@agent-native/core 0.146.7 → 0.147.0

package/dist/templates/headless/.agents/skills/turn-into-app/SKILL.md

@@ -3,8 +3,9 @@ name: turn-into-app
 description: >-
   Turn visible project context, a proven thread, skill, or workflow into a
   runnable Agent-Native app with simple buttons, visible agent steps, preview,
-  and deployment handoff. Use when a user invokes `/turn-into-app` or asks to
-  make a workflow into an app, including from Claude or ChatGPT on the web.
+  and deployment handoff. Use when a user invokes `/turn-into-app`,
+  `/make-into-app`, or asks to make a workflow into an app, including from
+  Claude or ChatGPT on the web.
 user-invocable: true
 scope: both
 metadata:
@@ -38,6 +39,15 @@ The build location depends on the host. Treat this as a hard routing rule:
   workspace, follow the local implementation steps below. The local agent may
   scaffold, edit, run, and verify the app there.
 
+Once the source brief is sufficient to identify a repeatable workflow, the
+handoff is non-interactive. Do not ask the user for visual, product, copy,
+layout, template, integration, or implementation choices that can be resolved
+from the source. Select the source's recommended option; otherwise choose the
+most direct conventional default and record the assumption for later review.
+Only stop for a genuine hard blocker such as missing authorization, a
+destructive external action, an ambiguous target workspace, or no identifiable
+workflow at all.
+
 ## Default behavior
 
 For a local code-agent runtime this is an end-to-end build skill, not a request
@@ -104,14 +114,16 @@ before creating the app. Read the host-provided context in this order:
 Record the brief with these headings before handoff: source and provenance,
 project goal, configuration and constraints, knowledge sources, repeatable
 workflow, inputs and outputs, judgment and review points, representative runs,
-integrations and permissions, and unknowns. This is the compact contract for
+integrations and permissions, and unknowns and assumptions. This is the compact contract for
 the app. It keeps the new app useful without pretending that hidden Project
 history was imported. See [the fresh Project reference](references/fresh-project.md)
 for the host setup and brief template.
 
-If the visible Project context has no concrete repeatable job, ask for one
-focused clarification or a representative artifact. Do not fall back to a
-generic “what app do you want to make?” builder.
+If the visible Project context has no concrete repeatable job and no primary
+goal can be inferred, ask for one focused clarification or a representative
+artifact. Otherwise use the project's primary goal and source conventions; do
+not ask a questionnaire and do not fall back to a generic “what app do you
+want to make?” builder.
 
 ## Source selection guard
 

package/dist/templates/headless/.agents/skills/turn-into-app/references/fresh-project.md

@@ -36,7 +36,7 @@ Inputs and outputs:
 Judgment and review points:
 Representative runs: none, or 1-3 selected examples
 Integrations and permissions:
-Unknowns and follow-up:
+Unknowns and assumptions:
 ```
 
 Keep source references bounded. Prefer a file name, URL, resource ID, or short
@@ -69,6 +69,13 @@ do not fall back to a local sandbox build. Claude Code and Codex Code are the
 local-agent exception and may follow the implementation steps in the main
 skill.
 
+The brief is an implementation authorization, not a questionnaire. After a
+repeatable workflow is identifiable, choose any source-recommended option
+automatically. For unresolved non-blocking choices, use the most direct
+conventional default, record it under assumptions, and continue. Ask only when
+there is no identifiable workflow, no authorized target workspace, or a
+destructive/credential boundary genuinely prevents the handoff.
+
 In a new Project chat, say:
 
 ```text

package/dist/templates/workspace-core/.agents/skills/adding-a-feature/SKILL.md

@@ -81,6 +81,13 @@ or other file-like payloads, design the upload path in the same change:
 provider upload first, then URL/id/blob handle in SQL. Do not add base64/binary
 columns or stuff files into `application_state`.
 
+If the feature adds a server-side dependency carrying a native binary or heavy
+runtime — headless browser, ffmpeg, image/video processing, ML runtime — read
+the `performance` skill §9 before adding it. A deployed app has one `/*` page
+function that every visitor's cache miss wakes, and it ships whatever the server
+bundle depends on. Run that work from a background function or a job so the page
+function never carries the weight.
+
 **If the action produces or lists a navigable resource**, add a `link` builder that returns `{ url: buildDeepLink({ app, view, params }), label }`. External coding agents and MCP hosts (Claude / ChatGPT / Claude Code / Cowork / Codex, over MCP/A2A) then surface an "Open in … →" deep link that drops the user back into the running UI focused on the record — for free. If a compatible MCP host should render an inline review/edit surface, also add `mcpApp` with `embedApp()` so the action embeds the real React app route instead of a one-off HTML UI. The `link` builder and `mcpApp` metadata must be pure and synchronous (no I/O). Any external-agent read/ingest action must be `http: { method: "GET" }` + `readOnly: true` + `publicAgent: { expose: true, readOnly: true, requiresAuth: true }`. See the `external-agents` skill.
 
 ### 3. Skills / Instructions
@@ -195,4 +202,6 @@ TL;DR: declare the vocabulary once with `defineAppRoles({ appId, roles, defaultR
 - **create-skill** — How to create skills for new patterns (area 3 in detail)
 - **storing-data** — Where to store the feature's data
 - **real-time-sync** — How the UI stays in sync when the agent writes data
+- **performance** — Query/load cost, and (§9) cold-start artifact size when a
+  feature adds a server-side dependency
 - **internationalization** — How to update localized UI copy and catalogs

package/dist/templates/workspace-core/.agents/skills/turn-into-app/SKILL.md

@@ -3,8 +3,9 @@ name: turn-into-app
 description: >-
   Turn visible project context, a proven thread, skill, or workflow into a
   runnable Agent-Native app with simple buttons, visible agent steps, preview,
-  and deployment handoff. Use when a user invokes `/turn-into-app` or asks to
-  make a workflow into an app, including from Claude or ChatGPT on the web.
+  and deployment handoff. Use when a user invokes `/turn-into-app`,
+  `/make-into-app`, or asks to make a workflow into an app, including from
+  Claude or ChatGPT on the web.
 user-invocable: true
 scope: both
 metadata:
@@ -38,6 +39,15 @@ The build location depends on the host. Treat this as a hard routing rule:
   workspace, follow the local implementation steps below. The local agent may
   scaffold, edit, run, and verify the app there.
 
+Once the source brief is sufficient to identify a repeatable workflow, the
+handoff is non-interactive. Do not ask the user for visual, product, copy,
+layout, template, integration, or implementation choices that can be resolved
+from the source. Select the source's recommended option; otherwise choose the
+most direct conventional default and record the assumption for later review.
+Only stop for a genuine hard blocker such as missing authorization, a
+destructive external action, an ambiguous target workspace, or no identifiable
+workflow at all.
+
 ## Default behavior
 
 For a local code-agent runtime this is an end-to-end build skill, not a request
@@ -104,14 +114,16 @@ before creating the app. Read the host-provided context in this order:
 Record the brief with these headings before handoff: source and provenance,
 project goal, configuration and constraints, knowledge sources, repeatable
 workflow, inputs and outputs, judgment and review points, representative runs,
-integrations and permissions, and unknowns. This is the compact contract for
+integrations and permissions, and unknowns and assumptions. This is the compact contract for
 the app. It keeps the new app useful without pretending that hidden Project
 history was imported. See [the fresh Project reference](references/fresh-project.md)
 for the host setup and brief template.
 
-If the visible Project context has no concrete repeatable job, ask for one
-focused clarification or a representative artifact. Do not fall back to a
-generic “what app do you want to make?” builder.
+If the visible Project context has no concrete repeatable job and no primary
+goal can be inferred, ask for one focused clarification or a representative
+artifact. Otherwise use the project's primary goal and source conventions; do
+not ask a questionnaire and do not fall back to a generic “what app do you
+want to make?” builder.
 
 ## Source selection guard
 

package/dist/templates/workspace-core/.agents/skills/turn-into-app/references/fresh-project.md

@@ -36,7 +36,7 @@ Inputs and outputs:
 Judgment and review points:
 Representative runs: none, or 1-3 selected examples
 Integrations and permissions:
-Unknowns and follow-up:
+Unknowns and assumptions:
 ```
 
 Keep source references bounded. Prefer a file name, URL, resource ID, or short
@@ -69,6 +69,13 @@ do not fall back to a local sandbox build. Claude Code and Codex Code are the
 local-agent exception and may follow the implementation steps in the main
 skill.
 
+The brief is an implementation authorization, not a questionnaire. After a
+repeatable workflow is identifiable, choose any source-recommended option
+automatically. For unresolved non-blocking choices, use the most direct
+conventional default, record it under assumptions, and continue. Ask only when
+there is no identifiable workflow, no authorized target workspace, or a
+destructive/credential boundary genuinely prevents the handoff.
+
 In a new Project chat, say:
 
 ```text

package/dist/templates/workspace-core/.agents/skills/workspace-conventions/SKILL.md

@@ -69,6 +69,12 @@ Preview before `--apply`, commit `agent-native.ejections.json`, and never edit
   data, or credential-looking literals in source, docs, prompts, fixtures,
   application state, action responses, or generated app content. Use
   secrets/OAuth/runtime configuration and obvious placeholders in examples.
+- Each app deploys its own `/*` page function, and that function ships whatever
+  the app's server bundle depends on — including a dependency only a background
+  job uses. Before an app takes on a heavy runtime (headless browser, ffmpeg,
+  media processing, ML), read `.agents/skills/performance/SKILL.md` §9 and keep
+  that work in a background function or job. A dependency belonging to one app
+  does not belong in `packages/shared`.
 - Prefer framework defaults until the workspace has a real custom rule,
   component, plugin, action, or skill to share.
 - Keep the Workspace files view for user-authored or user-requested resources.
@@ -91,5 +97,6 @@ Preview before `--apply`, commit `agent-native.ejections.json`, and never edit
 - **agent-native-toolkit** — Inventory of shared workspace and agent UI.
 - **customizing-agent-native** — The configure → compose → eject ladder.
 - **delegate-to-agent** — Routing every AI feature through the agent chat.
+- **performance** — Load cost, and (§9) cold-start artifact size per app.
 - **secrets** — Registering API keys and service credentials.
 - **storing-data** — Where structured data and large payloads belong.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.146.7",
+  "version": "0.147.0",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -111,6 +111,7 @@
     "./db/drizzle-config": "./dist/db/drizzle-config.js",
     "./client": "./dist/client/index.js",
     "./client/agent-chat": "./dist/client/agent-chat/index.js",
+    "./client/chat-first": "./dist/client/chat-first/index.js",
     "./client/analytics": "./dist/client/analytics/index.js",
     "./client/automation": "./dist/client/automation/index.js",
     "./client/chat": "./dist/client/chat/index.js",
@@ -412,8 +413,8 @@
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "^0.13.5",
-    "@agent-native/recap-cli": "0.5.3"
+    "@agent-native/recap-cli": "0.5.3",
+    "@agent-native/toolkit": "^0.13.6"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",

package/src/templates/chat/.agents/skills/adding-a-feature/SKILL.md

@@ -81,6 +81,13 @@ or other file-like payloads, design the upload path in the same change:
 provider upload first, then URL/id/blob handle in SQL. Do not add base64/binary
 columns or stuff files into `application_state`.
 
+If the feature adds a server-side dependency carrying a native binary or heavy
+runtime — headless browser, ffmpeg, image/video processing, ML runtime — read
+the `performance` skill §9 before adding it. A deployed app has one `/*` page
+function that every visitor's cache miss wakes, and it ships whatever the server
+bundle depends on. Run that work from a background function or a job so the page
+function never carries the weight.
+
 **If the action produces or lists a navigable resource**, add a `link` builder that returns `{ url: buildDeepLink({ app, view, params }), label }`. External coding agents and MCP hosts (Claude / ChatGPT / Claude Code / Cowork / Codex, over MCP/A2A) then surface an "Open in … →" deep link that drops the user back into the running UI focused on the record — for free. If a compatible MCP host should render an inline review/edit surface, also add `mcpApp` with `embedApp()` so the action embeds the real React app route instead of a one-off HTML UI. The `link` builder and `mcpApp` metadata must be pure and synchronous (no I/O). Any external-agent read/ingest action must be `http: { method: "GET" }` + `readOnly: true` + `publicAgent: { expose: true, readOnly: true, requiresAuth: true }`. See the `external-agents` skill.
 
 ### 3. Skills / Instructions
@@ -195,4 +202,6 @@ TL;DR: declare the vocabulary once with `defineAppRoles({ appId, roles, defaultR
 - **create-skill** — How to create skills for new patterns (area 3 in detail)
 - **storing-data** — Where to store the feature's data
 - **real-time-sync** — How the UI stays in sync when the agent writes data
+- **performance** — Query/load cost, and (§9) cold-start artifact size when a
+  feature adds a server-side dependency
 - **internationalization** — How to update localized UI copy and catalogs

package/src/templates/chat/.agents/skills/turn-into-app/SKILL.md

@@ -3,8 +3,9 @@ name: turn-into-app
 description: >-
   Turn visible project context, a proven thread, skill, or workflow into a
   runnable Agent-Native app with simple buttons, visible agent steps, preview,
-  and deployment handoff. Use when a user invokes `/turn-into-app` or asks to
-  make a workflow into an app, including from Claude or ChatGPT on the web.
+  and deployment handoff. Use when a user invokes `/turn-into-app`,
+  `/make-into-app`, or asks to make a workflow into an app, including from
+  Claude or ChatGPT on the web.
 user-invocable: true
 scope: both
 metadata:
@@ -38,6 +39,15 @@ The build location depends on the host. Treat this as a hard routing rule:
   workspace, follow the local implementation steps below. The local agent may
   scaffold, edit, run, and verify the app there.
 
+Once the source brief is sufficient to identify a repeatable workflow, the
+handoff is non-interactive. Do not ask the user for visual, product, copy,
+layout, template, integration, or implementation choices that can be resolved
+from the source. Select the source's recommended option; otherwise choose the
+most direct conventional default and record the assumption for later review.
+Only stop for a genuine hard blocker such as missing authorization, a
+destructive external action, an ambiguous target workspace, or no identifiable
+workflow at all.
+
 ## Default behavior
 
 For a local code-agent runtime this is an end-to-end build skill, not a request
@@ -104,14 +114,16 @@ before creating the app. Read the host-provided context in this order:
 Record the brief with these headings before handoff: source and provenance,
 project goal, configuration and constraints, knowledge sources, repeatable
 workflow, inputs and outputs, judgment and review points, representative runs,
-integrations and permissions, and unknowns. This is the compact contract for
+integrations and permissions, and unknowns and assumptions. This is the compact contract for
 the app. It keeps the new app useful without pretending that hidden Project
 history was imported. See [the fresh Project reference](references/fresh-project.md)
 for the host setup and brief template.
 
-If the visible Project context has no concrete repeatable job, ask for one
-focused clarification or a representative artifact. Do not fall back to a
-generic “what app do you want to make?” builder.
+If the visible Project context has no concrete repeatable job and no primary
+goal can be inferred, ask for one focused clarification or a representative
+artifact. Otherwise use the project's primary goal and source conventions; do
+not ask a questionnaire and do not fall back to a generic “what app do you
+want to make?” builder.
 
 ## Source selection guard
 

package/src/templates/chat/.agents/skills/turn-into-app/references/fresh-project.md

@@ -36,7 +36,7 @@ Inputs and outputs:
 Judgment and review points:
 Representative runs: none, or 1-3 selected examples
 Integrations and permissions:
-Unknowns and follow-up:
+Unknowns and assumptions:
 ```
 
 Keep source references bounded. Prefer a file name, URL, resource ID, or short
@@ -69,6 +69,13 @@ do not fall back to a local sandbox build. Claude Code and Codex Code are the
 local-agent exception and may follow the implementation steps in the main
 skill.
 
+The brief is an implementation authorization, not a questionnaire. After a
+repeatable workflow is identifiable, choose any source-recommended option
+automatically. For unresolved non-blocking choices, use the most direct
+conventional default, record it under assumptions, and continue. Ask only when
+there is no identifiable workflow, no authorized target workspace, or a
+destructive/credential boundary genuinely prevents the handoff.
+
 In a new Project chat, say:
 
 ```text

package/src/templates/default/.agents/skills/adding-a-feature/SKILL.md

@@ -81,6 +81,13 @@ or other file-like payloads, design the upload path in the same change:
 provider upload first, then URL/id/blob handle in SQL. Do not add base64/binary
 columns or stuff files into `application_state`.
 
+If the feature adds a server-side dependency carrying a native binary or heavy
+runtime — headless browser, ffmpeg, image/video processing, ML runtime — read
+the `performance` skill §9 before adding it. A deployed app has one `/*` page
+function that every visitor's cache miss wakes, and it ships whatever the server
+bundle depends on. Run that work from a background function or a job so the page
+function never carries the weight.
+
 **If the action produces or lists a navigable resource**, add a `link` builder that returns `{ url: buildDeepLink({ app, view, params }), label }`. External coding agents and MCP hosts (Claude / ChatGPT / Claude Code / Cowork / Codex, over MCP/A2A) then surface an "Open in … →" deep link that drops the user back into the running UI focused on the record — for free. If a compatible MCP host should render an inline review/edit surface, also add `mcpApp` with `embedApp()` so the action embeds the real React app route instead of a one-off HTML UI. The `link` builder and `mcpApp` metadata must be pure and synchronous (no I/O). Any external-agent read/ingest action must be `http: { method: "GET" }` + `readOnly: true` + `publicAgent: { expose: true, readOnly: true, requiresAuth: true }`. See the `external-agents` skill.
 
 ### 3. Skills / Instructions
@@ -195,4 +202,6 @@ TL;DR: declare the vocabulary once with `defineAppRoles({ appId, roles, defaultR
 - **create-skill** — How to create skills for new patterns (area 3 in detail)
 - **storing-data** — Where to store the feature's data
 - **real-time-sync** — How the UI stays in sync when the agent writes data
+- **performance** — Query/load cost, and (§9) cold-start artifact size when a
+  feature adds a server-side dependency
 - **internationalization** — How to update localized UI copy and catalogs

package/src/templates/default/.agents/skills/turn-into-app/SKILL.md

@@ -3,8 +3,9 @@ name: turn-into-app
 description: >-
   Turn visible project context, a proven thread, skill, or workflow into a
   runnable Agent-Native app with simple buttons, visible agent steps, preview,
-  and deployment handoff. Use when a user invokes `/turn-into-app` or asks to
-  make a workflow into an app, including from Claude or ChatGPT on the web.
+  and deployment handoff. Use when a user invokes `/turn-into-app`,
+  `/make-into-app`, or asks to make a workflow into an app, including from
+  Claude or ChatGPT on the web.
 user-invocable: true
 scope: both
 metadata:
@@ -38,6 +39,15 @@ The build location depends on the host. Treat this as a hard routing rule:
   workspace, follow the local implementation steps below. The local agent may
   scaffold, edit, run, and verify the app there.
 
+Once the source brief is sufficient to identify a repeatable workflow, the
+handoff is non-interactive. Do not ask the user for visual, product, copy,
+layout, template, integration, or implementation choices that can be resolved
+from the source. Select the source's recommended option; otherwise choose the
+most direct conventional default and record the assumption for later review.
+Only stop for a genuine hard blocker such as missing authorization, a
+destructive external action, an ambiguous target workspace, or no identifiable
+workflow at all.
+
 ## Default behavior
 
 For a local code-agent runtime this is an end-to-end build skill, not a request
@@ -104,14 +114,16 @@ before creating the app. Read the host-provided context in this order:
 Record the brief with these headings before handoff: source and provenance,
 project goal, configuration and constraints, knowledge sources, repeatable
 workflow, inputs and outputs, judgment and review points, representative runs,
-integrations and permissions, and unknowns. This is the compact contract for
+integrations and permissions, and unknowns and assumptions. This is the compact contract for
 the app. It keeps the new app useful without pretending that hidden Project
 history was imported. See [the fresh Project reference](references/fresh-project.md)
 for the host setup and brief template.
 
-If the visible Project context has no concrete repeatable job, ask for one
-focused clarification or a representative artifact. Do not fall back to a
-generic “what app do you want to make?” builder.
+If the visible Project context has no concrete repeatable job and no primary
+goal can be inferred, ask for one focused clarification or a representative
+artifact. Otherwise use the project's primary goal and source conventions; do
+not ask a questionnaire and do not fall back to a generic “what app do you
+want to make?” builder.
 
 ## Source selection guard
 

package/src/templates/default/.agents/skills/turn-into-app/references/fresh-project.md

@@ -36,7 +36,7 @@ Inputs and outputs:
 Judgment and review points:
 Representative runs: none, or 1-3 selected examples
 Integrations and permissions:
-Unknowns and follow-up:
+Unknowns and assumptions:
 ```
 
 Keep source references bounded. Prefer a file name, URL, resource ID, or short
@@ -69,6 +69,13 @@ do not fall back to a local sandbox build. Claude Code and Codex Code are the
 local-agent exception and may follow the implementation steps in the main
 skill.
 
+The brief is an implementation authorization, not a questionnaire. After a
+repeatable workflow is identifiable, choose any source-recommended option
+automatically. For unresolved non-blocking choices, use the most direct
+conventional default, record it under assumptions, and continue. Ask only when
+there is no identifiable workflow, no authorized target workspace, or a
+destructive/credential boundary genuinely prevents the handoff.
+
 In a new Project chat, say:
 
 ```text

package/src/templates/default/react-router.config.ts

@@ -4,4 +4,22 @@ export default {
   appDirectory: "app",
   ssr: true,
   routeDiscovery: { mode: "initial" },
+
+  // Prerendering writes a route's HTML to a static file at build time, so a CDN
+  // cache miss serves that file instead of cold-starting the SSR function
+  // (seconds of TTFB). It is off here because every route this app ships with is
+  // signed-in and personalized, and a prerendered file is served without the
+  // auth middleware ever running — freezing the wrong page for every visitor is
+  // far worse than a slow first byte.
+  //
+  // Turn it on only for paths that are all of: publicly reachable, rendered from
+  // build-time content alone (no loader data, query string, cookie, session, or
+  // database read), and never answering a redirect — prerender would bake a 301
+  // into a 200 HTML page. Keep the list in one shared constant and derive the
+  // auth plugin's `publicPaths` from it so the two cannot drift:
+  //
+  //   import { PRERENDERED_PUBLIC_PAGE_PATHS } from "./shared/prerendered-public-paths";
+  //   prerender: { paths: () => [...PRERENDERED_PUBLIC_PAGE_PATHS] },
+  //
+  // See `.agents/skills/performance/SKILL.md` §9.
 } satisfies Config;

package/src/templates/headless/.agents/skills/turn-into-app/SKILL.md

@@ -3,8 +3,9 @@ name: turn-into-app
 description: >-
   Turn visible project context, a proven thread, skill, or workflow into a
   runnable Agent-Native app with simple buttons, visible agent steps, preview,
-  and deployment handoff. Use when a user invokes `/turn-into-app` or asks to
-  make a workflow into an app, including from Claude or ChatGPT on the web.
+  and deployment handoff. Use when a user invokes `/turn-into-app`,
+  `/make-into-app`, or asks to make a workflow into an app, including from
+  Claude or ChatGPT on the web.
 user-invocable: true
 scope: both
 metadata:
@@ -38,6 +39,15 @@ The build location depends on the host. Treat this as a hard routing rule:
   workspace, follow the local implementation steps below. The local agent may
   scaffold, edit, run, and verify the app there.
 
+Once the source brief is sufficient to identify a repeatable workflow, the
+handoff is non-interactive. Do not ask the user for visual, product, copy,
+layout, template, integration, or implementation choices that can be resolved
+from the source. Select the source's recommended option; otherwise choose the
+most direct conventional default and record the assumption for later review.
+Only stop for a genuine hard blocker such as missing authorization, a
+destructive external action, an ambiguous target workspace, or no identifiable
+workflow at all.
+
 ## Default behavior
 
 For a local code-agent runtime this is an end-to-end build skill, not a request
@@ -104,14 +114,16 @@ before creating the app. Read the host-provided context in this order:
 Record the brief with these headings before handoff: source and provenance,
 project goal, configuration and constraints, knowledge sources, repeatable
 workflow, inputs and outputs, judgment and review points, representative runs,
-integrations and permissions, and unknowns. This is the compact contract for
+integrations and permissions, and unknowns and assumptions. This is the compact contract for
 the app. It keeps the new app useful without pretending that hidden Project
 history was imported. See [the fresh Project reference](references/fresh-project.md)
 for the host setup and brief template.
 
-If the visible Project context has no concrete repeatable job, ask for one
-focused clarification or a representative artifact. Do not fall back to a
-generic “what app do you want to make?” builder.
+If the visible Project context has no concrete repeatable job and no primary
+goal can be inferred, ask for one focused clarification or a representative
+artifact. Otherwise use the project's primary goal and source conventions; do
+not ask a questionnaire and do not fall back to a generic “what app do you
+want to make?” builder.
 
 ## Source selection guard
 

package/src/templates/headless/.agents/skills/turn-into-app/references/fresh-project.md

@@ -36,7 +36,7 @@ Inputs and outputs:
 Judgment and review points:
 Representative runs: none, or 1-3 selected examples
 Integrations and permissions:
-Unknowns and follow-up:
+Unknowns and assumptions:
 ```
 
 Keep source references bounded. Prefer a file name, URL, resource ID, or short
@@ -69,6 +69,13 @@ do not fall back to a local sandbox build. Claude Code and Codex Code are the
 local-agent exception and may follow the implementation steps in the main
 skill.
 
+The brief is an implementation authorization, not a questionnaire. After a
+repeatable workflow is identifiable, choose any source-recommended option
+automatically. For unresolved non-blocking choices, use the most direct
+conventional default, record it under assumptions, and continue. Ask only when
+there is no identifiable workflow, no authorized target workspace, or a
+destructive/credential boundary genuinely prevents the handoff.
+
 In a new Project chat, say:
 
 ```text

package/src/templates/workspace-core/.agents/skills/adding-a-feature/SKILL.md

@@ -81,6 +81,13 @@ or other file-like payloads, design the upload path in the same change:
 provider upload first, then URL/id/blob handle in SQL. Do not add base64/binary
 columns or stuff files into `application_state`.
 
+If the feature adds a server-side dependency carrying a native binary or heavy
+runtime — headless browser, ffmpeg, image/video processing, ML runtime — read
+the `performance` skill §9 before adding it. A deployed app has one `/*` page
+function that every visitor's cache miss wakes, and it ships whatever the server
+bundle depends on. Run that work from a background function or a job so the page
+function never carries the weight.
+
 **If the action produces or lists a navigable resource**, add a `link` builder that returns `{ url: buildDeepLink({ app, view, params }), label }`. External coding agents and MCP hosts (Claude / ChatGPT / Claude Code / Cowork / Codex, over MCP/A2A) then surface an "Open in … →" deep link that drops the user back into the running UI focused on the record — for free. If a compatible MCP host should render an inline review/edit surface, also add `mcpApp` with `embedApp()` so the action embeds the real React app route instead of a one-off HTML UI. The `link` builder and `mcpApp` metadata must be pure and synchronous (no I/O). Any external-agent read/ingest action must be `http: { method: "GET" }` + `readOnly: true` + `publicAgent: { expose: true, readOnly: true, requiresAuth: true }`. See the `external-agents` skill.
 
 ### 3. Skills / Instructions
@@ -195,4 +202,6 @@ TL;DR: declare the vocabulary once with `defineAppRoles({ appId, roles, defaultR
 - **create-skill** — How to create skills for new patterns (area 3 in detail)
 - **storing-data** — Where to store the feature's data
 - **real-time-sync** — How the UI stays in sync when the agent writes data
+- **performance** — Query/load cost, and (§9) cold-start artifact size when a
+  feature adds a server-side dependency
 - **internationalization** — How to update localized UI copy and catalogs

package/src/templates/workspace-core/.agents/skills/turn-into-app/SKILL.md

@@ -3,8 +3,9 @@ name: turn-into-app
 description: >-
   Turn visible project context, a proven thread, skill, or workflow into a
   runnable Agent-Native app with simple buttons, visible agent steps, preview,
-  and deployment handoff. Use when a user invokes `/turn-into-app` or asks to
-  make a workflow into an app, including from Claude or ChatGPT on the web.
+  and deployment handoff. Use when a user invokes `/turn-into-app`,
+  `/make-into-app`, or asks to make a workflow into an app, including from
+  Claude or ChatGPT on the web.
 user-invocable: true
 scope: both
 metadata:
@@ -38,6 +39,15 @@ The build location depends on the host. Treat this as a hard routing rule:
   workspace, follow the local implementation steps below. The local agent may
   scaffold, edit, run, and verify the app there.
 
+Once the source brief is sufficient to identify a repeatable workflow, the
+handoff is non-interactive. Do not ask the user for visual, product, copy,
+layout, template, integration, or implementation choices that can be resolved
+from the source. Select the source's recommended option; otherwise choose the
+most direct conventional default and record the assumption for later review.
+Only stop for a genuine hard blocker such as missing authorization, a
+destructive external action, an ambiguous target workspace, or no identifiable
+workflow at all.
+
 ## Default behavior
 
 For a local code-agent runtime this is an end-to-end build skill, not a request
@@ -104,14 +114,16 @@ before creating the app. Read the host-provided context in this order:
 Record the brief with these headings before handoff: source and provenance,
 project goal, configuration and constraints, knowledge sources, repeatable
 workflow, inputs and outputs, judgment and review points, representative runs,
-integrations and permissions, and unknowns. This is the compact contract for
+integrations and permissions, and unknowns and assumptions. This is the compact contract for
 the app. It keeps the new app useful without pretending that hidden Project
 history was imported. See [the fresh Project reference](references/fresh-project.md)
 for the host setup and brief template.
 
-If the visible Project context has no concrete repeatable job, ask for one
-focused clarification or a representative artifact. Do not fall back to a
-generic “what app do you want to make?” builder.
+If the visible Project context has no concrete repeatable job and no primary
+goal can be inferred, ask for one focused clarification or a representative
+artifact. Otherwise use the project's primary goal and source conventions; do
+not ask a questionnaire and do not fall back to a generic “what app do you
+want to make?” builder.
 
 ## Source selection guard
 

package/src/templates/workspace-core/.agents/skills/turn-into-app/references/fresh-project.md

@@ -36,7 +36,7 @@ Inputs and outputs:
 Judgment and review points:
 Representative runs: none, or 1-3 selected examples
 Integrations and permissions:
-Unknowns and follow-up:
+Unknowns and assumptions:
 ```
 
 Keep source references bounded. Prefer a file name, URL, resource ID, or short
@@ -69,6 +69,13 @@ do not fall back to a local sandbox build. Claude Code and Codex Code are the
 local-agent exception and may follow the implementation steps in the main
 skill.
 
+The brief is an implementation authorization, not a questionnaire. After a
+repeatable workflow is identifiable, choose any source-recommended option
+automatically. For unresolved non-blocking choices, use the most direct
+conventional default, record it under assumptions, and continue. Ask only when
+there is no identifiable workflow, no authorized target workspace, or a
+destructive/credential boundary genuinely prevents the handoff.
+
 In a new Project chat, say:
 
 ```text

package/src/templates/workspace-core/.agents/skills/workspace-conventions/SKILL.md

@@ -69,6 +69,12 @@ Preview before `--apply`, commit `agent-native.ejections.json`, and never edit
   data, or credential-looking literals in source, docs, prompts, fixtures,
   application state, action responses, or generated app content. Use
   secrets/OAuth/runtime configuration and obvious placeholders in examples.
+- Each app deploys its own `/*` page function, and that function ships whatever
+  the app's server bundle depends on — including a dependency only a background
+  job uses. Before an app takes on a heavy runtime (headless browser, ffmpeg,
+  media processing, ML), read `.agents/skills/performance/SKILL.md` §9 and keep
+  that work in a background function or job. A dependency belonging to one app
+  does not belong in `packages/shared`.
 - Prefer framework defaults until the workspace has a real custom rule,
   component, plugin, action, or skill to share.
 - Keep the Workspace files view for user-authored or user-requested resources.
@@ -91,5 +97,6 @@ Preview before `--apply`, commit `agent-native.ejections.json`, and never edit
 - **agent-native-toolkit** — Inventory of shared workspace and agent UI.
 - **customizing-agent-native** — The configure → compose → eject ladder.
 - **delegate-to-agent** — Routing every AI feature through the agent chat.
+- **performance** — Load cost, and (§9) cold-start artifact size per app.
 - **secrets** — Registering API keys and service credentials.
 - **storing-data** — Where structured data and large payloads belong.