@agent-native/core 0.137.8 → 0.138.0

package/dist/server/onboarding-html.js

@@ -72,6 +72,14 @@ const EN_AUTH_COPY = {
     passwordMinPlaceholder: "At least 8 characters",
     confirmPasswordPlaceholder: "Confirm password",
     enterPasswordPlaceholder: "Enter password",
+    magicLinkTitle: "Sign in with a link",
+    magicLinkSubtitle: "Enter your email and we'll send you a secure sign-in link",
+    sendMagicLink: "Email me a sign-in link",
+    magicLinkSent: "Check your email",
+    magicLinkSentCopy: "We sent a secure sign-in link to",
+    magicLinkFailed: "Could not send sign-in link.",
+    usePasswordInstead: "Use a password instead",
+    backToMagicLink: "Use a sign-in link instead",
     signupProgress: "Signup progress",
     progressAccount: "Account",
     progressVerify: "Verify",
@@ -160,6 +168,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "至少 8 个字符",
         confirmPasswordPlaceholder: "确认密码",
         enterPasswordPlaceholder: "输入密码",
+        magicLinkTitle: "使用链接登录",
+        magicLinkSubtitle: "输入邮箱，我们会发送安全登录链接",
+        sendMagicLink: "发送登录链接到邮箱",
+        magicLinkSent: "检查你的邮箱",
+        magicLinkSentCopy: "我们已向以下邮箱发送安全登录链接：",
+        magicLinkFailed: "无法发送登录链接。",
+        usePasswordInstead: "改用密码",
+        backToMagicLink: "改用登录链接",
         signupProgress: "注册进度",
         progressAccount: "账户",
         progressVerify: "验证",
@@ -246,6 +262,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "至少 8 個字元",
         confirmPasswordPlaceholder: "確認密碼",
         enterPasswordPlaceholder: "輸入密碼",
+        magicLinkTitle: "使用連結登入",
+        magicLinkSubtitle: "輸入電子郵件，我們會寄送安全登入連結",
+        sendMagicLink: "寄送登入連結",
+        magicLinkSent: "檢查你的電子郵件",
+        magicLinkSentCopy: "我們已向以下電子郵件寄送安全登入連結：",
+        magicLinkFailed: "無法寄送登入連結。",
+        usePasswordInstead: "改用密碼",
+        backToMagicLink: "改用登入連結",
         signupProgress: "註冊進度",
         progressAccount: "帳號",
         progressVerify: "驗證",
@@ -332,6 +356,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "Al menos 8 caracteres",
         confirmPasswordPlaceholder: "Confirmar contraseña",
         enterPasswordPlaceholder: "Introduce la contraseña",
+        magicLinkTitle: "Inicia sesión con un enlace",
+        magicLinkSubtitle: "Introduce tu email y te enviaremos un enlace seguro",
+        sendMagicLink: "Enviarme un enlace de inicio de sesión",
+        magicLinkSent: "Revisa tu email",
+        magicLinkSentCopy: "Enviamos un enlace seguro a",
+        magicLinkFailed: "No se pudo enviar el enlace de inicio de sesión.",
+        usePasswordInstead: "Usar una contraseña",
+        backToMagicLink: "Usar un enlace de inicio de sesión",
         signupProgress: "Progreso de registro",
         progressAccount: "Cuenta",
         progressVerify: "Verificar",
@@ -418,6 +450,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "Au moins 8 caractères",
         confirmPasswordPlaceholder: "Confirmer le mot de passe",
         enterPasswordPlaceholder: "Saisir le mot de passe",
+        magicLinkTitle: "Se connecter avec un lien",
+        magicLinkSubtitle: "Saisissez votre e-mail et nous vous enverrons un lien sécurisé",
+        sendMagicLink: "M'envoyer un lien de connexion",
+        magicLinkSent: "Vérifiez votre e-mail",
+        magicLinkSentCopy: "Nous avons envoyé un lien sécurisé à",
+        magicLinkFailed: "Impossible d'envoyer le lien de connexion.",
+        usePasswordInstead: "Utiliser un mot de passe",
+        backToMagicLink: "Utiliser un lien de connexion",
         signupProgress: "Progression de l'inscription",
         progressAccount: "Compte",
         progressVerify: "Vérifier",
@@ -504,6 +544,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "Mindestens 8 Zeichen",
         confirmPasswordPlaceholder: "Passwort bestätigen",
         enterPasswordPlaceholder: "Passwort eingeben",
+        magicLinkTitle: "Mit einem Link anmelden",
+        magicLinkSubtitle: "Gib deine E-Mail ein und wir senden dir einen sicheren Anmeldelink",
+        sendMagicLink: "Anmeldelink per E-Mail senden",
+        magicLinkSent: "Prüfe deine E-Mail",
+        magicLinkSentCopy: "Wir haben einen sicheren Anmeldelink gesendet an",
+        magicLinkFailed: "Anmeldelink konnte nicht gesendet werden.",
+        usePasswordInstead: "Stattdessen Passwort verwenden",
+        backToMagicLink: "Stattdessen Anmeldelink verwenden",
         signupProgress: "Registrierungsfortschritt",
         progressAccount: "Konto",
         progressVerify: "Prüfen",
@@ -590,6 +638,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "8 文字以上",
         confirmPasswordPlaceholder: "パスワードを確認",
         enterPasswordPlaceholder: "パスワードを入力",
+        magicLinkTitle: "リンクでサインイン",
+        magicLinkSubtitle: "メールアドレスを入力すると、安全なサインインリンクを送信します",
+        sendMagicLink: "サインインリンクをメールで送信",
+        magicLinkSent: "メールを確認してください",
+        magicLinkSentCopy: "安全なサインインリンクを送信しました：",
+        magicLinkFailed: "サインインリンクを送信できませんでした。",
+        usePasswordInstead: "パスワードを使用する",
+        backToMagicLink: "サインインリンクを使用する",
         signupProgress: "登録の進行状況",
         progressAccount: "アカウント",
         progressVerify: "確認",
@@ -676,6 +732,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "8자 이상",
         confirmPasswordPlaceholder: "비밀번호 확인",
         enterPasswordPlaceholder: "비밀번호 입력",
+        magicLinkTitle: "링크로 로그인",
+        magicLinkSubtitle: "이메일을 입력하면 안전한 로그인 링크를 보내드립니다",
+        sendMagicLink: "로그인 링크 이메일 받기",
+        magicLinkSent: "이메일을 확인하세요",
+        magicLinkSentCopy: "안전한 로그인 링크를 보냈습니다:",
+        magicLinkFailed: "로그인 링크를 보낼 수 없습니다.",
+        usePasswordInstead: "비밀번호 사용",
+        backToMagicLink: "로그인 링크 사용",
         signupProgress: "가입 진행 상황",
         progressAccount: "계정",
         progressVerify: "확인",
@@ -762,6 +826,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "Pelo menos 8 caracteres",
         confirmPasswordPlaceholder: "Confirmar senha",
         enterPasswordPlaceholder: "Digite a senha",
+        magicLinkTitle: "Entrar com um link",
+        magicLinkSubtitle: "Digite seu email e enviaremos um link seguro de acesso",
+        sendMagicLink: "Enviar link de acesso por email",
+        magicLinkSent: "Confira seu email",
+        magicLinkSentCopy: "Enviamos um link seguro para",
+        magicLinkFailed: "Não foi possível enviar o link de acesso.",
+        usePasswordInstead: "Usar uma senha",
+        backToMagicLink: "Usar um link de acesso",
         signupProgress: "Progresso do cadastro",
         progressAccount: "Conta",
         progressVerify: "Verificar",
@@ -848,6 +920,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "कम से कम 8 अक्षर",
         confirmPasswordPlaceholder: "पासवर्ड की पुष्टि करें",
         enterPasswordPlaceholder: "पासवर्ड दर्ज करें",
+        magicLinkTitle: "लिंक से साइन इन करें",
+        magicLinkSubtitle: "अपना ईमेल दर्ज करें और हम सुरक्षित साइन-इन लिंक भेजेंगे",
+        sendMagicLink: "मुझे साइन-इन लिंक ईमेल करें",
+        magicLinkSent: "अपना ईमेल देखें",
+        magicLinkSentCopy: "हमने सुरक्षित साइन-इन लिंक यहां भेजा है:",
+        magicLinkFailed: "साइन-इन लिंक नहीं भेजा जा सका।",
+        usePasswordInstead: "पासवर्ड का उपयोग करें",
+        backToMagicLink: "साइन-इन लिंक का उपयोग करें",
         signupProgress: "साइनअप प्रगति",
         progressAccount: "खाता",
         progressVerify: "सत्यापित करें",
@@ -934,6 +1014,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "8 أحرف على الأقل",
         confirmPasswordPlaceholder: "تأكيد كلمة المرور",
         enterPasswordPlaceholder: "أدخل كلمة المرور",
+        magicLinkTitle: "تسجيل الدخول باستخدام رابط",
+        magicLinkSubtitle: "أدخل بريدك الإلكتروني وسنرسل لك رابط تسجيل دخول آمنًا",
+        sendMagicLink: "إرسال رابط تسجيل الدخول إلى بريدي",
+        magicLinkSent: "تحقق من بريدك الإلكتروني",
+        magicLinkSentCopy: "أرسلنا رابط تسجيل دخول آمنًا إلى",
+        magicLinkFailed: "تعذر إرسال رابط تسجيل الدخول.",
+        usePasswordInstead: "استخدام كلمة مرور بدلًا من ذلك",
+        backToMagicLink: "استخدام رابط تسجيل الدخول بدلًا من ذلك",
         signupProgress: "تقدم التسجيل",
         progressAccount: "الحساب",
         progressVerify: "التحقق",
@@ -1126,6 +1214,8 @@ function isAgentNativeHostedHost(host) {
 export function getOnboardingHtml(opts = {}) {
     const showGoogle = hasGoogleOAuth();
     const googleOnly = !!opts.googleOnly;
+    const authMode = opts.authMode ?? "password";
+    const magicLinkMode = authMode === "magic-link";
     // In a Google-only app, Google is the sole sign-in method, so always render
     // a working button — never gate it on env vars detected at render time. The
     // login page is a public, CDN-cacheable shell served to everyone (per-user
@@ -2239,8 +2329,8 @@ ${marketingStyles}
 ${localePickerHtml}
 ${marketingPanelHtml}
 <div class="card">
-  <h1 id="heading"${i18nAttr(googleOnly ? "signInTitle" : "welcomeTitle")}>${esc(t(googleOnly ? "signInTitle" : "welcomeTitle"))}</h1>
-  <p class="subtitle" id="subtitle"${i18nAttr(googleOnly ? "googleOnlySubtitle" : "createAccountSubtitle")}>${esc(t(googleOnly ? "googleOnlySubtitle" : "createAccountSubtitle"))}</p>
+  <h1 id="heading"${i18nAttr(googleOnly ? "signInTitle" : magicLinkMode ? "magicLinkTitle" : "welcomeTitle")}>${esc(t(googleOnly ? "signInTitle" : magicLinkMode ? "magicLinkTitle" : "welcomeTitle"))}</h1>
+  <p class="subtitle" id="subtitle"${i18nAttr(googleOnly ? "googleOnlySubtitle" : magicLinkMode ? "magicLinkSubtitle" : "createAccountSubtitle")}>${esc(t(googleOnly ? "googleOnlySubtitle" : magicLinkMode ? "magicLinkSubtitle" : "createAccountSubtitle"))}</p>
   <p
     class="upgrade-note"
     id="upgrade-note"
@@ -2264,7 +2354,7 @@ ${googleOnly ? "" : `\n  <div class="divider" id="auth-divider"${i18nAttr("divid
         : ""}
 ${googleOnly
         ? ""
-        : `  <div class="tabs">
+        : `${magicLinkMode ? '\n    <form id="magic-link-form" class="form">\n      <label for="m-email"' + i18nAttr("email") + ">" + esc(t("email")) + '</label>\n      <input id="m-email" type="email" autocomplete="email" autofocus placeholder="you@example.com" required />\n      <button type="submit"' + i18nAttr("sendMagicLink") + ">" + esc(t("sendMagicLink")) + '</button>\n      <p class="msg" id="m-msg"></p>\n      <p style="margin-top:0.75rem;font-size:0.75rem;text-align:center">\n        <a href="#" id="use-password-link" class="link-button"' + i18nAttr("usePasswordInstead") + ">" + esc(t("usePasswordInstead")) + "</a>\n      </p>\n    </form>\n" : ""}  <div class="tabs"${magicLinkMode ? " hidden" : ""}>
     <button class="tab" data-tab="signup"${i18nAttr("createAccount")}>${esc(t("createAccount"))}</button>
     <button class="tab" data-tab="login"${i18nAttr("signIn")}>${esc(t("signIn"))}</button>
   </div>
@@ -2311,6 +2401,7 @@ ${signupLocalModeNoteHtml}
     <p style="margin-top:0.75rem;font-size:0.75rem;text-align:right">
       <a href="#" id="forgot-link" style="color:#888;text-decoration:underline;text-underline-offset:2px"${i18nAttr("forgotPassword")}>${esc(t("forgotPassword"))}</a>
     </p>
+    ${magicLinkMode ? `<p style="margin-top:0.5rem;font-size:0.75rem;text-align:center"><a href="#" id="back-to-magic-link" class="link-button"${i18nAttr("backToMagicLink")}>${esc(t("backToMagicLink"))}</a></p>` : ""}
   </form>
 
   <form id="forgot-form" class="form">
@@ -2361,7 +2452,8 @@ ${signInJourneyInlineScript()}
     var __AN_AUTH_MARKETING_LOCALES = ${JSON.stringify(AUTH_MARKETING_LOCALE_COPY)};
     var __anAuthLocale = __AN_AUTH_DEFAULT_LOCALE;
     var __anAuthLocalePreference = 'system';
-    var __anAuthView = ${JSON.stringify(googleOnly ? "googleOnly" : "signup")};
+    var __AN_AUTH_MODE = ${JSON.stringify(authMode)};
+    var __anAuthView = ${JSON.stringify(googleOnly ? "googleOnly" : magicLinkMode ? "magicLink" : "signup")};
     function __anAuthLocaleIsSupported(value) {
       return __AN_AUTH_SUPPORTED_LOCALES.indexOf(value) !== -1;
     }
@@ -2429,6 +2521,7 @@ ${signInJourneyInlineScript()}
       if (view === 'forgot') return { heading: 'resetPasswordTitle', subtitle: 'resetPasswordSubtitle' };
       if (view === 'verification') return { heading: 'checkEmailTitle', subtitle: 'finishAccountSubtitle' };
       if (view === 'googleOnly') return { heading: 'signInTitle', subtitle: 'googleOnlySubtitle' };
+      if (view === 'magicLink') return { heading: 'magicLinkTitle', subtitle: 'magicLinkSubtitle' };
       return { heading: 'welcomeTitle', subtitle: 'createAccountSubtitle' };
     }
     function __anRefreshAuthViewCopy() {
@@ -3049,7 +3142,14 @@ ${googleOnly
 	    function clearRememberedPendingSignupEmail() {
 	      rememberPendingSignupEmail('');
 	    }
-	    function setActiveTab(name, opts) {
+    function showMagicLinkForm() {
+      var form = document.getElementById('magic-link-form');
+      if (!form) return;
+      forms.forEach(function(x) { x.classList.remove('active'); });
+      form.classList.add('active');
+      __anSetAuthView('magicLink');
+    }
+    function setActiveTab(name, opts) {
 	      if (name !== 'signup' && name !== 'login') return;
 	      var form = document.getElementById(name + '-form');
 	      if (!form) return;
@@ -3156,7 +3256,10 @@ ${googleOnly
         __anRedirectToSignedInApp();
         return { ok: true };
       }
-      var data = await res.json().catch(function() { return {}; });
+      var data = await res.json().catch(function(error) {
+        console.warn('[auth] Could not parse sign-in response', error);
+        return null;
+      });
       var error = (data && (data.error || data.message)) || __anT('finishSignInFailed');
       return {
         ok: false,
@@ -3299,7 +3402,7 @@ ${googleOnly
       }
     }
     (function initActiveTab() {
-    var initial = 'signup';
+    var initial = __AN_AUTH_MODE === 'magic-link' ? 'magicLink' : 'signup';
     try {
       var params = new URLSearchParams(location.search);
       var qp = params.get('tab');
@@ -3318,7 +3421,8 @@ ${googleOnly
         if (stored === 'login' || stored === 'signup') initial = stored;
       }
     } catch (e) {}
-    setActiveTab(initial, { persist: false });
+    if (initial === 'magicLink') showMagicLinkForm();
+    else setActiveTab(initial, { persist: false });
 	      try {
 	        if (__anIsVerifiedRedirectSuccess()) {
 	          var rememberedEmail = readRememberedPendingSignupEmail();
@@ -3338,6 +3442,63 @@ ${googleOnly
     setActiveTab(t.dataset.tab, { persist: true });
   }); });
 
+  var usePasswordLink = document.getElementById('use-password-link');
+  if (usePasswordLink) usePasswordLink.addEventListener('click', function(e) {
+    e.preventDefault();
+    setActiveTab('login', { persist: false });
+    var magicEmail = document.getElementById('m-email');
+    var loginEmail = document.getElementById('l-email');
+    if (magicEmail && loginEmail && magicEmail.value) loginEmail.value = magicEmail.value;
+  });
+  var backToMagicLink = document.getElementById('back-to-magic-link');
+  if (backToMagicLink) backToMagicLink.addEventListener('click', function(e) {
+    e.preventDefault();
+    showMagicLinkForm();
+  });
+
+  var magicLinkForm = document.getElementById('magic-link-form');
+  if (magicLinkForm) magicLinkForm.addEventListener('submit', async function(e) {
+    e.preventDefault();
+    var btn = magicLinkForm.querySelector('button[type="submit"]');
+    var msg = document.getElementById('m-msg');
+    var emailInput = document.getElementById('m-email');
+    var email = __anNormalizeAuthEmail(emailInput && emailInput.value);
+    msg.classList.remove('show', 'error', 'success');
+    if (!__anIsValidAuthEmail(email)) {
+      __anShowEmailValidationError(emailInput, msg);
+      return;
+    }
+    var originalLabel = btn.textContent;
+    btn.disabled = true;
+    btn.textContent = __anT('sending');
+    try {
+      var res = await fetch(__anPath('/_agent-native/auth/magic-link'), {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: email, callbackURL: __anResumeHref() }),
+      });
+      var data = await res.json().catch(function(error) {
+        console.warn('[auth] Could not parse magic-link response', error);
+        return null;
+      });
+      if (res.ok) {
+        msg.textContent = __anT('magicLinkSent') + '. ' + __anT('magicLinkSentCopy') + ' ' + email + '.';
+        msg.classList.add('show', 'success');
+        btn.textContent = __anT('sent');
+        return;
+      }
+      msg.textContent = (data && (data.error || data.message)) || __anT('magicLinkFailed');
+      msg.classList.add('show', 'error');
+      btn.disabled = false;
+      btn.textContent = originalLabel;
+    } catch (err) {
+      msg.textContent = __anT('networkErrorDashRetry');
+      msg.classList.add('show', 'error');
+      btn.disabled = false;
+      btn.textContent = originalLabel;
+    }
+  });
+
   document.getElementById('signup-form').addEventListener('submit', async function(e) {
     e.preventDefault();
     var form = e.currentTarget;

package/dist/server/realtime-token.d.ts

@@ -26,9 +26,9 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=realtime-token.d.ts.map

package/dist/server/realtime-voice.js

@@ -412,7 +412,7 @@ function createSessionHandler(tools, capabilities, options) {
             if (!builderConfigured && !apiKey) {
                 setResponseStatus(event, 409);
                 return {
-                    error: "Connect Builder or configure an OpenAI API key to use realtime voice.",
+                    error: "Connect Builder (free tier available) or configure an OpenAI API key to use realtime voice.",
                     code: "realtime_voice_setup_required",
                 };
             }

package/dist/server/sentry.d.ts

@@ -57,7 +57,7 @@ export declare function setSentryRequestContext(ctx: {
  * this just records the error for observability.
  */
 export declare function captureAuthError(error: unknown, context: {
-    route: "login" | "signup" | "logout";
+    route: "login" | "signup" | "logout" | "magic-link";
     email?: string;
 }): string | undefined;
 export interface RouteErrorContext {

package/dist/server/transcribe-voice.js

@@ -269,7 +269,7 @@ export function createTranscribeVoiceHandler() {
             if (!(await hasBuilderPrivateKey())) {
                 setResponseStatus(event, 400);
                 return {
-                    error: `${label} is selected but Builder.io is not connected. Connect Builder.io in Settings, or change the provider preference.`,
+                    error: `${label} is selected but Builder.io is not connected. Connect Builder.io (free tier available) in Settings, or change the provider preference.`,
                 };
             }
             try {
@@ -403,7 +403,7 @@ export function createTranscribeVoiceHandler() {
             return {
                 error: builderError
                     ? `Builder transcription failed: ${builderError}. Add GEMINI_API_KEY, GROQ_API_KEY, or OPENAI_API_KEY in Settings → API Keys to enable a fallback provider.`
-                    : "No voice transcription provider configured. Connect Builder.io or add GEMINI_API_KEY / GROQ_API_KEY / OPENAI_API_KEY in Settings → API Keys.",
+                    : "No voice transcription provider configured. Connect Builder.io (free tier available) or add GEMINI_API_KEY / GROQ_API_KEY / OPENAI_API_KEY in Settings → API Keys.",
             };
         }
         return await callWhisperCompat({
@@ -489,7 +489,7 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
         if (!(await hasBuilderPrivateKey())) {
             setResponseStatus(event, 400);
             return {
-                error: "Builder.io cleanup is selected but Builder.io is not connected. Connect Builder.io in Settings, or change the provider preference.",
+                error: "Builder.io cleanup is selected but Builder.io is not connected. Connect Builder.io (free tier available) in Settings, or change the provider preference.",
             };
         }
         try {

package/dist/shared/first-run-onboarding.d.ts

@@ -1,3 +1,4 @@
 export declare const FIRST_RUN_ONBOARDING_COOKIE = "agent-native-first-run";
 export declare const FIRST_RUN_ONBOARDING_MAX_AGE: number;
+export declare const FIRST_RUN_ONBOARDING_COMPLETED_KEY = "onboarding:first-run-completed";
 //# sourceMappingURL=first-run-onboarding.d.ts.map

package/dist/shared/first-run-onboarding.js

@@ -1,3 +1,4 @@
 export const FIRST_RUN_ONBOARDING_COOKIE = "agent-native-first-run";
 export const FIRST_RUN_ONBOARDING_MAX_AGE = 24 * 60 * 60;
+export const FIRST_RUN_ONBOARDING_COMPLETED_KEY = "onboarding:first-run-completed";
 //# sourceMappingURL=first-run-onboarding.js.map

package/dist/templates/chat/.agents/skills/agent-native-docs/SKILL.md

@@ -31,6 +31,26 @@ the framework monorepo checkout.
 
 From a generated app directory:
 
+```bash
+pnpm action framework-search --pattern "defineAction"
+pnpm action framework-search --pattern "templates/*/actions/*.ts" --mode glob --scope source
+pnpm action framework-search --pattern "Agent(?:Panel|Sidebar)" --mode regex --scope source
+```
+
+Use `framework-search` first when a question may cross the docs and source
+boundary. It searches the version-matched framework docs, runtime-visible
+skills, readable Core or Toolkit package source, and first-party template
+corpus in one bounded read-only call. Use `scope: docs` or `scope: source` to
+narrow it, then use the existing focused readers for the page or file you need.
+
+The same tool is available in the headless `pnpm agent` loop and every built-in
+app agent. Its default substring mode is safest for ordinary questions; use
+`glob` for wildcard paths, `sql-like` for `%` and `_` wildcards, and `regex`
+for precise structural matches. Results are bounded, so refine the pattern or
+path instead of treating a truncated result as exhaustive.
+
+From a generated app directory, the lower-level readers remain available:
+
 ```bash
 pnpm action docs-search --query "<feature>"
 pnpm action docs-search --slug <slug>
@@ -41,9 +61,9 @@ pnpm action source-search --path templates/chat/actions/hello.ts
 pnpm action source-search --list
 ```
 
-The headless `pnpm agent` loop and built-in app agent also expose a read-only
-`docs-search` tool with the same `query`, `slug`, and `list` options, plus a
-read-only `source-search` tool with `query`, `path`, and `list`.
+The headless `pnpm agent` loop and built-in app agent also expose read-only
+`framework-search`, `docs-search`, and `source-search` tools. Use the unified
+tool for discovery, then the focused tools for full page or file reads.
 
 If the action runner is unavailable, search the package directly:
 

package/dist/templates/chat/.agents/skills/agent-native-toolkit/SKILL.md

@@ -65,6 +65,22 @@ Contextual agent UI is not a reason to expose every option at once. Start with
 the domain task's primary action, reveal review or configuration only when the
 current state needs it, and let the sidebar carry conversational depth.
 
+## Visual Direction And Workspace Variety
+
+Shared workspace behavior should be consistent without forcing every app into
+the same visual skin. Keep shell and component tokens semantic, then let each
+app declare a named direction in `DESIGN.md` before styling. A new app should
+choose its palette family and composition from the product context, compare
+nearby apps, and avoid inheriting their accent by default. Use the
+`frontend-design` visual-direction reference for mode, palette, type, density,
+shape, anti-references, and the `distill` / `typeset` / `colorize` / `layout` /
+`polish` / `audit` review vocabulary.
+
+Do not make warm beige plus terracotta the workspace fallback. Preserve a
+workspace-level brand when one exists; otherwise keep shared chrome neutral and
+allow app-owned accents to distinguish products while retaining accessible
+semantic states and the shared AgentSidebar contract.
+
 ## Discover Before Building
 
 Before creating an app-local version of repeated workspace or agent UI:

package/dist/templates/chat/.agents/skills/frontend-design/SKILL.md

@@ -34,6 +34,22 @@ Before coding, decide:
 
 Then implement working code that is cohesive, accessible, responsive, and polished in small details: typography, spacing, copy, motion, empty states, loading states, focus states, and error states.
 
+## Visual Direction Contract
+
+Before styling a new app or workspace surface, define its product mode,
+audience, visual world, palette family, type treatment, composition, shape
+language, and anti-references in `DESIGN.md`. Read
+`references/visual-direction.md` for the direction families and review
+vocabulary. This is the Impeccable-inspired design contract for Agent-Native
+apps: understand the product, name the mode, deal a few coherent directions,
+commit to one, and audit the result instead of averaging back to a starter.
+
+Preserve an existing brand system and component library. When no brand exists,
+choose a deliberate direction based on the domain and compare sibling apps
+before selecting its accent family. Shared behavior and semantic token names
+should stay consistent; palette, density, composition, type contrast, and
+shape language should not be identical by default.
+
 ## Minimalism And Progressive Disclosure
 
 Default to Apple/Linear-level restraint: make the primary workflow obvious, then remove everything that does not help that workflow right now. A polished UI often has fewer visible controls, fewer borders, fewer labels, and fewer explanatory surfaces than the first reasonable implementation.
@@ -81,13 +97,13 @@ passed this requirement yet.
   operational apps, make a clear sans-serif hierarchy the default; reserve a
   serif or editorial face for a deliberate content preview or brand moment,
   not the whole application shell.
-- **Color and theme**: Use semantic tokens and CSS variables. Avoid one-note palettes and default purple/blue gradients unless the brand demands them.
+- **Color and theme**: Use semantic tokens and CSS variables. Avoid one-note palettes, default warm beige/terracotta, and default purple/blue gradients unless the brand demands them. New apps should choose a product-fitting accent family rather than inherit the previous app's color.
 - **Motion**: Prefer purposeful transitions and small state changes. Use CSS transitions/keyframes unless the app already uses a motion library. Never `transition-all` — list the properties that actually change (e.g. `transition-[opacity,transform]`). Use the shared easing tokens defined in `packages/core/src/styles/agent-native.css` instead of hand-typing curves: `var(--ease-drawer)` (260ms, drawers/app chrome), `var(--ease-collapse)` (200ms, expand/collapse), `var(--ease-out-strong)` (snappy entrances) — in Tailwind, `ease-[var(--ease-collapse)]`. Enter/exit with ease-out, never `ease-in`. Overlays that zoom in must set the Radix origin var (e.g. `origin-[--radix-popover-content-transform-origin]`). Animate `transform`/`opacity`, not width/height/padding/box-shadow. Gate looping or large-movement animations with `motion-reduce:`. Command palettes and keyboard-triggered actions get no animation.
 - **Composition**: Match the workflow. Operational apps should be dense and scannable; marketing or portfolio pages can be more immersive.
 - **Visual assets**: Websites, games, and object-focused pages need real or generated media when images help users understand the subject.
 - **Responsive fit**: Text must not overflow buttons, cards, tabs, sidebars, or fixed-format tools. Use stable dimensions for boards, grids, toolbars, and counters.
 
-**Beat convergence, not just defaults.** You sample toward the "on-distribution" center, so naming what to avoid is not enough: every "don't" needs a "do", or you converge on the next safe option (ban Inter and you reach for Roboto; ban purple gradients and you reach for Space Grotesk + a teal accent on every screen). Commit to one named direction, pair any reference with the reason it fits ("Linear: the quiet confidence of its spacing" — a bare "Linear" collapses back to the average), and match implementation effort to the vision: maximalist wants elaborate motion and effects, minimal wants restraint and precise spacing. When building on an existing app, inspect its tokens/type/components first and treat any drift back to a default as a missing token to pin, not something to re-prompt.
+**Beat convergence, not just defaults.** You sample toward the "on-distribution" center, so naming what to avoid is not enough: every "don't" needs a "do", or you converge on the next safe option. Commit to one named direction, pair any reference with the reason it fits, and match implementation effort to the vision. If the brief is open, consider two or three coherent visual worlds, then commit to one instead of averaging them. When building on an existing app, inspect its tokens/type/components first and treat any drift back to a default as a missing token to pin, not something to re-prompt.
 
 ## Agent-Native UI Rules
 
@@ -164,6 +180,9 @@ as an operator would use it repeatedly:
 - For review flows, stack the source/original first and the generated or safe
   result second by default. Use side-by-side comparison only when the content
   is short enough to scan without excessive horizontal reading.
+- Compare the result with sibling apps. Shared toolkit behavior should feel
+  consistent, but a repeated palette, hero composition, type pairing, and
+  radius language without a product reason is visual drift, not consistency.
 - Check the result at the target desktop width and a narrow width. If the first
   viewport feels like documentation instead of a tool, subtract again.
 
@@ -216,6 +235,8 @@ For substantial frontend work:
 5. When registering or changing a company adapter, run
    `@agent-native/toolkit/conformance`, including mixed-overlay focus,
    `portalContainer`, and z-index stacking checks.
+6. For a new app or a visual redesign, review `DESIGN.md` against the rendered
+   surface and run the anti-slop audit in `references/visual-direction.md`.
 
 ## Related Skills
 

package/dist/templates/chat/.agents/skills/frontend-design/references/visual-direction.md

@@ -0,0 +1,99 @@
+# Visual Direction Reference
+
+Use this reference when a new app or workspace needs a visual point of view and
+does not already have an established brand system. It adapts the useful parts
+of Impeccable's workflow: understand the product, name the surface mode, deal
+several coherent directions, commit to one, and audit the result for defaults
+that became the design by accident.
+
+## The direction contract
+
+Before writing UI, capture these decisions in the app's `DESIGN.md`:
+
+| Decision             | What to record                                                      |
+| -------------------- | ------------------------------------------------------------------- |
+| Product mode         | `operate`, `read`, `persuade`, or `experience`                      |
+| Audience and cadence | Who uses it, how often, and under what conditions                   |
+| Visual world         | A short name and the feeling it creates                             |
+| Palette family       | The semantic accent family and neutral undertone                    |
+| Type treatment       | Sans-first, editorial contrast, or display-led emphasis             |
+| Composition          | Dense console, focused workbench, document, canvas, or guided steps |
+| Shape language       | Quiet corners, crisp geometry, or soft utility surfaces             |
+| Anti-references      | Defaults this app must not drift toward                             |
+
+`DESIGN.md` is a portable design contract, not a license to bypass the app's
+tokens or component system. If the app already has a brand system, document it
+and preserve it. If it does not, choose a direction before styling.
+
+## Palette families
+
+Use one family as an accent and keep the rest of the system semantic and quiet.
+These are starting points, not a fixed theme library:
+
+| Family           | Good fit                                    | Typical character                 |
+| ---------------- | ------------------------------------------- | --------------------------------- |
+| Ink / graphite   | Admin, security, sensitive review           | Serious, low-noise, high contrast |
+| Cobalt / sky     | Planning, collaboration, scheduling         | Clear, trustworthy, alert         |
+| Pine / teal      | Automation, systems, finance, data          | Calm, capable, grounded           |
+| Indigo / violet  | Slides, creative tools, research            | Exploratory, focused, expressive  |
+| Plum / berry     | Publishing, knowledge, editorial work       | Distinctive, thoughtful, human    |
+| Coral / rose     | Communication, people, customer workflows   | Warm, direct, social              |
+| Ochre / citron   | Lightweight planning or energetic utilities | Optimistic, sparing, directional  |
+| Paper / charcoal | Long-form reading, exports, approvals       | Tactile, restrained, legible      |
+
+Do not make warm beige plus terracotta the universal fallback. Do not rotate
+through saturated colors mechanically. Choose the family that supports the
+workflow, then verify contrast, dark mode, focus states, destructive states,
+and the sidebar boundary.
+
+## Variation without chaos
+
+Vary at least two independent axes when sibling apps share a workspace:
+
+- accent family or neutral undertone;
+- information density and page composition;
+- type contrast and display treatment;
+- radius and border language;
+- navigation emphasis and use of whitespace.
+
+Keep shared behavior, semantic token names, accessibility, and AgentSidebar
+placement consistent. The goal is a family of products, not five unrelated
+themes and not five copies of the same starter.
+
+For a batch of apps, keep a small direction ledger in the workspace
+`DESIGN.md` or the handoff. Record each app's mode, direction, and palette
+family, then choose a new family or a clearly different composition for the
+next app unless an existing brand requires reuse. Never copy a sibling's
+`global.css` palette block or treat the last app's accent as the generator
+default.
+
+## Review vocabulary
+
+Make one named intervention at a time so the agent can reason about the
+change:
+
+- `distill` - remove copy, controls, cards, and chrome that do not serve the
+  next decision;
+- `typeset` - repair hierarchy, measure, line length, and emphasis;
+- `colorize` - establish a restrained semantic palette and contrast states;
+- `layout` - repair grouping, density, alignment, and responsive composition;
+- `polish` - resolve the small visual inconsistencies after the structure is
+  right;
+- `audit` - check slop, accessibility, responsive behavior, and visual drift.
+
+Do not average several directions into a generic compromise. Deal two or three
+coherent options when the brief is open, select one, and encode the decision in
+tokens and `DESIGN.md`.
+
+## Anti-slop audit
+
+Before handoff, inspect the first viewport and ask:
+
+- Did the app inherit the neighboring app's palette or hero layout without a
+  product reason?
+- Are there equal-weight cards, status chips, helper paragraphs, or controls
+  that should be removed or disclosed?
+- Does the typography fit the product mode instead of decorating the shell?
+- Is the AgentSidebar distinct but quiet, with the domain page still primary?
+- Are focus, loading, empty, error, dark, and narrow-width states part of the
+  same design direction?

package/dist/templates/chat/AGENTS.md

@@ -22,6 +22,9 @@ workflow needs durable UI around the conversation.
 - Use a sans-first SaaS hierarchy with one restrained visual cue; reserve serif
   type for content previews. Give the AgentSidebar a subtle surface/divider
   boundary, and stack original/generated review vertically by default.
+- Before visual work, read `frontend-design` and fill in `DESIGN.md`. Choose a
+  product-fitting visual direction and palette family; do not make warm beige
+  plus terracotta the default or copy a sibling app's accent automatically.
 - Every AI-labeled button must call `sendToAgentChat()` with
   `openSidebar: true`; label deterministic local actions as local or preview.
 - Scale effort to the task. A small, well-specified change is a short read, the