds. Defaults to\n   * AGENT_RUN_SOFT_TIMEOUT_MS when set, otherwise no framework-imposed\n   * timeout. When reached, long runs continue through the hidden continuation\n   * path instead of surfacing a timeout warning. */\n  runSoftTimeoutMs?: number;\n  /** Optional per-app run-manager no-progress watchdog in milliseconds. */\n  runNoProgressTimeoutMs?: number;\n  /**\n   * Opt this app into Netlify durable background-function agent-chat runs. This\n   * gives hosted agent turns the 15-minute async-function budget when the app's\n   * Netlify build also emits the background function. Set this to `false` to\n   * explicitly disable a stale deploy-wide `AGENT_CHAT_DURABLE_BACKGROUND`\n   * flag for this app.\n   */\n  durableBackgroundRuns?: boolean;\n  /** Anthropic API key. Falls back to ANTHROPIC_API_KEY env var */\n  apiKey?: string;\n  /**\n   * Agent engine to use. Can be a pre-constructed AgentEngine, a registered\n   * engine name (e.g. \"anthropic\", \"ai-sdk:openai\"), or an object with name\n   * and config. Defaults to the \"anthropic\" engine using ANTHROPIC_API_KEY.\n   */\n  engine?:\n    | import(\"../../agent/engine/types.js\").AgentEngine\n    | string\n    | { name: string; config: Record<string, unknown> };\n  /** Route path. Default: /_agent-native/agent-chat */\n  path?: string;\n  /** Custom mention providers for @-tagging template entities */\n  mentionProviders?:\n    | Record<string, MentionProvider>\n    | (() =>\n        | Record<string, MentionProvider>\n        | Promise<Record<string, MentionProvider>>);\n  /** App ID used to exclude self from agent discovery (e.g., \"mail\", \"calendar\") */\n  appId?: string;\n  /** Optional MCP server branding surfaced during the initialize handshake. */\n  mcpServerInfo?: {\n    /** Human-facing title. Defaults to the capitalized app id/name. */\n    title?: string;\n    /** Host-facing description. Defaults to \"Agent-native <app> agent\". */\n    description?: string;\n    /** Canonical app URL. Relative URLs are resolved against the request origin. */\n    websiteUrl?: string;\n    /** App icons. Relative `src` values are resolved against the request origin. */\n    icons?: Array<{\n      src: string;\n      mimeType?: string;\n      sizes?: string[];\n      theme?: \"light\" | \"dark\";\n    }>;\n  };\n  /**\n   * Optional callback to resolve the org ID for the current request.\n   * When provided, the resolved value is set as AGENT_ORG_ID env var so\n   * that db-query/db-exec automatically scope by org_id in addition to\n   * owner_email.\n   *\n   * If not provided, the framework automatically uses `session.orgId` from\n   * Better Auth's active organization. Only provide this callback when you\n   * need custom org resolution logic (e.g., Atlassian org mapping).\n   */\n  resolveOrgId?: (event: any) => string | null | Promise<string | null>;\n  /**\n   * Optional owner resolver for public/anonymous chat surfaces. When the\n   * normal app session is missing, this callback may return a synthetic\n   * owner id for a narrowly-scoped public request (for example, a public\n   * shared document page). Anonymous requests use a read-only tool set by\n   * default so public viewers cannot mutate app data through the agent.\n   */\n  anonymousOwner?: (event: any) => string | null | Promise<string | null>;\n  /**\n   * Keep anonymous-owner requests on read-only template actions. Defaults to\n   * true. Only disable for single-tenant apps that intentionally allow public\n   * agent mutations.\n   */\n  anonymousReadOnly?: boolean;\n  /**\n   * Optional auth adapter for the HTTP action route\n   * (`/_agent-native/actions/*`). Its `resolveCaller` runs before the\n   * cookie/bearer `getSession` chain, letting an app accept caller identities\n   * `getSession` doesn't understand (e.g. an A2A JWT verified with\n   * `verifyA2AToken`) declaratively, instead of pre-seeding request context\n   * from a Nitro `request` hook.\n   *\n   * Returning `null` defers to the normal chain; THROWING hard-rejects with a\n   * 401 (an invalid/forged credential must not fall through to a same-origin\n   * session cookie). A resolved caller's org comes exclusively from the\n   * verified credential — the returned `orgId` or the owner-email membership\n   * lookup — never from the request's session cookie.\n   * See {@link import(\"../action-routes.js\").ActionRouteAuthAdapter}.\n   */\n  actionRouteAuth?: import(\"../action-routes.js\").ActionRouteAuthAdapter;\n  /**\n   * Optional callback to append template-specific context to the system\n   * prompt on each request. Runs after AGENTS.md / skills / memory are\n   * loaded and before the schema block — use it to inject dynamic SQL\n   * context like a data dictionary, active feature flags, or whatever\n   * the agent should know about *right now* for this user/org.\n   *\n   * Return `null` or an empty string to skip. The string you return is\n   * appended verbatim, so wrap it in your own XML tags (e.g.\n   * `<data-dictionary>…</data-dictionary>`) to keep the prompt scannable.\n   *\n   * Called on every request in every prompt variant (lean, lazy, full).\n   * Templates that want to suppress it in a particular mode should return\n   * `null` from the callback based on their own logic.\n   */\n  extraContext?: (\n    event: any,\n    owner: string,\n  ) => string | null | Promise<string | null>;\n  /**\n   * Optional final-answer guard. Templates can use this to require a\n   * corrective retry before accepting a text-only final answer, e.g. forcing\n   * real data-source tool calls for analytics requests.\n   */\n  finalResponseGuard?: AgentLoopFinalResponseGuard;\n  /**\n   * Optional per-template request normalizer. Runs after authentication and\n   * before the model sees the message, so apps can translate chat attachments\n   * into template-native file handles while preserving the user's visible text.\n   */\n  prepareRequest?: (details: {\n    event: any;\n    ownerEmail: string | null;\n    message: string;\n    displayMessage?: string;\n    attachments: AgentChatAttachment[];\n    references: AgentChatReference[];\n    threadId?: string;\n    internalContinuation?: boolean;\n    mode: \"act\" | \"plan\";\n  }) =>\n    | void\n    | {\n        message?: string;\n        displayMessage?: string;\n        attachments?: AgentChatAttachment[];\n      }\n    | Promise<void | {\n        message?: string;\n        displayMessage?: string;\n        attachments?: AgentChatAttachment[];\n      }>;\n  /**\n   * Use ONLY the template's `systemPrompt` and the actions list — skip the\n   * framework prompt wrapper, resource loading (AGENTS.md/LEARNINGS.md/\n   * memory), the SQL schema block, and the workspace files/skills/agents\n   * inventory. Intended for minimal or voice-first apps where a long,\n   * generic preamble adds latency and iteration noise without adding value.\n   *\n   * When set, the same lean prompt is used in both dev and prod modes. In\n   * dev mode the tool registry is ALSO swapped to the template's actions\n   * (same set as prod) — the dev-only bash/db-exec/file-system tools\n   * and the resource/docs/chat/team/job/browser scripts are dropped. The\n   * lean system prompt has no bash-usage guidance, so routing actions\n   * through bash would break. If you need the full dev tool surface,\n   * leave this off.\n   */\n  leanPrompt?: boolean;\n  /**\n   * Skip auto-injecting the workspace files/skills/agents inventory on the\n   * first message of a conversation while keeping the normal prompt, resources,\n   * and tool surface. Use this for domain-focused apps where broad workspace\n   * inventory is mostly latency/noise unless the user explicitly references it.\n   *\n   * `leanPrompt: true` and the default `lazyContext` mode imply this because\n   * those catalogs are already discoverable through resources, docs-search,\n   * tool-search, and the compact resource indexes. Set `false` explicitly only\n   * when a workspace-wide inventory is central to the app's first-turn job.\n   */\n  skipFilesContext?: boolean;\n  /**\n   * Initial native tool schemas to send to the LLM provider. When set, the\n   * agent starts with only these tools plus `tool-search`; the live registry\n   * remains searchable, and matching schemas from `tool-search` results are\n   * loaded into the next model request. Use this for domain-focused apps that\n   * have a few common actions and many rare framework utilities. Common\n   * discovery and resource-reading tools are promoted automatically when\n   * present. Provider, MCP, extension, and code-execution schemas stay behind\n   * tool-search unless the app explicitly includes them in this list.\n   */\n  initialToolNames?: string[];\n  /**\n   * Controls whether broad provider/corpus tools and their workflow prompt are\n   * loaded into the first model request. Use `\"lazy\"` for apps that can answer\n   * ordinary lookups from a compact curated tool set; corpus tools remain\n   * discoverable through tool-search and the full retry surface.\n   *\n   * @default \"initial\"\n   */\n  corpusTools?: \"initial\" | \"lazy\";\n  /**\n   * Use a compact system prompt with on-demand context loading. The system\n   * prompt includes essential behavioral rules and action signatures, but\n   * defers verbose framework details, SQL schema, skills, learnings, and\n   * memory behind tools (`get-framework-context`, `db-schema`,\n   * `resources` (action: read)). The agent fetches these on-demand when needed.\n   *\n   * This reduces the system prompt by ~60-70%, significantly improving\n   * time-to-first-token and reducing \"thinking\" time. The agent retains\n   * all capabilities — it just loads context lazily instead of upfront.\n   *\n   * Defaults to `true`. Set to `false` to use the original full prompt.\n   * Ignored when `leanPrompt` is set (lean mode is even more minimal).\n   */\n  lazyContext?: boolean;\n  /**\n   * In dev mode, register the template's actions as native tools the agent\n   * can call directly with structured JSON args — skipping the default\n   * `bash(command=\"pnpm action <name> ...\")` indirection.\n   *\n   * The default dev behavior shells out because it \"mirrors how Claude Code\n   * works locally\" and reduces empty-object tool calls for templates with\n   * simple string args. But templates whose actions take structured data\n   * (objects, arrays, nested JSON) can't round-trip those cleanly through\n   * the CLI parser — stringified JSON on the way in, loss of type fidelity\n   * on the way out.\n   *\n   * Set to `true` to get the same tool surface in dev that production uses.\n   * `leanPrompt: true` implies this already (lean mode has no bash-usage\n   * guidance, so actions must be native). Set this flag without\n   * `leanPrompt` when you want native actions AND the full system prompt.\n   *\n   * Defaults to `false`.\n   */\n  nativeActionsInDev?: boolean;\n  /**\n   * Expose raw SQL/native database tools to the app agent.\n   *\n   * Defaults to `\"read\"`: `db-schema`/`db-query` are available for inspection,\n   * while writes route through typed app actions. Set to `\"write\"` (also\n   * `true`) to expose `db-exec`/`db-patch` for scoped raw SQL maintenance.\n   * Set to `\"off\"` (also `false`) for chat-first apps that want agents to use\n   * typed actions only.\n   */\n  databaseTools?: DatabaseToolsOption;\n  /**\n   * Expose framework extension management actions (`create-extension`,\n   * `update-extension`, `list-extensions`, etc.) to the app agent. Defaults to\n   * true. Set to false for apps that do not want the LLM to create or manage\n   * sandboxed extension mini-apps, even though the core extension routes may\n   * still be mounted for other surfaces.\n   */\n  extensionTools?: boolean;\n  /**\n   * Optional A2A-only deterministic response path. Runs after inbound A2A text\n   * and user context are resolved, but before an agent engine/model is loaded.\n   * Return a message to complete the A2A task without invoking the LLM, or\n   * null/undefined to continue through the normal agent loop.\n   */\n  a2aMessageFallback?: (details: {\n    message: import(\"../../a2a/types.js\").Message;\n    text: string;\n    context: import(\"../../a2a/types.js\").A2AHandlerContext;\n    userEmail: string | undefined;\n  }) =>\n    | import(\"../../a2a/types.js\").Message\n    | string\n    | null\n    | undefined\n    | Promise<import(\"../../a2a/types.js\").Message | string | null | undefined>;\n  /**\n   * Optional injectable prompt examples for core rules (rule 5 auto-refresh\n   * examples and rule 8 external provider names). When absent, generic\n   * placeholders are used so no template-specific names appear in the core\n   * prompt by default.\n   *\n   * - `providerActions`: external provider action names this template exposes\n   *   (e.g. `[\"warehouse-query\", \"crm-records\"]` for a template).\n   * - `appActions`: representative template action names for rule 5's refresh\n   *   examples (e.g. `[\"log-meal\", \"update-form\"]` for a forms template).\n   */\n  promptExamples?: PromptExamples;\n  /**\n   * Curated allow-list of action names to serve external **connector** clients\n   * on a hosted multi-tenant deployment.\n   *\n   * Whenever this list is non-empty it is active by default for **every**\n   * caller (hosted connectors, code/stdio clients, and the local CLI): external\n   * MCP clients see (and can call) only these actions plus the builtin\n   * cross-app tools (`list_apps`, `open_app`, `ask_app`, `create_embed_session`).\n   * Calls to any tool outside the list are rejected with \"Unknown tool\".\n   * This prevents the full ~105-tool catalog from bloating external-agent\n   * context windows and removes footguns (db-exec, seed-*, extension suite,\n   * browser-session tools) from connectors. It is no longer gated behind an\n   * environment variable, and the catalog is never inferred from the client.\n   *\n   * `tool-search` stays available for discovery; a trimmed action still needs\n   * the connector catalog, authenticated-read policy, or full-catalog opt-in\n   * before an external caller can execute it.\n   * Callers who need the full surface up front opt in explicitly with\n   * `agent-native connect --full-catalog` (embeds a `catalog_scope: \"full\"`\n   * claim in their connect-minted JWT) or the deployment-wide\n   * `AGENT_NATIVE_MCP_FULL_CATALOG=1` env override.\n   *\n   * Declare here rather than in MCPConfig directly; the plugin copies it through.\n   */\n  connectorCatalog?: string[];\n\n  /**\n   * Default authenticated external-agent policy. In `auto` read mode, every\n   * action explicitly marked as GET + readOnly + publicAgent.requiresAuth is\n   * added to the connector surface automatically. Writes remain ask_app-only\n   * unless `writes: \"allowlisted\"` is explicitly selected.\n   */\n  externalAgents?: ExternalAgentPolicy;\n\n  /**\n   * Skip mounting the remote MCP protocol route.\n   *\n   * Most apps should leave this off so agent chat, A2A, and MCP share one\n   * runtime. Hosted apps with a dedicated early MCP plugin can set this to\n   * true so their external connector does not depend on the heavier chat\n   * plugin initialization path.\n   */\n  disableMcp?: boolean;\n\n  /**\n   * Code-execution capability for the production agent.\n   *\n   * - `\"off\"` (default) — no code-execution tools in production.\n   * - `\"sandboxed\"` — registers the `run-code` tool (isolated Node.js sandbox\n   *   with a bridge to allowlisted registered tools). Safe for shared or\n   *   hosted deployments.\n   * - `\"trusted\"` — registers both the full coding tool registry\n   *   (bash / read / edit / write) and the `run-code` sandbox. Only use in\n   *   single-tenant or operator-controlled deployments where full shell access\n   *   to the host machine is intentional.\n   *\n   * The `AGENT_PROD_CODE_EXECUTION` environment variable (`\"trusted\"`,\n   * `\"sandboxed\"`, or `\"off\"`) takes precedence over this option, allowing\n   * per-deployment overrides without code changes.\n   *\n   * Dev-mode behavior is unchanged — both the coding tools and `run-code` are\n   * always available when the environment allows toggling.\n   */\n  codeExecution?: {\n    production?: \"off\" | \"sandboxed\" | \"trusted\";\n    /**\n     * Extra registered-tool names the sandbox bridge may forward (beyond the\n     * default allowlist: provider-api-request, provider-api-docs,\n     * provider-api-catalog, web-request).\n     */\n    bridgeTools?: string[];\n  };\n\n  /**\n   * App-level default tool-call limits. Individual actions override these with\n   * their own `timeoutMs` / `maxResultChars` declarations.\n   */\n  toolLimits?: { timeoutMs?: number; maxResultChars?: number };\n}\n"]}
+{"version":3,"file":"plugin-options.js","sourceRoot":"","sources":["../../../src/server/agent-chat/plugin-options.ts"],"names":[],"mappings":"","sourcesContent":["import type { ActionEntry } from \"../../agent/production-agent.js\";\nimport type { AgentLoopFinalResponseGuard } from \"../../agent/production-agent.js\";\nimport type {\n  AgentChatAttachment,\n  AgentChatReference,\n  MentionProvider,\n} from \"../../agent/types.js\";\nimport type { ExternalAgentPolicy } from \"../../mcp/external-agent-policy.js\";\nimport type { DatabaseToolsOption } from \"../../scripts/db/tool-mode.js\";\nimport type { PromptExamples } from \"../prompts/index.js\";\n\n/** Shape of a Nitro plugin function: receives the Nitro app instance at\n * startup and may register routes/hooks synchronously or asynchronously. */\nexport type NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\nexport interface AgentChatPluginOptions {\n  /** Template-specific actions (email ops, booking ops, etc.) */\n  actions?:\n    | Record<string, ActionEntry>\n    | (() =>\n        | Record<string, ActionEntry>\n        | Promise<Record<string, ActionEntry>>);\n  /** @deprecated Use `actions` instead */\n  scripts?:\n    | Record<string, ActionEntry>\n    | (() =>\n        | Record<string, ActionEntry>\n        | Promise<Record<string, ActionEntry>>);\n  /** System prompt for the agent. A sensible default is provided. */\n  systemPrompt?: string;\n  /** Additional system prompt prepended in dev mode */\n  devSystemPrompt?: string;\n  /** Model to use. Defaults to the resolved engine's default model. */\n  model?: string;\n  /** Optional per-app agent run chunk budget in milliseconds. Defaults to\n   * AGENT_RUN_SOFT_TIMEOUT_MS when set, otherwise no framework-imposed\n   * timeout. When reached, long runs continue through the hidden continuation\n   * path instead of surfacing a timeout warning. */\n  runSoftTimeoutMs?: number;\n  /** Optional per-app run-manager no-progress watchdog in milliseconds. */\n  runNoProgressTimeoutMs?: number;\n  /**\n   * Opt this app into Netlify durable background-function agent-chat runs. This\n   * gives hosted agent turns the 15-minute async-function budget when the app's\n   * Netlify build also emits the background function. Set this to `false` to\n   * explicitly disable a stale deploy-wide `AGENT_CHAT_DURABLE_BACKGROUND`\n   * flag for this app.\n   */\n  durableBackgroundRuns?: boolean;\n  /** Anthropic API key. Falls back to ANTHROPIC_API_KEY env var */\n  apiKey?: string;\n  /**\n   * Agent engine to use. Can be a pre-constructed AgentEngine, a registered\n   * engine name (e.g. \"anthropic\", \"ai-sdk:openai\"), or an object with name\n   * and config. Defaults to the \"anthropic\" engine using ANTHROPIC_API_KEY.\n   */\n  engine?:\n    | import(\"../../agent/engine/types.js\").AgentEngine\n    | string\n    | { name: string; config: Record<string, unknown> };\n  /** Route path. Default: /_agent-native/agent-chat */\n  path?: string;\n  /** Custom mention providers for @-tagging template entities */\n  mentionProviders?:\n    | Record<string, MentionProvider>\n    | (() =>\n        | Record<string, MentionProvider>\n        | Promise<Record<string, MentionProvider>>);\n  /** App ID used to exclude self from agent discovery (e.g., \"mail\", \"calendar\") */\n  appId?: string;\n  /** Optional MCP server branding surfaced during the initialize handshake. */\n  mcpServerInfo?: {\n    /** Human-facing title. Defaults to the capitalized app id/name. */\n    title?: string;\n    /** Host-facing description. Defaults to \"Agent-native <app> agent\". */\n    description?: string;\n    /** Canonical app URL. Relative URLs are resolved against the request origin. */\n    websiteUrl?: string;\n    /** App icons. Relative `src` values are resolved against the request origin. */\n    icons?: Array<{\n      src: string;\n      mimeType?: string;\n      sizes?: string[];\n      theme?: \"light\" | \"dark\";\n    }>;\n  };\n  /**\n   * Optional callback to resolve the org ID for the current request.\n   * When provided, the resolved value is set as AGENT_ORG_ID env var so\n   * that db-query/db-exec automatically scope by org_id in addition to\n   * owner_email.\n   *\n   * If not provided, the framework automatically uses `session.orgId` from\n   * Better Auth's active organization. Only provide this callback when you\n   * need custom org resolution logic (e.g., Atlassian org mapping).\n   */\n  resolveOrgId?: (event: any) => string | null | Promise<string | null>;\n  /**\n   * Optional owner resolver for public/anonymous chat surfaces. When the\n   * normal app session is missing, this callback may return a synthetic\n   * owner id for a narrowly-scoped public request (for example, a public\n   * shared document page). Anonymous requests use a read-only tool set by\n   * default so public viewers cannot mutate app data through the agent.\n   */\n  anonymousOwner?: (event: any) => string | null | Promise<string | null>;\n  /**\n   * Keep anonymous-owner requests on read-only template actions. Defaults to\n   * true. Only disable for single-tenant apps that intentionally allow public\n   * agent mutations.\n   */\n  anonymousReadOnly?: boolean;\n  /**\n   * Optional auth adapter for the HTTP action route\n   * (`/_agent-native/actions/*`). Its `resolveCaller` runs before the\n   * cookie/bearer `getSession` chain, letting an app accept caller identities\n   * `getSession` doesn't understand (e.g. an A2A JWT verified with\n   * `verifyA2AToken`) declaratively, instead of pre-seeding request context\n   * from a Nitro `request` hook.\n   *\n   * Returning `null` defers to the normal chain; THROWING hard-rejects with a\n   * 401 (an invalid/forged credential must not fall through to a same-origin\n   * session cookie). A resolved caller's org comes exclusively from the\n   * verified credential — the returned `orgId` or the owner-email membership\n   * lookup — never from the request's session cookie.\n   * See {@link import(\"../action-routes.js\").ActionRouteAuthAdapter}.\n   */\n  actionRouteAuth?: import(\"../action-routes.js\").ActionRouteAuthAdapter;\n  /**\n   * Optional callback to append template-specific context to the system\n   * prompt on each request. Runs after AGENTS.md / skills / memory are\n   * loaded and before the schema block — use it to inject dynamic SQL\n   * context like a data dictionary, active feature flags, or whatever\n   * the agent should know about *right now* for this user/org.\n   *\n   * Return `null` or an empty string to skip. The string you return is\n   * appended verbatim, so wrap it in your own XML tags (e.g.\n   * `<data-dictionary>…</data-dictionary>`) to keep the prompt scannable.\n   *\n   * Called on every request in every prompt variant (lean, lazy, full).\n   * Templates that want to suppress it in a particular mode should return\n   * `null` from the callback based on their own logic.\n   */\n  extraContext?: (\n    event: any,\n    owner: string,\n  ) => string | null | Promise<string | null>;\n  /**\n   * Optional final-answer guard. Templates can use this to require a\n   * corrective retry before accepting a text-only final answer, e.g. forcing\n   * real data-source tool calls for analytics requests.\n   */\n  finalResponseGuard?: AgentLoopFinalResponseGuard;\n  /**\n   * Optional per-template request normalizer. Runs after authentication and\n   * before the model sees the message, so apps can translate chat attachments\n   * into template-native file handles while preserving the user's visible text.\n   */\n  prepareRequest?: (details: {\n    event: any;\n    ownerEmail: string | null;\n    message: string;\n    displayMessage?: string;\n    attachments: AgentChatAttachment[];\n    references: AgentChatReference[];\n    threadId?: string;\n    internalContinuation?: boolean;\n    mode: \"act\" | \"plan\";\n  }) =>\n    | void\n    | {\n        message?: string;\n        displayMessage?: string;\n        attachments?: AgentChatAttachment[];\n      }\n    | Promise<void | {\n        message?: string;\n        displayMessage?: string;\n        attachments?: AgentChatAttachment[];\n      }>;\n  /**\n   * Use ONLY the template's `systemPrompt` and the actions list — skip the\n   * framework prompt wrapper, resource loading (AGENTS.md/LEARNINGS.md/\n   * memory), the SQL schema block, and the workspace files/skills/agents\n   * inventory. Intended for minimal or voice-first apps where a long,\n   * generic preamble adds latency and iteration noise without adding value.\n   *\n   * When set, the same lean prompt is used in both dev and prod modes. In\n   * dev mode the tool registry is ALSO swapped to the template's actions\n   * (same set as prod) — the dev-only bash/db-exec/file-system tools\n   * and the resource/docs/chat/team/job/browser scripts are dropped. The\n   * lean system prompt has no bash-usage guidance, so routing actions\n   * through bash would break. If you need the full dev tool surface,\n   * leave this off.\n   */\n  leanPrompt?: boolean;\n  /**\n   * Skip auto-injecting the workspace files/skills/agents inventory on the\n   * first message of a conversation while keeping the normal prompt, resources,\n   * and tool surface. Use this for domain-focused apps where broad workspace\n   * inventory is mostly latency/noise unless the user explicitly references it.\n   *\n   * `leanPrompt: true` and the default `lazyContext` mode imply this because\n   * those catalogs are already discoverable through resources, docs-search,\n   * tool-search, and the compact resource indexes. Set `false` explicitly only\n   * when a workspace-wide inventory is central to the app's first-turn job.\n   */\n  skipFilesContext?: boolean;\n  /**\n   * Initial native tool schemas to send to the LLM provider. When set, the\n   * agent starts with only these tools plus `tool-search`; the live registry\n   * remains searchable, and matching schemas from `tool-search` results are\n   * loaded into the next model request. Use this for domain-focused apps that\n   * have a few common actions and many rare framework utilities. Common\n   * discovery and resource-reading tools are promoted automatically when\n   * present. Provider, MCP, extension, and code-execution schemas stay behind\n   * tool-search unless the app explicitly includes them in this list.\n   */\n  initialToolNames?: string[];\n  /**\n   * Controls whether broad provider/corpus tools and their workflow prompt are\n   * loaded into the first model request. Use `\"lazy\"` for apps that can answer\n   * ordinary lookups from a compact curated tool set; corpus tools remain\n   * discoverable through tool-search and the full retry surface.\n   *\n   * @default \"initial\"\n   */\n  corpusTools?: \"initial\" | \"lazy\";\n  /**\n   * Use a compact system prompt with on-demand context loading. The system\n   * prompt includes essential behavioral rules and action signatures, but\n   * defers verbose framework details, SQL schema, skills, learnings, and\n   * memory behind tools (`get-framework-context`, `db-schema`,\n   * `resources` (action: read)). The agent fetches these on-demand when needed.\n   *\n   * This reduces the system prompt by ~60-70%, significantly improving\n   * time-to-first-token and reducing \"thinking\" time. The agent retains\n   * all capabilities — it just loads context lazily instead of upfront.\n   *\n   * Defaults to `true`. Set to `false` to use the original full prompt.\n   * Ignored when `leanPrompt` is set (lean mode is even more minimal).\n   */\n  lazyContext?: boolean;\n  /**\n   * In dev mode, register the template's actions as native tools the agent\n   * can call directly with structured JSON args — skipping the default\n   * `bash(command=\"pnpm action <name> ...\")` indirection.\n   *\n   * The default dev behavior shells out because it \"mirrors how Claude Code\n   * works locally\" and reduces empty-object tool calls for templates with\n   * simple string args. But templates whose actions take structured data\n   * (objects, arrays, nested JSON) can't round-trip those cleanly through\n   * the CLI parser — stringified JSON on the way in, loss of type fidelity\n   * on the way out.\n   *\n   * Set to `true` to get the same tool surface in dev that production uses.\n   * `leanPrompt: true` implies this already (lean mode has no bash-usage\n   * guidance, so actions must be native). Set this flag without\n   * `leanPrompt` when you want native actions AND the full system prompt.\n   *\n   * Defaults to `false`.\n   */\n  nativeActionsInDev?: boolean;\n  /**\n   * Expose raw SQL/native database tools to the app agent.\n   *\n   * Defaults to `\"read\"`: `db-schema`/`db-query` are available for inspection,\n   * while writes route through typed app actions. Set to `\"write\"` (also\n   * `true`) to expose `db-exec`/`db-patch` for scoped raw SQL maintenance.\n   * Set to `\"off\"` (also `false`) for chat-first apps that want agents to use\n   * typed actions only.\n   */\n  databaseTools?: DatabaseToolsOption;\n  /**\n   * Expose framework extension management actions (`create-extension`,\n   * `update-extension`, `list-extensions`, etc.) to the app agent. Defaults to\n   * false. Set to true for apps that intentionally let the LLM create or\n   * manage sandboxed extension mini-apps. Core extension routes may still be\n   * mounted for compatibility and app-owned surfaces.\n   */\n  extensionTools?: boolean;\n  /**\n   * Optional A2A-only deterministic response path. Runs after inbound A2A text\n   * and user context are resolved, but before an agent engine/model is loaded.\n   * Return a message to complete the A2A task without invoking the LLM, or\n   * null/undefined to continue through the normal agent loop.\n   */\n  a2aMessageFallback?: (details: {\n    message: import(\"../../a2a/types.js\").Message;\n    text: string;\n    context: import(\"../../a2a/types.js\").A2AHandlerContext;\n    userEmail: string | undefined;\n  }) =>\n    | import(\"../../a2a/types.js\").Message\n    | string\n    | null\n    | undefined\n    | Promise<import(\"../../a2a/types.js\").Message | string | null | undefined>;\n  /**\n   * Optional injectable prompt examples for core rules (rule 5 auto-refresh\n   * examples and rule 8 external provider names). When absent, generic\n   * placeholders are used so no template-specific names appear in the core\n   * prompt by default.\n   *\n   * - `providerActions`: external provider action names this template exposes\n   *   (e.g. `[\"warehouse-query\", \"crm-records\"]` for a template).\n   * - `appActions`: representative template action names for rule 5's refresh\n   *   examples (e.g. `[\"log-meal\", \"update-form\"]` for a forms template).\n   */\n  promptExamples?: PromptExamples;\n  /**\n   * Curated allow-list of action names to serve external **connector** clients\n   * on a hosted multi-tenant deployment.\n   *\n   * Whenever this list is non-empty it is active by default for **every**\n   * caller (hosted connectors, code/stdio clients, and the local CLI): external\n   * MCP clients see (and can call) only these actions plus the builtin\n   * cross-app tools (`list_apps`, `open_app`, `ask_app`, `create_embed_session`).\n   * Calls to any tool outside the list are rejected with \"Unknown tool\".\n   * This prevents the full ~105-tool catalog from bloating external-agent\n   * context windows and removes footguns (db-exec, seed-*, extension suite,\n   * browser-session tools) from connectors. It is no longer gated behind an\n   * environment variable, and the catalog is never inferred from the client.\n   *\n   * `tool-search` stays available for discovery; a trimmed action still needs\n   * the connector catalog, authenticated-read policy, or full-catalog opt-in\n   * before an external caller can execute it.\n   * Callers who need the full surface up front opt in explicitly with\n   * `agent-native connect --full-catalog` (embeds a `catalog_scope: \"full\"`\n   * claim in their connect-minted JWT) or the deployment-wide\n   * `AGENT_NATIVE_MCP_FULL_CATALOG=1` env override.\n   *\n   * Declare here rather than in MCPConfig directly; the plugin copies it through.\n   */\n  connectorCatalog?: string[];\n\n  /**\n   * Default authenticated external-agent policy. In `auto` read mode, every\n   * action explicitly marked as GET + readOnly + publicAgent.requiresAuth is\n   * added to the connector surface automatically. Writes remain ask_app-only\n   * unless `writes: \"allowlisted\"` is explicitly selected.\n   */\n  externalAgents?: ExternalAgentPolicy;\n\n  /**\n   * Skip mounting the remote MCP protocol route.\n   *\n   * Most apps should leave this off so agent chat, A2A, and MCP share one\n   * runtime. Hosted apps with a dedicated early MCP plugin can set this to\n   * true so their external connector does not depend on the heavier chat\n   * plugin initialization path.\n   */\n  disableMcp?: boolean;\n\n  /**\n   * Code-execution capability for the production agent.\n   *\n   * - `\"off\"` (default) — no code-execution tools in production.\n   * - `\"sandboxed\"` — registers the `run-code` tool (isolated Node.js sandbox\n   *   with a bridge to allowlisted registered tools). Safe for shared or\n   *   hosted deployments.\n   * - `\"trusted\"` — registers both the full coding tool registry\n   *   (bash / read / edit / write) and the `run-code` sandbox. Only use in\n   *   single-tenant or operator-controlled deployments where full shell access\n   *   to the host machine is intentional.\n   *\n   * The `AGENT_PROD_CODE_EXECUTION` environment variable (`\"trusted\"`,\n   * `\"sandboxed\"`, or `\"off\"`) takes precedence over this option, allowing\n   * per-deployment overrides without code changes.\n   *\n   * Dev-mode behavior is unchanged — both the coding tools and `run-code` are\n   * always available when the environment allows toggling.\n   */\n  codeExecution?: {\n    production?: \"off\" | \"sandboxed\" | \"trusted\";\n    /**\n     * Extra registered-tool names the sandbox bridge may forward (beyond the\n     * default allowlist: provider-api-request, provider-api-docs,\n     * provider-api-catalog, web-request).\n     */\n    bridgeTools?: string[];\n  };\n\n  /**\n   * App-level default tool-call limits. Individual actions override these with\n   * their own `timeoutMs` / `maxResultChars` declarations.\n   */\n  toolLimits?: { timeoutMs?: number; maxResultChars?: number };\n}\n"]}

package/dist/server/agent-chat/script-entries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"script-entries.d.ts","sourceRoot":"","sources":["../../../src/server/agent-chat/script-entries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAQnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAyDvE;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,iBAA0B,EAChC,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACzC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAkJtC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CA2EA;AAED;;GAEG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAW3E;AAED,wBAAsB,2BAA2B,IAAI,OAAO,CAC1D,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAuPA;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAqJA;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAqBtC;AAED;;;GAGG;AACH,wBAAsB,oCAAoC,IAAI,OAAO,CACnE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAUA;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAwBtC"}
+{"version":3,"file":"script-entries.d.ts","sourceRoot":"","sources":["../../../src/server/agent-chat/script-entries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAQnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAyDvE;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,iBAA0B,EAChC,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACzC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAkJtC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CA2EA;AAED;;GAEG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAW3E;AAED,wBAAsB,2BAA2B,IAAI,OAAO,CAC1D,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAkQA;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CA0JA;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CA0BtC;AAED;;;GAGG;AACH,wBAAsB,oCAAoC,IAAI,OAAO,CACnE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAUA;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAsDtC"}

package/dist/server/agent-chat/script-entries.js

@@ -54,7 +54,7 @@ export async function createDbScriptEntries(mode = "read", options = {}) {
     try {
         if (mode === "off")
             return {};
-        const extensionQueryGuidance = options.extensionTools === false
+        const extensionQueryGuidance = options.extensionTools !== true
             ? "Extension management tools are disabled for this app; do not query or mutate the legacy tools table as a workaround."
             : "For extension management, use list-extensions, update-extension, hide-extension, or delete-extension instead of querying the legacy tools table.";
         const [schemaMod, queryMod] = await Promise.all([
@@ -337,6 +337,15 @@ export async function createResourceScriptEntries() {
                         required: ["action"],
                     },
                 },
+                planMode: {
+                    effect: (args) => args.action === "list" ||
+                        args.action === "read" ||
+                        args.action === "effective"
+                        ? "read"
+                        : "write",
+                    allowedValues: { action: ["list", "read", "effective"] },
+                    description: "Plan mode allows listing and reading workspace resources.",
+                },
                 run: async (args) => {
                     const { action: a, ...rest } = args;
                     if (a === "list")
@@ -539,6 +548,11 @@ export async function createChatScriptEntries() {
                         required: ["action"],
                     },
                 },
+                planMode: {
+                    effect: (args) => (args.action === "search" ? "read" : "write"),
+                    allowedValues: { action: ["search"] },
+                    description: "Plan mode allows searching chat history.",
+                },
                 run: async (args) => {
                     if (args?.action === "open") {
                         return openEntry.run(args);
@@ -601,6 +615,11 @@ export async function createAgentEngineScriptEntries(appId) {
         return {
             "manage-agent-engine": {
                 tool: mod.tool,
+                planMode: {
+                    effect: (args) => (args.action === "list" ? "read" : "write"),
+                    allowedValues: { action: ["list"] },
+                    description: "Plan mode allows listing available agent engines.",
+                },
                 run: (args) => mod.run({
                     ...args,
                     appId: typeof args.appId === "string" && args.appId.trim()
@@ -639,6 +658,28 @@ export async function createCallAgentScriptEntry(selfAppId) {
         const mod = await import("../../scripts/call-agent.js");
         entries["call-agent"] = {
             tool: mod.tool,
+            planMode: {
+                effect: (args) => {
+                    const keys = Object.keys(args);
+                    if (keys.some((key) => key !== "agent" && key !== "action" && key !== "input")) {
+                        return "write";
+                    }
+                    if (typeof args.agent !== "string" ||
+                        !args.agent.trim() ||
+                        typeof args.action !== "string" ||
+                        !args.action.trim() ||
+                        !Object.hasOwn(args, "input") ||
+                        args.input === null ||
+                        typeof args.input !== "object" ||
+                        Array.isArray(args.input)) {
+                        return "unknown";
+                    }
+                    return "read";
+                },
+                allowedProperties: ["agent", "action", "input"],
+                requiredProperties: ["agent", "action"],
+                description: "Plan mode allows only exact read-only cross-app action calls with agent, action, and input.",
+            },
             run: (args, context) => mod.run(args, context, selfAppId),
         };
     }
@@ -650,6 +691,7 @@ export async function createCallAgentScriptEntry(selfAppId) {
         entries["describe-workspace-apps"] = {
             tool: mod.tool,
             run: (args, context) => mod.run(args, context, selfAppId),
+            readOnly: true,
         };
     }
     catch {