@agent-native/core 0.130.2 → 0.131.3

package/corpus/templates/slides/server/handlers/google-docs-auth.ts

@@ -12,7 +12,6 @@ import {
 import {
   defineEventHandler,
   getQuery,
-  sendRedirect,
   setResponseStatus,
   type H3Event,
 } from "h3";
@@ -98,7 +97,10 @@ export const getGoogleDocsAuthUrlHandler = defineEventHandler(
       });
       const url = await getGoogleDocsAuthUrl(redirectUri, state, owner);
       if (q.redirect === "1") {
-        return sendRedirect(event, url, 302);
+        return new Response(null, {
+          status: 302,
+          headers: { Location: url },
+        });
       }
       return { url };
     } catch (error) {

package/corpus/templates/slides/server/handlers/image-providers/builder.ts

@@ -0,0 +1,305 @@
+import {
+  getBuilderImageGenerationBaseUrl,
+  resolveBuilderCredentialsDetailed,
+} from "@agent-native/core/server";
+
+import type {
+  ImageProvider,
+  ImageProviderConfig,
+  ImageGenerationResult,
+  ReferenceImage,
+} from "./types.js";
+
+const REQUEST_TIMEOUT_MS = 90_000;
+const MAX_ATTEMPTS = 3;
+const RETRY_DELAY_MS = 3_000;
+
+// "auto" lets Builder pick a model (normally Gemini, which supports the
+// style reference images). Some connected Google Cloud projects don't have
+// Vertex AI access to any Gemini image publisher model, which surfaces as a
+// 404/400 from Builder's gateway regardless of retries — that's a project
+// access problem, not a transient one, so fall back to Builder's OpenAI path
+// instead of failing the whole request.
+const MODEL_FALLBACK_CHAIN = ["auto", "gpt-image-1"];
+
+interface BuilderImageGenerationResponse {
+  id: string;
+  model: { publicId: string; provider: string };
+  outputs: Array<{ url?: string; downloadUrl?: string; mimeType?: string }>;
+}
+
+/**
+ * Builder-managed generation lets a deck author with a connected Builder.io
+ * account generate images without bringing their own Gemini/OpenAI key —
+ * Builder's gateway holds the provider credentials. `isConfigured()` only
+ * has env available (sync), so it under-reports until a request can check
+ * the per-user/org connection via `isConfiguredForRequest()`.
+ */
+export class BuilderProvider implements ImageProvider {
+  name = "builder";
+
+  // Builder credentials are scoped per-user/org and must only be read via
+  // resolveBuilderCredentials(), never process.env directly (even for a sync
+  // existence check), so the real check always happens in
+  // isConfiguredForRequest(), which providerIsConfigured() in ./index.ts
+  // always prefers when it's defined. This sync fallback is never relied on.
+  isConfigured(): boolean {
+    return false;
+  }
+
+  async isConfiguredForRequest(): Promise<boolean> {
+    const creds = await resolveBuilderCredentialsDetailed();
+    if (creds.lookupFailed) return true;
+    return !!(creds.privateKey && creds.publicKey);
+  }
+
+  async generate(
+    prompt: string,
+    referenceImages: ReferenceImage[] = [],
+    _context?: { slideContent?: string; deckText?: string },
+    config?: ImageProviderConfig,
+  ): Promise<ImageGenerationResult> {
+    const creds = await resolveBuilderCredentialsDetailed();
+    if (creds.lookupFailed) {
+      throw new Error(
+        "Could not verify your Builder.io connection right now. Please try again.",
+      );
+    }
+    if (!creds.privateKey || !creds.publicKey) {
+      throw new Error(
+        "Builder.io is not fully connected for managed image generation.",
+      );
+    }
+
+    const baseUrl = getBuilderImageGenerationBaseUrl().replace(/\/$/, "");
+    const references = referenceImages.map((ref, i) => ({
+      id: `ref-${i}`,
+      role: "style",
+      mimeType: ref.mimeType,
+      data: ref.data,
+    }));
+
+    let lastError: Error = new Error(
+      "Builder-managed image generation failed.",
+    );
+
+    for (const model of MODEL_FALLBACK_CHAIN) {
+      const outcome = await requestModel({
+        baseUrl,
+        privateKey: creds.privateKey,
+        publicKey: creds.publicKey,
+        userId: creds.userId,
+        model,
+        prompt,
+        references,
+        config,
+      });
+      if (outcome.kind === "success") return outcome.result;
+      lastError = outcome.error;
+      if (outcome.kind === "permanent") throw outcome.error;
+    }
+
+    throw lastError;
+  }
+}
+
+type ModelOutcome =
+  | { kind: "success"; result: ImageGenerationResult }
+  | { kind: "retryable"; error: Error }
+  | { kind: "permanent"; error: Error };
+
+async function requestModel(args: {
+  baseUrl: string;
+  privateKey: string;
+  publicKey: string;
+  userId: string | null;
+  model: string;
+  prompt: string;
+  references: Array<{
+    id: string;
+    role: string;
+    mimeType: string;
+    data: string;
+  }>;
+  config?: ImageProviderConfig;
+}): Promise<ModelOutcome> {
+  const {
+    baseUrl,
+    privateKey,
+    publicKey,
+    userId,
+    model,
+    prompt,
+    references,
+    config,
+  } = args;
+  // Stable idempotency key: retries reuse it so a client-side timeout
+  // replays the in-progress/finished result instead of starting (and
+  // billing) a second generation.
+  const idempotencyKey = `slides-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const requestBody = {
+    idempotencyKey,
+    prompt,
+    model,
+    count: 1,
+    aspectRatio: toBuilderAspectRatio(config?.aspectRatio, model),
+    size: "1K",
+    outputFormat: config?.outputFormat || "png",
+    references,
+    source: { appId: "slides", feature: "generate-image" },
+  };
+
+  let lastError: Error = new Error("Builder-managed image generation failed.");
+
+  for (let attempt = 0; attempt < MAX_ATTEMPTS; attempt++) {
+    if (attempt > 0) {
+      await new Promise((r) => setTimeout(r, attempt * RETRY_DELAY_MS));
+    }
+
+    let response: Response;
+    try {
+      response = await fetch(`${baseUrl}/generations`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${privateKey}`,
+          "x-builder-api-key": publicKey,
+          "Content-Type": "application/json",
+          ...(userId ? { "x-builder-user-id": userId } : {}),
+        },
+        body: JSON.stringify(requestBody),
+        signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+      });
+    } catch (err) {
+      const name = (err as Error)?.name;
+      lastError =
+        name === "AbortError" || name === "TimeoutError"
+          ? new Error("Builder-managed image generation timed out.")
+          : (err as Error);
+      continue;
+    }
+
+    if (!response.ok) {
+      const text = await response.text().catch(() => "");
+      lastError = new Error(
+        `Builder-managed image generation failed (${response.status})${text ? `: ${text}` : "."}`,
+      );
+      if (isModelUnavailableError(response.status, text)) {
+        return { kind: "retryable", error: lastError };
+      }
+      if (isTransientError(response.status)) continue;
+      return { kind: "permanent", error: lastError };
+    }
+
+    let body: BuilderImageGenerationResponse;
+    try {
+      body = (await response.json()) as BuilderImageGenerationResponse;
+    } catch {
+      lastError = new Error(
+        "Builder-managed image generation returned a malformed response.",
+      );
+      continue;
+    }
+    const output = body.outputs?.[0];
+    const sourceUrl = output?.downloadUrl ?? output?.url;
+    if (!sourceUrl) {
+      return {
+        kind: "permanent",
+        error: new Error(
+          "Builder-managed image generation returned no image URL.",
+        ),
+      };
+    }
+
+    let imageResponse: Response;
+    try {
+      imageResponse = await fetch(sourceUrl, {
+        signal: AbortSignal.timeout(30_000),
+      });
+    } catch (err) {
+      // Network blip / CDN timeout downloading the already-generated image:
+      // retryable (and falls through to the next model in the chain if
+      // every attempt here is exhausted), not a permanent failure.
+      const name = (err as Error)?.name;
+      lastError =
+        name === "AbortError" || name === "TimeoutError"
+          ? new Error("Timed out downloading the Builder-generated image.")
+          : (err as Error);
+      continue;
+    }
+    if (!imageResponse.ok) {
+      lastError = new Error(
+        `Could not download Builder-generated image (${imageResponse.status}).`,
+      );
+      if (isTransientError(imageResponse.status)) continue;
+      return { kind: "permanent", error: lastError };
+    }
+
+    return {
+      kind: "success",
+      result: {
+        imageData: Buffer.from(await imageResponse.arrayBuffer()),
+        mimeType:
+          output.mimeType ||
+          imageResponse.headers.get("content-type") ||
+          "image/png",
+        model: body.model?.publicId || model,
+        provider: "builder",
+      },
+    };
+  }
+
+  return { kind: "retryable", error: lastError };
+}
+
+function isTransientError(status: number): boolean {
+  return [429, 500, 503, 504].includes(status);
+}
+
+function isModelUnavailableError(
+  status: number,
+  responseText: string,
+): boolean {
+  if (status !== 404 && status !== 502 && status !== 400) return false;
+  return /publisher model|not_found|NOT_FOUND|unknown_model|unknown image model/i.test(
+    responseText,
+  );
+}
+
+// gpt-image-* only supports a landscape/square/portrait triplet, unlike
+// Gemini's wider set on Builder's gateway — map to the closest one instead
+// of sending a ratio the requested model will 400 on.
+const OPENAI_ASPECT_RATIOS = new Set(["1:1", "2:3", "3:2"]);
+const GEMINI_ASPECT_RATIOS = new Set([
+  "1:1",
+  "2:3",
+  "3:2",
+  "3:4",
+  "4:3",
+  "9:16",
+  "16:9",
+  "21:9",
+]);
+
+function toBuilderAspectRatio(
+  aspectRatio: string | undefined,
+  model: string,
+): string {
+  const isOpenAiModel = model.startsWith("gpt-image");
+  const supported = isOpenAiModel ? OPENAI_ASPECT_RATIOS : GEMINI_ASPECT_RATIOS;
+  if (aspectRatio && supported.has(aspectRatio)) return aspectRatio;
+
+  if (isOpenAiModel) {
+    if (aspectRatio === "4:5" || aspectRatio === "9:16") return "2:3";
+    if (
+      aspectRatio === "5:4" ||
+      aspectRatio === "16:9" ||
+      aspectRatio === "21:9"
+    )
+      return "3:2";
+    return "3:2";
+  }
+
+  if (aspectRatio === "4:5") return "3:4";
+  if (aspectRatio === "5:4") return "4:3";
+  return "16:9";
+}

package/corpus/templates/slides/server/handlers/image-providers/index.ts

@@ -1,8 +1,10 @@
+import { BuilderProvider } from "./builder.js";
 import { GeminiProvider } from "./gemini.js";
 import { OpenAIProvider } from "./openai.js";
 import type { ImageProvider } from "./types.js";
 
 const providers: Record<string, () => ImageProvider> = {
+  builder: () => new BuilderProvider(),
   gemini: () => new GeminiProvider(),
   openai: () => new OpenAIProvider(),
 };
@@ -24,14 +26,15 @@ export async function getProvider(name?: string): Promise<ImageProvider> {
     return p;
   }
 
-  // Auto: prefer gemini (has reference image support), fall back to openai
-  for (const key of ["gemini", "openai"]) {
+  // Auto: prefer a connected Builder.io account (no BYOK needed), then
+  // gemini (has reference image support), then openai.
+  for (const key of ["builder", "gemini", "openai"]) {
     const p = providers[key]!();
     if (await providerIsConfigured(p)) return p;
   }
 
   throw new Error(
-    "No image generation provider configured. Save GEMINI_API_KEY or OPENAI_API_KEY in settings.",
+    "No image generation provider configured. Connect Builder.io, or save GEMINI_API_KEY or OPENAI_API_KEY in settings.",
   );
 }
 

package/corpus/templates/slides/server/plugins/agent-chat.ts

@@ -14,6 +14,7 @@ const INITIAL_TOOL_NAMES = [
   "view-screen",
   "list-decks",
   "get-deck",
+  "get-deck-reference-context",
   "create-deck",
   "add-slide",
   "update-slide",

package/corpus/templates/slides/server/workspace-defaults.ts

@@ -0,0 +1,169 @@
+import { canManageOrg, orgMembers, type OrgRole } from "@agent-native/core/org";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server/request-context";
+import { getOrgSetting, mutateOrgSetting } from "@agent-native/core/settings";
+import { and, eq, sql } from "drizzle-orm";
+
+import { getDb, schema } from "./db/index.js";
+
+const WORKSPACE_DEFAULTS_KEY = "slides.brand-defaults";
+
+export interface WorkspaceDefaults {
+  referenceDeckId: string | null;
+  designSystemId: string | null;
+}
+
+const EMPTY_DEFAULTS: WorkspaceDefaults = {
+  referenceDeckId: null,
+  designSystemId: null,
+};
+
+function readId(value: unknown): string | null {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+
+/**
+ * Workspace defaults live on the org, so a caller with no org (personal
+ * context, CLI, cron) genuinely has none — that is absent, not unreadable, and
+ * every read below distinguishes the two by letting store failures propagate.
+ */
+export async function getWorkspaceDefaults(): Promise<WorkspaceDefaults> {
+  const orgId = getRequestOrgId();
+  if (!orgId) return EMPTY_DEFAULTS;
+  const raw = await getOrgSetting(orgId, WORKSPACE_DEFAULTS_KEY);
+  if (!raw) return EMPTY_DEFAULTS;
+  return {
+    referenceDeckId: readId(raw.referenceDeckId),
+    designSystemId: readId(raw.designSystemId),
+  };
+}
+
+export async function getCallerOrgRole(): Promise<OrgRole | null> {
+  const orgId = getRequestOrgId();
+  const email = getRequestUserEmail();
+  if (!orgId || !email) return null;
+  const rows = await getDb()
+    .select({ role: orgMembers.role })
+    .from(orgMembers)
+    .where(
+      and(
+        eq(orgMembers.orgId, orgId),
+        eq(sql`lower(${orgMembers.email})`, email.toLowerCase()),
+      ),
+    )
+    .limit(1);
+  const role = rows[0]?.role;
+  return role === "owner" || role === "admin" || role === "member"
+    ? role
+    : null;
+}
+
+export async function canManageWorkspaceDefaults(): Promise<boolean> {
+  return canManageOrg(await getCallerOrgRole());
+}
+
+async function assertWorkspaceAdmin(): Promise<string> {
+  const orgId = getRequestOrgId();
+  if (!orgId) {
+    throw Object.assign(
+      new Error(
+        "Workspace defaults belong to an organization. Switch out of Personal context to set them.",
+      ),
+      { statusCode: 400 },
+    );
+  }
+  if (!canManageOrg(await getCallerOrgRole())) {
+    throw Object.assign(
+      new Error("Only workspace admins can change the workspace defaults."),
+      { statusCode: 403 },
+    );
+  }
+  return orgId;
+}
+
+export async function writeWorkspaceDefaults(
+  patch: Partial<WorkspaceDefaults>,
+): Promise<WorkspaceDefaults> {
+  const orgId = await assertWorkspaceAdmin();
+  const next = await mutateOrgSetting(
+    orgId,
+    WORKSPACE_DEFAULTS_KEY,
+    (raw: Record<string, unknown> | null) => {
+      const current: WorkspaceDefaults = raw
+        ? {
+            referenceDeckId: readId(raw.referenceDeckId),
+            designSystemId: readId(raw.designSystemId),
+          }
+        : EMPTY_DEFAULTS;
+      return { ...current, ...patch };
+    },
+  );
+  return {
+    referenceDeckId: readId(next.referenceDeckId),
+    designSystemId: readId(next.designSystemId),
+  };
+}
+
+/**
+ * A default nobody else can open is worse than no default: every teammate's
+ * first prompt would 404 on the reference lookup and silently produce an
+ * off-brand deck. Refuse to set one that is still private, and refuse an
+ * `org`-visible resource that belongs to a different org than the one it is
+ * being set as the default for — an individual viewer share on the caller's
+ * side must not make a foreign org's resource resolvable workspace-wide.
+ */
+export async function assertWorkspaceVisible(
+  kind: "deck" | "design-system",
+  id: string,
+): Promise<void> {
+  const t = kind === "deck" ? schema.decks : schema.designSystems;
+  const rows = await getDb()
+    .select({ visibility: t.visibility, orgId: t.orgId })
+    .from(t)
+    .where(eq(t.id, id))
+    .limit(1);
+  if (rows.length === 0) {
+    throw Object.assign(new Error(`${kind} not found`), { statusCode: 404 });
+  }
+  const { visibility, orgId } = rows[0];
+  if (visibility === "private") {
+    throw Object.assign(
+      new Error(
+        `This ${kind} is private, so nobody else in the workspace could use it. Share it with the workspace first, then set it as the default.`,
+      ),
+      { statusCode: 400 },
+    );
+  }
+  if (visibility === "org" && orgId !== getRequestOrgId()) {
+    throw Object.assign(
+      new Error(
+        `This ${kind} belongs to a different organization, so this workspace's members could not use it. Share it with this workspace first, then set it as the default.`,
+      ),
+      { statusCode: 400 },
+    );
+  }
+}
+
+/**
+ * Design-system precedence: an explicit pick wins, then the caller's own
+ * default, then the workspace default. A user who never set one still gets
+ * on-brand output; one who did keeps their choice.
+ */
+export async function resolveDefaultDesignSystemId(
+  ownerEmail: string,
+): Promise<string | null> {
+  const personal = await getDb()
+    .select({ id: schema.designSystems.id })
+    .from(schema.designSystems)
+    .where(
+      and(
+        eq(schema.designSystems.ownerEmail, ownerEmail),
+        eq(schema.designSystems.isDefault, true),
+      ),
+    )
+    .limit(1);
+  if (personal[0]?.id) return personal[0].id;
+  return (await getWorkspaceDefaults()).designSystemId;
+}

package/corpus/templates/tasks/.agents/skills/agent-native-toolkit/SKILL.md

@@ -117,6 +117,11 @@ in the moment of agent use.
   missing-secret states, OAuth grants, and provider connection health.
 - **Agent UX kit**: sidebar, composer, staged context, mentions, voice, human
   approval, generative UI, progress, and screen-state exposure.
+- **Custom block kit**: optional extension creation, viewer chrome, slots, and
+  promotion affordances. Apps must opt in; Core keeps the sandbox, SQL storage,
+  access checks, and compatibility routes, while Toolkit owns reusable adoption
+  UI. Analytics may expose this as one-off **Custom Blocks**; durable behavior
+  should be promoted to app code.
 - **Chat history kit**: presentational chat lists and recent-chat rails belong
   in Toolkit; Core keeps thread persistence, agent execution, transport, and
   page-to-sidebar handoff. Use Toolkit's `ChatHistoryRail` for the standard

package/corpus/templates/tasks/app/components/layout/Sidebar.tsx

@@ -1,13 +1,16 @@
 import { appPath } from "@agent-native/core/client/api-path";
 import { useT } from "@agent-native/core/client/i18n";
+import { openCommandMenu } from "@agent-native/core/client/navigation";
 import { OrgSwitcher } from "@agent-native/core/client/org";
 import { FeedbackButton } from "@agent-native/core/client/ui";
+import { SidebarFooterActions } from "@agent-native/toolkit/app-shell";
 import {
   IconCheckbox,
   IconForms,
   IconInbox,
   IconLayoutSidebarLeftCollapse,
   IconLayoutSidebarLeftExpand,
+  IconSearch,
   IconSettings,
 } from "@tabler/icons-react";
 import { Link, useLocation } from "react-router";
@@ -84,6 +87,28 @@ export function Sidebar({
       </TooltipContent>
     </Tooltip>
   ) : null;
+  const searchButton = (
+    <Tooltip>
+      <TooltipTrigger asChild>
+        <button
+          type="button"
+          onClick={openCommandMenu}
+          aria-label={t("sidebar.search")}
+          className="flex size-8 items-center justify-center rounded-md text-sidebar-foreground/65 transition-colors hover:bg-sidebar-accent hover:text-sidebar-accent-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+        >
+          <IconSearch className="size-4" />
+        </button>
+      </TooltipTrigger>
+      <TooltipContent side="right">{t("sidebar.search")}</TooltipContent>
+    </Tooltip>
+  );
+  const feedbackButton = (
+    <FeedbackButton
+      variant={collapsed ? "icon" : "sidebar"}
+      className={collapsed ? "size-8" : "min-w-0"}
+      side="right"
+    />
+  );
 
   return (
     <aside
@@ -219,14 +244,12 @@ export function Sidebar({
           />
         </div>
 
-        {!collapsed ? (
-          <div className="flex items-center justify-end gap-1 border-t border-sidebar-border px-3 py-2">
-            <FeedbackButton className="min-w-0 flex-1" side="right" />
-            {collapseButton}
-          </div>
-        ) : collapseButton ? (
-          <div className="flex justify-center px-1 py-1">{collapseButton}</div>
-        ) : null}
+        <SidebarFooterActions
+          collapsed={collapsed}
+          feedback={feedbackButton}
+          search={searchButton}
+          collapse={collapseButton}
+        />
       </div>
     </aside>
   );

package/corpus/templates/tasks/app/i18n/en-US.ts

@@ -16,6 +16,7 @@ const messages = {
     navInbox: "Inbox",
     navTasks: "Tasks",
     navFields: "Fields",
+    search: "Search",
     collapseSidebar: "Collapse sidebar",
     expandSidebar: "Expand sidebar",
     navigationTitle: "Navigation",
@@ -29,6 +30,12 @@ const messages = {
     pageExtension: "Extension",
     pageExtensions: "Extensions",
   },
+  settings: {
+    languageTitle: "Language",
+    languageDescription:
+      "Choose the interface language. This preference is saved for your account.",
+    languageLabel: "Interface language",
+  },
   agent: {
     emptyState: "Ask the agent to inspect or change this app.",
     suggestionCalendar: "Check my calendar and mails - any tasks for today?",

package/corpus/templates/tasks/app/routes/settings.tsx

@@ -1,10 +1,18 @@
-import { useT } from "@agent-native/core/client/i18n";
+import { LanguagePicker, useT } from "@agent-native/core/client/i18n";
 import {
   SettingsTabsPage,
   useAgentSettingsTabs,
 } from "@agent-native/core/client/settings";
 import { useSetPageTitle } from "@agent-native/toolkit/app-shell";
 
+import {
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from "@/components/ui/card";
+import { Label } from "@/components/ui/label";
 import { APP_TITLE } from "@/lib/app-config";
 
 export function meta() {
@@ -20,10 +28,25 @@ export default function SettingsRoute() {
     <SettingsTabsPage
       extraTabs={agentSettingsTabs}
       general={
-        <div className="mx-auto w-full max-w-2xl">
+        <div className="mx-auto w-full max-w-2xl space-y-6">
           <p className="text-sm leading-6 text-muted-foreground">
             {t("header.pageSettings")}
           </p>
+
+          <Card id="language" className="scroll-mt-16">
+            <CardHeader>
+              <CardTitle className="text-base">
+                {t("settings.languageTitle")}
+              </CardTitle>
+              <CardDescription>
+                {t("settings.languageDescription")}
+              </CardDescription>
+            </CardHeader>
+            <CardContent className="max-w-xs space-y-1.5">
+              <Label>{t("settings.languageLabel")}</Label>
+              <LanguagePicker label={t("settings.languageLabel")} />
+            </CardContent>
+          </Card>
         </div>
       }
     />

package/corpus/templates/tasks/changelog/2026-07-29-sidebar-footers-now-keep-feedback-search-and-collapse-togeth.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-29
+---
+
+Sidebar footers now keep Feedback, Search, and Collapse together, with language preferences available in Settings.