@agent-native/core 0.131.2 → 0.131.4

package/corpus/README.md

@@ -30,4 +30,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 - core files: 1642
 - toolkit files: 160
-- template files: 7176
+- template files: 7192

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @agent-native/core
 
+## 0.131.4
+
+### Patch Changes
+
+- 13f7e6b: Simplify the agent panel's error-recovery copy and move it into the message catalog, so it no longer shows untranslated English or explains the failure as an "internal UI error".
+
+## 0.131.3
+
+### Patch Changes
+
+- 5b67dea: Advertise A2A action input schemas in capability details.
+- 5b67dea: Stop apps from handing each other raw queries to execute. An action whose input
+  is a program the receiver runs — `sql`, `code`, `script`, `expression` — is no
+  longer invocable by a sibling app over A2A.
+
+  The app that owns the data owns its schema, data dictionary, reference
+  dashboards, and dialect quirks. A calling app has none of that, so passing SQL
+  across apps makes every caller reimplement the owner's schema knowledge from
+  guesses, and each copy silently rots the next time the owner's shape changes.
+  Callers ask the owning app a question, or call a shaped action that takes
+  semantic parameters; the owner forms the query. `publicAgent.allowRawQueryInput`
+  opts a specific action out when that is genuinely the right call.
+
+  `query` is deliberately not treated as a raw query field: across the templates
+  it is natural-language search text (Brain's `search-everything`,
+  `search-knowledge`), and blocking it would break the ask-don't-instruct calls
+  this rule exists to encourage. MCP and in-app tool surfaces are unchanged — this
+  narrows cross-app invocation only.
+
+  Agent cards also now publish each advertised skill's `inputSchema`, and
+  `describe-workspace-apps` renders it as `input: { field*: type }`. Advertising an
+  action without its parameters is what led callers to invoke it with `{}` and fail
+  on a required field.
+
 ## 0.131.2
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.131.2",
+  "version": "0.131.4",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/a2a/types.ts

@@ -85,6 +85,12 @@ export interface AgentSkill {
   requiresAuth?: boolean;
   isConsequential?: boolean;
   publicAgent?: PublicAgentActionConfig;
+  /**
+   * JSON Schema for the action's `input`. Advertising a skill without it tells a
+   * caller the action exists but not how to call it, so callers invoke with `{}`
+   * and get a required-property error back.
+   */
+  inputSchema?: Record<string, unknown>;
 }
 
 export interface AgentCapabilities {

package/corpus/core/src/action.ts

@@ -200,6 +200,19 @@ export interface PublicAgentActionConfig {
   isConsequential?: boolean;
   title?: string;
   description?: string;
+  /**
+   * Allow a sibling app to invoke this action over A2A even though its input is
+   * a free-form query or program (`sql`, `query`, `code`, `script`,
+   * `expression`).
+   *
+   * Off by default and rarely correct. The app that owns the data owns its
+   * schema, data dictionary, and reference queries; a caller has none of that,
+   * so passing raw SQL across apps makes every caller reimplement the owner's
+   * schema knowledge and silently break when it changes. Prefer a semantic
+   * action the owner implements, or let the caller ask in natural language and
+   * form the query yourself.
+   */
+  allowRawQueryInput?: boolean;
 }
 
 export type ActionPlanModeEffect = "read" | "write" | "unknown";

package/corpus/core/src/client/AgentPanel.tsx

@@ -2585,47 +2585,71 @@ class AgentPanelErrorBoundary extends React.Component<
       assistantUiRecoverableRenderErrorKind(this.state.error) &&
       this.state.staleIndexRecoveryCount < 2
     ) {
-      return (
-        <div className="flex h-full items-center justify-center p-6 text-center text-xs text-muted-foreground">
-          Reloading chat UI...
-        </div>
-      );
+      return <AgentPanelReloadingNotice />;
     }
 
     return (
-      <div className="flex h-full flex-col items-center justify-center gap-3 p-6 text-center">
-        <div className="max-w-[260px] space-y-1">
-          <p className="text-sm font-medium text-foreground">
-            Agent panel hit an internal UI error.
-          </p>
-          <p className="text-xs leading-relaxed text-muted-foreground">
-            The app is still usable. Reset the panel to reload the chat UI.
-          </p>
-        </div>
-        <button
-          type="button"
-          className="rounded-md border border-border bg-background px-3 py-1.5 text-xs font-medium text-foreground hover:bg-accent"
-          onClick={() => {
-            this.setState({ error: null, staleIndexRecoveryCount: 0 });
-            this.props.onReset();
-          }}
-        >
-          Reset agent panel
-        </button>
-        <ErrorReportActions
-          appName="Agent panel"
-          title="Agent panel UI error"
-          details={this.state.error.message}
-          issueTitle="Agent panel UI error"
-          className="max-w-[260px]"
-          feedbackClassName="h-7"
-          githubClassName="h-7"
-        />
-      </div>
+      <AgentPanelErrorFallback
+        details={this.state.error.message}
+        onReset={() => {
+          this.setState({ error: null, staleIndexRecoveryCount: 0 });
+          this.props.onReset();
+        }}
+      />
     );
   }
 }
 
+// The boundary must stay a class (componentDidCatch), but its copy still has to
+// come from the catalog like every other string in this file — so the fallback
+// UI lives in function components that can call useT.
+function AgentPanelReloadingNotice() {
+  const t = useT();
+  return (
+    <div className="flex h-full items-center justify-center p-6 text-center text-xs text-muted-foreground">
+      {t("agentPanel.uiError.reloading")}
+    </div>
+  );
+}
+
+function AgentPanelErrorFallback({
+  details,
+  onReset,
+}: {
+  details: string;
+  onReset: () => void;
+}) {
+  const t = useT();
+  return (
+    <div className="flex h-full flex-col items-center justify-center gap-3 p-6 text-center">
+      <div className="max-w-[260px] space-y-1">
+        <p className="text-sm font-medium text-foreground">
+          {t("agentPanel.uiError.title")}
+        </p>
+        <p className="text-xs leading-relaxed text-muted-foreground">
+          {t("agentPanel.uiError.description")}
+        </p>
+      </div>
+      <button
+        type="button"
+        className="rounded-md border border-border bg-background px-3 py-1.5 text-xs font-medium text-foreground hover:bg-accent"
+        onClick={onReset}
+      >
+        {t("agentPanel.uiError.reset")}
+      </button>
+      <ErrorReportActions
+        appName="Agent panel"
+        title={t("agentPanel.uiError.title")}
+        details={details}
+        issueTitle="Agent panel UI error"
+        className="max-w-[260px]"
+        feedbackClassName="h-7"
+        githubClassName="h-7"
+      />
+    </div>
+  );
+}
+
 export function AgentPanel(props: AgentPanelProps) {
   const [resetKey, setResetKey] = useState(0);
   const resetPanel = useCallback(() => {

package/corpus/core/src/localization/default-messages.ts

@@ -336,6 +336,12 @@ const messages = {
     },
   },
   agentPanel: {
+    uiError: {
+      title: "Agent panel hit a glitch",
+      description: "The app's still usable. Reset to reload the chat.",
+      reset: "Reset agent panel",
+      reloading: "Reloading chat…",
+    },
     useBuilder: "Use Builder",
     openDesktopToEditCode: "Open Desktop to edit code",
     codeUnavailableDescription:

package/corpus/core/src/server/agent-capabilities.ts

@@ -136,6 +136,38 @@ export function formatCapabilitySummary(
     .join("\n");
 }
 
+/**
+ * Render a skill's `input` contract as `input: { field*: type, other?: type }`,
+ * marking required fields with `*`. Returns undefined when the skill publishes
+ * no schema, so callers fall back to the description alone.
+ */
+function formatSkillInput(skill: AgentSkill): string | undefined {
+  const schema = skill.inputSchema as
+    | {
+        properties?: Record<string, { type?: unknown }>;
+        required?: unknown;
+      }
+    | undefined;
+  const properties = schema?.properties;
+  if (!properties || typeof properties !== "object") return undefined;
+  const names = Object.keys(properties);
+  if (names.length === 0) return " — input: {} (no fields)";
+
+  const required = new Set(
+    Array.isArray(schema?.required)
+      ? schema.required.filter(
+          (name): name is string => typeof name === "string",
+        )
+      : [],
+  );
+  const fields = names.map((name) => {
+    const type = properties[name]?.type;
+    const rendered = typeof type === "string" ? type : "any";
+    return `${name}${required.has(name) ? "*" : "?"}: ${rendered}`;
+  });
+  return ` — input: { ${fields.join(", ")} } (* = required)`;
+}
+
 export function formatCapabilityDetail(
   peer: PeerCapabilities,
   callHint: (appId: string) => string,
@@ -151,14 +183,17 @@ export function formatCapabilityDetail(
 
   const shown = peer.skills.slice(0, MAX_SKILLS_IN_DETAIL);
   const rest = peer.skills.length - shown.length;
-  const lines = shown.map(
-    (skill) =>
-      `- ${skill.id}${skill.readOnly ? "" : " (mutating)"}: ${
-        skill.description
-          ? truncate(skill.description, MAX_DESCRIPTION_CHARS)
-          : skill.name || "(no description)"
-      }`,
-  );
+  const lines = shown.map((skill) => {
+    const summary = skill.description
+      ? truncate(skill.description, MAX_DESCRIPTION_CHARS)
+      : skill.name || "(no description)";
+    // Naming an action without its parameters is what makes a caller invoke it
+    // with `{}` and fail on a required field, which reads as the sibling being
+    // broken rather than as a malformed call.
+    return `- ${skill.id}${skill.readOnly ? "" : " (mutating)"}: ${summary}${
+      formatSkillInput(skill) ?? ""
+    }`;
+  });
 
   return [
     header,

package/corpus/core/src/server/agent-chat/action-filters-a2a.ts

@@ -65,10 +65,49 @@ export function filterPublicAgentActions(
   );
 }
 
+/**
+ * Input fields that unambiguously carry a program the receiver executes.
+ *
+ * Deliberately excludes `query`: across the templates that field is nearly
+ * always natural-language search text (Brain's `search-everything`,
+ * `search-knowledge`), and blocking it would break exactly the ask-don't-instruct
+ * calls this rule exists to encourage.
+ */
+const RAW_QUERY_INPUT_FIELDS = new Set(["sql", "code", "script", "expression"]);
+
+/**
+ * True when an action takes a free-form query or program as input — raw SQL, a
+ * code body, an arbitrary expression.
+ *
+ * Such an action must not be sibling-invocable over A2A. The app that owns the
+ * data owns its schema, data dictionary, skills, and reference queries; a
+ * calling app has none of that, so letting it pass SQL means every caller
+ * reimplements the owner's schema knowledge badly and silently rots when the
+ * owner's shape changes. Callers ask the owning app a question; the owner
+ * forms the query. Set `publicAgent.allowRawQueryInput` to opt a specific
+ * action out of this rule.
+ */
+export function hasRawQueryInput(entry: ActionEntry): boolean {
+  const parameters = entry.tool?.parameters as
+    | { properties?: Record<string, { type?: unknown }> }
+    | undefined;
+  const properties = parameters?.properties;
+  if (!properties || typeof properties !== "object") return false;
+  return Object.entries(properties).some(([field, schema]) => {
+    const type = schema?.type;
+    const acceptsString =
+      type === "string" ||
+      type === undefined ||
+      (Array.isArray(type) && type.includes("string"));
+    return RAW_QUERY_INPUT_FIELDS.has(field.toLowerCase()) && acceptsString;
+  });
+}
+
 /**
  * Direct A2A action calls share the authenticated external-agent policy with
  * MCP, but remain stricter: only explicitly exposed, authenticated read-only
- * actions can skip the receiver's model loop.
+ * actions can skip the receiver's model loop, and never one that takes a raw
+ * query the caller wrote.
  */
 export function filterDirectA2AActions(
   actions: Record<string, ActionEntry>,
@@ -86,8 +125,11 @@ export function filterDirectA2AActions(
         (autoReads &&
           isAuthenticatedReadAction(entry) &&
           !isAutoReadExcludedActionName(name));
+      const rawQueryAllowed =
+        !hasRawQueryInput(entry) || exposure?.allowRawQueryInput === true;
       return (
         selected &&
+        rawQueryAllowed &&
         !denied.has(name) &&
         entry.agentTool !== false &&
         entry.readOnly === true &&
@@ -108,6 +150,7 @@ export function buildPublicAgentA2ASkills(
   name: string;
   description: string;
   publicAgent: ActionEntry["publicAgent"];
+  inputSchema?: Record<string, unknown>;
 }> {
   return Object.entries(filterPublicAgentActions(actions)).map(
     ([name, entry]) => ({
@@ -115,6 +158,14 @@ export function buildPublicAgentA2ASkills(
       name,
       description: entry.tool.description,
       publicAgent: entry.publicAgent,
+      ...(entry.tool.parameters
+        ? {
+            inputSchema: entry.tool.parameters as unknown as Record<
+              string,
+              unknown
+            >,
+          }
+        : {}),
     }),
   );
 }
@@ -135,6 +186,7 @@ export function buildAuthenticatedAgentA2ASkills(
   name: string;
   description: string;
   publicAgent: ActionEntry["publicAgent"];
+  inputSchema?: Record<string, unknown>;
 }> {
   return Object.entries(filterDirectA2AActions(actions, options)).map(
     ([name, entry]) => ({
@@ -142,6 +194,16 @@ export function buildAuthenticatedAgentA2ASkills(
       name,
       description: entry.tool.description,
       publicAgent: entry.publicAgent,
+      // Naming an action without its parameters is what makes a caller invoke
+      // it with `{}` and fail on a required field.
+      ...(entry.tool.parameters
+        ? {
+            inputSchema: entry.tool.parameters as unknown as Record<
+              string,
+              unknown
+            >,
+          }
+        : {}),
     }),
   );
 }

package/corpus/templates/analytics/AGENTS.md

@@ -42,6 +42,11 @@ change the numbers.
 
 ## Core Rules
 
+- A sibling app asking over A2A sends a question or shaped input, never SQL. It
+  lacks this app's schema, data dictionary, dashboards, and dialect knowledge,
+  so raw-query actions (`sql`, `code`, `script`, `expression`) are not
+  sibling-invocable. For recurring numbers, add a shaped read action with
+  semantic parameters and let this app own the query.
 - Data integrity first. Never invent numbers, dimensions, filters, or source
   semantics; only present values you actually retrieved, and state uncertainty.
 - Every analytical answer carries audit context: source(s), time window,

package/corpus/templates/analytics/actions/hubspot-deals.ts

@@ -493,6 +493,7 @@ export default defineAction({
       .describe("Optional HubSpot pagination cursor for query results."),
   }),
   http: { method: "GET" },
+  publicAgent: { expose: true, readOnly: true, requiresAuth: true },
   run: async ({
     properties,
     owner,

package/corpus/templates/analytics/actions/hubspot-records.ts

@@ -48,6 +48,7 @@ export default defineAction({
       .describe("Optional HubSpot pagination cursor from a previous result."),
   }),
   http: { method: "GET" },
+  publicAgent: { expose: true, readOnly: true, requiresAuth: true },
   run: async ({ objectType, query, properties, limit, after }) => {
     const result = await searchHubSpotObjects({
       objectType,

package/corpus/templates/analytics/server/lib/analytics-connector-catalog.ts

@@ -9,6 +9,8 @@ export const ANALYTICS_CONNECTOR_CATALOG = [
   "account-deep-dive",
   "gong-calls",
   "gong-native-insights",
+  "hubspot-deals",
+  "hubspot-records",
   "list-session-recordings",
   "get-session-replay-summary",
   "get-session-replay-timeline",

package/corpus/templates/calendar/actions/get-event.ts

@@ -66,6 +66,7 @@ export default defineAction({
         const calEvent: CalendarEvent = {
           id: `google-${evt.id}`,
           title: evt.summary || "Untitled",
+          titleIsGenerated: !evt.summary,
           description: evt.description || "",
           start: evt.start?.dateTime || evt.start?.date || "",
           end: evt.end?.dateTime || evt.end?.date || "",

package/corpus/templates/calendar/app/components/calendar/CreateEventDialog.tsx

@@ -757,6 +757,7 @@ export function CreateEventPopover({
 
     const payload: Parameters<typeof createEvent.mutate>[0] = {
       title: title.trim() || undefined,
+      titleIsGenerated: !title.trim(),
       description: isOutOfOffice ? "" : description,
       start: startValue,
       end: endValue,

package/corpus/templates/calendar/app/components/calendar/EventDetailPanel.tsx

@@ -34,6 +34,7 @@ import {
 } from "@/components/ui/tooltip";
 import { useUpdateEvent } from "@/hooks/use-events";
 import { useViewPreferences } from "@/hooks/use-view-preferences";
+import { getEditableEventTitle } from "@/lib/event-form-utils";
 import { isOutOfOfficeEvent } from "@/lib/out-of-office";
 import { cn } from "@/lib/utils";
 import {
@@ -338,7 +339,10 @@ export function EventDetailPanel({
                       if (e.key === "Enter") {
                         e.preventDefault();
                         const trimmed = editingTitle.trim();
-                        if (trimmed && trimmed !== event.title) {
+                        if (
+                          trimmed &&
+                          trimmed !== getEditableEventTitle(event)
+                        ) {
                           onTitleSave?.(event.id, trimmed, event.accountEmail);
                         }
                         setIsEditingTitle(false);
@@ -350,7 +354,7 @@ export function EventDetailPanel({
                     }}
                     onBlur={() => {
                       const trimmed = editingTitle.trim();
-                      if (trimmed && trimmed !== event.title) {
+                      if (trimmed && trimmed !== getEditableEventTitle(event)) {
                         onTitleSave?.(event.id, trimmed, event.accountEmail);
                       }
                       setIsEditingTitle(false);
@@ -366,7 +370,7 @@ export function EventDetailPanel({
                     )}
                     onClick={() => {
                       if (isWorkingLocation) return;
-                      setEditingTitle(event.title);
+                      setEditingTitle(getEditableEventTitle(event));
                       setIsEditingTitle(true);
                     }}
                   >

package/corpus/templates/calendar/app/components/calendar/EventDetailPopover.tsx

@@ -83,6 +83,7 @@ import {
   buildReminderPayload,
   dateTimeInTimezoneToIso,
   formatReminderText,
+  getEditableEventTitle,
   getEventEndValidationMessage,
   getLocalTimezone,
   getRecurrencePreset,
@@ -536,7 +537,7 @@ export function EventDetailPopover({
   const isMobile = useIsMobile();
   const [open, setOpen] = useState(defaultOpen);
   const [editingTitle, setEditingTitle] = useState(
-    defaultOpen ? event.title : "",
+    defaultOpen ? getEditableEventTitle(event) : "",
   );
   const [isEditingTitle, setIsEditingTitle] = useState(defaultOpen);
   const isNewEventRef = useRef(defaultOpen);
@@ -675,12 +676,12 @@ export function EventDetailPopover({
       setIsEditingTitle(true);
       isNewEventRef.current = true;
       setEditingTitle((current) => {
-        const hasDraft = current.trim().length > 0 && current !== "(No title)";
-        if (hasDraft && current !== event.title) return current;
-        return event.title === "(No title)" ? "" : event.title;
+        const eventTitle = getEditableEventTitle(event);
+        if (current.trim() && current !== eventTitle) return current;
+        return eventTitle;
       });
     }
-  }, [defaultOpen, event.title]);
+  }, [defaultOpen, event.title, event.titleIsGenerated]);
 
   // Focus title input when editing starts
   useEffect(() => {
@@ -1326,10 +1327,8 @@ export function EventDetailPopover({
 
   const handleCreateDraft = useCallback(() => {
     if (!onDraftCreate) return;
-    const updates =
-      isEditingTitle && editingTitle.trim()
-        ? { title: editingTitle.trim() }
-        : undefined;
+    const title = editingTitle.trim();
+    const updates = isEditingTitle && title ? { title } : undefined;
     if (updates) {
       onTitleSave?.(event.id, updates.title, event.accountEmail);
       setIsEditingTitle(false);
@@ -1370,7 +1369,7 @@ export function EventDetailPopover({
         let savedPendingChange = false;
         // Popover is closing — handle saves
         if (isEditingTitle) {
-          if (trimmedTitle && trimmedTitle !== "(No title)") {
+          if (trimmedTitle) {
             onTitleSave?.(event.id, trimmedTitle, event.accountEmail);
             isNewEventRef.current = false;
             savedPendingChange = true;
@@ -1393,7 +1392,7 @@ export function EventDetailPopover({
         if (
           isNewEventRef.current &&
           !savedPendingChange &&
-          (!trimmedTitle || trimmedTitle === "(No title)") &&
+          !trimmedTitle &&
           onDismissNew
         ) {
           onDismissNew(event.id, event.accountEmail);
@@ -1538,7 +1537,7 @@ export function EventDetailPopover({
                     if (e.key === "Enter") {
                       e.preventDefault();
                       const trimmed = editingTitle.trim();
-                      if (trimmed && trimmed !== "(No title)") {
+                      if (trimmed) {
                         onTitleSave?.(event.id, trimmed, event.accountEmail);
                         isNewEventRef.current = false;
                       }
@@ -1548,7 +1547,7 @@ export function EventDetailPopover({
                       if (isNewEventRef.current && onDismissNew) {
                         handleOpenChange(false);
                       } else {
-                        setEditingTitle(event.title);
+                        setEditingTitle(getEditableEventTitle(event));
                         setIsEditingTitle(false);
                       }
                     } else if (
@@ -1564,11 +1563,7 @@ export function EventDetailPopover({
                   }}
                   onBlur={() => {
                     const trimmed = editingTitle.trim();
-                    if (
-                      trimmed &&
-                      trimmed !== "(No title)" &&
-                      trimmed !== event.title
-                    ) {
+                    if (trimmed && trimmed !== getEditableEventTitle(event)) {
                       onTitleSave?.(event.id, trimmed, event.accountEmail);
                       isNewEventRef.current = false;
                     }
@@ -1582,7 +1577,7 @@ export function EventDetailPopover({
                   className={`mb-4 -mx-0.5 rounded px-0.5 text-lg font-semibold leading-tight text-foreground ${!isOverlay && !isWorkingLocation ? "cursor-text hover:bg-muted/50" : ""}`}
                   onClick={() => {
                     if (isOverlay || isWorkingLocation) return;
-                    setEditingTitle(event.title);
+                    setEditingTitle(getEditableEventTitle(event));
                     setIsEditingTitle(true);
                   }}
                 >

package/corpus/templates/calendar/app/hooks/use-events.ts

@@ -103,6 +103,12 @@ function getEventQueryKey(id: string) {
   return ["action", "get-event", { id }] as const;
 }
 
+export function getOptimisticTitleIsGenerated(
+  input: Pick<CreateEventInput, "title" | "titleIsGenerated">,
+): boolean {
+  return input.titleIsGenerated ?? !input.title?.trim();
+}
+
 function buildOptimisticCalendarEvent(
   newData: CreateEventInput,
   optimisticId: string,
@@ -130,6 +136,7 @@ function buildOptimisticCalendarEvent(
     title:
       newData.title?.trim() ||
       (newData.eventType === "outOfOffice" ? "Out of office" : ""),
+    titleIsGenerated: getOptimisticTitleIsGenerated(newData),
     start,
     end,
     startTimeZone: newData.startTimeZone,

package/corpus/templates/calendar/app/lib/event-form-utils.ts

@@ -34,6 +34,19 @@ export const REMINDER_PRESETS = [
 ] as const;
 
 export const MAX_EVENT_ATTACHMENTS = 25;
+export const UNNAMED_EVENT_TITLE = "(No title)";
+
+export function getEditableEventTitle(
+  event: Pick<CalendarEvent, "title" | "titleIsGenerated">,
+): string {
+  return event.titleIsGenerated ? "" : event.title;
+}
+
+export function buildEventTitleUpdate(
+  title: string,
+): Pick<CalendarEvent, "title" | "titleIsGenerated"> {
+  return { title: title.trim(), titleIsGenerated: false };
+}
 
 const DAY_CODES = ["SU", "MO", "TU", "WE", "TH", "FR", "SA"] as const;
 const DAY_CODE_BY_LABEL: Record<string, (typeof DAY_CODES)[number]> = {