@agent-native/core 0.154.5 → 0.157.0

package/corpus/templates/clips/server/routes/api/public-meeting.get.ts

@@ -6,7 +6,11 @@
  * of that share and is omitted unless the meeting owner enables it.
  */
 
-import { getSession, runWithRequestContext } from "@agent-native/core/server";
+import {
+  getSession,
+  runWithRequestContext,
+  verifyScopedAgentAccessToken,
+} from "@agent-native/core/server";
 import { resolveAccess } from "@agent-native/core/sharing";
 import { eq } from "drizzle-orm";
 import {
@@ -16,6 +20,10 @@ import {
   setResponseStatus,
 } from "h3";
 
+import {
+  CLIPS_MEETING_AGENT_ACCESS_PARAM,
+  CLIPS_MEETING_AGENT_RESOURCE_KIND,
+} from "../../../shared/meeting-agent-access.js";
 import {
   normalizeTranscriptSegments,
   parseTranscriptSegments,
@@ -43,17 +51,31 @@ function parseBullets(raw: string | null | undefined): Bullet[] {
   }
 }
 
+function queryString(value: unknown): string {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value) && typeof value[0] === "string") return value[0];
+  return "";
+}
+
 export default defineEventHandler(async (event) => {
   setResponseHeader(event, "Cache-Control", "private, max-age=0, no-store");
   setResponseHeader(event, "Referrer-Policy", "no-referrer");
 
   const query = getQuery(event);
-  const meetingId = typeof query.id === "string" ? query.id : "";
+  const meetingId = queryString(query.id);
   if (!meetingId) {
     setResponseStatus(event, 400);
     return { error: "id is required" };
   }
 
+  const agentAccessToken = queryString(query[CLIPS_MEETING_AGENT_ACCESS_PARAM]);
+  const tokenAccess = agentAccessToken
+    ? verifyScopedAgentAccessToken(agentAccessToken, {
+        resourceKind: CLIPS_MEETING_AGENT_RESOURCE_KIND,
+        resourceId: meetingId,
+      })
+    : null;
+
   const session = await getSession(event).catch(() => null);
   const accessContext = {
     userEmail: session?.email,
@@ -61,14 +83,25 @@ export default defineEventHandler(async (event) => {
   };
 
   return runWithRequestContext(accessContext, async () => {
-    const access = await resolveAccess("meeting", meetingId, accessContext);
+    let db: ReturnType<typeof getDb> | undefined;
+    const access = tokenAccess?.ok
+      ? await (async () => {
+          db = getDb();
+          const [resource] = await db
+            .select()
+            .from(schema.meetings)
+            .where(eq(schema.meetings.id, meetingId))
+            .limit(1);
+          return resource ? { role: "viewer" as const, resource } : null;
+        })()
+      : await resolveAccess("meeting", meetingId, accessContext);
     const meeting = access?.resource;
     if (!meeting || meeting.trashedAt) {
       setResponseStatus(event, 404);
       return { error: "Not found" };
     }
 
-    const db = getDb();
+    db ??= getDb();
     const [participants, actionItems, transcriptRows] = await Promise.all([
       db
         .select({

package/corpus/templates/clips/server/routes/api/public-recording.get.ts

@@ -58,6 +58,7 @@ import {
   parseSpaceIds,
   type RecordingVisibility,
 } from "../../lib/recordings.js";
+import { isSeekableRepairPending } from "../../lib/seekable-media-state.js";
 import { verifySharePassword } from "../../lib/share-password.js";
 
 function appPath(path: string): string {
@@ -406,11 +407,19 @@ export default defineEventHandler(async (event) => {
   // Referer of any outbound link the share page renders.
   setResponseHeader(event, "Referrer-Policy", "no-referrer");
   const transcriptPresentation = resolveTranscriptPresentation(transcript);
-  const verificationPending = await isMediaVerificationPending({
-    ownerEmail: rec.ownerEmail,
-    recordingId,
-    recordingStatus: rec.status,
-  });
+  const [verificationPending, seekableRepairPending] = await Promise.all([
+    isMediaVerificationPending({
+      ownerEmail: rec.ownerEmail,
+      recordingId,
+      recordingStatus: rec.status,
+    }),
+    isSeekableRepairPending({
+      ownerEmail: rec.ownerEmail,
+      recordingId,
+      recordingStatus: rec.status,
+      videoUrl: rec.videoUrl,
+    }),
+  ]);
 
   const [viewCount, agentViewCount] = await Promise.all([
     countRecordingViews(recordingId),
@@ -454,12 +463,14 @@ export default defineEventHandler(async (event) => {
       videoUrl: playbackVideoUrl,
       videoFormat: rec.videoFormat,
       videoSizeBytes: rec.videoSizeBytes ?? null,
+      mediaUpdatedAt: rec.mediaUpdatedAt,
       width: rec.width,
       height: rec.height,
       hasAudio: Boolean(rec.hasAudio),
       hasCamera: Boolean(rec.hasCamera),
       status: rec.status,
       verificationPending,
+      seekableRepairPending,
       uploadProgress: rec.uploadProgress,
       failureReason: rec.failureReason,
       // Don't leak the password to clients; just indicate whether one was set.

package/corpus/templates/clips/shared/clips-ai-prefs.ts

@@ -37,6 +37,9 @@ export type ClipsUserPrefs = ClipsAiPrefs & {
 /** Visibility applied to new recordings unless the creator picks another. */
 export type ClipsDefaultVisibility = "private" | "org" | "public";
 
+export const DEFAULT_CLIPS_RECORDING_VISIBILITY: ClipsDefaultVisibility =
+  "public";
+
 export function isIncludeFullVideoInAiEnabled(
   prefs: ClipsAiPrefs | Record<string, unknown> | null | undefined,
 ): boolean {

package/corpus/templates/clips/shared/meeting-agent-access.ts

@@ -0,0 +1,5 @@
+import { AGENT_ACCESS_PARAM } from "@agent-native/core/shared";
+
+export const CLIPS_MEETING_AGENT_RESOURCE_KIND = "clips:meeting";
+export const CLIPS_MEETING_AGENT_CONTEXT_ENDPOINT = "/api/public-meeting";
+export const CLIPS_MEETING_AGENT_ACCESS_PARAM = AGENT_ACCESS_PARAM;

package/corpus/templates/content/actions/add-comment.ts

@@ -44,7 +44,8 @@ function displayNameFromEmail(email: string): string {
 }
 
 export default defineAction({
-  description: "Add a comment to a document. For new threads, omit threadId.",
+  description:
+    "Add a comment to a document. Comment text supports inline Markdown for emphasis, inline code, links, and line breaks; headings are flattened. For new threads, omit threadId.",
   schema: z.object({
     documentId: z.string().optional().describe("Document ID (required)"),
     content: z.string().optional().describe("Comment text (required)"),

package/corpus/templates/content/actions/update-comment.ts

@@ -9,7 +9,7 @@ import { getDb, schema } from "../server/db/index.js";
 
 export default defineAction({
   description:
-    "Update a document comment. Resolving or reopening a comment applies to the full thread.",
+    "Update a document comment. Comment text supports inline Markdown without headings. Resolving or reopening a comment applies to the full thread.",
   schema: z.object({
     id: z.string().describe("Comment ID"),
     documentId: z.string().optional().describe("Document ID"),

package/corpus/templates/content/app/components/editor/CommentsSidebar.tsx

@@ -1,6 +1,10 @@
 import { sendToAgentChat } from "@agent-native/core/client/agent-chat";
 import { emailToName } from "@agent-native/core/client/collab";
 import { useT } from "@agent-native/core/client/i18n";
+import {
+  InlineMarkdown,
+  type InlineMarkdownProtectedSpan,
+} from "@agent-native/core/client/markdown";
 import {
   IconCheck,
   IconMessageCircle,
@@ -40,23 +44,28 @@ import { CommentComposer, type MentionEntry } from "./CommentComposer";
 
 /**
  * Render a comment body, styling any `@mention` tokens that match the comment's
- * stored mentions. Plain text otherwise — no HTML is interpreted.
+ * stored mentions. Raw HTML is never interpreted.
  */
-function renderCommentBody(content: string, mentions: CommentMention[]) {
+function commentMentionSpans(
+  mentions: CommentMention[],
+): InlineMarkdownProtectedSpan[] {
   const labels = Array.from(
     new Set(mentions.map((m) => m.name).filter((n): n is string => !!n)),
   ).sort((a, b) => b.length - a.length);
-  if (labels.length === 0) return content;
-  const escaped = labels.map((l) => l.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
-  const re = new RegExp(`(@(?:${escaped.join("|")}))`, "g");
-  return content.split(re).map((seg, i) =>
-    seg.startsWith("@") && labels.includes(seg.slice(1)) ? (
-      <span key={i} className="comment-mention">
-        {seg}
-      </span>
-    ) : (
-      seg
-    ),
+  return labels.map((label) => ({
+    source: `@${label}`,
+    label: `@${label}`,
+    className: "comment-mention",
+  }));
+}
+
+function renderCommentBody(content: string, mentions: CommentMention[]) {
+  return (
+    <InlineMarkdown
+      content={content}
+      inline
+      protectedSpans={commentMentionSpans(mentions)}
+    />
   );
 }
 
@@ -942,9 +951,9 @@ function ThreadView({
                 {formatDate(c.created_at)}
               </span>
             </div>
-            <p className="text-[13px] text-foreground/90 pl-8 leading-relaxed whitespace-pre-wrap">
+            <div className="text-[13px] text-foreground/90 pl-8 leading-relaxed">
               {renderCommentBody(c.content, c.mentions)}
-            </p>
+            </div>
           </div>
         ))}
       </div>

package/corpus/templates/design/actions/generate-design.ts

@@ -171,12 +171,15 @@ const reuseLabelSchema = z
     }
   });
 
-function hasBreakpointSet(value: unknown): boolean {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return false;
-  }
+function classifyBreakpointSet(
+  value: unknown,
+): "absent" | "malformed" | "present" {
+  if (value === null || value === undefined) return "absent";
+  if (typeof value !== "object" || Array.isArray(value)) return "malformed";
   const breakpoints = (value as { breakpoints?: unknown }).breakpoints;
-  return Array.isArray(breakpoints) && breakpoints.length > 0;
+  if (breakpoints === undefined) return "malformed";
+  if (!Array.isArray(breakpoints)) return "malformed";
+  return breakpoints.length > 0 ? "present" : "malformed";
 }
 
 function jsonValuesEqual(left: unknown, right: unknown): boolean {
@@ -1137,7 +1140,7 @@ const generateDesignAction = defineAction({
           mergedData.breakpointSetUpdatedAt = updatedAt;
         } else if (
           generatedBreakpointSet.length > 0 &&
-          !hasBreakpointSet(mergedData.breakpointSet)
+          classifyBreakpointSet(mergedData.breakpointSet) === "absent"
         ) {
           mergedData.breakpointSet = {
             id: "generated-responsive",
@@ -1200,7 +1203,7 @@ const generateDesignAction = defineAction({
           devices && devices.length > 0
             ? jsonValuesEqual(currentBreakpointWidths, expectedBreakpointWidths)
             : generatedBreakpointSet.length === 0 ||
-              hasBreakpointSet(current.breakpointSet);
+              classifyBreakpointSet(current.breakpointSet) !== "absent";
         return framesApplied && breakpointSetApplied;
       },
     });

package/corpus/templates/design/actions/present-design-variants.ts

@@ -89,12 +89,25 @@ async function hasLinkedDesignSystem(designId: string): Promise<boolean> {
   return Boolean(design?.designSystemId?.trim());
 }
 
-function hasBreakpointSet(value: unknown): boolean {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return false;
-  }
+/**
+ * Absent, or present but unreadable — the caller must not treat these alike.
+ * A malformed set is still the user's data: overwriting it with the generated
+ * default silently discards breakpoints they configured, so it reports
+ * `"malformed"` and the install is skipped rather than clobbering it.
+ */
+function classifyBreakpointSet(
+  value: unknown,
+): "absent" | "malformed" | "present" {
+  if (value === null || value === undefined) return "absent";
+  if (typeof value !== "object" || Array.isArray(value)) return "malformed";
   const breakpoints = (value as { breakpoints?: unknown }).breakpoints;
-  return Array.isArray(breakpoints) && breakpoints.length > 0;
+  if (breakpoints === undefined) return "malformed";
+  if (!Array.isArray(breakpoints)) return "malformed";
+  return breakpoints.length > 0 ? "present" : "malformed";
+}
+
+function hasBreakpointSet(value: unknown): boolean {
+  return classifyBreakpointSet(value) === "present";
 }
 
 function designDeepLink(designId: string): string {
@@ -1042,9 +1055,16 @@ export default defineAction({
       });
     }
 
+    // Presenting options should not silently reconfigure the design. When it
+    // does, the overview paints an extra preview beside EVERY primary frame
+    // from then on — including screens created later — so the caller is told.
+    let installedBreakpointSet = false;
+
     await mutateDesignData({
       designId,
       mutate: (current, { updatedAt }) => {
+        installedBreakpointSet =
+          classifyBreakpointSet(current.breakpointSet) === "absent";
         // Placement depends on the breakpoint set in effect after this call, so
         // it is resolved here (inside the compare-and-set body) rather than
         // against a design snapshot that a concurrent write may have moved on
@@ -1106,7 +1126,9 @@ export default defineAction({
           canvasFrames: mergedFrames.canvasFrames,
           screenMetadata: previousMetadata,
           designVariantSets: previousVariantSets,
-          ...(hasBreakpointSet(current.breakpointSet)
+          // Only when genuinely absent. A malformed set is the user's data in
+          // a shape this action cannot read, not a blank slate to overwrite.
+          ...(classifyBreakpointSet(current.breakpointSet) !== "absent"
             ? {}
             : {
                 breakpointSet: {
@@ -1227,6 +1249,13 @@ export default defineAction({
       embed: true,
       cleanedUpPreviousVariantScreens: variantSetCleanup.removedFileIds.length,
       deletedSupersededSetIds: variantSetCleanup.removedSetIds,
+      ...(installedBreakpointSet
+        ? {
+            installedBreakpointSet: DEFAULT_RESPONSIVE_BREAKPOINTS.map(
+              (breakpoint) => breakpoint.widthPx,
+            ),
+          }
+        : {}),
       fallbackInstructions: FALLBACK_INSTRUCTIONS,
       nextRequiredAction:
         'Wait for the user to pick a screen in chat. Then delete each unchosen variant screen with delete-file at most once, call get-design-snapshot exactly once with fileId for the chosen screen, and call edit-design with that same fileId in a bounded pass. Use mode "replace-file" to replace the representative direction screen with a complete but compact requested app/product UI in the chosen visual style. Prioritize the primary workflow and render secondary details as visible controls, states, or affordances if the full feature list is too large for one reliable edit. Do not leave a direction board, variant brief, or summary card as the final result. Do not repeat delete/snapshot cycles. Do not call generate-design after a variant pick. Stop after the first successful edit-design save.',

package/corpus/templates/design/actions/run-design-audit.ts

@@ -25,6 +25,10 @@ import type {
   A11yFindingCategory,
   A11ySeverity,
 } from "../shared/design-review.js";
+import {
+  describeDesignHtmlIntegrityIssue,
+  inspectDesignHtmlDocumentIntegrity,
+} from "../shared/html-integrity.js";
 
 // ---------------------------------------------------------------------------
 // HTML helpers (static analysis — no DOM runtime available server-side)
@@ -259,6 +263,34 @@ export function checkTapTargets(html: string): A11yFinding[] {
   return findings;
 }
 
+/**
+ * Screens that render with an Alpine-controlled element covering them. Every
+ * other check here is a regex over the raw string; this one delegates to the
+ * save-time integrity parser so the audit and the write gate cannot drift into
+ * disagreeing about the same document. It is the only check that can see the
+ * failure a screenshot cannot: `take-design-screenshot` waits for Alpine to
+ * settle, so a pre-Alpine cover never appears in the agent's own capture.
+ */
+export function checkRenderBlockingOverlays(html: string): A11yFinding[] {
+  const result = inspectDesignHtmlDocumentIntegrity(html);
+  const issues = [...(result.detail ?? []), ...(result.advisory ?? [])].filter(
+    (issue) =>
+      issue.issue === "runtime-overlay-unhidden" ||
+      issue.issue === "runtime-cloak-missing" ||
+      issue.issue === "runtime-alpine-missing",
+  );
+
+  return issues.map((issue, index) => ({
+    id: `render-blocking-overlay:${issue.issue}-${index}`,
+    severity: "error" as A11ySeverity,
+    category: "render-blocking-overlay" as A11yFindingCategory,
+    message:
+      "An Alpine-controlled element can cover the screen before Alpine starts.",
+    detail: describeDesignHtmlIntegrityIssue(issue),
+    fixAvailable: false,
+  }));
+}
+
 /** Check for animations/transitions without a prefers-reduced-motion guard. */
 function checkReducedMotion(html: string): A11yFinding[] {
   const findings: A11yFinding[] = [];
@@ -848,6 +880,7 @@ export default defineAction({
       ...checkReducedMotion(html),
       ...checkFocusVisibility(html),
       ...checkContrastHint(html),
+      ...checkRenderBlockingOverlays(html),
       ...tokenDriftFindings,
       ...designSystemFindings,
     ];

package/corpus/templates/design/changelog/2026-08-13-the-design-audit-now-catches-a-screen-that-renders-behind-an.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-08-13
+---
+
+The design audit now catches a screen that renders behind a full-frame Alpine overlay — the failure a screenshot cannot show, because the capture waits for Alpine to settle and the overlay is gone by then.

package/corpus/templates/design/shared/design-review.ts

@@ -25,6 +25,7 @@ export const A11Y_FINDING_CATEGORIES = [
   "role",
   "token-drift",
   "design-system-drift",
+  "render-blocking-overlay",
   "other",
 ] as const;
 

package/corpus/templates/design/shared/html-integrity.ts

@@ -34,6 +34,7 @@ export type DesignHtmlIntegrityIssue =
   | "runtime-missing"
   | "runtime-alpine-missing"
   | "runtime-cloak-missing"
+  | "runtime-overlay-unhidden"
   | "url-backed-screen-replaced";
 
 /**
@@ -153,6 +154,14 @@ export function describeDesignHtmlIntegrityIssue(
         `but no script source contains Alpine.js. The element will remain ` +
         `hidden forever; load Alpine.js before relying on x-cloak.`
       );
+    case "runtime-overlay-unhidden":
+      return (
+        `<${detail.tag ?? "element"}> at ${at} covers the whole frame and is ` +
+        `shown by Alpine (${detail.attribute ?? "x-show"}), but nothing hides ` +
+        `it before Alpine starts. It paints over the design on first render. ` +
+        `Add x-cloak plus [x-cloak] { display: none !important; }, or an ` +
+        `inline style="display:none".`
+      );
     case "runtime-cloak-missing":
       return (
         `the document uses x-cloak on <${detail.tag ?? "element"}> at ${at}, ` +
@@ -1175,6 +1184,53 @@ function collectInteractiveRuntimeIssues(
   ];
 }
 
+/**
+ * Covers the frame when it is taken out of flow AND stretched to every edge.
+ * `fixed` alone is a toolbar; `inset-0` alone is a normal filled parent.
+ */
+function coversViewport(className: string): boolean {
+  const classes = new Set(className.split(/\s+/));
+  const positioned = classes.has("fixed") || classes.has("absolute");
+  const fullBleed =
+    classes.has("inset-0") ||
+    (classes.has("w-screen") && classes.has("h-screen"));
+  return positioned && fullBleed;
+}
+
+/**
+ * The shape the `x-cloak` checks above cannot see. An overlay toggled by
+ * `x-show` with no `x-cloak` at all paints over the design until Alpine
+ * evaluates the expression — the same symptom, minus the attribute that makes
+ * it detectable. Advisory rather than blocking: with Alpine healthy this is one
+ * frame, and a genuinely broken runtime is already caught above.
+ *
+ * `<template x-if>` is deliberately not checked: template content is inert
+ * until Alpine clones it, so it cannot paint early.
+ */
+function collectOverlayAdvisory(
+  parsed: ParsedDocument,
+  locate: Locator,
+): DesignHtmlIntegrityIssueDetail[] {
+  for (const element of parsed.elements) {
+    const names = new Set(
+      element.attrs.map((attribute) => attribute.name.toLowerCase()),
+    );
+    if (names.has("x-cloak") || !names.has("x-show")) continue;
+    if (!coversViewport(attributeOf(element, "class") ?? "")) continue;
+    if (INLINE_PRE_HIDE.test(attributeOf(element, "style") ?? "")) continue;
+
+    return [
+      {
+        issue: "runtime-overlay-unhidden",
+        ...locate(locationOf(element)?.startOffset ?? 0),
+        tag: element.tagName,
+        attribute: "x-show",
+      },
+    ];
+  }
+  return [];
+}
+
 /**
  * Reported, never enforced: legitimate fragments and token-only screens carry no
  * runtime of their own, so blocking here would reject valid work.
@@ -1182,6 +1238,16 @@ function collectInteractiveRuntimeIssues(
 function collectAdvisoryIssues(
   parsed: ParsedDocument,
   locate: Locator,
+): DesignHtmlIntegrityIssueDetail[] {
+  return [
+    ...collectOverlayAdvisory(parsed, locate),
+    ...collectTailwindRuntimeAdvisory(parsed, locate),
+  ];
+}
+
+function collectTailwindRuntimeAdvisory(
+  parsed: ParsedDocument,
+  locate: Locator,
 ): DesignHtmlIntegrityIssueDetail[] {
   // Only documents that actually depend on utility classes can be broken by a
   // missing runtime. A screen styled entirely through its own CSS needs no

package/corpus/templates/dispatch/.env.example

@@ -43,6 +43,11 @@
 # App URL (used for webhook callback construction)
 # APP_URL=https://your-app.example.com
 
+# Optional exact registry for custom workspace apps that opt into Desktop SSO.
+# Each entry must declare appId, clientId, an exact HTTPS origin, callbackPath
+# "/_agent-native/identity/callback", and the "identity-sso" capability.
+# IDENTITY_SSO_APP_REGISTRY_JSON=
+
 # Builder-backed app creation in production
 # DISPATCH_BUILDER_PROJECT_ID=   # Default Builder project for new app branches
 # BUILDER_PUBLIC_KEY=            # Builder space/public key

package/corpus/templates/dispatch/AGENTS.md

@@ -13,10 +13,9 @@ Read the relevant skill before deeper work:
 
 ## Core Rules
 
-- Store large file/blob payloads in configured file/blob storage, not SQL: no
-  base64, `data:` URLs, images, video/audio, PDFs, ZIPs, screenshots,
-  thumbnails, or replay chunks in app tables, `application_state`, `settings`,
-  or `resources`; persist URLs, ids, or handles instead.
+- Store large file/blob payloads in configured file/blob storage, not SQL:
+  persist URLs, ids, or handles instead of base64, media, documents, archives,
+  screenshots, thumbnails, or replay chunks.
 - Never hardcode API keys, tokens, webhook URLs, signing secrets, private Builder/internal data, customer data, or credential-looking literals. Use secrets/OAuth/runtime configuration and obvious placeholders in examples.
 - Treat Dispatch as workspace infrastructure. Prefer actions over raw SQL for
   vault, integrations, resource grants, messaging, routing, and approvals.
@@ -32,13 +31,22 @@ Read the relevant skill before deeper work:
   values or silently widen app access while doing this.
 - Use `view-screen` when the current integration, resource, approval, route, or
   setup item is unclear.
-- Dispatch keeps its primary navigation focused on Overview, Chat, Apps, and
-  the workspace app rail. Workspace management and operator tools live under
-  the top-level `/admin` control plane, which uses grouped navigation for
-  `/admin/operations`, `/admin/metrics`, `/admin/integrations`, `/admin/vault`,
-  `/admin/automations`, `/admin/approvals`, `/admin/destinations`,
-  `/admin/agents`, `/admin/workspace`, `/admin/messaging`, `/admin/identities`,
-  `/admin/audit`, `/admin/dreams`, and `/admin/thread-debug`.
+- Use `import-agent` to normalize safe Claude Markdown or JSON into an
+  `agents/<slug>.md` profile; it skips credentials, hooks, shell, and local env.
+- Use `import-agent-pack` for a Claude Project/Cowork-style folder. It keeps the
+  runnable profile at `agents/<slug>.md` and stores text references, context,
+  and agent-owned skills below `agents/<slug>/`. Use `list-agent-pack` to
+  inspect the files and the shared agent pack UI to edit them.
+- Use `connect-external-agent` for public HTTP/A2A metadata; authenticate through
+  the normal connection flow.
+- Dispatch's primary nav is Overview, Chat, Apps, Agents, and the app rail.
+  `/agents` creates/imports reusable profiles, opens per-agent chat, and can
+  hand a profile off to app creation; `/admin/agents` manages technical MCP/A2A
+  connections; other workspace/operator tools live under `/admin`.
+- Agent profiles and agentic apps are also managed from Factory's top-level
+  Agents tab. Factory embeds the same agent actions and pack editor and reads
+  mounted app metadata through the shared Dispatch database; it does not create
+  a second agent registry.
 - Keep approval and routing behavior explicit. Never silently widen access to
   secrets, apps, integrations, or workspace resources.
 - Curated workspace templates are private app sources. Use
@@ -65,15 +73,12 @@ Read the relevant skill before deeper work:
   preserve the returned per-source health instead of treating an unavailable
   source as zero failures.
 - For a Slack-linked issue, call `read-slack-thread-context` with the exact
-  permalink before diagnosing it. It resolves child links to the parent thread,
-  preserves attachments and related URLs, and reports whether pagination is
-  complete. Never treat an unreadable Slack thread as an empty one.
+  permalink before diagnosing it; preserve its pagination and readability
+  status instead of treating an unreadable thread as empty.
 - For usage investigations, use `list-dispatch-usage-metrics` with the smallest
-  useful scope (`me` or `workspace`), lookback, and optional `userEmail` filter.
-  Treat prompt attribution as evidence with gaps: `not-captured` and
-  `unavailable` are not zero usage or a reason to guess. Use `view-screen` on
-  `/admin/metrics` to keep the agent's analysis aligned with the visible scope
-  and selected user.
+  useful scope and lookback. Treat `not-captured` and `unavailable` attribution
+  as gaps, not zero usage; use `view-screen` on `/admin/metrics` to align with
+  the visible scope and selected user.
 
 ## Application State