@agent-native/core 0.146.3 → 0.146.4

package/corpus/templates/macros/netlify.toml

@@ -1,6 +1,6 @@
 [build]
 ignore = "node ./scripts/netlify-ignore-build.mjs macros"
-command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && DATABASE_URL=${NETLIFY_DATABASE_URL_UNPOOLED:-$DATABASE_URL} NITRO_PRESET=netlify pnpm --filter macros build"
+command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && DATABASE_URL=${NETLIFY_DATABASE_URL_UNPOOLED:-$DATABASE_URL} NITRO_PRESET=netlify pnpm --filter macros build && if [ \"${CONTEXT:-}\" = \"production\" ]; then DATABASE_URL=${NETLIFY_DATABASE_URL_UNPOOLED:-$DATABASE_URL} pnpm --filter macros migrate:production; fi"
 publish = "templates/macros/dist"
 functions = "templates/macros/.netlify/functions-internal"
 

package/corpus/templates/macros/package.json

@@ -10,6 +10,7 @@
     "test": "vitest --run --passWithNoTests",
     "format.fix": "oxfmt --write .",
     "typecheck": "agent-native typecheck",
+    "migrate:production": "tsx scripts/migrate-production.ts",
     "action": "agent-native action",
     "script": "agent-native script",
     "db:push": "drizzle-kit push",

package/corpus/templates/macros/scripts/migrate-production.ts

@@ -0,0 +1,24 @@
+import { closeDbExec, withMigrationRuntime } from "@agent-native/core/db";
+import { runFrameworkReleaseMigrations } from "@agent-native/core/server";
+
+import { runMacrosMigrations } from "../server/plugins/db.js";
+
+/**
+ * Release-time schema entrypoint for Macros.
+ *
+ * This script is the production owner of schema changes. It runs against the
+ * direct migration endpoint selected by core, while request functions skip
+ * all migration and ensure-table work automatically.
+ */
+async function main(): Promise<void> {
+  await withMigrationRuntime(async () => {
+    await runFrameworkReleaseMigrations(null);
+    await runMacrosMigrations(null);
+  });
+}
+
+try {
+  await main();
+} finally {
+  await closeDbExec();
+}

package/corpus/templates/macros/server/plugins/db.ts

@@ -37,7 +37,7 @@ const schemaTables = Object.values(schema).filter(isDrizzleTable);
 // packages/core/src/db/migrations.ts for the full rationale). Version numbers
 // alone are not a safe identity across parallel branches that each extend
 // this list independently.
-const runMacrosMigrations = runMigrations(
+export const runMacrosMigrations = runMigrations(
   [
     {
       version: 1,

package/corpus/templates/macros/tsconfig.json

@@ -13,6 +13,7 @@
     "app/**/*",
     "server/**/*",
     "shared/**/*",
+    "scripts/**/*",
     "actions/**/*",
     "react-router.config.ts",
     ".react-router/types/**/*",

package/corpus/templates/mail/.agents/skills/self-modifying-code/SKILL.md

@@ -36,8 +36,10 @@ Tier 4 includes **all** of the following — not only editing package source:
 - Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
 - `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
   target any `@agent-native/*` package
-- Local package patches or invented "dispatch/core behavior" shims meant to
-  paper over a version skew or failed upgrade
+- `pnpm patch`, `pnpm patch-commit`, or local package patch artifacts for any
+  dependency
+- Invented "dispatch/core behavior" shims meant to paper over a version skew
+  or failed upgrade
 
 This does not prohibit intentional app-owned UI customization. When public
 props and composition are insufficient, the `customizing-agent-native` skill
@@ -100,8 +102,10 @@ inline strings in components.
 - Don't confuse readable package source with app-owned code: use
   `customizing-agent-native` and `agent-native eject` for supported ownership
   transfer
+- Don't use `pnpm patch` / `pnpm patch-commit`, commit `patches/` artifacts, or
+  add `pnpm.patchedDependencies` to "make the app run" after a version bump
 - Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
-  `@agent-native/*` to "make the app run" after a version bump
+  `@agent-native/*` to paper over a broken upgrade
 - Don't invent local dispatch/core behavior overrides when upgrade fails —
   run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested

package/corpus/templates/mail/.agents/skills/upgrade-agent-native/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 
 When an older Agent Native app/branch needs to run on current packages, use
 `agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
+`pnpm patch`, `pnpm patch-commit`, `pnpm.patchedDependencies`,
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patch artifacts,
+or edits under `node_modules/@agent-native/*` — especially not against
 `@agent-native/core` or `@agent-native/dispatch`.
 
 ## Why
@@ -109,6 +110,8 @@ install → refresh scaffold skills → verify, then fix **app** code only.
 
 - Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
   `patchedDependencies` for any `@agent-native/*` package
+- Don't run `pnpm patch` or `pnpm patch-commit`, or commit files under
+  `patches/`, for any dependency
 - Don't edit `node_modules/@agent-native/core` or
   `node_modules/@agent-native/dispatch`
 - Don't invent local "dispatch behavior" shims to paper over version skew

package/corpus/templates/mail/netlify.toml

@@ -1,6 +1,6 @@
 [build]
 ignore = "node ./scripts/netlify-ignore-build.mjs mail"
-command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && DATABASE_URL=${NETLIFY_DATABASE_URL_UNPOOLED:-$DATABASE_URL} NITRO_PRESET=netlify pnpm --filter mail build"
+command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && DATABASE_URL=${NETLIFY_DATABASE_URL_UNPOOLED:-$DATABASE_URL} NITRO_PRESET=netlify pnpm --filter mail build && if [ \"${CONTEXT:-}\" = \"production\" ]; then DATABASE_URL=${NETLIFY_DATABASE_URL_UNPOOLED:-$DATABASE_URL} pnpm --filter mail migrate:production; fi"
 publish = "templates/mail/dist"
 functions = "templates/mail/.netlify/functions-internal"
 

package/corpus/templates/mail/package.json

@@ -10,6 +10,7 @@
     "test": "vitest --run",
     "format.fix": "oxfmt --write .",
     "typecheck": "agent-native typecheck",
+    "migrate:production": "tsx scripts/migrate-production.ts",
     "action": "agent-native action",
     "script": "agent-native script",
     "db:push": "drizzle-kit push",

package/corpus/templates/mail/scripts/migrate-production.ts

@@ -0,0 +1,24 @@
+import { closeDbExec, withMigrationRuntime } from "@agent-native/core/db";
+import { runFrameworkReleaseMigrations } from "@agent-native/core/server";
+
+import { runMailMigrations } from "../server/plugins/db.js";
+
+/**
+ * Release-time schema entrypoint for Mail.
+ *
+ * This script is the production owner of schema changes. It runs against the
+ * direct migration endpoint selected by core, while request functions skip
+ * all migration and ensure-table work automatically.
+ */
+async function main(): Promise<void> {
+  await withMigrationRuntime(async () => {
+    await runFrameworkReleaseMigrations(null);
+    await runMailMigrations(null);
+  });
+}
+
+try {
+  await main();
+} finally {
+  await closeDbExec();
+}

package/corpus/templates/mail/server/plugins/db.ts

@@ -29,7 +29,7 @@ const schemaTables = Object.values(schema).filter(isDrizzleTable);
 // packages/core/src/db/migrations.ts for the full rationale). Version numbers
 // alone are not a safe identity across parallel branches that each extend
 // this list independently.
-const runMailMigrations = runMigrations(
+export const runMailMigrations = runMigrations(
   [
     {
       version: 1,

package/corpus/templates/mail/tsconfig.json

@@ -13,6 +13,7 @@
     "app/**/*",
     "server/**/*",
     "shared/**/*",
+    "scripts/**/*",
     "vite.config.ts",
     "react-router.config.ts",
     ".react-router/types/**/*",

package/corpus/templates/plan/.agents/skills/self-modifying-code/SKILL.md

@@ -36,8 +36,10 @@ Tier 4 includes **all** of the following — not only editing package source:
 - Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
 - `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
   target any `@agent-native/*` package
-- Local package patches or invented "dispatch/core behavior" shims meant to
-  paper over a version skew or failed upgrade
+- `pnpm patch`, `pnpm patch-commit`, or local package patch artifacts for any
+  dependency
+- Invented "dispatch/core behavior" shims meant to paper over a version skew
+  or failed upgrade
 
 This does not prohibit intentional app-owned UI customization. When public
 props and composition are insufficient, the `customizing-agent-native` skill
@@ -100,8 +102,10 @@ inline strings in components.
 - Don't confuse readable package source with app-owned code: use
   `customizing-agent-native` and `agent-native eject` for supported ownership
   transfer
+- Don't use `pnpm patch` / `pnpm patch-commit`, commit `patches/` artifacts, or
+  add `pnpm.patchedDependencies` to "make the app run" after a version bump
 - Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
-  `@agent-native/*` to "make the app run" after a version bump
+  `@agent-native/*` to paper over a broken upgrade
 - Don't invent local dispatch/core behavior overrides when upgrade fails —
   run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested

package/corpus/templates/plan/.agents/skills/upgrade-agent-native/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 
 When an older Agent Native app/branch needs to run on current packages, use
 `agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
+`pnpm patch`, `pnpm patch-commit`, `pnpm.patchedDependencies`,
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patch artifacts,
+or edits under `node_modules/@agent-native/*` — especially not against
 `@agent-native/core` or `@agent-native/dispatch`.
 
 ## Why
@@ -109,6 +110,8 @@ install → refresh scaffold skills → verify, then fix **app** code only.
 
 - Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
   `patchedDependencies` for any `@agent-native/*` package
+- Don't run `pnpm patch` or `pnpm patch-commit`, or commit files under
+  `patches/`, for any dependency
 - Don't edit `node_modules/@agent-native/core` or
   `node_modules/@agent-native/dispatch`
 - Don't invent local "dispatch behavior" shims to paper over version skew

package/corpus/templates/plan/netlify.toml

@@ -1,6 +1,6 @@
 [build]
 ignore = "node ./scripts/netlify-ignore-build.mjs plan"
-command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && NITRO_PRESET=netlify pnpm --filter plan build"
+command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && NITRO_PRESET=netlify pnpm --filter plan build && if [ \"${CONTEXT:-}\" = \"production\" ]; then pnpm --filter plan migrate:production; fi"
 publish = "templates/plan/dist"
 functions = "templates/plan/.netlify/functions-internal"
 

package/corpus/templates/plan/package.json

@@ -9,6 +9,7 @@
     "build": "agent-native build",
     "start": "agent-native start",
     "typecheck": "agent-native typecheck",
+    "migrate:production": "tsx scripts/migrate-production.ts",
     "action": "agent-native action",
     "script": "agent-native script",
     "test": "vitest --run"

package/corpus/templates/plan/scripts/migrate-production.ts

@@ -0,0 +1,24 @@
+import { closeDbExec, withMigrationRuntime } from "@agent-native/core/db";
+import { runFrameworkReleaseMigrations } from "@agent-native/core/server";
+
+import { runPlanMigrations } from "../server/plugins/db.js";
+
+/**
+ * Release-time schema entrypoint for Plan.
+ *
+ * This script is the production owner of schema changes. It runs against the
+ * direct migration endpoint selected by core, while request functions skip
+ * all migration and ensure-table work automatically.
+ */
+async function main(): Promise<void> {
+  await withMigrationRuntime(async () => {
+    await runFrameworkReleaseMigrations(null);
+    await runPlanMigrations(null);
+  });
+}
+
+try {
+  await main();
+} finally {
+  await closeDbExec();
+}

package/corpus/templates/plan/server/plugins/00-mcp.ts

@@ -37,8 +37,9 @@ export default function planMcpPlugin(nitroApp: any) {
       {
         ...loadActionsFromStaticRegistry(actionsRegistry),
         ...(frameworkTools.isEnabled("automation")
-          ? createAutomationToolEntries(() =>
-              requireMcpOwner("manage automations"),
+          ? createAutomationToolEntries(
+              () => requireMcpOwner("manage automations"),
+              "plan",
             )
           : {}),
       },

package/corpus/templates/plan/server/plugins/db.ts

@@ -30,7 +30,7 @@ const schemaTables = Object.values(schema).filter(isDrizzleTable);
 // packages/core/src/db/migrations.ts for the full rationale). Version numbers
 // alone are not a safe identity across parallel branches that each extend
 // this list independently.
-const runPlanMigrations = runMigrations(
+export const runPlanMigrations = runMigrations(
   [
     {
       version: 1,

package/corpus/templates/plan/tsconfig.json

@@ -15,6 +15,7 @@
     "app/**/*",
     "server/**/*",
     "shared/**/*",
+    "scripts/**/*",
     "vite.config.ts",
     "react-router.config.ts",
     ".react-router/types/**/*",

package/corpus/templates/slides/.agents/skills/self-modifying-code/SKILL.md

@@ -36,8 +36,10 @@ Tier 4 includes **all** of the following — not only editing package source:
 - Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
 - `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
   target any `@agent-native/*` package
-- Local package patches or invented "dispatch/core behavior" shims meant to
-  paper over a version skew or failed upgrade
+- `pnpm patch`, `pnpm patch-commit`, or local package patch artifacts for any
+  dependency
+- Invented "dispatch/core behavior" shims meant to paper over a version skew
+  or failed upgrade
 
 This does not prohibit intentional app-owned UI customization. When public
 props and composition are insufficient, the `customizing-agent-native` skill
@@ -100,8 +102,10 @@ inline strings in components.
 - Don't confuse readable package source with app-owned code: use
   `customizing-agent-native` and `agent-native eject` for supported ownership
   transfer
+- Don't use `pnpm patch` / `pnpm patch-commit`, commit `patches/` artifacts, or
+  add `pnpm.patchedDependencies` to "make the app run" after a version bump
 - Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
-  `@agent-native/*` to "make the app run" after a version bump
+  `@agent-native/*` to paper over a broken upgrade
 - Don't invent local dispatch/core behavior overrides when upgrade fails —
   run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested

package/corpus/templates/slides/.agents/skills/upgrade-agent-native/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 
 When an older Agent Native app/branch needs to run on current packages, use
 `agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
+`pnpm patch`, `pnpm patch-commit`, `pnpm.patchedDependencies`,
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patch artifacts,
+or edits under `node_modules/@agent-native/*` — especially not against
 `@agent-native/core` or `@agent-native/dispatch`.
 
 ## Why
@@ -109,6 +110,8 @@ install → refresh scaffold skills → verify, then fix **app** code only.
 
 - Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
   `patchedDependencies` for any `@agent-native/*` package
+- Don't run `pnpm patch` or `pnpm patch-commit`, or commit files under
+  `patches/`, for any dependency
 - Don't edit `node_modules/@agent-native/core` or
   `node_modules/@agent-native/dispatch`
 - Don't invent local "dispatch behavior" shims to paper over version skew

package/corpus/templates/slides/netlify.toml

@@ -2,7 +2,7 @@
 ignore = "node ./scripts/netlify-ignore-build.mjs slides"
 # Rebuild Core explicitly so a cached Netlify install cannot bundle an older
 # agent loop or A2A handler into Slides' server functions.
-command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && pnpm --filter @agent-native/core build && NITRO_PRESET=netlify pnpm --filter slides build"
+command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && pnpm --filter @agent-native/core build && NITRO_PRESET=netlify pnpm --filter slides build && if [ \"${CONTEXT:-}\" = \"production\" ]; then pnpm --filter slides migrate:production; fi"
 publish = "templates/slides/dist"
 functions = "templates/slides/.netlify/functions-internal"
 

package/corpus/templates/slides/package.json

@@ -10,6 +10,7 @@
     "test": "vitest --run",
     "format.fix": "oxfmt --write .",
     "typecheck": "agent-native typecheck",
+    "migrate:production": "tsx scripts/migrate-production.ts",
     "action": "agent-native action",
     "script": "agent-native script"
   },

package/corpus/templates/slides/scripts/migrate-production.ts

@@ -0,0 +1,24 @@
+import { closeDbExec, withMigrationRuntime } from "@agent-native/core/db";
+import { runFrameworkReleaseMigrations } from "@agent-native/core/server";
+
+import { runSlidesMigrations } from "../server/plugins/db.js";
+
+/**
+ * Release-time schema entrypoint for Slides.
+ *
+ * This script is the production owner of schema changes. It runs against the
+ * direct migration endpoint selected by core, while request functions skip
+ * all migration and ensure-table work automatically.
+ */
+async function main(): Promise<void> {
+  await withMigrationRuntime(async () => {
+    await runFrameworkReleaseMigrations(null);
+    await runSlidesMigrations(null);
+  });
+}
+
+try {
+  await main();
+} finally {
+  await closeDbExec();
+}

package/corpus/templates/slides/server/plugins/db.ts

@@ -33,7 +33,7 @@ const schemaTables = Object.values(schema).filter(isDrizzleTable);
 // packages/core/src/db/migrations.ts for the full rationale). Version numbers
 // alone are not a safe identity across parallel branches that each extend
 // this list independently.
-const runSlidesMigrations = runMigrations(
+export const runSlidesMigrations = runMigrations(
   [
     {
       version: 1,

package/corpus/templates/slides/tsconfig.json

@@ -13,6 +13,7 @@
     "app/**/*",
     "server/**/*",
     "shared/**/*",
+    "scripts/**/*",
     "vite.config.ts",
     "react-router.config.ts",
     ".react-router/types/**/*",

package/corpus/templates/tasks/.agents/skills/self-modifying-code/SKILL.md

@@ -36,8 +36,10 @@ Tier 4 includes **all** of the following — not only editing package source:
 - Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
 - `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
   target any `@agent-native/*` package
-- Local package patches or invented "dispatch/core behavior" shims meant to
-  paper over a version skew or failed upgrade
+- `pnpm patch`, `pnpm patch-commit`, or local package patch artifacts for any
+  dependency
+- Invented "dispatch/core behavior" shims meant to paper over a version skew
+  or failed upgrade
 
 This does not prohibit intentional app-owned UI customization. When public
 props and composition are insufficient, the `customizing-agent-native` skill
@@ -100,8 +102,10 @@ inline strings in components.
 - Don't confuse readable package source with app-owned code: use
   `customizing-agent-native` and `agent-native eject` for supported ownership
   transfer
+- Don't use `pnpm patch` / `pnpm patch-commit`, commit `patches/` artifacts, or
+  add `pnpm.patchedDependencies` to "make the app run" after a version bump
 - Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
-  `@agent-native/*` to "make the app run" after a version bump
+  `@agent-native/*` to paper over a broken upgrade
 - Don't invent local dispatch/core behavior overrides when upgrade fails —
   run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested

package/corpus/templates/tasks/.agents/skills/upgrade-agent-native/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 
 When an older Agent Native app/branch needs to run on current packages, use
 `agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
+`pnpm patch`, `pnpm patch-commit`, `pnpm.patchedDependencies`,
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patch artifacts,
+or edits under `node_modules/@agent-native/*` — especially not against
 `@agent-native/core` or `@agent-native/dispatch`.
 
 ## Why
@@ -109,6 +110,8 @@ install → refresh scaffold skills → verify, then fix **app** code only.
 
 - Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
   `patchedDependencies` for any `@agent-native/*` package
+- Don't run `pnpm patch` or `pnpm patch-commit`, or commit files under
+  `patches/`, for any dependency
 - Don't edit `node_modules/@agent-native/core` or
   `node_modules/@agent-native/dispatch`
 - Don't invent local "dispatch behavior" shims to paper over version skew

package/corpus/templates/tasks/netlify.toml

@@ -1,6 +1,6 @@
 [build]
 ignore = "node ./scripts/netlify-ignore-build.mjs tasks"
-command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && NITRO_PRESET=netlify pnpm --filter tasks build"
+command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && NITRO_PRESET=netlify pnpm --filter tasks build && if [ \"${CONTEXT:-}\" = \"production\" ]; then pnpm --filter tasks migrate:production; fi"
 publish = "templates/tasks/dist"
 functions = "templates/tasks/.netlify/functions-internal"
 

package/corpus/templates/tasks/package.json

@@ -10,6 +10,7 @@
     "start": "agent-native start",
     "format.fix": "oxfmt --write .",
     "typecheck": "agent-native typecheck",
+    "migrate:production": "tsx scripts/migrate-production.ts",
     "action": "agent-native action",
     "script": "agent-native script",
     "db:push": "drizzle-kit push",

package/corpus/templates/tasks/scripts/migrate-production.ts

@@ -0,0 +1,24 @@
+import { closeDbExec, withMigrationRuntime } from "@agent-native/core/db";
+import { runFrameworkReleaseMigrations } from "@agent-native/core/server";
+
+import { runTasksMigrations } from "../server/plugins/db.js";
+
+/**
+ * Release-time schema entrypoint for Tasks.
+ *
+ * This script is the production owner of schema changes. It runs against the
+ * direct migration endpoint selected by core, while request functions skip
+ * all migration and ensure-table work automatically.
+ */
+async function main(): Promise<void> {
+  await withMigrationRuntime(async () => {
+    await runFrameworkReleaseMigrations(null);
+    await runTasksMigrations(null);
+  });
+}
+
+try {
+  await main();
+} finally {
+  await closeDbExec();
+}

package/corpus/templates/tasks/server/plugins/db.ts

@@ -8,7 +8,7 @@ import * as schema from "../db/schema.js";
 
 // Keep historical entries unnamed for legacy-ledger compatibility; every new
 // migration must add a stable, unique `name` slug.
-const runTasksMigrations = runMigrations(
+export const runTasksMigrations = runMigrations(
   [
     {
       version: 1,

package/corpus/templates/tasks/tsconfig.json

@@ -14,6 +14,7 @@
     "server/**/*",
     "shared/**/*",
     "actions/**/*",
+    "scripts/**/*",
     "vite.config.ts",
     "vitest.config.ts",
     "react-router.config.ts",

package/dist/action.d.ts

@@ -60,6 +60,8 @@ export interface ActionRunContext {
     requestHeaders?: Headers;
     /** Resolved org id, or `null` when the request has no org. */
     orgId?: string | null;
+    /** Hosting app/template id used for app-owned resource boundaries. */
+    appId?: string;
     /** How this action was invoked. */
     caller: ActionCaller;
     /** Present only for trigger-dispatched automation calls. */

package/dist/agent/production-agent.d.ts

@@ -697,6 +697,7 @@ export declare function runAgentLoop(opts: {
     onOutcome?: (outcome: AgentLoopOutcome) => void;
     ownerEmail?: string | null;
     orgId?: string | null;
+    appId?: string;
     /** Action invocation attribution. Defaults to the normal agent tool loop. */
     actionCaller?: ActionCaller;
     /** Trusted trigger lineage for automation-dispatched action calls. */

package/dist/agent/production-agent.js

@@ -3974,6 +3974,7 @@ export async function runAgentLoop(opts) {
                             ? Boolean(await actionEntry.needsApproval(toolCall.input, {
                                 userEmail: getRequestUserEmail(),
                                 orgId: getRequestOrgId() ?? null,
+                                appId: opts.appId,
                                 caller: opts.actionCaller ?? "tool",
                                 automation: opts.automation,
                                 networkProtocol: opts.networkProtocol,
@@ -4370,6 +4371,7 @@ export async function runAgentLoop(opts) {
                     send,
                     userEmail: actionUserEmail ?? undefined,
                     orgId: actionOrgId,
+                    appId: opts.appId,
                     caller: opts.actionCaller ?? "tool",
                     automation: opts.automation,
                     networkProtocol: opts.networkProtocol,

package/dist/agent/thread-data-builder.d.ts

@@ -17,6 +17,10 @@ interface ContentPart {
     completedSideEffect?: boolean;
     mcpApp?: AgentMcpAppPayload;
     chatUI?: ActionChatUIConfig;
+    approval?: {
+        approvalKey: string;
+        dismissed?: boolean;
+    };
 }
 interface BuildAssistantMessageOptions {
     suppressInternalContinuation?: boolean;

package/dist/agent/thread-data-builder.js

@@ -114,6 +114,14 @@ export function buildAssistantMessage(events, runId, options = {}) {
             });
             continue;
         }
+        if (event.type === "approval_required") {
+            const matchingIndex = findApprovalToolCallIndex(content, event.tool ?? "unknown", event.toolCallId);
+            const part = content[matchingIndex];
+            if (part?.type === "tool-call") {
+                part.approval = { approvalKey: event.approvalKey };
+            }
+            continue;
+        }
         if (event.type === "tool_done") {
             const eventToolCallId = event.id?.trim();
             let matchingIndex = -1;
@@ -339,6 +347,42 @@ function normalizeAttachmentIdentity(attachments) {
         contentType: att?.contentType,
     }));
 }
+function findApprovalToolCallIndex(content, toolName, toolCallId) {
+    if (toolCallId) {
+        for (let i = content.length - 1; i >= 0; i--) {
+            const part = content[i];
+            if (part.type === "tool-call" &&
+                part.toolCallId === toolCallId &&
+                part.result === undefined) {
+                return i;
+            }
+        }
+        // Older tool_start events without an id use one reader-local tc_N id.
+        // Only accept that fallback when it is unambiguous, so a replayed approval
+        // cannot attach its key to another same-name call.
+        const readerLocalCandidates = [];
+        for (let i = 0; i < content.length; i += 1) {
+            const part = content[i];
+            if (part.type === "tool-call" &&
+                part.toolName === toolName &&
+                part.result === undefined &&
+                typeof part.toolCallId === "string" &&
+                /^tc_\d+$/.test(part.toolCallId)) {
+                readerLocalCandidates.push(i);
+            }
+        }
+        return readerLocalCandidates.length === 1 ? readerLocalCandidates[0] : -1;
+    }
+    for (let i = content.length - 1; i >= 0; i--) {
+        const part = content[i];
+        if (part.type === "tool-call" &&
+            part.toolName === toolName &&
+            part.result === undefined) {
+            return i;
+        }
+    }
+    return -1;
+}
 // Strip the render-only `toolCallId` before fingerprinting. The id is generated
 // differently depending on who built the message — the server now scopes it by
 // run (`${runId}:tc_1`) while the client's live stream uses a bare counter