@agent-native/core 0.149.5 → 0.151.0

package/corpus/templates/dispatch/server/plugins/org-apps-directory.ts

@@ -37,9 +37,9 @@
  * Auth-guard reachability: `/_agent-native/*` is 401'd by the core auth
  * guard when there is no session. This route is authenticated by the A2A
  * JWT, not a cookie, so — exactly like the identity-sso plugin's authorize
- * route — it registers its exact path as a `publicPath` via a second
- * additive `createAuthPlugin({ publicPaths })` call. "Public path" only
- * means "the guard does not pre-empt with a 401"; the handler still performs
+ * route — Dispatch's primary auth plugin receives its exact `publicPath`
+ * from `setupDispatch`. "Public path" only means "the guard does not pre-empt
+ * with a 401"; the handler still performs
  * the full A2A JWT + same-org check itself (defense in depth). The path is
  * matched exactly, so no other `/_agent-native/org/*` route is affected.
  *
@@ -51,11 +51,7 @@ import {
   getOrgDomain,
   resolveOrgByDomain,
 } from "@agent-native/core/org";
-import {
-  createAuthPlugin,
-  getH3App,
-  runWithRequestContext,
-} from "@agent-native/core/server";
+import { getH3App, runWithRequestContext } from "@agent-native/core/server";
 import { discoverAgents } from "@agent-native/core/server/agent-discovery";
 import { defineEventHandler, getMethod, getRequestHeader } from "h3";
 import type { H3Event } from "h3";
@@ -181,14 +177,10 @@ const orgAppsHandler = defineEventHandler(
 );
 
 /**
- * Dispatch org-app-directory plugin. Mounts the directory route and
- * registers its exact path as a public path so the core auth guard does not
- * 401 the A2A peer call before our own JWT + same-org check runs. The
- * `createAuthPlugin({ publicPaths })` call is additive — it appends to the
- * live guard config without disturbing Dispatch's primary auth plugin
- * (same mechanism the identity-sso plugin relies on).
+ * Dispatch org-app-directory plugin. The primary Dispatch auth plugin owns
+ * the exact public-path registration so this handler can perform its own JWT
+ * and same-org checks without racing a second auth initializer.
  */
 export default async (nitroApp: any) => {
   getH3App(nitroApp).use(ORG_APPS_PATH, orgAppsHandler);
-  return createAuthPlugin({ publicPaths: [ORG_APPS_PATH] })(nitroApp);
 };

package/corpus/templates/dispatch/server/plugins/setup-dispatch.ts

@@ -1,3 +1,11 @@
 import { setupDispatch } from "@agent-native/dispatch/server";
 
-export default setupDispatch();
+export default setupDispatch({
+  auth: {
+    publicPaths: [
+      "/_agent-native/identity/availability",
+      "/_agent-native/identity/authorize",
+      "/_agent-native/org/apps",
+    ],
+  },
+});

package/corpus/templates/dispatch/shared/feature-flags.ts

@@ -0,0 +1,15 @@
+import {
+  defineFeatureFlag,
+  defineFeatureFlags,
+} from "@agent-native/core/feature-flags";
+
+export const DESKTOP_WORKSPACE_SSO_FLAG = defineFeatureFlag({
+  key: "desktop.workspace-sso",
+  displayName: "Desktop workspace sign-in",
+  description:
+    "Let the signed Agent Native Desktop broker workspace identity across first-party apps.",
+});
+
+export const DISPATCH_FEATURE_FLAGS = defineFeatureFlags([
+  DESKTOP_WORKSPACE_SSO_FLAG,
+]);

package/corpus/templates/factory/.agents/skills/delegate-to-agent/SKILL.md

@@ -49,6 +49,34 @@ sendToAgentChat({
 });
 ```
 
+### Keep user text separate from injected context
+
+Treat the visible `message` as the user's request or the shortest clear
+description of an app-initiated operation. Put context the user did not type —
+IDs, URLs, filenames, current selection or screen state, serialized records,
+upload instructions, and bounded source excerpts — in the `context` field.
+`context` is model input carried through the agent turn; it is stripped from
+the rendered user message, so do not concatenate it into `message` with labels,
+blank-line sections, or `<context>` tags yourself.
+
+Use the related surface for each kind of supporting input:
+
+| Surface | Use for |
+| --- | --- |
+| `message` | User-authored intent or a concise app action description |
+| `context` | Derived metadata and bounded text needed to carry out that intent |
+| `setAgentChatContextItem` | Context staged for a later user-submitted prompt; keep it keyed so updates replace stale context |
+| `images`, `referenceImagePaths`, attachments | Binary or visual inputs; describe only the handling instructions in `context` |
+
+If an app builds a prompt from a form, selection, upload, or editor state, keep
+the visible message short and pass the assembled details as `context`. Preserve
+the user's actual freeform text in `message` when it is the request; do not
+restate it as metadata in `context` unless the agent needs a structured copy.
+
+This boundary applies to auto-submitted turns and prefills. A hidden context
+field is not a license to send unbounded records or secrets: cap excerpts,
+prefer stable IDs and URLs, and use an action or resource lookup for full data.
+
 **From the UI, in the background:**
 
 ```ts

package/corpus/templates/factory/.agents/skills/frontend-design/SKILL.md

@@ -168,6 +168,11 @@ the useful information remains dense and scannable.
 - Do not build custom dropdowns, menus, popovers, modals, or confirmations with manual absolute positioning and click-outside effects.
 - Never use browser dialogs (`window.alert`, `window.confirm`, `window.prompt`). Use `AlertDialog`, `Dialog`, or app-specific confirmation UI.
 - Use Tabler icons for all first-party UI icons. Do not add Lucide, Heroicons, inline SVG icon sets, or emoji icons.
+- Never guess a Tabler icon name. Names like `IconPartyPopper` or `IconConfettiCannon` feel
+  plausible but don't exist and crash Vite with a "Named export not found" error. Before importing
+  an icon you haven't used elsewhere in this app, confirm it exists by grepping
+  `node_modules/@tabler/icons-react/dist/tabler-icons-react.d.ts` (or the package's icon list)
+  for the exact name, and pick the closest real match if your first guess isn't there.
 - Keep inline help/info glyphs next to labels at `size-3` (12px) or smaller than the adjacent text. Preserve a larger hit area on the trigger, not the glyph. Use `guard:allow-large-help-icon` only for deliberate heading documentation or menu action exceptions.
 - Use `useActionQuery` and `useActionMutation` from `@agent-native/core/client` for action-backed UI. Standard CRUD should go through actions, not custom `/api/` routes.
 - Keep UI optimistic where possible: update cache and navigation immediately, then reconcile or roll back on mutation result.

package/corpus/templates/forms/.agents/skills/delegate-to-agent/SKILL.md

@@ -49,6 +49,34 @@ sendToAgentChat({
 });
 ```
 
+### Keep user text separate from injected context
+
+Treat the visible `message` as the user's request or the shortest clear
+description of an app-initiated operation. Put context the user did not type —
+IDs, URLs, filenames, current selection or screen state, serialized records,
+upload instructions, and bounded source excerpts — in the `context` field.
+`context` is model input carried through the agent turn; it is stripped from
+the rendered user message, so do not concatenate it into `message` with labels,
+blank-line sections, or `<context>` tags yourself.
+
+Use the related surface for each kind of supporting input:
+
+| Surface | Use for |
+| --- | --- |
+| `message` | User-authored intent or a concise app action description |
+| `context` | Derived metadata and bounded text needed to carry out that intent |
+| `setAgentChatContextItem` | Context staged for a later user-submitted prompt; keep it keyed so updates replace stale context |
+| `images`, `referenceImagePaths`, attachments | Binary or visual inputs; describe only the handling instructions in `context` |
+
+If an app builds a prompt from a form, selection, upload, or editor state, keep
+the visible message short and pass the assembled details as `context`. Preserve
+the user's actual freeform text in `message` when it is the request; do not
+restate it as metadata in `context` unless the agent needs a structured copy.
+
+This boundary applies to auto-submitted turns and prefills. A hidden context
+field is not a license to send unbounded records or secrets: cap excerpts,
+prefer stable IDs and URLs, and use an action or resource lookup for full data.
+
 **From the UI, in the background:**
 
 ```ts

package/corpus/templates/forms/.agents/skills/form-responses/SKILL.md

@@ -80,13 +80,14 @@ Each response is stored in the `responses` SQL table:
 `submitterEmail` may come from the logged-in Forms session or from trusted
 feedback clients that pass the logged-in user email as submission metadata.
 
-`pageUrl` and `clientSurface` are hidden pass-through fields: trusted embeds
-(e.g. the framework FeedbackButton) forward the URL of the page the respondent
-was on and the runtime shell they were in (`web`, `electron`, or `tauri`) as
-submission metadata, so owners can see which screen and which app feedback came
-from. Both are null for direct fills that send no context, and `clientSurface`
-is allowlisted server-side (unknown values are dropped). The responses table
-surfaces them as "Page" and "Source" columns when any response carries them.
+`pageUrl` and `clientSurface` are hidden pass-through fields. Direct public
+fills record the current form URL, while trusted embeds (e.g. the framework
+FeedbackButton) forward the respondent's source page and runtime shell (`web`,
+`electron`, or `tauri`) so owners can see which screen and app feedback came
+from. Sensitive URL query keys are scrubbed before persistence, `clientSurface`
+is allowlisted server-side (unknown values are dropped), and anonymous forms
+suppress both fields. The responses table surfaces them as "Page" and "Source"
+columns when any response carries them.
 
 The `data` JSON maps field IDs to values:
 

package/corpus/templates/forms/.agents/skills/frontend-design/SKILL.md

@@ -168,6 +168,11 @@ the useful information remains dense and scannable.
 - Do not build custom dropdowns, menus, popovers, modals, or confirmations with manual absolute positioning and click-outside effects.
 - Never use browser dialogs (`window.alert`, `window.confirm`, `window.prompt`). Use `AlertDialog`, `Dialog`, or app-specific confirmation UI.
 - Use Tabler icons for all first-party UI icons. Do not add Lucide, Heroicons, inline SVG icon sets, or emoji icons.
+- Never guess a Tabler icon name. Names like `IconPartyPopper` or `IconConfettiCannon` feel
+  plausible but don't exist and crash Vite with a "Named export not found" error. Before importing
+  an icon you haven't used elsewhere in this app, confirm it exists by grepping
+  `node_modules/@tabler/icons-react/dist/tabler-icons-react.d.ts` (or the package's icon list)
+  for the exact name, and pick the closest real match if your first guess isn't there.
 - Keep inline help/info glyphs next to labels at `size-3` (12px) or smaller than the adjacent text. Preserve a larger hit area on the trigger, not the glyph. Use `guard:allow-large-help-icon` only for deliberate heading documentation or menu action exceptions.
 - Use `useActionQuery` and `useActionMutation` from `@agent-native/core/client` for action-backed UI. Standard CRUD should go through actions, not custom `/api/` routes.
 - Keep UI optimistic where possible: update cache and navigation immediately, then reconcile or roll back on mutation result.

package/corpus/templates/forms/app/hooks/use-forms.ts

@@ -4,6 +4,7 @@ import {
   useActionMutation,
 } from "@agent-native/core/client/hooks";
 import { useT } from "@agent-native/core/client/i18n";
+import { scrubPageUrl } from "@shared/page-url";
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
 import { toast } from "sonner";
 
@@ -189,7 +190,13 @@ export function useSubmitForm() {
       fetch(appApiPath(`/api/submit/${formId}`), {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ data, captchaToken, _hp, _t }),
+        body: JSON.stringify({
+          data,
+          captchaToken,
+          _hp,
+          _t,
+          _meta: { pageUrl: scrubPageUrl(window.location.href) },
+        }),
       }).then((r) => {
         if (!r.ok) return r.json().then((e: any) => Promise.reject(e));
         return r.json();

package/corpus/templates/forms/changelog/2026-08-11-fixed-public-forms-so-conditional-questions-stay-hidden-unti.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-11
+---
+
+Fixed public forms so conditional questions stay hidden until relevant and submissions retain a safe page link.

package/corpus/templates/forms/server/handlers/submissions.ts

@@ -21,6 +21,7 @@ import {
   isConditionalFieldVisible,
   sanitizeConditionalValues as sanitizeVisibleValues,
 } from "../../shared/conditional.js";
+import { scrubPageUrl } from "../../shared/page-url.js";
 import {
   cleanSubmitterEmail,
   publicSubmitterEmail,
@@ -226,7 +227,7 @@ export const submitForm = defineEventHandler(async (event: H3Event) => {
     meta?.chatSessionIds,
   ]);
   const activeRunId = cleanMetaText(meta?.activeRunId);
-  const pageUrl = cleanMetaText(meta?.pageUrl);
+  const pageUrl = scrubPageUrl(meta?.pageUrl);
   const clientSurface = cleanClientSurface(meta?.clientSurface);
 
   await db.insert(schema.responses).values({

package/corpus/templates/forms/server/lib/public-form-ssr.ts

@@ -10,6 +10,8 @@ import {
 import { eq } from "drizzle-orm";
 import { getMethod, getRequestURL, type H3Event } from "h3";
 
+import { isConditionalFieldVisible } from "../../shared/conditional.js";
+import { SENSITIVE_QUERY_PARAMS } from "../../shared/page-url.js";
 import {
   toPublicFormSettings,
   type FormField,
@@ -200,6 +202,10 @@ function renderField(field: FormField): string {
     ? ` data-cond-field="${escapeHtml(field.conditional.fieldId)}" data-cond-op="${escapeHtml(field.conditional.operator)}" data-cond-val="${escapeHtml(field.conditional.value)}"`
     : "";
   const widthClass = field.width === "half" ? " field-half" : "";
+  const initiallyVisible = isConditionalFieldVisible(field, {});
+  const initialVisibility = initiallyVisible
+    ? ""
+    : ' style="display:none" data-hidden="1"';
 
   let input = "";
 
@@ -265,7 +271,7 @@ function renderField(field: FormField): string {
       break;
   }
 
-  return `<div class="field${widthClass}" data-field-id="${id}"${cond}>
+  return `<div class="field${widthClass}" data-field-id="${id}"${cond}${initialVisibility}>
     <label class="field-label">${escapeHtml(field.label)}${field.required ? '<span class="req">*</span>' : ""}</label>
     ${desc}${input}</div>`;
 }
@@ -435,6 +441,34 @@ function renderFormPage(
   var REDIRECT = ${JSON.stringify(safeRedirectUrl(settings.redirectUrl))};
   var TURNSTILE_KEY = ${JSON.stringify(turnstileSiteKey)};
   var FIELDS = ${JSON.stringify(fields.map((f) => ({ id: f.id, type: f.type, required: f.required, validation: f.validation, label: f.label, conditional: f.conditional })))};
+  var SENSITIVE_QUERY_PARAMS = ${JSON.stringify(SENSITIVE_QUERY_PARAMS)};
+
+  function scrubPageUrl(value) {
+    try {
+      var url = new URL(value);
+      if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+      url.username = "";
+      url.password = "";
+      scrubParams(url.searchParams);
+      if (url.hash.indexOf("=") >= 0) {
+        var hashParams = new URLSearchParams(url.hash.slice(1));
+        scrubParams(hashParams);
+        url.hash = hashParams.toString();
+      }
+      return url.toString();
+    // coercion-ok: an invalid browser URL is absent page context, not a valid submission value
+    } catch (_) {
+      return null;
+    }
+  }
+
+  function scrubParams(params) {
+    Array.from(params.keys()).forEach(function(key) {
+      if (SENSITIVE_QUERY_PARAMS.indexOf(key.toLowerCase()) >= 0) {
+        params.set(key, "<redacted>");
+      }
+    });
+  }
 
   function revalidateFormVersion() {
     fetch(PUBLIC_FORM_API, { cache: "no-store" })
@@ -631,11 +665,12 @@ function renderFormPage(
     btn.textContent = "Submitting...";
     btn.disabled = true;
     var hp = (document.getElementById("_hp") || {}).value || "";
+    var pageUrl = scrubPageUrl(window.location.href);
 
     fetch(${JSON.stringify(submitPath)} + FORM_ID, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ data: data, captchaToken: captchaToken, _hp: hp, _t: PAGE_LOAD_T }),
+      body: JSON.stringify({ data: data, captchaToken: captchaToken, _hp: hp, _t: PAGE_LOAD_T, _meta: { pageUrl: pageUrl } }),
     })
     .then(function(r) { return r.json().then(function(d) { return { ok: r.ok, data: d }; }); })
     .then(function(res) {

package/corpus/templates/forms/shared/page-url.ts

@@ -0,0 +1,54 @@
+export const SENSITIVE_QUERY_PARAMS = [
+  "password",
+  "p",
+  "token",
+  "state",
+  "code",
+  "share",
+  "share_token",
+  "bridge",
+  "access_token",
+  "id_token",
+  "refresh_token",
+  "authorization",
+  "api_key",
+  "key",
+  "secret",
+  "session",
+] as const;
+
+const SENSITIVE_QUERY_PARAM_SET = new Set<string>(SENSITIVE_QUERY_PARAMS);
+
+/**
+ * Keep response page context useful while never retaining URL-bar secrets.
+ * This mirrors the framework feedback URL scrubber for Forms-owned public
+ * submissions and re-checks metadata supplied by embeds on the server.
+ */
+export function scrubPageUrl(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  if (!URL.canParse(trimmed)) return null;
+
+  const url = new URL(trimmed);
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  url.username = "";
+  url.password = "";
+  scrubParams(url.searchParams);
+
+  if (url.hash.includes("=")) {
+    const hashParams = new URLSearchParams(url.hash.slice(1));
+    scrubParams(hashParams);
+    url.hash = hashParams.toString();
+  }
+
+  return url.toString();
+}
+
+function scrubParams(params: URLSearchParams) {
+  for (const key of params.keys()) {
+    if (SENSITIVE_QUERY_PARAM_SET.has(key.toLowerCase())) {
+      params.set(key, "<redacted>");
+    }
+  }
+}

package/corpus/templates/forms/shared/types.ts

@@ -155,15 +155,15 @@ export interface FormResponse {
   /** Real submitter email when known; synthetic anonymous-owner ids are hidden. */
   submitterEmail?: string | null;
   /**
-   * URL of the page the respondent was on, forwarded by trusted embeds (e.g.
-   * the framework FeedbackButton) as a hidden pass-through field. Null when the
-   * submission carried no page context (e.g. a direct fill on the public page).
+   * URL of the direct public form or trusted embed source page. Sensitive URL
+   * query keys are scrubbed before it is stored; null when no page context is
+   * available or anonymous mode suppresses response metadata.
    */
   pageUrl?: string | null;
   /**
    * Runtime shell the feedback was sent from — "web", "electron", or "tauri" —
    * forwarded by trusted embeds as a hidden pass-through field. Null when
-   * unknown (e.g. a direct fill on the public page).
+   * unknown or anonymous mode suppresses response metadata.
    */
   clientSurface?: string | null;
 }

package/corpus/templates/macros/.agents/skills/frontend-design/SKILL.md

@@ -168,6 +168,11 @@ the useful information remains dense and scannable.
 - Do not build custom dropdowns, menus, popovers, modals, or confirmations with manual absolute positioning and click-outside effects.
 - Never use browser dialogs (`window.alert`, `window.confirm`, `window.prompt`). Use `AlertDialog`, `Dialog`, or app-specific confirmation UI.
 - Use Tabler icons for all first-party UI icons. Do not add Lucide, Heroicons, inline SVG icon sets, or emoji icons.
+- Never guess a Tabler icon name. Names like `IconPartyPopper` or `IconConfettiCannon` feel
+  plausible but don't exist and crash Vite with a "Named export not found" error. Before importing
+  an icon you haven't used elsewhere in this app, confirm it exists by grepping
+  `node_modules/@tabler/icons-react/dist/tabler-icons-react.d.ts` (or the package's icon list)
+  for the exact name, and pick the closest real match if your first guess isn't there.
 - Keep inline help/info glyphs next to labels at `size-3` (12px) or smaller than the adjacent text. Preserve a larger hit area on the trigger, not the glyph. Use `guard:allow-large-help-icon` only for deliberate heading documentation or menu action exceptions.
 - Use `useActionQuery` and `useActionMutation` from `@agent-native/core/client` for action-backed UI. Standard CRUD should go through actions, not custom `/api/` routes.
 - Keep UI optimistic where possible: update cache and navigation immediately, then reconcile or roll back on mutation result.

package/corpus/templates/mail/.agents/skills/delegate-to-agent/SKILL.md

@@ -49,6 +49,34 @@ sendToAgentChat({
 });
 ```
 
+### Keep user text separate from injected context
+
+Treat the visible `message` as the user's request or the shortest clear
+description of an app-initiated operation. Put context the user did not type —
+IDs, URLs, filenames, current selection or screen state, serialized records,
+upload instructions, and bounded source excerpts — in the `context` field.
+`context` is model input carried through the agent turn; it is stripped from
+the rendered user message, so do not concatenate it into `message` with labels,
+blank-line sections, or `<context>` tags yourself.
+
+Use the related surface for each kind of supporting input:
+
+| Surface | Use for |
+| --- | --- |
+| `message` | User-authored intent or a concise app action description |
+| `context` | Derived metadata and bounded text needed to carry out that intent |
+| `setAgentChatContextItem` | Context staged for a later user-submitted prompt; keep it keyed so updates replace stale context |
+| `images`, `referenceImagePaths`, attachments | Binary or visual inputs; describe only the handling instructions in `context` |
+
+If an app builds a prompt from a form, selection, upload, or editor state, keep
+the visible message short and pass the assembled details as `context`. Preserve
+the user's actual freeform text in `message` when it is the request; do not
+restate it as metadata in `context` unless the agent needs a structured copy.
+
+This boundary applies to auto-submitted turns and prefills. A hidden context
+field is not a license to send unbounded records or secrets: cap excerpts,
+prefer stable IDs and URLs, and use an action or resource lookup for full data.
+
 **From the UI, in the background:**
 
 ```ts

package/corpus/templates/mail/.agents/skills/frontend-design/SKILL.md

@@ -168,6 +168,11 @@ the useful information remains dense and scannable.
 - Do not build custom dropdowns, menus, popovers, modals, or confirmations with manual absolute positioning and click-outside effects.
 - Never use browser dialogs (`window.alert`, `window.confirm`, `window.prompt`). Use `AlertDialog`, `Dialog`, or app-specific confirmation UI.
 - Use Tabler icons for all first-party UI icons. Do not add Lucide, Heroicons, inline SVG icon sets, or emoji icons.
+- Never guess a Tabler icon name. Names like `IconPartyPopper` or `IconConfettiCannon` feel
+  plausible but don't exist and crash Vite with a "Named export not found" error. Before importing
+  an icon you haven't used elsewhere in this app, confirm it exists by grepping
+  `node_modules/@tabler/icons-react/dist/tabler-icons-react.d.ts` (or the package's icon list)
+  for the exact name, and pick the closest real match if your first guess isn't there.
 - Keep inline help/info glyphs next to labels at `size-3` (12px) or smaller than the adjacent text. Preserve a larger hit area on the trigger, not the glyph. Use `guard:allow-large-help-icon` only for deliberate heading documentation or menu action exceptions.
 - Use `useActionQuery` and `useActionMutation` from `@agent-native/core/client` for action-backed UI. Standard CRUD should go through actions, not custom `/api/` routes.
 - Keep UI optimistic where possible: update cache and navigation immediately, then reconcile or roll back on mutation result.

package/corpus/templates/plan/.agents/skills/delegate-to-agent/SKILL.md

@@ -49,6 +49,34 @@ sendToAgentChat({
 });
 ```
 
+### Keep user text separate from injected context
+
+Treat the visible `message` as the user's request or the shortest clear
+description of an app-initiated operation. Put context the user did not type —
+IDs, URLs, filenames, current selection or screen state, serialized records,
+upload instructions, and bounded source excerpts — in the `context` field.
+`context` is model input carried through the agent turn; it is stripped from
+the rendered user message, so do not concatenate it into `message` with labels,
+blank-line sections, or `<context>` tags yourself.
+
+Use the related surface for each kind of supporting input:
+
+| Surface | Use for |
+| --- | --- |
+| `message` | User-authored intent or a concise app action description |
+| `context` | Derived metadata and bounded text needed to carry out that intent |
+| `setAgentChatContextItem` | Context staged for a later user-submitted prompt; keep it keyed so updates replace stale context |
+| `images`, `referenceImagePaths`, attachments | Binary or visual inputs; describe only the handling instructions in `context` |
+
+If an app builds a prompt from a form, selection, upload, or editor state, keep
+the visible message short and pass the assembled details as `context`. Preserve
+the user's actual freeform text in `message` when it is the request; do not
+restate it as metadata in `context` unless the agent needs a structured copy.
+
+This boundary applies to auto-submitted turns and prefills. A hidden context
+field is not a license to send unbounded records or secrets: cap excerpts,
+prefer stable IDs and URLs, and use an action or resource lookup for full data.
+
 **From the UI, in the background:**
 
 ```ts

package/corpus/templates/plan/.agents/skills/frontend-design/SKILL.md

@@ -168,6 +168,11 @@ the useful information remains dense and scannable.
 - Do not build custom dropdowns, menus, popovers, modals, or confirmations with manual absolute positioning and click-outside effects.
 - Never use browser dialogs (`window.alert`, `window.confirm`, `window.prompt`). Use `AlertDialog`, `Dialog`, or app-specific confirmation UI.
 - Use Tabler icons for all first-party UI icons. Do not add Lucide, Heroicons, inline SVG icon sets, or emoji icons.
+- Never guess a Tabler icon name. Names like `IconPartyPopper` or `IconConfettiCannon` feel
+  plausible but don't exist and crash Vite with a "Named export not found" error. Before importing
+  an icon you haven't used elsewhere in this app, confirm it exists by grepping
+  `node_modules/@tabler/icons-react/dist/tabler-icons-react.d.ts` (or the package's icon list)
+  for the exact name, and pick the closest real match if your first guess isn't there.
 - Keep inline help/info glyphs next to labels at `size-3` (12px) or smaller than the adjacent text. Preserve a larger hit area on the trigger, not the glyph. Use `guard:allow-large-help-icon` only for deliberate heading documentation or menu action exceptions.
 - Use `useActionQuery` and `useActionMutation` from `@agent-native/core/client` for action-backed UI. Standard CRUD should go through actions, not custom `/api/` routes.
 - Keep UI optimistic where possible: update cache and navigation immediately, then reconcile or roll back on mutation result.

package/corpus/templates/slides/.agents/skills/delegate-to-agent/SKILL.md

@@ -49,6 +49,34 @@ sendToAgentChat({
 });
 ```
 
+### Keep user text separate from injected context
+
+Treat the visible `message` as the user's request or the shortest clear
+description of an app-initiated operation. Put context the user did not type —
+IDs, URLs, filenames, current selection or screen state, serialized records,
+upload instructions, and bounded source excerpts — in the `context` field.
+`context` is model input carried through the agent turn; it is stripped from
+the rendered user message, so do not concatenate it into `message` with labels,
+blank-line sections, or `<context>` tags yourself.
+
+Use the related surface for each kind of supporting input:
+
+| Surface | Use for |
+| --- | --- |
+| `message` | User-authored intent or a concise app action description |
+| `context` | Derived metadata and bounded text needed to carry out that intent |
+| `setAgentChatContextItem` | Context staged for a later user-submitted prompt; keep it keyed so updates replace stale context |
+| `images`, `referenceImagePaths`, attachments | Binary or visual inputs; describe only the handling instructions in `context` |
+
+If an app builds a prompt from a form, selection, upload, or editor state, keep
+the visible message short and pass the assembled details as `context`. Preserve
+the user's actual freeform text in `message` when it is the request; do not
+restate it as metadata in `context` unless the agent needs a structured copy.
+
+This boundary applies to auto-submitted turns and prefills. A hidden context
+field is not a license to send unbounded records or secrets: cap excerpts,
+prefer stable IDs and URLs, and use an action or resource lookup for full data.
+
 **From the UI, in the background:**
 
 ```ts

package/corpus/templates/slides/.agents/skills/frontend-design/SKILL.md

@@ -168,6 +168,11 @@ the useful information remains dense and scannable.
 - Do not build custom dropdowns, menus, popovers, modals, or confirmations with manual absolute positioning and click-outside effects.
 - Never use browser dialogs (`window.alert`, `window.confirm`, `window.prompt`). Use `AlertDialog`, `Dialog`, or app-specific confirmation UI.
 - Use Tabler icons for all first-party UI icons. Do not add Lucide, Heroicons, inline SVG icon sets, or emoji icons.
+- Never guess a Tabler icon name. Names like `IconPartyPopper` or `IconConfettiCannon` feel
+  plausible but don't exist and crash Vite with a "Named export not found" error. Before importing
+  an icon you haven't used elsewhere in this app, confirm it exists by grepping
+  `node_modules/@tabler/icons-react/dist/tabler-icons-react.d.ts` (or the package's icon list)
+  for the exact name, and pick the closest real match if your first guess isn't there.
 - Keep inline help/info glyphs next to labels at `size-3` (12px) or smaller than the adjacent text. Preserve a larger hit area on the trigger, not the glyph. Use `guard:allow-large-help-icon` only for deliberate heading documentation or menu action exceptions.
 - Use `useActionQuery` and `useActionMutation` from `@agent-native/core/client` for action-backed UI. Standard CRUD should go through actions, not custom `/api/` routes.
 - Keep UI optimistic where possible: update cache and navigation immediately, then reconcile or roll back on mutation result.

package/corpus/templates/slides/actions/add-slide.ts

@@ -24,10 +24,6 @@ import {
   awaitLayoutFitCheck,
   formatOverflowForTool,
 } from "./_await-fit-check.js";
-import {
-  readAppStateForCurrentTab,
-  writeAppStateForCurrentTab,
-} from "./_tab-state.js";
 // Use the shared, globalThis-pinned per-deck lock so add-slide, update-slide,
 // and the browser's patch-deck all serialise against the SAME lock — writes to
 // different slides of the same deck can never clobber each other.
@@ -383,29 +379,6 @@ export default defineAction({
       // Include the new slideId + agent actor (backwards-compatible payload).
       notifyClients(deckId, { slideId: newSlideId, actor: "agent" });
 
-      // Nudge any open editor onto the new slide so the renderer measures
-      // IT (not whichever slide was previously selected). Only fires when an
-      // editor is open on this deck; navigation state is a no-op if nobody
-      // is watching.
-      const nav = (await readAppStateForCurrentTab("navigation", {
-        fallbackToGlobal: false,
-      }).catch(() => null)) as {
-        view?: string;
-        deckId?: string;
-      } | null;
-      if (nav?.view === "editor" && nav.deckId === deckId) {
-        await writeAppStateForCurrentTab("navigate", {
-          deckId,
-          slideIndex: insertIndex,
-          // Unique-per-write token. The UI's `use-navigation-state` hook
-          // dedups by this so a race between the GET and the consume-DELETE
-          // doesn't cause the same command to be re-applied repeatedly
-          // (which previously bounced the editor between slides whenever the
-          // agent path errored partway through a turn).
-          _writeId: `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
-        }).catch(() => {});
-      }
-
       // Wait briefly for the editor to render the new slide and report its
       // measured fit. If we get an "overflows" signal, append the auto-fix
       // hint so the agent can make one bounded structural repair. Timeout = no