@agent-native/core 0.144.3 → 0.145.0

package/dist/server/prompts/shared-rules.js

@@ -7,6 +7,7 @@
  * rule) and 12–13 (planning discipline; collaborate through uncertainty) are
  * reproduced verbatim in both prompts — keep them here.
  */
+import { frameworkGroupEnabled, } from "../../framework-tools.js";
 import { normalizeDatabaseToolsMode, } from "../../scripts/db/tool-mode.js";
 const DEFAULT_PROVIDER_ACTIONS = [
     "provider-search",
@@ -64,14 +65,23 @@ export const SHARED_RULE_9 = `9. **Never fabricate — verify results, report fa
    - **Never fabricate success from tool errors** — when a tool call returns an error (marked \`isError: true\`, contains "Command failed", "Error:", or non-zero exit output), the operation FAILED; do not synthesize a success narrative or describe what it "would have" produced. Report the failure verbatim (this applies especially to \`bash(command="pnpm action ...")\` calls). Before telling the user a mutating action (create/update/delete/send/publish) is done, confirm it actually landed — check the tool result, or read the refreshed \`<current-screen>\` / re-query the data; having *called* an action is not proof it worked. If a result is ambiguous, check rather than assume.
    - **Recover instead of giving up** — treat a failure or ambiguous result as a signal to retry the obvious fix, try an alternate tool or approach, or clearly hand the blocker back with what you tried; never silently give up, and never paper over a failure by claiming success.`;
 /**
- * Rule 12 (const name retained as SHARED_RULE_14 for import stability) —
- * Planning and progress. Deliberately states only when to open a progress run;
- * the start/update/complete discipline lives in `manage-progress`'s own tool
+ * Rule 12 (name retained as `sharedRule14` for import stability) — Planning and
+ * progress. Deliberately states only when to open a progress run; the
+ * start/update/complete discipline lives in `manage-progress`'s own tool
  * description (packages/core/src/progress/actions.ts). Re-adding the mechanics
  * here means every turn pays for guidance the model only needs once it has the
  * tool loaded.
+ *
+ * Drops the `manage-progress` reference when the `automation` group is off, so
+ * the rule never names a tool the request does not carry. The planning
+ * discipline itself still applies — only the tool call goes away.
  */
-export const SHARED_RULE_14 = `12. **Plan and track multi-step work** — When a task spans several real steps the user would want to watch, open a \`manage-progress\` run so the work is visible while it's still in flight, and keep it updated as you go rather than after the fact; the tool's own description carries the full discipline. Skip it for single-action lookups, simple reads, and anything that finishes in one tool call — never create single-step plans.`;
+export function sharedRule14(options) {
+    if (!frameworkGroupEnabled(options?.disabledFrameworkGroups, "automation")) {
+        return `12. **Plan and track multi-step work** — When a task spans several real steps, work through them in order and tell the user where you are as you go rather than only at the end. Skip ceremony for single-action lookups, simple reads, and anything that finishes in one tool call.`;
+    }
+    return `12. **Plan and track multi-step work** — When a task spans several real steps the user would want to watch, open a \`manage-progress\` run so the work is visible while it's still in flight, and keep it updated as you go rather than after the fact; the tool's own description carries the full discipline. Skip it for single-action lookups, simple reads, and anything that finishes in one tool call — never create single-step plans.`;
+}
 /**
  * Rule 14 — Relay agent warnings. Named for what it is rather than its number,
  * since the `SHARED_RULE_14`/`15` names above no longer match theirs.

package/dist/templates/workspace-core/.agents/skills/extensions/SKILL.md

@@ -217,9 +217,12 @@ POST /_agent-native/extensions
 
 HTTP creation is disabled by default. The host app must set
 `extensionTools: true` on `createCoreRoutesPlugin()` as well as
-`createAgentChatPlugin()`; otherwise authenticated collection `POST` requests
-return `403` while existing extension runtime, read, edit, and deep-link routes
-remain available for compatibility.
+`frameworkTools: { extensions: true }` on `createAgentChatPlugin()`; otherwise
+authenticated collection `POST` requests return `403` while existing extension
+runtime, read, edit, and deep-link routes remain available for compatibility.
+(`extensionTools` on the agent-chat plugin is the deprecated spelling of
+`frameworkTools.extensions`; the core-routes option keeps its own name because
+it gates route mounting rather than agent tools.)
 
 The action accepts:
 

package/docs/content/deployment.mdx

@@ -580,16 +580,19 @@ Rotate signing/session keys by replacing the env var on every instance and redep
 
 ## Production Agent Tools {#production-agent-tools}
 
-Production agents get the app's registered actions plus framework tools from
-the agent chat plugin. SQL inspection is enabled by default, while database
-writes go through typed app actions unless the app explicitly opts into raw
-write tools:
+Production agents get the app's registered actions plus the framework's own
+tools. `frameworkTools` selects which of those framework tools this app exposes.
+Every group defaults to today's behavior, so omitting the option changes
+nothing:
 
 ```ts filename="server/plugins/agent-chat.ts"
 export default createAgentChatPlugin({
-  // Default: "read"
-  databaseTools: "read", // "write" | "read" | "off"
-  extensionTools: true,
+  frameworkTools: {
+    database: "read", // "write" | "read" | "off" — default "read"
+    extensions: true, // default false
+    sharing: false, // this app has no share surface
+    review: false,
+  },
 });
 ```
 
@@ -599,17 +602,48 @@ export default createCoreRoutesPlugin({
 });
 ```
 
-- `databaseTools: "read"` — default. Registers only `db-schema` and `db-query`;
+`database` and `extensions` accept the values the old top-level flags did:
+
+- `database: "read"` — default. Registers only `db-schema` and `db-query`;
   agents inspect data with SQL but must use typed app actions for writes.
-- `databaseTools: "write"` or `true` — additionally registers `db-exec` and
+- `database: "write"` or `true` — additionally registers `db-exec` and
   `db-patch` for deliberate raw SQL maintenance. Writes are scoped to the
   current user/org and schema changes are blocked.
-- `databaseTools: "off"` or `false` — removes raw database tools from the
+- `database: "off"` or `false` — removes raw database tools from the
   agent surface so the app's actions are the only data access path.
-- `extensionTools: true` — opts the app into framework extension-management
+- `extensions: true` — opts the app into framework extension-management
   actions and prompt guidance (`create-extension`, `update-extension`, etc.).
-  Set it on both plugins to also allow authenticated REST creation. Extensions
-  are disabled by default.
+  Set `extensionTools: true` on the core-routes plugin as well to allow
+  authenticated REST creation. Extensions are disabled by default.
+
+The remaining groups are booleans, all on by default: `sharing`, `review`,
+`history`, `featureFlags`, `localization`, `audit`, `contextXray`,
+`userProfile`, `automation`, `docs`, `resources`, `web`, `workspaceApps`,
+`chat`, and `email`. Use `frameworkTools: "minimal"` to turn every group off at
+once for a voice-first or single-purpose app, or
+`frameworkTools: { preset: "minimal", resources: true }` to keep just one — an
+explicit group key always wins over the preset.
+
+Switching a group off removes it from the **agent** surfaces only: interactive
+chat, MCP, A2A, and background runs. The matching HTTP action routes stay
+mounted, because the UI reaches them through client hooks — disabling `sharing`
+must not 404 a share dialog that is still on screen. Weigh that parity cost
+before using it: the framework's contract is that anything the UI can do the
+agent can do, so `sharing: false` alongside a visible share button is a
+deliberate break, and only makes sense when the app has no such surface at all.
+
+Framework tools are no longer promoted into the first model request by default,
+independent of this option. They stay in the searchable registry and load
+through `tool-search`, or immediately if the app names them in
+`initialToolNames`.
+
+<Callout tone="warning">
+  The top-level `databaseTools` and `extensionTools` options are deprecated in
+  favor of `frameworkTools.database` and `frameworkTools.extensions`. They are
+  still honored, but setting a top-level flag and its `frameworkTools`
+  equivalent to conflicting values throws at plugin startup rather than booting
+  with a tool surface nobody chose.
+</Callout>
 
 ## Production Code Execution {#production-code-execution}
 

package/docs/content/key-concepts.mdx

@@ -254,12 +254,19 @@ pnpm action db-query --sql "SELECT * FROM forms"
 ```
 
 The production agent chat plugin defaults raw SQL tools to read-only
-(`databaseTools: "read"`), so agents inspect app-owned data with `db-schema` /
-`db-query` and perform writes through typed app actions. Set
-`databaseTools: "write"` (or `true`) only for deliberate maintenance surfaces
-that should also expose scoped `db-exec` / `db-patch`; set
-`databaseTools: "off"` / `false` to require typed app actions for all data
-access.
+(`frameworkTools: { database: "read" }`), so agents inspect app-owned data with
+`db-schema` / `db-query` and perform writes through typed app actions. Set
+`database: "write"` (or `true`) only for deliberate maintenance surfaces that
+should also expose scoped `db-exec` / `db-patch`; set `database: "off"` /
+`false` to require typed app actions for all data access.
+
+`frameworkTools` governs the rest of the framework's own tools the same way —
+sharing, review comments, version history, feature flags, localization, audit,
+context X-Ray, profile, automations, docs, resources, web, cross-app delegation,
+chat, and email. See
+[Production Agent Tools](/docs/deployment#production-agent-tools) for the full
+list, the `"minimal"` preset, and why disabling a group leaves its HTTP routes
+mounted.
 
 ## Agent chat bridge {#agent-chat-bridge}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.144.3",
+  "version": "0.145.0",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -412,8 +412,8 @@
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "^0.13.3",
-    "@agent-native/recap-cli": "0.5.3"
+    "@agent-native/recap-cli": "0.5.3",
+    "@agent-native/toolkit": "^0.13.3"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",

package/src/templates/workspace-core/.agents/skills/extensions/SKILL.md

@@ -217,9 +217,12 @@ POST /_agent-native/extensions
 
 HTTP creation is disabled by default. The host app must set
 `extensionTools: true` on `createCoreRoutesPlugin()` as well as
-`createAgentChatPlugin()`; otherwise authenticated collection `POST` requests
-return `403` while existing extension runtime, read, edit, and deep-link routes
-remain available for compatibility.
+`frameworkTools: { extensions: true }` on `createAgentChatPlugin()`; otherwise
+authenticated collection `POST` requests return `403` while existing extension
+runtime, read, edit, and deep-link routes remain available for compatibility.
+(`extensionTools` on the agent-chat plugin is the deprecated spelling of
+`frameworkTools.extensions`; the core-routes option keeps its own name because
+it gates route mounting rather than agent tools.)
 
 The action accepts: