@agent-native/core 0.157.20 → 0.157.21

package/corpus/templates/analytics/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/assets/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/brain/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/calendar/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/chat/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/clips/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/content/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/crm/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/design/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/dispatch/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/factory/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/forms/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/macros/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/mail/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/plan/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/slides/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/corpus/templates/tasks/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/mcp/screen-memory-stdio.d.ts

@@ -137,13 +137,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -159,7 +159,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -175,6 +174,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -190,7 +190,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             minutes: {
                 type: string;
                 description: string;
@@ -200,6 +199,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -216,7 +216,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -235,6 +234,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -250,7 +250,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
@@ -264,6 +263,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
@@ -314,13 +314,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -349,13 +349,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;

package/dist/notifications/routes.d.ts

@@ -16,18 +16,18 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error?: undefined;
     ok?: undefined;
 } | {
-    count?: undefined;
     updated: number;
     error?: undefined;
     ok?: undefined;
-} | {
     count?: undefined;
+} | {
     updated?: undefined;
     error: string;
     ok?: undefined;
-} | {
     count?: undefined;
+} | {
     updated?: undefined;
     error?: undefined;
     ok: boolean;
+    count?: undefined;
 }>>;

package/dist/observability/routes.d.ts

@@ -62,6 +62,6 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/templates/chat/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/dist/templates/default/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/dist/templates/headless/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/dist/templates/workspace-core/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.157.20",
+  "version": "0.157.21",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/src/templates/chat/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/src/templates/default/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/src/templates/headless/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/src/templates/workspace-core/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one