@agent-native/core 0.146.8 → 0.148.0

package/dist/agent/engine/registry.d.ts

@@ -75,14 +75,16 @@ export declare function resolveDelegatedRunModel(engine: ModelResolvableEngine,
  * verbatim instead of normalized against the built-in catalog.
  *
  * `normalizeModelForEngine` honors a live engine's `preserveCustomModels`, but
- * that flag is only set on an AI SDK engine INSTANCE when the OpenAI provider
- * is pointed at an OpenAI-compatible gateway (a custom base URL — e.g. Ollama
- * Cloud or LiteLLM), whose model IDs are not in the built-in OpenAI catalog.
+ * that flag is only set on an AI SDK engine INSTANCE when the provider is
+ * Ollama, or when OpenAI is pointed at an OpenAI-compatible gateway (a custom
+ * base URL — e.g. Ollama Cloud or LiteLLM), whose model IDs are not in the
+ * built-in catalogs.
  * The static registry entry the settings actions pass to
  * `normalizeModelForEngine` cannot carry that runtime flag, so this async
- * helper reproduces the same decision — `ai-sdk:openai` AND a resolved base URL
- * — from the request's stored/deploy config. First-party OpenAI (no gateway)
- * returns false so an unknown/invalid model still normalizes to a supported one.
+ * helper reproduces the same decision from the request's stored/deploy config.
+ * Ollama always returns true because its local model inventory is user-defined;
+ * first-party OpenAI (no gateway) returns false so an unknown/invalid model
+ * still normalizes to a supported one.
  */
 export declare function resolveEnginePreservesCustomModels(entry: Pick<AgentEngineEntry, "name">): Promise<boolean>;
 /**

package/dist/agent/engine/registry.js

@@ -11,7 +11,8 @@ import { createRequire } from "node:module";
 import { assertCredentialStoreReadable, canUseDeployCredentialFallbackForRequest, getBuilderCredentialAuthFailure, getProviderCredentialAuthFailure, readDeployCredentialEnv, resolveBuilderCredentialsDetailed, resolveSecret, } from "../../server/credential-provider.js";
 import { getSetting } from "../../settings/store.js";
 import { getAgentAppModelDefaultForCurrentRequest } from "../app-model-defaults.js";
-import { normalizeOpenAiBaseUrl, OPENAI_BASE_URL_ENV_VAR, } from "./openai-compatible-endpoint.js";
+import { OLLAMA_BASE_URL_ENV_VAR, OPENAI_BASE_URL_ENV_VAR, } from "./openai-compatible-endpoint.js";
+import { validateProviderBaseUrl } from "./provider-endpoint-validation.js";
 const require = createRequire(import.meta.url);
 const _registry = new Map();
 const _packageAvailabilityCache = new Map();
@@ -234,20 +235,24 @@ export function resolveDelegatedRunModel(engine, options) {
  * verbatim instead of normalized against the built-in catalog.
  *
  * `normalizeModelForEngine` honors a live engine's `preserveCustomModels`, but
- * that flag is only set on an AI SDK engine INSTANCE when the OpenAI provider
- * is pointed at an OpenAI-compatible gateway (a custom base URL — e.g. Ollama
- * Cloud or LiteLLM), whose model IDs are not in the built-in OpenAI catalog.
+ * that flag is only set on an AI SDK engine INSTANCE when the provider is
+ * Ollama, or when OpenAI is pointed at an OpenAI-compatible gateway (a custom
+ * base URL — e.g. Ollama Cloud or LiteLLM), whose model IDs are not in the
+ * built-in catalogs.
  * The static registry entry the settings actions pass to
  * `normalizeModelForEngine` cannot carry that runtime flag, so this async
- * helper reproduces the same decision — `ai-sdk:openai` AND a resolved base URL
- * — from the request's stored/deploy config. First-party OpenAI (no gateway)
- * returns false so an unknown/invalid model still normalizes to a supported one.
+ * helper reproduces the same decision from the request's stored/deploy config.
+ * Ollama always returns true because its local model inventory is user-defined;
+ * first-party OpenAI (no gateway) returns false so an unknown/invalid model
+ * still normalizes to a supported one.
  */
 export async function resolveEnginePreservesCustomModels(entry) {
+    if (entry.name === "ai-sdk:ollama")
+        return true;
     if (entry.name !== "ai-sdk:openai")
         return false;
     try {
-        return Boolean(await resolveOpenAiBaseUrl());
+        return Boolean(await resolveProviderBaseUrl(OPENAI_BASE_URL_ENV_VAR));
     }
     catch {
         return false;
@@ -493,19 +498,22 @@ function engineCreateConfig(entry, apiKey, extra) {
         ...(extra ?? {}),
     };
 }
-async function resolveOpenAiBaseUrl() {
-    let raw = null;
-    try {
-        raw = await resolveSecret(OPENAI_BASE_URL_ENV_VAR);
-    }
-    catch {
-        raw = null;
-    }
-    if (!raw &&
-        canUseDeployCredentialFallbackForRequest(OPENAI_BASE_URL_ENV_VAR)) {
-        raw = readDeployCredentialEnv(OPENAI_BASE_URL_ENV_VAR);
-    }
-    return raw ? normalizeOpenAiBaseUrl(raw) : undefined;
+async function resolveProviderBaseUrl(envVar) {
+    const raw = await resolveSecret(envVar);
+    if (!raw && canUseDeployCredentialFallbackForRequest(envVar)) {
+        const deployValue = readDeployCredentialEnv(envVar);
+        if (!deployValue)
+            return undefined;
+        return validateProviderBaseUrl(deployValue, {
+            allowPrivate: true,
+        });
+    }
+    return raw
+        ? validateProviderBaseUrl(raw, {
+            allowLocalOllama: envVar === OLLAMA_BASE_URL_ENV_VAR &&
+                process.env.NODE_ENV === "development",
+        })
+        : undefined;
 }
 /**
  * A Builder connection we could not read is not a missing connection. Throwing
@@ -609,12 +617,17 @@ async function engineCreateConfigForEntry(entry, apiKey, extra, preferResolvedCr
                     : undefined;
         }
     }
-    if (entry.name === "ai-sdk:openai") {
+    if (entry.name === "ai-sdk:openai" || entry.name === "ai-sdk:ollama") {
         if (typeof safeExtra.baseURL === "string" && safeExtra.baseUrl == null) {
-            safeExtra.baseUrl = normalizeOpenAiBaseUrl(safeExtra.baseURL);
+            safeExtra.baseUrl = await validateProviderBaseUrl(safeExtra.baseURL, {
+                allowLocalOllama: entry.name === "ai-sdk:ollama" &&
+                    process.env.NODE_ENV === "development",
+            });
         }
         if (safeExtra.baseUrl == null) {
-            const baseUrl = await resolveOpenAiBaseUrl();
+            const baseUrl = await resolveProviderBaseUrl(entry.name === "ai-sdk:ollama"
+                ? OLLAMA_BASE_URL_ENV_VAR
+                : OPENAI_BASE_URL_ENV_VAR);
             if (baseUrl)
                 safeExtra.baseUrl = baseUrl;
         }

package/dist/agent/tool-search.d.ts

@@ -4,6 +4,7 @@ type ToolSearchArgs = {
     query?: unknown;
     limit?: unknown;
     includeSchemas?: unknown;
+    readOnlyOnly?: unknown;
 };
 type ToolParameterSummary = {
     name: string;

package/dist/agent/tool-search.js

@@ -23,6 +23,10 @@ export function createToolSearchEntry(getRegistry, options = {}) {
                         type: "boolean",
                         description: "When true, include each matching tool's full input schema. Default false.",
                     },
+                    readOnlyOnly: {
+                        type: "boolean",
+                        description: "When true, return tools whose current policy is read-only or can classify the supplied arguments as read-only. The bounded orchestration host rechecks conditional policies before every call.",
+                    },
                 },
             },
         },
@@ -44,11 +48,13 @@ export function searchToolRegistry(registry, args = {}, options = {}) {
     // actually needs. A query switches to ranked search with parameter details.
     const listAll = query.length === 0;
     const includeSchemas = !listAll && parseBoolean(args.includeSchemas);
+    const readOnlyOnly = parseBoolean(args.readOnlyOnly);
     const limit = parseLimit(args.limit, options.defaultLimit ?? DEFAULT_LIMIT, options.maxLimit ?? MAX_LIMIT);
     const cacheKey = normalizeToolSearchCacheKey({
         query,
         limit,
         includeSchemas,
+        readOnlyOnly,
     });
     const runCtx = getRequestRunContext();
     const priorSearch = includeSchemas
@@ -83,13 +89,22 @@ export function searchToolRegistry(registry, args = {}, options = {}) {
         if (name.startsWith("mcp__") && !isMcpToolAllowedForRequest(name)) {
             continue;
         }
-        totalTools++;
         const description = normalizeWhitespace(entry.tool.description ?? "");
         const parsedMcp = parseMcpToolName(name);
         const kind = parsedMcp ? "mcp" : "action";
         const source = parsedMcp?.serverId;
         const callable = entry.allowInPlanMode !== false;
         const planAvailability = getPlanAvailability(name, entry);
+        // Conditional policies still need discovery: MCP tools and provider/web
+        // actions classify the arguments at call time. Bash is marked conditional
+        // for Plan mode, but the orchestration bridge intentionally does not expose
+        // shell execution, so do not advertise it as a child-call candidate.
+        if (readOnlyOnly &&
+            planAvailability !== "read" &&
+            (planAvailability !== "conditional" || name === "bash")) {
+            continue;
+        }
+        totalTools++;
         if (listAll) {
             candidates.push({
                 name,
@@ -181,6 +196,7 @@ function normalizeToolSearchCacheKey(options) {
         query: options.query.trim().toLowerCase(),
         limit: options.limit,
         includeSchemas: options.includeSchemas,
+        readOnlyOnly: options.readOnlyOnly,
     });
 }
 function rememberToolSearchResult(cacheKey, result) {

package/dist/automations/service.js

@@ -1,6 +1,6 @@
 import { getDbExec } from "../db/client.js";
 import { isValidCron, isValidTimezone, nextOccurrence } from "../jobs/cron.js";
-import { buildJobResourceContent, normalizeJobMcpTools, parseJobResource, } from "../jobs/frontmatter.js";
+import { buildJobResourceContent, jobBelongsToApp, normalizeJobMcpTools, parseJobResource, } from "../jobs/frontmatter.js";
 import { deleteAutomationRuns } from "../jobs/run-history.js";
 import { resolveUserSchedulingTimezone } from "../localization/user-timezone.js";
 import { organizationIdFromResourceOwner, organizationResourceOwner, resourceDelete, resourceGetByPath, resourceList, resourcePut, } from "../resources/store.js";
@@ -60,12 +60,6 @@ async function requireOrganizationMembership(actor) {
 function isOrganizationAdmin(membership) {
     return membership.role === "owner" || membership.role === "admin";
 }
-function automationBelongsToApp(meta, appId) {
-    const ownerAppId = meta.appId?.trim();
-    if (!ownerAppId || !appId?.trim())
-        return true;
-    return ownerAppId === appId.trim();
-}
 async function mutationAccess(actorInput, resource, meta) {
     const actor = normalizeActor(actorInput);
     const resourceOrgId = organizationIdFromResourceOwner(resource.owner);
@@ -94,7 +88,7 @@ async function mutationAccess(actorInput, resource, meta) {
 export async function canUpdateAutomationResource(actorInput, resource) {
     const { meta } = parseJobResource(resource.content);
     const actor = normalizeActor(actorInput);
-    if (!automationBelongsToApp(meta, actor.appId))
+    if (!jobBelongsToApp(meta, actor.appId))
         return false;
     return (await mutationAccess(actor, resource, meta)).canUpdate;
 }
@@ -124,7 +118,7 @@ async function readDefinition(actorInput, scope, name) {
         throw httpError(`Automation "${automationName(path)}" not found.`, 404);
     }
     const definition = assertExplicitAutomation(resource);
-    if (!automationBelongsToApp(definition.meta, actor.appId)) {
+    if (!jobBelongsToApp(definition.meta, actor.appId)) {
         throw httpError(`Automation "${automationName(path)}" not found.`, 404);
     }
     const access = await mutationAccess(actor, resource, definition.meta);
@@ -154,7 +148,7 @@ export async function listAutomationDefinitions(actorInput, scope) {
         const parsed = parseJobResource(resource.content);
         if (parsed.classification.kind !== "automation")
             continue;
-        if (!automationBelongsToApp(parsed.meta, actor.appId))
+        if (!jobBelongsToApp(parsed.meta, actor.appId))
             continue;
         const isCreator = parsed.meta.createdBy?.trim().toLowerCase() === actor.userEmail;
         automations.push({

package/dist/brand-kit/brand-signals.d.ts

@@ -7,6 +7,19 @@
  * thin action wrapper.
  */
 import type { BrandWebsiteSignals } from "./types.js";
+export interface BrandAnalysisResult {
+    companyName?: string;
+    brandNotes?: string;
+    existingDesignSystem?: unknown;
+    websiteAnalysis?: unknown;
+}
+/** Assemble brand-analysis data without performing template or network work. */
+export declare function buildBrandAnalysisResult(input: {
+    companyName?: string;
+    brandNotes?: string;
+    existingDesignSystem?: unknown;
+    websiteAnalysis?: unknown;
+}): BrandAnalysisResult;
 /**
  * Normalize a user-supplied brand website URL: add an `https://` scheme when
  * missing and reject anything that isn't http(s). Throws on empty input or an

package/dist/brand-kit/brand-signals.js

@@ -7,6 +7,21 @@
  * thin action wrapper.
  */
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
+/** Assemble brand-analysis data without performing template or network work. */
+export function buildBrandAnalysisResult(input) {
+    const result = {};
+    if (input.companyName)
+        result.companyName = input.companyName;
+    if (input.brandNotes)
+        result.brandNotes = input.brandNotes;
+    if (input.existingDesignSystem !== undefined) {
+        result.existingDesignSystem = input.existingDesignSystem;
+    }
+    if (input.websiteAnalysis !== undefined) {
+        result.websiteAnalysis = input.websiteAnalysis;
+    }
+    return result;
+}
 /**
  * Normalize a user-supplied brand website URL: add an `https://` scheme when
  * missing and reject anything that isn't http(s). Throws on empty input or an

package/dist/brand-kit/index.d.ts

@@ -17,5 +17,5 @@
 export * from "./types.js";
 export * from "./brand-signals.js";
 export * from "./tokens.js";
-export { extractDesignTokensFromUrl, validateUrl, parseOwnerRepo, fetchGitHubJson, fetchGitHubJsonResult, fetchGitHubRaw, parseTailwindConfig, parseCss, detectStylingFramework, createCodeAnalysisState, analyzeCodeFile, analyzeCssFile, analyzeTailwindConfig, analyzeJsonTheme, analyzePackageJson, analyzeThemeSourceFile, addFont, extractCssVars, extractCodeColors, extractCodeFonts, extractDocumentColors, extractDocumentFonts, classifyFile, suggestionsForType, unique, MAX_FILES, MAX_FILE_SIZE, FETCH_TIMEOUT, ROOT_PATTERNS, SECONDARY_PATHS, CODE_MAX_FILES, CODE_MAX_TOTAL_BYTES, } from "../server/design-token-utils.js";
-export type { ContentType, ParsedCss, ParsedTailwindConfig, CodeAnalysisState, UrlExtractionResult, GitHubFetchOptions, GitHubJsonResult, } from "../server/design-token-utils.js";
+export { extractDesignTokensFromUrl, validateUrl, parseOwnerRepo, fetchGitHubJson, fetchGitHubJsonResult, fetchGitHubRaw, parseTailwindConfig, parseCss, detectStylingFramework, createCodeAnalysisState, analyzeCodeFile, analyzeCodeFiles, analyzeCssFile, analyzeTailwindConfig, analyzeJsonTheme, analyzePackageJson, analyzeThemeSourceFile, addFont, extractCssVars, extractCodeColors, extractCodeFonts, extractDocumentColors, extractDocumentFonts, classifyFile, suggestionsForType, unique, MAX_FILES, MAX_FILE_SIZE, FETCH_TIMEOUT, ROOT_PATTERNS, SECONDARY_PATHS, CODE_MAX_FILES, CODE_MAX_TOTAL_BYTES, } from "../server/design-token-utils.js";
+export type { ContentType, ParsedCss, ParsedTailwindConfig, CodeAnalysisState, CodeAnalysisFile, CodeAnalysisResult, UrlExtractionResult, GitHubFetchOptions, GitHubJsonResult, } from "../server/design-token-utils.js";

package/dist/brand-kit/index.js

@@ -27,7 +27,7 @@ parseOwnerRepo, fetchGitHubJson, fetchGitHubJsonResult, fetchGitHubRaw,
 // Tailwind / CSS parsing
 parseTailwindConfig, parseCss, detectStylingFramework, 
 // Code-file analysis
-createCodeAnalysisState, analyzeCodeFile, analyzeCssFile, analyzeTailwindConfig, analyzeJsonTheme, analyzePackageJson, analyzeThemeSourceFile, addFont, extractCssVars, extractCodeColors, extractCodeFonts, 
+createCodeAnalysisState, analyzeCodeFile, analyzeCodeFiles, analyzeCssFile, analyzeTailwindConfig, analyzeJsonTheme, analyzePackageJson, analyzeThemeSourceFile, addFont, extractCssVars, extractCodeColors, extractCodeFonts, 
 // Document analysis
 extractDocumentColors, extractDocumentFonts, classifyFile, suggestionsForType, unique, 
 // Constants

package/dist/chat-threads/store.d.ts

@@ -73,6 +73,8 @@ export declare function createThread(ownerEmail: string, opts?: {
     title?: string;
     scope?: ChatThreadScope | null;
     source?: ChatThreadSource | null;
+    /** Explicit owner organization for durable/background callers. */
+    orgId?: string | null;
 }): Promise<ChatThread>;
 export declare function registerChatThreadsShareable(): void;
 export declare function ensureChatThreadTables(): Promise<void>;

package/dist/chat-threads/store.js

@@ -367,7 +367,7 @@ export async function createThread(ownerEmail, opts) {
     const title = opts?.title ?? "";
     const scope = opts?.scope ?? null;
     const source = opts?.source ?? null;
-    const orgId = getRequestOrgId() ?? null;
+    const orgId = opts?.orgId ?? getRequestOrgId() ?? null;
     await client.execute({
         sql: `INSERT INTO chat_threads (id, owner_email, title, preview, thread_data, message_count, created_at, updated_at, scope_type, scope_id, scope_label, source_platform, source_app_id, source_url, org_id, visibility) VALUES (?, ?, ?, '', '{}', 0, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'private')`,
         args: [

package/dist/cli/agent-plugin.d.ts

@@ -2,8 +2,9 @@
  * Import and validate the portable Agent Plugin format.
  *
  * The importer intentionally handles only local plugin directories. Skills are
- * copied as inert files, and remote Streamable HTTP MCP entries are translated
- * to the Agent-Native `mcp.config.json` shape without copying package headers.
+ * copied as inert files into the workspace's agent-visible `.agents/skills`
+ * tree, and remote Streamable HTTP MCP entries are translated to the
+ * Agent-Native `mcp.config.json` shape without copying package headers.
  * A plugin package is not a credential store and this command never executes
  * a plugin's scripts or stdio servers.
  */
@@ -62,6 +63,8 @@ export interface LoadedAgentPlugin {
 }
 export interface AgentPluginImportOptions {
     targetDir?: string;
+    /** Optional skills root used by hosts whose agent cwd is a child workspace. */
+    skillsTargetDir?: string;
     force?: boolean;
     dryRun?: boolean;
 }

package/dist/cli/agent-plugin.js

@@ -2,8 +2,9 @@
  * Import and validate the portable Agent Plugin format.
  *
  * The importer intentionally handles only local plugin directories. Skills are
- * copied as inert files, and remote Streamable HTTP MCP entries are translated
- * to the Agent-Native `mcp.config.json` shape without copying package headers.
+ * copied as inert files into the workspace's agent-visible `.agents/skills`
+ * tree, and remote Streamable HTTP MCP entries are translated to the
+ * Agent-Native `mcp.config.json` shape without copying package headers.
  * A plugin package is not a credential store and this command never executes
  * a plugin's scripts or stdio servers.
  */
@@ -42,7 +43,7 @@ Usage:
 Commands:
   import   Import a standard Agent Plugin's Skills and remote MCP servers into an Agent-Native workspace.
 
-The importer copies Skills into a namespaced skills/<plugin>/<skill> path and
+The importer copies Skills into a namespaced .agents/skills/<plugin>/<skill> path and
 maps Streamable HTTP MCP servers into mcp.config.json. Package headers are
 never imported as credentials; configure authentication through the app's
 normal Connections flow. Stdio and SSE servers are reported and skipped.`;
@@ -691,10 +692,10 @@ function planMcpServers(plugin, existing, force) {
     }
     return planned;
 }
-function planSkills(plugin, targetDir, targetPluginSlug, force) {
+function planSkills(plugin, skillsRoot, force) {
     return plugin.skills.map((skill) => {
-        const destination = path.join(targetDir, "skills", targetPluginSlug, skill.name);
-        assertPathInside(targetDir, destination, "Imported skill destination");
+        const destination = path.join(skillsRoot, skill.name);
+        assertPathInside(skillsRoot, destination, "Imported skill destination");
         assertPathOutside(plugin.rootDir, destination, "Imported skill destination");
         assertNoSymlinkInExistingPath(path.dirname(destination), "Imported skill destination");
         if (!pathExists(destination)) {
@@ -878,12 +879,19 @@ export function importAgentPlugin(input, options = {}) {
     }
     assertNoSymlinkInExistingPath(targetDir, "Agent-Native import target");
     const slug = pluginSlug(plugin.manifest.name);
-    const skillsRoot = path.join(targetDir, "skills", slug);
+    const skillsTargetDir = canonicalPathForComparison(options.skillsTargetDir ?? path.join(targetDir, ".agents", "skills"));
+    if (pathExists(skillsTargetDir) &&
+        !fs.statSync(skillsTargetDir).isDirectory()) {
+        throw new Error(`Agent-Native skills target must be a directory: ${skillsTargetDir}`);
+    }
+    assertPathOutside(plugin.rootDir, skillsTargetDir, "Imported skills target");
+    assertNoSymlinkInExistingPath(skillsTargetDir, "Imported skills target");
+    const skillsRoot = path.join(skillsTargetDir, slug);
     const metadataFile = path.join(targetDir, ".agent-native", "plugins", `${slug}.json`);
     const mcpFile = path.join(targetDir, "mcp.config.json");
-    assertPathInside(targetDir, skillsRoot, "Imported skills root");
     assertPathInside(targetDir, metadataFile, "Imported metadata path");
     assertPathInside(targetDir, mcpFile, "Imported MCP config path");
+    assertPathInside(skillsTargetDir, skillsRoot, "Imported skills root");
     assertPathOutside(plugin.rootDir, skillsRoot, "Imported skills root");
     assertPathOutside(plugin.rootDir, metadataFile, "Imported metadata path");
     assertPathOutside(plugin.rootDir, mcpFile, "Imported MCP config path");
@@ -892,7 +900,7 @@ export function importAgentPlugin(input, options = {}) {
     const force = options.force ?? false;
     const dryRun = options.dryRun ?? false;
     const existingMcp = readExistingMcpConfig(mcpFile);
-    const skillPlans = planSkills(plugin, targetDir, slug, force);
+    const skillPlans = planSkills(plugin, skillsRoot, force);
     const mcpPlans = planMcpServers(plugin, existingMcp, force);
     const existingMetadata = readExistingMetadata(metadataFile);
     const metadataIsSame = metadataMatches(existingMetadata, plugin);

package/dist/cli/code-agent-executor.js

@@ -14,6 +14,7 @@ import { readAgentsBundleFromFs, generateDevelopmentSkillsPromptBlock, } from ".
 import { getAmbientOrgId, getAmbientUserEmail, runWithRequestContext, } from "../server/request-context.js";
 import { isReasoningEffort, } from "../shared/reasoning-effort.js";
 import { createAgentNativeConfigContext, loadResolvedAgentNativeConfig, } from "../vite/agent-native-config-loader.js";
+import { codexMcpConfigArgs, mergeCodeAgentMcpConfig, restrictCodeAgentMcpConfig, } from "./code-agent-mcp-config.js";
 import { createCodeAgentOutputSmoother } from "./code-agent-output-smoother.js";
 import { addCodeAgentCommandToAllowlist, appendCodeAgentTranscriptEvent, dequeueCodeAgentFollowUp, getCodeAgentRunRecord, isCodeAgentCommandAllowed, listCodeAgentTranscriptEvents, updateCodeAgentRunRecord, } from "./code-agent-runs.js";
 const DEFAULT_COMMAND_TIMEOUT_MS = 120_000;
@@ -443,20 +444,26 @@ async function executeCodexCliRun(options) {
     const model = normalizeCodexCliModel(options.model);
     const streamToolOutputToStdout = options.streamToolOutputToStdout ??
         process.env.AGENT_NATIVE_CODE_AGENT_STRUCTURED_STDOUT !== "1";
+    const additionalSkillsRoot = process.env.AGENT_NATIVE_CODE_AGENT_SKILLS_ROOT?.trim();
     const args = [
+        ...codexMcpConfigArgs(),
         "--ask-for-approval",
         "never",
-        "exec",
+        "--sandbox",
+        codexSandboxForPermissionMode(options.permissionMode),
         "--cd",
         cwd,
+        "exec",
         "--color",
         "never",
         "--skip-git-repo-check",
-        "--sandbox",
-        codexSandboxForPermissionMode(options.permissionMode),
+        "--ignore-user-config",
         "--output-last-message",
         outputPath,
     ];
+    if (additionalSkillsRoot && fs.existsSync(additionalSkillsRoot)) {
+        args.splice(args.indexOf("--output-last-message"), 0, "--add-dir", additionalSkillsRoot);
+    }
     if (model)
         args.push("--model", model);
     args.push("-");
@@ -663,9 +670,15 @@ function buildCodexCliPrompt(run, prompt) {
     const modeInstruction = mode === "Plan"
         ? "Inspect and explain only. Do not edit files or run mutating commands."
         : "Edit and verify as needed. Do not create, switch, reset, rebase, or stash git branches.";
+    const additionalSkillsRoot = process.env.AGENT_NATIVE_CODE_AGENT_SKILLS_ROOT?.trim();
     return [
         `You are running from Agent-Native Code in ${run.cwd || process.cwd()}.`,
         "Follow the repository AGENTS.md and any relevant skill instructions.",
+        ...(additionalSkillsRoot
+            ? [
+                `Additional installed Agent Plugin skills are available under ${additionalSkillsRoot}. Read any relevant SKILL.md files before acting.`,
+            ]
+            : []),
         `Run mode: ${mode} (${permissionMode}). ${modeInstruction}`,
         "",
         "# User request",
@@ -933,9 +946,12 @@ async function startCodeAgentMcpManager(runId) {
         });
         return null;
     });
-    if (!config || Object.keys(config.servers ?? {}).length === 0)
+    const effectiveConfig = restrictCodeAgentMcpConfig(mergeCodeAgentMcpConfig(config));
+    if (!effectiveConfig ||
+        Object.keys(effectiveConfig.servers ?? {}).length === 0) {
         return null;
-    const manager = new McpClientManager(config);
+    }
+    const manager = new McpClientManager(effectiveConfig);
     await manager.start().catch((err) => {
         const message = err instanceof Error ? err.message : String(err);
         appendCodeAgentTranscriptEvent({
@@ -1299,6 +1315,10 @@ export async function buildCodeAgentSystemPrompt(cwd, permissionMode) {
     const appConfig = await loadResolvedAgentNativeConfig(cwd, createAgentNativeConfigContext("serve", "development"));
     const bundle = readAgentsBundleFromFs(cwd, null, {
         instructions: appConfig.instructions,
+        additionalSkillDirs: (process.env.AGENT_NATIVE_CODE_AGENT_SKILLS_ROOT ?? "")
+            .split(path.delimiter)
+            .map((value) => value.trim())
+            .filter(Boolean),
     });
     // If the bundle has no AGENTS.md, try CLAUDE.md as a fallback — many repos
     // use that name for agent instructions (e.g. Claude Code projects).

package/dist/cli/code-agent-mcp-config.d.ts

@@ -0,0 +1,21 @@
+import type { McpConfig } from "../mcp-client/config.js";
+/**
+ * Keep a desktop coding run on the app registry's MCP servers. The normal
+ * server-side manager merges persisted MCP settings for web requests, but a
+ * local shell must not inherit arbitrary user MCP servers when the desktop
+ * host has supplied an explicit workspace allowlist.
+ */
+export declare function restrictCodeAgentMcpConfig(config: McpConfig | null, environment?: NodeJS.ProcessEnv): McpConfig | null;
+/**
+ * Add host-provided app/plugin servers to the normal merged config. The
+ * filesystem and environment layers have different precedence rules, so the
+ * child process combines them explicitly instead of silently dropping one.
+ */
+export declare function mergeCodeAgentMcpConfig(config: McpConfig | null, environment?: NodeJS.ProcessEnv): McpConfig | null;
+/**
+ * Convert the host-scoped HTTP MCP config into Codex CLI's `-c` overrides.
+ * The caller adds `--ignore-user-config` in the `exec` segment so a local
+ * coding session receives the workspace apps, not the user's global MCP
+ * catalog.
+ */
+export declare function codexMcpConfigArgs(environment?: NodeJS.ProcessEnv): string[];

package/dist/cli/code-agent-mcp-config.js

@@ -0,0 +1,103 @@
+const DESKTOP_MCP_ALLOWLIST_ENV = "AGENT_NATIVE_CODE_AGENT_MCP_SERVER_ALLOWLIST";
+function parseServerAllowlist(raw) {
+    if (raw === undefined)
+        return null;
+    return new Set(raw
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean));
+}
+/**
+ * Keep a desktop coding run on the app registry's MCP servers. The normal
+ * server-side manager merges persisted MCP settings for web requests, but a
+ * local shell must not inherit arbitrary user MCP servers when the desktop
+ * host has supplied an explicit workspace allowlist.
+ */
+export function restrictCodeAgentMcpConfig(config, environment = process.env) {
+    const allowlist = parseServerAllowlist(environment[DESKTOP_MCP_ALLOWLIST_ENV]);
+    if (!allowlist || !config)
+        return config;
+    const servers = Object.fromEntries(Object.entries(config.servers).filter(([id]) => allowlist.has(id)));
+    return { ...config, servers };
+}
+function codexConfigKey(serverId) {
+    const normalized = serverId.replace(/[^A-Za-z0-9_-]/g, "_");
+    return normalized || "workspace";
+}
+function tomlString(value) {
+    return JSON.stringify(value);
+}
+function tomlInlineTable(headers) {
+    return `{${Object.entries(headers)
+        .map(([key, value]) => `${tomlString(key)}=${tomlString(value)}`)
+        .join(",")}}`;
+}
+function parseMcpServers(environment) {
+    const raw = environment.MCP_SERVERS?.trim();
+    if (!raw)
+        return {};
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("MCP_SERVERS is not valid JSON.");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error("MCP_SERVERS must contain a servers object.");
+    }
+    const serverMap = "servers" in parsed &&
+        parsed.servers &&
+        typeof parsed.servers === "object" &&
+        !Array.isArray(parsed.servers)
+        ? parsed.servers
+        : parsed;
+    return Object.fromEntries(Object.entries(serverMap).map(([id, value]) => {
+        if (!value || typeof value !== "object" || Array.isArray(value)) {
+            throw new Error(`MCP_SERVERS entry ${id} is invalid.`);
+        }
+        return [id, value];
+    }));
+}
+/**
+ * Add host-provided app/plugin servers to the normal merged config. The
+ * filesystem and environment layers have different precedence rules, so the
+ * child process combines them explicitly instead of silently dropping one.
+ */
+export function mergeCodeAgentMcpConfig(config, environment = process.env) {
+    const environmentServers = parseMcpServers(environment);
+    if (Object.keys(environmentServers).length === 0)
+        return config;
+    return {
+        ...(config ?? { servers: {} }),
+        servers: {
+            ...(config?.servers ?? {}),
+            ...environmentServers,
+        },
+        source: config?.source
+            ? `${config.source}+desktop-environment`
+            : "env:MCP_SERVERS",
+    };
+}
+/**
+ * Convert the host-scoped HTTP MCP config into Codex CLI's `-c` overrides.
+ * The caller adds `--ignore-user-config` in the `exec` segment so a local
+ * coding session receives the workspace apps, not the user's global MCP
+ * catalog.
+ */
+export function codexMcpConfigArgs(environment = process.env) {
+    const servers = parseMcpServers(environment);
+    if (Object.keys(servers).length === 0)
+        return [];
+    const args = [];
+    for (const [serverId, server] of Object.entries(servers)) {
+        if (server.type !== "http" || !server.url)
+            continue;
+        const key = codexConfigKey(serverId);
+        args.push("-c", `mcp_servers.${tomlString(key)}.url=${tomlString(server.url)}`);
+        if (server.headers && Object.keys(server.headers).length > 0) {
+            args.push("-c", `mcp_servers.${tomlString(key)}.http_headers=${tomlInlineTable(server.headers)}`);
+        }
+    }
+    return args;
+}

package/dist/cli/plan-blocks.d.ts

@@ -1,18 +1,3 @@
-export declare const DEFAULT_PLAN_APP_URL = "https://plan.agent-native.com";
-export type PlanBlockFormat = "reference" | "schema";
-export type FetchPlanBlockCatalogInput = {
-    appUrl?: string;
-    out?: string;
-    format?: PlanBlockFormat;
-    fetchFn?: typeof fetch;
-};
-export type FetchPlanBlockCatalogResult = {
-    ok: true;
-    out: string;
-    count?: number;
-    format: PlanBlockFormat;
-};
-export declare function planActionEndpoint(appUrl: string, action: string): string;
-export declare function normalizePlanBlockFormat(value: string | undefined): PlanBlockFormat;
-export declare function defaultPlanBlocksOut(format: PlanBlockFormat): string;
-export declare function fetchPlanBlockCatalog(input: FetchPlanBlockCatalogInput): Promise<FetchPlanBlockCatalogResult>;
+/** Compatibility re-export for the canonical recap CLI implementation. */
+export { DEFAULT_PLAN_APP_URL, defaultPlanBlocksOut, fetchPlanBlockCatalog, normalizePlanBlockFormat, planActionEndpoint, } from "@agent-native/recap-cli";
+export type { FetchPlanBlockCatalogInput, FetchPlanBlockCatalogResult, PlanBlockFormat, } from "@agent-native/recap-cli";