@agent-native/core 0.154.4 → 0.155.0

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,9 +75,11 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    deleted?: undefined;
     id?: undefined;
     provider?: undefined;
+    deleted?: undefined;
+    found?: undefined;
+    message?: undefined;
     providers: {
         id: string;
         label: string;
@@ -88,46 +90,44 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    found?: undefined;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    deleted?: undefined;
     id?: undefined;
+    deleted?: undefined;
+    message?: undefined;
     providers?: undefined;
     count?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    deleted?: undefined;
     provider?: undefined;
+    deleted?: undefined;
+    message?: undefined;
     providers?: undefined;
     count?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
     provider?: undefined;
+    found?: undefined;
+    message?: undefined;
     providers?: undefined;
     count?: undefined;
-    found?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    deleted?: undefined;
     provider?: undefined;
+    deleted?: undefined;
+    found?: undefined;
     providers?: undefined;
     count?: undefined;
-    found?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,9 +311,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        message?: undefined;
         id?: undefined;
-        deleted?: undefined;
+        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -325,45 +324,46 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         }[];
         count: number;
         provider?: undefined;
-        found?: undefined;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        count?: undefined;
+    } | {
         id?: undefined;
-        deleted?: undefined;
         providers?: undefined;
+        count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        count?: undefined;
-        deleted?: undefined;
+    } | {
         providers?: undefined;
+        count?: undefined;
         provider?: undefined;
         found: boolean;
         id: string;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        count?: undefined;
+    } | {
+        found?: undefined;
         providers?: undefined;
+        count?: undefined;
         provider?: undefined;
-        found?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        count?: undefined;
-        deleted?: undefined;
+        found?: undefined;
         providers?: undefined;
+        count?: undefined;
         provider?: undefined;
-        found?: undefined;
+        deleted?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/resources/agents.js

@@ -1,5 +1,35 @@
-import { parseCustomAgentProfile, } from "./metadata.js";
+import { getResourceKind, parseCustomAgentProfile, } from "./metadata.js";
 import { resourceGet, resourceGetByPath, resourceListAccessible, SHARED_OWNER, } from "./store.js";
+function metadataFields(metadata) {
+    if (!metadata)
+        return {};
+    try {
+        const parsed = JSON.parse(metadata);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : null;
+        // coercion-ok: malformed resource metadata is absent, not a valid profile field
+    }
+    catch (_error) {
+        return null;
+    }
+}
+async function enrichAgentProfile(owner, profile, accessibleResources) {
+    const root = profile.path.replace(/\.md$/i, "");
+    const resources = accessibleResources ?? (await resourceListAccessible(owner, `${root}/`));
+    const workspace = resources.map((resource) => {
+        const metadata = metadataFields(resource.metadata) ?? {};
+        return {
+            path: resource.path,
+            kind: getResourceKind(resource.path),
+            name: typeof metadata.name === "string" ? metadata.name : undefined,
+            description: typeof metadata.description === "string"
+                ? metadata.description
+                : undefined,
+        };
+    });
+    return { ...profile, workspace: { root, resources: workspace } };
+}
 export async function listAccessibleCustomAgents(owner) {
     const resources = await resourceListAccessible(owner, "agents/");
     const profiles = await Promise.all(resources
@@ -8,9 +38,14 @@ export async function listAccessibleCustomAgents(owner) {
         const full = await resourceGet(resource.id);
         if (!full)
             return null;
-        return parseCustomAgentProfile(full.content, resource.path);
+        const profile = parseCustomAgentProfile(full.content, resource.path);
+        return profile;
+    }));
+    const validProfiles = profiles.filter((profile) => !!profile);
+    return Promise.all(validProfiles.map((profile) => {
+        const root = `${profile.path.replace(/\.md$/i, "")}/`;
+        return enrichAgentProfile(owner, profile, resources.filter((resource) => resource.path.startsWith(root)));
     }));
-    return profiles.filter((profile) => !!profile);
 }
 export async function findAccessibleCustomAgent(owner, identifier) {
     const trimmed = identifier.trim();
@@ -26,13 +61,13 @@ export async function findAccessibleCustomAgent(owner, identifier) {
         if (personal) {
             const profile = parseCustomAgentProfile(personal.content, personal.path);
             if (profile)
-                return profile;
+                return enrichAgentProfile(owner, profile);
         }
         const shared = await resourceGetByPath(SHARED_OWNER, path);
         if (shared) {
             const profile = parseCustomAgentProfile(shared.content, shared.path);
             if (profile)
-                return profile;
+                return enrichAgentProfile(owner, profile);
         }
     }
     const lower = trimmed.toLowerCase();

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/resources/metadata.d.ts

@@ -11,6 +11,12 @@ export interface SkillMetadata {
     name: string;
     description?: string;
 }
+export interface AgentWorkspaceResource {
+    path: string;
+    kind: ResourceKind;
+    name?: string;
+    description?: string;
+}
 export interface CustomAgentProfile {
     id: string;
     path: string;
@@ -21,6 +27,10 @@ export interface CustomAgentProfile {
     color?: string;
     delegateDefault?: boolean;
     instructions: string;
+    workspace?: {
+        root: string;
+        resources: AgentWorkspaceResource[];
+    };
 }
 export interface RemoteAgentManifest {
     id: string;

package/dist/resources/metadata.js

@@ -81,15 +81,19 @@ export function frontmatterFieldsToObject(frontmatter) {
     return Object.fromEntries(frontmatter?.fields.map((f) => [f.key, f.value]) ?? []);
 }
 export function isSkillPath(path) {
-    if (!path.startsWith("skills/") || !path.endsWith(".md"))
+    const prefix = path.startsWith("skills/")
+        ? "skills/"
+        : path.match(/^agents\/[^/]+\/skills\//)?.[0];
+    if (!prefix || !path.endsWith(".md"))
         return false;
-    const relative = path.replace(/^skills\//, "");
+    const relative = path.slice(prefix.length);
     return (relative.endsWith("/SKILL.md") ||
         (relative.endsWith(".md") && !relative.includes("/")));
 }
 export function getSkillNameFromPath(path) {
     const relative = path
         .replace(/^\.agents\/skills\//, "")
+        .replace(/^agents\/[^/]+\/skills\//, "")
         .replace(/^skills\//, "");
     if (relative.endsWith("/SKILL.md")) {
         return (relative
@@ -103,7 +107,7 @@ export function isJobPath(path) {
     return path.startsWith("jobs/") && path.endsWith(".md");
 }
 export function isCustomAgentPath(path) {
-    return path.startsWith("agents/") && path.endsWith(".md");
+    return /^agents\/[^/]+\.md$/.test(path);
 }
 export function isRemoteAgentPath(path) {
     return (path.endsWith(".json") &&

package/dist/review/actions/create-review-comment.js

@@ -32,7 +32,7 @@ const schema = z.object({
     metadata: z.record(z.string(), z.unknown()).optional(),
 });
 export default defineAction({
-    description: "Create an inline comment, annotation, or review thread for a resource.",
+    description: "Create an inline comment, annotation, or review thread for a resource. Body text supports inline Markdown without headings.",
     schema,
     run: async (args, ctx) => {
         const actionCtx = ctx;

package/dist/review/actions/reply-review-comment.js

@@ -21,7 +21,7 @@ const schema = z.object({
     metadata: z.record(z.string(), z.unknown()).optional(),
 });
 export default defineAction({
-    description: "Reply to an existing review comment thread.",
+    description: "Reply to an existing review comment thread with inline Markdown text without headings.",
     schema,
     run: async (args, ctx) => {
         const actionCtx = ctx;

package/dist/review/actions/resolve-review-thread.js

@@ -10,7 +10,7 @@ const schema = z.object({
     resolutionNote: z.string().trim().min(1).max(2_000).optional(),
 });
 export default defineAction({
-    description: "Resolve an inline comment or review thread.",
+    description: "Resolve an inline comment or review thread. An optional resolution note supports inline Markdown without headings.",
     schema,
     run: async (args, ctx) => {
         const actionCtx = ctx;

package/dist/server/action-routes.js

@@ -1,6 +1,7 @@
 import { createError, defineEventHandler, setResponseStatus, setResponseHeader, getMethod, getQuery, getHeader, getRequestURL, } from "h3";
 import { verifyA2ATokenWithClaims } from "../a2a-claims.js";
-import { isAgentActionStopError } from "../action.js";
+import { isActionContractError, isAgentActionStopError } from "../action.js";
+import { isTransientDatabaseError } from "../db/client.js";
 import { declaresFeatureFlagDelegation } from "../feature-flags/a2a-action-route.js";
 import { resolveOrgByDomain, resolveOrgIdForEmail } from "../org/context.js";
 import { readBody } from "../server/h3-helpers.js";
@@ -177,6 +178,34 @@ function normalizeOrgId(value) {
         ? value.trim()
         : undefined;
 }
+function isFirstBootMissingOrgTableError(error) {
+    if (!(error instanceof Error))
+        return false;
+    return (/no such table:?\s*["'`]?org_members["'`]?/i.test(error.message) ||
+        /relation\s+["'`]?org_members["'`]?\s+does not exist/i.test(error.message));
+}
+/**
+ * The user's stored active org, for a request whose own org resolution came
+ * back empty. An empty `orgId` is not "this user has no org": it silently
+ * narrows every scoped read to rows with a null `org_id`, so a session minted
+ * before org selection — or one whose membership read failed — stops seeing
+ * the user's own org-scoped dashboards, credentials, and resources. This
+ * honors an explicit Personal selection by returning undefined, so it can
+ * never promote a user into an org they left. A transient database failure is
+ * not an answer and propagates.
+ */
+async function storedActiveOrgId(email) {
+    try {
+        return normalizeOrgId(await resolveOrgIdForEmail(email));
+    }
+    catch (error) {
+        if (isTransientDatabaseError(error) ||
+            !isFirstBootMissingOrgTableError(error)) {
+            throw error;
+        }
+        return undefined;
+    }
+}
 function isAuthResolutionFailure(error) {
     if (!error || typeof error !== "object")
         return false;
@@ -344,18 +373,15 @@ export function mountActionRoutes(nitroApp, actions, options) {
             if (resolvedCaller) {
                 orgId = normalizeOrgId(resolvedCaller.orgId);
                 if (!orgId && resolvedCaller.owner && !resolvedCaller.anonymous) {
-                    try {
-                        orgId = normalizeOrgId(await resolveOrgIdForEmail(resolvedCaller.owner));
-                    }
-                    catch {
-                        // Org tables may not exist yet on first boot.
-                    }
+                    orgId = await storedActiveOrgId(resolvedCaller.owner);
                 }
             }
             else {
                 orgId = options?.resolveOrgId
                     ? ((await options.resolveOrgId(event)) ?? undefined)
                     : undefined;
+                if (!orgId && userEmail)
+                    orgId = await storedActiveOrgId(userEmail);
             }
             const timezone = readTimezoneHeader(event);
             const browserSessionId = readBrowserSessionIdHeader(event);
@@ -507,7 +533,15 @@ export function mountActionRoutes(nitroApp, actions, options) {
                         isAgentActionStopError(err) ||
                         (explicitStatus !== undefined && explicitStatus < 500);
                     if (isUserFacing) {
-                        return { error: msg };
+                        return isActionContractError(err)
+                            ? {
+                                error: msg,
+                                errorCode: err.errorCode,
+                                ...(err.details === undefined
+                                    ? {}
+                                    : { details: err.details }),
+                            }
+                            : { error: msg };
                     }
                     const requestId = getHttpRequestTelemetryId(event);
                     const captureId = captureError(err, {

package/dist/server/agent-discovery.js

@@ -214,11 +214,22 @@ export async function discoverAgents(selfAppId, options) {
     }
     // Overlay custom agents from resources
     try {
-        const { resourceList, resourceGet, SHARED_OWNER } = await import("../resources/store.js");
+        const { resourceList, resourceGet, SHARED_OWNER, sharedResourceOwner } = await import("../resources/store.js");
         const { parseRemoteAgentManifest, REMOTE_AGENT_RESOURCE_PREFIXES } = await import("../resources/metadata.js");
+        const activeOwner = sharedResourceOwner(getRequestOrgId());
+        const owners = [...new Set([SHARED_OWNER, activeOwner])];
         const resources = [];
-        for (const prefix of [...REMOTE_AGENT_RESOURCE_PREFIXES].reverse()) {
-            resources.push(...(await resourceList(SHARED_OWNER, prefix)));
+        const seenResources = new Set();
+        for (const owner of owners) {
+            for (const prefix of [...REMOTE_AGENT_RESOURCE_PREFIXES].reverse()) {
+                for (const resource of await resourceList(owner, prefix)) {
+                    const resourceKey = `${owner}\0${resource.id}`;
+                    if (seenResources.has(resourceKey))
+                        continue;
+                    seenResources.add(resourceKey);
+                    resources.push(resource);
+                }
+            }
         }
         for (const r of resources) {
             if (!r.path.endsWith(".json"))

package/dist/server/core-routes-plugin.js

@@ -624,7 +624,7 @@ function isAgentNativeAnonymousOwner(email) {
     return /^anon-[^@]+@agent-native\.com$/i.test(email ?? "");
 }
 export async function resolveBuilderOwnerContextForRequest(event, options = {}, mode) {
-    const searchParams = getRequestURL(event).searchParams;
+    const searchParams = getFrameworkRouteRequestUrl(event).searchParams;
     const signedOwner = mode === "connect"
         ? verifyBuilderConnectTokenAndGetOwner(searchParams.get(BUILDER_CONNECT_PARAM))
         : mode === "callback"

package/dist/server/identity-sso-migrations.d.ts

@@ -0,0 +1,7 @@
+import type { MigrationEntry } from "../db/migrations.js";
+/**
+ * Cross-app SSO state belongs to every app that can receive a callback. Keep
+ * these tables in the framework release migration so production serverless
+ * requests never need to create schema before starting a login.
+ */
+export declare const IDENTITY_SSO_MIGRATIONS: MigrationEntry[];

package/dist/server/identity-sso-migrations.js

@@ -0,0 +1,36 @@
+/**
+ * Cross-app SSO state belongs to every app that can receive a callback. Keep
+ * these tables in the framework release migration so production serverless
+ * requests never need to create schema before starting a login.
+ */
+export const IDENTITY_SSO_MIGRATIONS = [
+    {
+        version: 1,
+        name: "identity-sso-flow-state-and-jti",
+        sql: `
+      CREATE TABLE IF NOT EXISTS identity_sso_flow_state (
+        state TEXT PRIMARY KEY,
+        return_path TEXT,
+        app_id TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        redirect_uri TEXT NOT NULL,
+        authority TEXT NOT NULL,
+        code_challenge TEXT NOT NULL,
+        created_at INTEGER,
+        expires_at INTEGER,
+        consumed_at INTEGER
+      );
+
+      CREATE INDEX IF NOT EXISTS identity_sso_flow_state_expires_idx
+        ON identity_sso_flow_state (expires_at);
+
+      CREATE TABLE IF NOT EXISTS identity_sso_jti (
+        jti TEXT PRIMARY KEY,
+        seen_at INTEGER
+      );
+
+      CREATE INDEX IF NOT EXISTS identity_sso_jti_seen_idx
+        ON identity_sso_jti (seen_at);
+    `,
+    },
+];

package/dist/server/identity-sso-store.d.ts

@@ -11,8 +11,9 @@
  *     server-to-server assertions, including identity SSO and privileged A2A
  *     mutations.
  *
- * Uses the same portable raw-SQL pattern as the other framework stores. DDL is
- * additive and lazy, and PostgreSQL creation goes through the DDL guard.
+ * Uses the same portable raw-SQL pattern as the other framework stores. Local
+ * development may initialize these tables lazily; production release
+ * migrations own their creation before serverless requests are served.
  */
 export declare const SSO_STATE_TTL_MS: number;
 export declare const SSO_LOGIN_MAX = 60;

package/dist/server/identity-sso-store.js

@@ -11,11 +11,12 @@
  *     server-to-server assertions, including identity SSO and privileged A2A
  *     mutations.
  *
- * Uses the same portable raw-SQL pattern as the other framework stores. DDL is
- * additive and lazy, and PostgreSQL creation goes through the DDL guard.
+ * Uses the same portable raw-SQL pattern as the other framework stores. Local
+ * development may initialize these tables lazily; production release
+ * migrations own their creation before serverless requests are served.
  */
 import { randomBytes } from "node:crypto";
-import { getDbExec, intType, isConnectionError, isPostgres, } from "../db/client.js";
+import { getDbExec, intType, isConnectionError, isPostgres, isProductionServerlessFunctionRuntime, } from "../db/client.js";
 import { ensureTableExists } from "../db/ddl-guard.js";
 let _initPromise;
 const DESKTOP_SSO_CANARY_USER_AGENT = /AgentNativeDesktopSsoCanary\//i;
@@ -138,6 +139,10 @@ function buildIdentitySsoJtiCreateSql() {
       `;
 }
 async function ensureTable() {
+    // Release migrations own schema in production serverless functions. A
+    // request must not turn a missing migration into request-time DDL.
+    if (isProductionServerlessFunctionRuntime())
+        return;
     if (!_initPromise) {
         _initPromise = (async () => {
             const flowStateSql = buildIdentitySsoFlowStateCreateSql();

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/release-migrations.js

@@ -7,6 +7,7 @@ import { runAutomationSchedulerHealthMigrations } from "../jobs/scheduler-health
 import { OAUTH_TOKEN_MIGRATIONS, OAUTH_TOKEN_MIGRATIONS_TABLE, } from "../oauth-tokens/migrations.js";
 import { ORG_MIGRATIONS } from "../org/migrations.js";
 import { runBetterAuthMigrations } from "./better-auth-migrations.js";
+import { IDENTITY_SSO_MIGRATIONS } from "./identity-sso-migrations.js";
 /**
  * Apply framework-owned schema in one explicit release step.
  *
@@ -23,6 +24,9 @@ export async function runFrameworkReleaseMigrations(nitroApp) {
         table: OAUTH_TOKEN_MIGRATIONS_TABLE,
     })(nitroApp);
     await runMigrations(ORG_MIGRATIONS, { table: "_org_migrations" })(nitroApp);
+    await runMigrations(IDENTITY_SSO_MIGRATIONS, {
+        table: "_identity_sso_migrations",
+    })(nitroApp);
     await runMigrations(CONTEXT_XRAY_MIGRATIONS, {
         table: "_context_xray_migrations",
     })(nitroApp);

package/dist/tracking/providers.js

@@ -257,6 +257,18 @@ function createMixpanelProvider(token) {
     };
 }
 // ─── Amplitude ─────────────────────────────────────────────────────────────
+function stripExceptionContextForAmplitude(properties) {
+    const { exceptionTags: _exceptionTags, exceptionExtra: _exceptionExtra, ...stableProperties } = properties;
+    return stableProperties;
+}
+function amplitudeEventProperties(event) {
+    const properties = event.name === "$exception" && event.properties
+        ? stripExceptionContextForAmplitude(event.properties)
+        : event.properties;
+    if (!event.sessionId)
+        return properties;
+    return { ...(properties ?? {}), session_id: event.sessionId };
+}
 function createAmplitudeProvider(apiKey) {
     return {
         name: "amplitude",
@@ -269,9 +281,7 @@ function createAmplitudeProvider(apiKey) {
                         user_id: event.userId || "anonymous",
                         // Amplitude's top-level `session_id` must be a numeric epoch, so
                         // the browser session ships as an event property instead.
-                        event_properties: event.sessionId
-                            ? { ...event.properties, session_id: event.sessionId }
-                            : event.properties,
+                        event_properties: amplitudeEventProperties(event),
                         time: event.timestamp
                             ? new Date(event.timestamp).getTime()
                             : undefined,

package/dist/workspace-files/tool.js

@@ -34,7 +34,7 @@ export function createWorkspaceFilesTool() {
                     "Use scratch/... for temporary intermediate results; scratch files are hidden from the Resources view by default and expire. Use durable folder names for files the user explicitly wants to keep/manage.",
                     "Use this to stage large intermediate results (fetched pages, per-item analysis memos, API payloads) so they don't consume context window, then read them back selectively for synthesis.",
                     "",
-                    "Typical fusion-style workflow:",
+                    "Typical staged-analysis workflow:",
                     "  1. Fan out: for each item, fetch data and `write` a per-item memo file.",
                     "  2. Synthesize: `list` files, then `read` each memo (with offset/maxChars to page large ones).",
                     "  3. Optionally `grep` across all memos to find patterns.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.154.4",
+  "version": "0.155.0",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -116,6 +116,7 @@
     "./client/automation": "./dist/client/automation/index.js",
     "./client/chat": "./dist/client/chat/index.js",
     "./client/changelog": "./dist/client/changelog/index.js",
+    "./client/markdown": "./dist/client/markdown/index.js",
     "./client/collab": "./dist/client/collab/index.js",
     "./client/composer": "./dist/client/composer/index.js",
     "./client/conversation": "./dist/client/conversation/index.js",
@@ -423,7 +424,7 @@
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
     "@agent-native/recap-cli": "0.5.4",
-    "@agent-native/toolkit": "^0.14.2"
+    "@agent-native/toolkit": "^0.14.3"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",