@agent-native/core 0.136.0 → 0.136.2

package/corpus/templates/mail/server/lib/automation-engine.ts

@@ -1,4 +1,5 @@
 import {
+  isResolvedEngineUsableForRequest,
   registerBuiltinEngines,
   resolveEngine,
 } from "@agent-native/core/agent/engine";
@@ -20,6 +21,10 @@ import {
   executeActions,
   type ActionContext,
 } from "./automation-actions.js";
+import {
+  resolveAutomationModelSettings,
+  type AutomationModelSettings,
+} from "./automation-model.js";
 import {
   createOAuth2Client,
   gmailListMessages,
@@ -30,7 +35,6 @@ import {
 } from "./google-api.js";
 import { getOAuth2Credentials } from "./google-auth.js";
 
-const DEFAULT_MODEL = "claude-haiku-4-5-20251001";
 const MAX_EMAILS_PER_RUN = 50;
 const MAX_PROCESSED_IDS = 500;
 const PROCESSED_IDS_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
@@ -338,11 +342,6 @@ interface RuleMatch {
   match: boolean;
 }
 
-interface AutomationModelSettings {
-  engine?: string;
-  model?: string;
-}
-
 const MODEL_AVAILABILITY_CACHE_TTL_MS = 5 * 60 * 1000;
 const modelAvailabilityCache = new Map<
   string,
@@ -370,10 +369,17 @@ async function canUseAutomationModel(
         !settings.engine || settings.engine === "anthropic"
           ? await resolveAnthropicKey(ownerEmail)
           : undefined;
-      await resolveEngine({
+      const engine = await resolveEngine({
         engineOption: settings.engine,
         apiKey: anthropicKey,
       });
+      if (
+        !(await isResolvedEngineUsableForRequest(engine, {
+          apiKey: anthropicKey,
+        }))
+      ) {
+        throw new Error("No LLM provider is connected");
+      }
     });
     modelAvailabilityCache.set(cacheKey, {
       ok: true,
@@ -482,13 +488,12 @@ async function getAutomationModelSettings(
   ownerEmail: string,
 ): Promise<AutomationModelSettings> {
   const autoSettings = await getUserSetting(ownerEmail, "automation-settings");
-  if (autoSettings && typeof autoSettings === "object") {
-    return {
-      engine: (autoSettings as any).engine,
-      model: (autoSettings as any).model,
-    };
-  }
-  return { model: DEFAULT_MODEL };
+  return resolveAutomationModelSettings(
+    ownerEmail,
+    autoSettings && typeof autoSettings === "object"
+      ? (autoSettings as AutomationModelSettings)
+      : null,
+  );
 }
 
 async function evaluateRules(

package/corpus/templates/mail/server/lib/automation-model.ts

@@ -0,0 +1,110 @@
+import {
+  isResolvedEngineUsableForRequest,
+  registerBuiltinEngines,
+  resolveEngine,
+} from "@agent-native/core/agent/engine";
+import { runWithRequestContext } from "@agent-native/core/server";
+import { getSetting } from "@agent-native/core/settings";
+
+export interface AutomationModelSettings {
+  engine?: string;
+  model?: string;
+}
+
+export const DEFAULT_AUTOMATION_ENGINE = "builder";
+export const DEFAULT_AUTOMATION_MODEL = "gpt-5-6-luna";
+
+const CHEAP_MODEL_CANDIDATES: AutomationModelSettings[] = [
+  { engine: DEFAULT_AUTOMATION_ENGINE, model: DEFAULT_AUTOMATION_MODEL },
+  { engine: "ai-sdk:openai", model: "gpt-5.6-luna" },
+  { engine: "ai-sdk:openrouter", model: "openai/gpt-5.6-luna" },
+];
+
+function isUnavailableEngineError(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error);
+  return /No LLM provider is connected|Connect an LLM provider|missing_credentials|not configured|not installed|unknown agent engine|engine .* unavailable/i.test(
+    message,
+  );
+}
+
+async function canResolveEngine(
+  ownerEmail: string,
+  engineName: string,
+): Promise<boolean> {
+  try {
+    registerBuiltinEngines();
+    return runWithRequestContext({ userEmail: ownerEmail }, async () => {
+      const engine = await resolveEngine({ engineOption: engineName });
+      return isResolvedEngineUsableForRequest(engine);
+    });
+  } catch (error) {
+    if (isUnavailableEngineError(error)) return false;
+    throw error;
+  }
+}
+
+async function resolveEngineDefaultModel(
+  ownerEmail: string,
+  engineName: string,
+): Promise<string> {
+  registerBuiltinEngines();
+  return runWithRequestContext({ userEmail: ownerEmail }, async () => {
+    const engine = await resolveEngine({ engineOption: engineName });
+    return engine.defaultModel;
+  });
+}
+
+/**
+ * Prefer Luna for background text classification when a Luna-capable provider
+ * is actually configured. An app's explicit automation setting always wins;
+ * this is only the no-override default.
+ */
+export async function resolveDefaultAutomationModel(
+  ownerEmail: string,
+): Promise<AutomationModelSettings> {
+  for (const candidate of CHEAP_MODEL_CANDIDATES) {
+    if (
+      candidate.engine &&
+      (await canResolveEngine(ownerEmail, candidate.engine))
+    ) {
+      return candidate;
+    }
+  }
+
+  const agentEngine = (await getSetting("agent-engine")) as {
+    engine?: string;
+    model?: string;
+  } | null;
+  if (agentEngine?.engine || agentEngine?.model) {
+    const model =
+      agentEngine.model ??
+      (agentEngine.engine
+        ? await resolveEngineDefaultModel(ownerEmail, agentEngine.engine)
+        : undefined);
+    return {
+      engine: agentEngine.engine,
+      model,
+    };
+  }
+
+  // Leave engine selection to resolveEngine so a configured non-Luna provider
+  // remains usable when none of the preferred Luna engines is connected.
+  return {};
+}
+
+export async function resolveAutomationModelSettings(
+  ownerEmail: string,
+  settings: AutomationModelSettings | null | undefined,
+): Promise<AutomationModelSettings> {
+  const defaults = await resolveDefaultAutomationModel(ownerEmail);
+  if (!settings?.engine && !settings?.model) return defaults;
+
+  return {
+    engine: settings.engine ?? defaults.engine,
+    model:
+      settings.model ??
+      (settings.engine
+        ? await resolveEngineDefaultModel(ownerEmail, settings.engine)
+        : defaults.model),
+  };
+}

package/corpus/templates/mail/server/plugins/agent-chat.ts

@@ -150,7 +150,7 @@ Examples:
 - User says "archive marketing emails" \u2192 create rule with condition "marketing or promotional email" and action archive
 - User says "star emails from alice@example.com" \u2192 create rule with condition "from alice@example.com" and action star
 
-Rules are evaluated by a fast AI model (Haiku) and run every minute + when the user opens the app.
+Rules are evaluated by a low-cost text model, preferring GPT-5.6 Luna when a Luna-capable provider is available, and run every minute + when the user opens the app.
 Use trigger-automations to force immediate processing.
 
 Available action types: label (with labelName), archive, mark_read, star, trash.

package/corpus/templates/slides/actions/generate-slides-ai.ts

@@ -1,11 +1,18 @@
 import { defineAction } from "@agent-native/core";
-import { resolveSecret } from "@agent-native/core/server";
+import { createBuilderEngine } from "@agent-native/core/agent/engine";
+import {
+  resolveBuilderCredentials,
+  resolveSecret,
+} from "@agent-native/core/server";
 import type { GeneratedSlide } from "@shared/api";
 import { z } from "zod";
 
+const BUILDER_MODEL = "gpt-5-6-luna";
+const GEMINI_MODEL = "gemini-2.0-flash";
+
 export default defineAction({
   description:
-    "Legacy helper for the Generate Slides dialog that drafts a whole new deck outline (multiple slides) from a topic. It returns markdown slide drafts, not the app's rendered slide HTML. Agent chat should create decks with create-deck slides: [] plus add-slide HTML instead of this action. Do NOT use this for a request to generate one or more images/image variations for an existing slide — use generate-image-api for that; this action requires its own GEMINI_API_KEY and has no Builder-managed fallback.",
+    "Legacy helper for the Generate Slides dialog that drafts a whole new deck outline (multiple slides) from a topic. It returns markdown slide drafts, not the app's rendered slide HTML. Agent chat should create decks with create-deck slides: [] plus add-slide HTML instead of this action. Do NOT use this for a request to generate one or more images/image variations for an existing slide — use generate-image-api for that. When Builder is connected, this uses GPT-5.6 Luna; otherwise it falls back to a user Gemini API key.",
   schema: z.object({
     topic: z.string().describe("Presentation topic"),
     slideCount: z.coerce
@@ -22,15 +29,8 @@ export default defineAction({
       .describe("Whether to include image prompts (default: true)"),
   }),
   run: async (args) => {
-    const apiKey = await resolveSecret("GEMINI_API_KEY");
-    if (!apiKey) {
-      throw new Error(
-        "Gemini API key not configured. Save GEMINI_API_KEY in settings.",
-      );
-    }
-
     const topic = args.topic;
-    // Cap at 10. Single-shot Gemini JSON generation reliably truncates
+    // Cap at 10. Single-shot JSON generation reliably truncates
     // beyond that — the resulting JSON fails to parse and the user sees
     // an error. Larger decks should be assembled with sequential
     // `add-slide` calls from the agent chat instead.
@@ -38,9 +38,6 @@ export default defineAction({
     const style = args.style;
     const includeImages = args.includeImages !== false;
 
-    const { GoogleGenAI } = await import("@google/genai");
-    const client = new GoogleGenAI({ apiKey });
-
     const imageInstruction = includeImages
       ? `For slides where a visual would enhance the message, set the layout to "image" and provide an "imagePrompt" field with a detailed description of what image to generate. The imagePrompt should describe a professional, high-quality image that supports the slide content. Include imagePrompt for roughly 30-40% of slides (not the title slide).`
       : `Do not include imagePrompt fields.`;
@@ -70,17 +67,44 @@ Rules:
 
 Respond ONLY with valid JSON. No markdown code fences, no explanation. Just the JSON array.`;
 
-    const response = await client.models.generateContent({
-      model: "gemini-2.0-flash",
-      contents: [{ text: prompt }],
-      config: {
-        responseMimeType: "application/json",
-      },
-    });
-
-    const text = response.candidates?.[0]?.content?.parts?.[0]?.text;
-    if (!text) {
-      throw new Error("No response from Gemini");
+    const builderCreds = await resolveBuilderCredentials();
+    const builderConfigured = Boolean(
+      builderCreds.privateKey && builderCreds.publicKey,
+    );
+    let text: string | undefined;
+    let builderError: Error | null = null;
+
+    if (builderConfigured) {
+      try {
+        text = await callBuilderGateway(prompt);
+      } catch (error) {
+        builderError =
+          error instanceof Error ? error : new Error(String(error));
+      }
+    }
+
+    if (!text?.trim()) {
+      const apiKey = await resolveSecret("GEMINI_API_KEY");
+      if (!apiKey) {
+        throw (
+          builderError ??
+          new Error(
+            "Slides outline generation needs Builder.io Connect or GEMINI_API_KEY.",
+          )
+        );
+      }
+
+      const { GoogleGenAI } = await import("@google/genai");
+      const client = new GoogleGenAI({ apiKey });
+      const response = await client.models.generateContent({
+        model: GEMINI_MODEL,
+        contents: [{ text: prompt }],
+        config: {
+          responseMimeType: "application/json",
+        },
+      });
+      text = response.candidates?.[0]?.content?.parts?.[0]?.text;
+      if (!text) throw new Error("No response from Gemini");
     }
 
     let slides: GeneratedSlide[];
@@ -113,3 +137,47 @@ Respond ONLY with valid JSON. No markdown code fences, no explanation. Just the
     return { slides };
   },
 });
+
+async function callBuilderGateway(prompt: string): Promise<string> {
+  const engine = createBuilderEngine();
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 45_000);
+  let streamedText = "";
+  let finalText = "";
+  let terminalError: string | undefined;
+
+  try {
+    for await (const event of engine.stream({
+      model: BUILDER_MODEL,
+      systemPrompt:
+        "Return only the valid JSON requested by the user. Do not use markdown fences or commentary.",
+      messages: [{ role: "user", content: [{ type: "text", text: prompt }] }],
+      tools: [],
+      abortSignal: controller.signal,
+      maxOutputTokens: 16_000,
+      temperature: 0,
+    })) {
+      if (event.type === "text-delta") streamedText += event.text;
+      if (event.type === "assistant-content") {
+        finalText = event.parts
+          .filter((part) => part.type === "text")
+          .map((part) => part.text)
+          .join("")
+          .trim();
+      }
+      if (event.type === "stop" && event.reason === "error") {
+        terminalError = event.error ?? "Builder gateway returned an error";
+      }
+      if (event.type === "stop" && event.reason === "max_tokens") {
+        terminalError = "Builder gateway truncated the slide outline";
+      }
+    }
+  } finally {
+    clearTimeout(timeout);
+  }
+
+  if (terminalError) throw new Error(terminalError);
+  const text = (finalText || streamedText).trim();
+  if (!text) throw new Error("Builder gateway returned no slide outline");
+  return text;
+}

package/corpus/templates/slides/changelog/2026-08-03-legacy-slide-outlines-now-prefer-the-lowest-cost-luna-model-.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-08-03
+---
+
+Legacy slide outlines now prefer the lowest-cost Luna model when Builder is connected.

package/corpus/templates/tasks/package.json

@@ -16,7 +16,7 @@
     "db:generate": "drizzle-kit generate",
     "test": "vitest --run --config vitest.config.ts",
     "test:e2e": "playwright test",
-    "test:e2e:install": "playwright install chromium",
+    "test:e2e:install": "playwright install --only-shell chromium",
     "test:all": "pnpm test && pnpm test:e2e"
   },
   "dependencies": {
@@ -36,7 +36,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@playwright/test": "^1.61.0",
+    "@playwright/test": "catalog:",
     "@radix-ui/react-accordion": "^1.2.12",
     "@radix-ui/react-alert-dialog": "^1.1.15",
     "@radix-ui/react-aspect-ratio": "^1.1.8",

package/dist/agent/production-agent.d.ts

@@ -273,8 +273,8 @@ export interface ProductionAgentOptions {
      * `AGENT_CHAT_DURABLE_BACKGROUND` flag so the background function is emitted.
      */
     durableBackgroundRuns?: boolean;
-    /** Called when a run starts, with the send function for emitting events and the threadId */
-    onRunStart?: (send: (event: AgentChatEvent) => void, threadId: string) => void | Promise<void>;
+    /** Called when a run starts, with the send function, threadId, and runId. */
+    onRunStart?: (send: (event: AgentChatEvent) => void, threadId: string, runId: string) => void | Promise<void>;
     /**
      * Called after the engine + model are resolved for this request. Used by
      * the plugin layer to thread the parent's choices into sub-agents so

package/dist/agent/production-agent.js

@@ -6870,7 +6870,7 @@ export function createProductionAgentHandler(options) {
             }
             // Notify listeners that a run has started (used by agent teams)
             if (options.onRunStart) {
-                await options.onRunStart(send, threadId ?? runId);
+                await options.onRunStart(send, threadId ?? runId, runId);
             }
             // Resolve custom workspace agent mentions first.
             if (customAgentRefs.length > 0) {

package/dist/catalog.json

@@ -1,5 +1,6 @@
 {
   "@assistant-ui/react": "^0.12.19",
+  "@playwright/test": "1.61.1",
   "@radix-ui/react-dialog": "^1.1.19",
   "@radix-ui/react-dropdown-menu": "^2.1.20",
   "@radix-ui/react-hover-card": "^1.1.19",
@@ -40,6 +41,7 @@
   "lowlight": "^3.3.0",
   "next-themes": "^0.4.6",
   "oxfmt": "0.56.0",
+  "playwright": "1.61.1",
   "react": "^19.2.7",
   "react-dom": "^19.2.7",
   "recharts": "^3.9.2",

package/dist/client/AgentTaskCard.js

@@ -4,12 +4,14 @@ import { useState, useEffect, useRef, useCallback } from "react";
 import ReactMarkdown from "react-markdown";
 import remarkGfm from "remark-gfm";
 import { agentNativePath } from "./api-path.js";
+import { useT } from "./i18n.js";
 import { cn } from "./utils.js";
 /**
  * Rich preview card for a sub-agent task. Listens for agent-task-event
  * CustomEvents to update its state in real-time.
  */
 export function AgentTaskCard({ taskId, threadId, description, onOpen, }) {
+    const t = useT();
     const [expanded, setExpanded] = useState(true);
     const [status, setStatus] = useState("running");
     const [preview, setPreview] = useState("");
@@ -142,8 +144,8 @@ export function AgentTaskCard({ taskId, threadId, description, onOpen, }) {
             ? "border-destructive/30"
             : isComplete
                 ? "border-emerald-500/20"
-                : "border-border"), children: [_jsxs("button", { type: "button", "aria-expanded": expanded, className: "flex w-full items-center gap-2 px-3 py-2 text-start transition-colors hover:bg-muted/45", onClick: () => setExpanded(!expanded), children: [_jsxs("span", { className: "inline-flex h-5 shrink-0 items-center gap-1 rounded-md border border-border/60 bg-background/70 px-1.5 text-[10px] font-medium text-muted-foreground", children: [_jsx(IconSubtask, { className: "h-3 w-3" }), "Sub-agent"] }), _jsx("span", { className: "min-w-0 flex-1 truncate text-xs font-medium text-foreground", children: taskTitle }), _jsxs("span", { className: statusClassName, children: [isRunning ? (_jsx(IconLoader2, { className: "h-3 w-3 animate-spin" })) : isError ? (_jsx(IconAlertCircle, { className: "h-3 w-3" })) : (_jsx(IconCheck, { className: "h-3 w-3" })), statusLabel] }), _jsx(IconChevronRight, { className: cn("h-3 w-3 shrink-0 text-muted-foreground/40 transition-transform duration-150", expanded && "rotate-90", "rtl:-scale-x-100") })] }), expanded && isRunning && currentStepText && (_jsxs("div", { className: "flex gap-1.5 border-t border-border/60 px-3 py-1.5 text-[11px] text-muted-foreground", children: [_jsx("span", { className: "shrink-0 font-medium text-foreground/70", children: "Now:" }), _jsx("span", { className: "min-w-0 break-words", children: currentStepText })] })), expanded && hasContent && (_jsx("div", { className: "px-3 pb-2 pt-1", children: _jsx("div", { ref: previewRef, className: "agent-markdown prose prose-sm prose-invert max-h-48 max-w-none overflow-y-auto break-words rounded-md border border-border/50 bg-muted/25 px-3 py-2 text-xs text-muted-foreground", children: _jsx(ReactMarkdown, { remarkPlugins: [remarkGfm], children: displayText.length > 800
+                : "border-border"), children: [_jsxs("button", { type: "button", "aria-expanded": expanded, className: "flex w-full items-center gap-2 px-3 py-2 text-start transition-colors hover:bg-muted/45", onClick: () => setExpanded(!expanded), children: [_jsxs("span", { className: "inline-flex h-5 shrink-0 items-center gap-1 rounded-md border border-border/60 bg-background/70 px-1.5 text-[10px] font-medium text-muted-foreground", children: [_jsx(IconSubtask, { className: "h-3 w-3" }), t("agentTask.backgroundTask")] }), _jsx("span", { className: "min-w-0 flex-1 truncate text-xs font-medium text-foreground", children: taskTitle }), _jsxs("span", { className: statusClassName, children: [isRunning ? (_jsx(IconLoader2, { className: "h-3 w-3 animate-spin" })) : isError ? (_jsx(IconAlertCircle, { className: "h-3 w-3" })) : (_jsx(IconCheck, { className: "h-3 w-3" })), statusLabel] }), _jsx(IconChevronRight, { className: cn("h-3 w-3 shrink-0 text-muted-foreground/40 transition-transform duration-150", expanded && "rotate-90", "rtl:-scale-x-100") })] }), expanded && isRunning && currentStepText && (_jsxs("div", { className: "flex gap-1.5 border-t border-border/60 px-3 py-1.5 text-[11px] text-muted-foreground", children: [_jsx("span", { className: "shrink-0 font-medium text-foreground/70", children: "Now:" }), _jsx("span", { className: "min-w-0 break-words", children: currentStepText })] })), expanded && hasContent && (_jsx("div", { className: "px-3 pb-2 pt-1", children: _jsx("div", { ref: previewRef, className: "agent-markdown prose prose-sm prose-invert max-h-48 max-w-none overflow-y-auto break-words rounded-md border border-border/50 bg-muted/25 px-3 py-2 text-xs text-muted-foreground", children: _jsx(ReactMarkdown, { remarkPlugins: [remarkGfm], children: displayText.length > 800
                             ? "..." + displayText.slice(-800)
-                            : displayText }) }) })), expanded && (_jsxs("div", { className: "flex items-center justify-between gap-2 px-3 pb-2", children: [_jsx("span", { className: "min-w-0 flex-1 truncate text-[10px] text-muted-foreground/60", children: !hasContent ? emptyMessage : "" }), _jsxs("div", { className: "flex shrink-0 items-center gap-1", children: [isRunning && (_jsxs("button", { onClick: handleStop, className: "inline-flex cursor-pointer items-center gap-1 rounded-md px-2 py-1 text-[11px] font-medium text-muted-foreground hover:bg-muted hover:text-destructive", "aria-label": "Stop sub-agent", children: [_jsx(IconPlayerStop, { className: "h-3 w-3" }), "Stop"] })), _jsxs("button", { onClick: handleOpen, className: "inline-flex cursor-pointer items-center gap-1 rounded-md px-2 py-1 text-[11px] font-medium text-muted-foreground hover:bg-muted hover:text-foreground", children: ["Open thread", _jsx(IconExternalLink, { className: "h-3 w-3" })] })] })] }))] }));
+                            : displayText }) }) })), expanded && (_jsxs("div", { className: "flex items-center justify-between gap-2 px-3 pb-2", children: [_jsx("span", { className: "min-w-0 flex-1 truncate text-[10px] text-muted-foreground/60", children: !hasContent ? emptyMessage : "" }), _jsxs("div", { className: "flex shrink-0 items-center gap-1", children: [isRunning && (_jsxs("button", { onClick: handleStop, className: "inline-flex cursor-pointer items-center gap-1 rounded-md px-2 py-1 text-[11px] font-medium text-muted-foreground hover:bg-muted hover:text-destructive", "aria-label": t("agentTask.stop"), children: [_jsx(IconPlayerStop, { className: "h-3 w-3" }), "Stop"] })), _jsxs("button", { onClick: handleOpen, className: "inline-flex cursor-pointer items-center gap-1 rounded-md px-2 py-1 text-[11px] font-medium text-muted-foreground hover:bg-muted hover:text-foreground", children: [t("agentTask.openThread"), _jsx(IconExternalLink, { className: "h-3 w-3" })] })] })] }))] }));
 }
 //# sourceMappingURL=AgentTaskCard.js.map

package/dist/client/i18n.js

@@ -349,6 +349,9 @@ const CORE_FALLBACK_MESSAGES = {
     "runsTray.finishedHours": "Finished {{count}}h ago",
     "runsTray.updatedDate": "Updated {{date}}",
     "runsTray.finishedDate": "Finished {{date}}",
+    "agentTask.backgroundTask": "Background task",
+    "agentTask.stop": "Stop background task",
+    "agentTask.openThread": "Open task thread",
     "codeRequired.fallbackDetail": "Edit locally or use Builder.io to edit this code in the cloud and continue customizing the app any way you like.",
     "codeRequired.defaultFeature": "Make the requested code changes to this app",
     "codeRequired.branchError": "Failed to create branch",

package/dist/client/settings/VoiceTranscriptionSection.js

@@ -292,8 +292,8 @@ export function VoiceTranscriptionSection() {
                                         e.stopPropagation();
                                         focusKey("GOOGLE_APPLICATION_CREDENTIALS");
                                     }, className: "inline-flex items-center gap-1 rounded border border-border px-2 py-0.5 text-[10px] text-muted-foreground hover:text-foreground hover:bg-accent/40", children: ["Configure", _jsx(IconExternalLink, { size: 10 })] })) }), _jsx(ProviderOption, { id: "auto", selected: transcriptionMode === "batch" && provider === "auto", onSelect: () => chooseBatchProvider("auto"), title: "Automatic batch fallback", subtitle: "Keep the current Clips fallback chain: Builder Gemini, Gemini, Groq, then OpenAI." }), _jsx(ProviderOption, { id: "builder-gemini", selected: transcriptionMode === "batch" && provider === "builder-gemini", onSelect: () => chooseBatchProvider("builder-gemini"), disabled: !builderStatus?.configured, title: "Builder.io Connect", subtitle: builderStatus?.configured
-                                    ? "Use Builder-hosted Gemini Flash-Lite for batch transcription and cleanup."
-                                    : "One-click connect for Gemini Flash-Lite cleanup and batch transcription. No Google key needed.", rightSlot: builderStatus?.configured ? (_jsxs("span", { className: "flex items-center gap-1 text-[10px] text-green-500", children: [_jsx(IconCheck, { size: 10 }), "Connected"] })) : (_jsxs("button", { type: "button", onClick: (e) => {
+                                    ? "Use Builder-hosted Gemini Flash-Lite for batch transcription and Luna for text cleanup."
+                                    : "One-click connect for Gemini Flash-Lite transcription and Luna text cleanup. No Google key needed.", rightSlot: builderStatus?.configured ? (_jsxs("span", { className: "flex items-center gap-1 text-[10px] text-green-500", children: [_jsx(IconCheck, { size: 10 }), "Connected"] })) : (_jsxs("button", { type: "button", onClick: (e) => {
                                         e.stopPropagation();
                                         openBuilderConnect();
                                     }, className: "inline-flex items-center gap-1 rounded border border-border px-2 py-0.5 text-[10px] text-muted-foreground hover:text-foreground hover:bg-accent/40", children: ["Connect Builder.io", _jsx(IconExternalLink, { size: 10 })] })) }), _jsx(ProviderOption, { id: "gemini", selected: transcriptionMode === "batch" && provider === "gemini", onSelect: () => chooseBatchProvider("gemini"), title: "Google Gemini", subtitle: "BYOK Gemini for AI cleanup and optional strict batch transcription.", rightSlot: geminiConfigured === null ? null : geminiConfigured ? (_jsxs("span", { className: "flex items-center gap-1 text-[10px] text-green-500", children: [_jsx(IconCheck, { size: 10 }), "Key set"] })) : (_jsxs("button", { type: "button", onClick: (e) => {

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,12 +17,12 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;
 //# sourceMappingURL=upload-image.d.ts.map

package/dist/localization/default-messages.d.ts

@@ -637,6 +637,11 @@ declare const messages: {
         updatedDate: string;
         finishedDate: string;
     };
+    agentTask: {
+        backgroundTask: string;
+        stop: string;
+        openThread: string;
+    };
     codeRequired: {
         fallbackDetail: string;
         defaultFeature: string;

package/dist/localization/default-messages.js

@@ -642,6 +642,11 @@ const messages = {
         updatedDate: "Updated {{date}}",
         finishedDate: "Finished {{date}}",
     },
+    agentTask: {
+        backgroundTask: "Background task",
+        stop: "Stop background task",
+        openThread: "Open task thread",
+    },
     codeRequired: {
         fallbackDetail: "Edit locally or use Builder.io to edit this code in the cloud and continue customizing the app any way you like.",
         defaultFeature: "Make the requested code changes to this app",

package/dist/mcp/oauth-client-metadata.d.ts

@@ -10,6 +10,13 @@ export interface OAuthClientMetadataDocument {
 export declare function isUrlBasedOAuthClientId(clientId: string): boolean;
 export declare function validateOAuthClientMetadataUrl(clientId: string): URL;
 export declare function isAllowedOAuthRedirectUri(value: unknown): value is string;
+/**
+ * RFC 8252 section 7.3: a native client's loopback redirect URI uses a port
+ * chosen at request time, so the authorization server must ignore the port when
+ * comparing loopback redirect URIs against the registered set. Non-loopback
+ * redirects keep exact matching, so this cannot widen into an open redirect.
+ */
+export declare function matchesRegisteredRedirectUri(registered: readonly string[], redirectUri: string, applicationType: "native" | "web"): boolean;
 export declare function applicationTypeForRedirectUris(redirectUris: string[]): "native" | "web";
 export declare function resolveOAuthClientMetadataDocument(clientId: string): Promise<OAuthClientMetadataDocument>;
 //# sourceMappingURL=oauth-client-metadata.d.ts.map

package/dist/mcp/oauth-client-metadata.js

@@ -73,6 +73,53 @@ export function isAllowedOAuthRedirectUri(value) {
         return false;
     }
 }
+function isLoopbackRedirectHost(hostname) {
+    return (hostname === "localhost" ||
+        hostname === "127.0.0.1" ||
+        hostname === "::1" ||
+        hostname === "[::1]");
+}
+/**
+ * RFC 8252 section 7.3: a native client's loopback redirect URI uses a port
+ * chosen at request time, so the authorization server must ignore the port when
+ * comparing loopback redirect URIs against the registered set. Non-loopback
+ * redirects keep exact matching, so this cannot widen into an open redirect.
+ */
+export function matchesRegisteredRedirectUri(registered, redirectUri, applicationType) {
+    let candidate;
+    try {
+        candidate = new URL(redirectUri);
+        // coercion-ok: a malformed candidate is an invalid redirect, not a runtime failure.
+    }
+    catch {
+        return false;
+    }
+    if (candidate.hash || candidate.username || candidate.password)
+        return false;
+    if (registered.includes(redirectUri))
+        return true;
+    if (applicationType !== "native" ||
+        candidate.protocol !== "http:" ||
+        !isLoopbackRedirectHost(candidate.hostname)) {
+        return false;
+    }
+    return registered.some((value) => {
+        let allowed;
+        try {
+            allowed = new URL(value);
+            // coercion-ok: a malformed registration cannot match a valid redirect.
+        }
+        catch {
+            return false;
+        }
+        if (allowed.hash || allowed.username || allowed.password)
+            return false;
+        return (allowed.protocol === candidate.protocol &&
+            allowed.hostname === candidate.hostname &&
+            allowed.pathname === candidate.pathname &&
+            allowed.search === candidate.search);
+    });
+}
 export function applicationTypeForRedirectUris(redirectUris) {
     return redirectUris.some((value) => {
         const url = new URL(value);

package/dist/mcp/oauth-route.js

@@ -13,7 +13,7 @@ import { getOrgDomain } from "../org/context.js";
 import { getConfiguredLoginHtml, getSession } from "../server/auth.js";
 import { getAuthSecret } from "../server/better-auth-instance.js";
 import { readBody } from "../server/h3-helpers.js";
-import { applicationTypeForRedirectUris, isAllowedOAuthRedirectUri, isUrlBasedOAuthClientId, resolveOAuthClientMetadataDocument, } from "./oauth-client-metadata.js";
+import { applicationTypeForRedirectUris, isAllowedOAuthRedirectUri, isUrlBasedOAuthClientId, matchesRegisteredRedirectUri, resolveOAuthClientMetadataDocument, } from "./oauth-client-metadata.js";
 import { createOAuthCode, createOAuthRefreshToken, consumeOAuthCode, generateOpaqueToken, getOAuthClient, getOAuthCode, getOAuthRefreshToken, registerOAuthClient, touchOAuthRefreshToken, } from "./oauth-store.js";
 import { MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS, MCP_OAUTH_SCOPES, normalizeOAuthScope, signMcpOAuthAccessToken, } from "./oauth-token.js";
 import { MCP_PUBLIC_ROUTE_PREFIX, MCP_ROUTE_PREFIXES } from "./route-paths.js";
@@ -291,7 +291,9 @@ async function handleRegister(event) {
         requestedApplicationType !== "web") {
         return oauthError("invalid_client_metadata", "application_type must be native or web");
     }
-    const applicationType = requestedApplicationType ?? applicationTypeForRedirectUris(redirectUris);
+    const applicationType = requestedApplicationType === "native" || requestedApplicationType === "web"
+        ? requestedApplicationType
+        : applicationTypeForRedirectUris(redirectUris);
     const clientName = typeof body.client_name === "string"
         ? body.client_name.trim().slice(0, 120)
         : null;
@@ -303,6 +305,7 @@ async function handleRegister(event) {
             grantTypes: grantTypes.length ? grantTypes : undefined,
             responseTypes: responseTypes.length ? responseTypes : undefined,
             tokenEndpointAuthMethod: method,
+            applicationType,
         });
     }
     catch (err) {
@@ -555,7 +558,8 @@ async function handleAuthorize(event, options) {
     const client = isUrlBasedOAuthClientId(clientId)
         ? await resolveOAuthClientMetadataDocument(clientId).catch(() => null)
         : await getOAuthClient(clientId);
-    if (!client || !client.redirectUris.includes(redirectUri)) {
+    if (!client ||
+        !matchesRegisteredRedirectUri(client.redirectUris, redirectUri, client.applicationType)) {
         return oauthError("invalid_client", "Unknown client or redirect_uri");
     }
     const session = await getSession(event);

package/dist/mcp/oauth-store.d.ts

@@ -26,6 +26,7 @@ export interface OAuthClientRow {
     grantTypes: string[];
     responseTypes: string[];
     tokenEndpointAuthMethod: string;
+    applicationType: "native" | "web";
     createdAt: number | null;
 }
 export interface OAuthCodeRow {
@@ -66,6 +67,7 @@ export declare function registerOAuthClient(params: {
     grantTypes?: string[];
     responseTypes?: string[];
     tokenEndpointAuthMethod?: string;
+    applicationType?: "native" | "web";
 }): Promise<OAuthClientRow>;
 export declare function getOAuthClient(clientId: string): Promise<OAuthClientRow | null>;
 export declare function createOAuthCode(params: {