@agent-native/core 0.161.17 → 0.161.22

package/corpus/templates/plan/AGENTS.md

@@ -36,6 +36,7 @@ generating or editing a plan.
 - Never hardcode API keys, tokens, webhook URLs, signing secrets, private
   Builder/internal data, customer data, or credential-looking literals. Use
   secrets/OAuth/runtime configuration and obvious placeholders in examples.
+- For external integrations, inspect the workspace/provider connection catalog first; reuse its scoped resolver.
 - Use `view-screen` or application state when the active page/selection is
   unclear.
 - Default to structured visual artifacts over long Markdown. Text is one block

package/corpus/templates/slides/.agents/skills/adding-a-feature/SKILL.md

@@ -76,6 +76,16 @@ Builder/internal data, or customer data in the action, UI, seed data, fixtures,
 docs, prompts, or generated extension/app content. Register required secrets,
 use OAuth helpers, or read scoped values from the vault/credential store.
 
+Before writing custom setup or credential UI, perform the shared-primitive
+preflight from `agent-native-toolkit`: inspect the workspace/provider connection
+catalog first, then settings, secrets/vault, OAuth, onboarding, and provider API
+support. Reuse an existing connection's app grant and scoped credential
+resolver; only use app-local vault or OAuth primitives when no reusable
+connection exists. Keep any wizard thin and provider-specific - it may explain
+prerequisites, ordering, or readiness, but must not become a second vault or
+custom credential transport. Do not mark each field `required` by reflex;
+model onboarding around the logical connection outcome.
+
 If the feature involves attachments, images, recordings, screenshots, exports,
 or other file-like payloads, design the upload path in the same change:
 provider upload first, then URL/id/blob handle in SQL. Do not add base64/binary

package/corpus/templates/slides/.agents/skills/agent-native-toolkit/SKILL.md

@@ -152,6 +152,30 @@ preference, notification preference, or usage/billing surface, register it as a
 settings tab or app settings panel first. Only add sidebar UI when it is needed
 in the moment of agent use.
 
+## Integration Setup Preflight
+
+Before building any setup, settings, credential, OAuth, or connection surface,
+search the workspace/provider connection catalog first. If the provider already
+has a reusable connection, use its catalog, app grant, and scoped credential
+resolver rather than registering a parallel secret. Only then classify fields
+that still need app-local setup by lifecycle and scope:
+
+| Need | Default primitive |
+| --- | --- |
+| Deploy- or app-level configuration | Runtime configuration or deployment env vars |
+| Existing workspace/provider connection | Workspace-connection catalog/grant plus `resolveWorkspaceConnectionCredential(s)ForApp` |
+| App-local API/service key with no reusable connection | `registerRequiredSecret({ kind: "api-key" })` and the vault |
+| Authorization-code or refresh-token flow | `kind: "oauth"` with `@agent-native/core/oauth-tokens` |
+| Account, customer, or other non-secret identifiers | Scoped connection metadata or app data |
+| Provider-specific prerequisites, sequencing, or health | A thin app-local guide over the shared primitives |
+
+Do not register every provider field as a generic secret, mark every field as
+required, or create a second credential-management surface. One logical
+connection should normally produce one onboarding outcome. A custom setup page
+is appropriate only when it adds domain-specific guidance or readiness checks;
+it should link to or call the shared settings, OAuth, and action surfaces rather
+than duplicating their storage or transport.
+
 ## Reusable Kits
 
 - **Settings kit**: a searchable settings page with account, workspace, AI

package/corpus/templates/slides/.agents/skills/secrets/SKILL.md

@@ -3,8 +3,8 @@ name: secrets
 description: >-
   Declaratively register API keys and service credentials a template needs so
   they appear in the agent sidebar settings UI and the onboarding checklist.
-  Use for any third-party API key (OpenAI, Stripe, Twilio, etc.) and for
-  surfacing OAuth connections in the unified settings UI.
+  Use before adding any third-party credential or setup UI so API keys, OAuth
+  connections, and scoped configuration use the correct shared primitive.
 scope: dev
 metadata:
   internal: true
@@ -24,6 +24,33 @@ encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
 `${keys.NAME}` substitution. Examples must use obvious placeholders such as
 `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
 
+## Credential Modeling Preflight
+
+Before registering a provider's fields, inspect the workspace/provider connection
+catalog first. If a reusable connection exists, use its app grant and scoped
+`resolveWorkspaceConnectionCredential(s)ForApp` path instead of registering a
+parallel secret. Only classify fields for app-local setup when no reusable
+connection exists:
+
+- **API or service key** - register it as `kind: "api-key"` with the narrowest
+  correct `scope`, a human label, a description, a docs link, and a validator.
+- **OAuth authorization or refresh token** - use the OAuth token store and
+  register a `kind: "oauth"` entry so the shared UI renders Connect and the
+  runtime owns status, refresh, and reauthorization.
+- **Deploy- or app-level configuration** - use deployment/runtime
+  configuration, not a per-user secret row.
+- **Account, customer, manager, or other non-secret identifier** - store it as
+  scoped connection metadata or app data, not as a masked secret field.
+
+`required: true` is for a logical setup requirement. If a provider needs
+several values, do not automatically create one required checklist item per
+field; use one composite onboarding step or a registered connection readiness
+check.
+
+Custom setup UI is allowed for provider-specific prerequisites, ordering, or
+health checks, but it must delegate credential storage and connection state to
+the shared vault/OAuth/settings surfaces.
+
 ## When to use
 
 Use this for any external credential your template needs: API keys, service

package/corpus/templates/slides/AGENTS.md

@@ -23,6 +23,7 @@ Read the relevant skill before deeper work:
   resources; persist only URLs, ids, or handles.
 - Never hardcode secrets or private/customer data; use vault/OAuth/runtime
   configuration and fake placeholders in examples.
+- For external integrations, inspect the workspace/provider connection catalog first; reuse its scoped resolver.
 - Use actions for deck lifecycle, slide edits, imports, exports, images, design
   systems, and sharing. Do not write deck/slide rows directly. Read the action
   schema if a parameter is unclear.
@@ -44,7 +45,7 @@ Read the relevant skill before deeper work:
   within tolerance; hold Cmd/Ctrl to bypass snapping. With 2+ compatible
   selected objects, use the contextual toolbar to align to selection bounds;
   distribute only when 3+ objects are selected.
-- Follow linked design-system tokens; read `design-systems` for per-source actions.
+- Follow linked design-system tokens.
 - Import/export actions are shortcuts, not capability limits. For exact Google
   Drive API needs, use `provider-api-catalog`, `provider-api-docs`, and
   `provider-api-request`; auth comes from the user's Google Docs OAuth. Stage

package/corpus/templates/slides/actions/get-deck.ts

@@ -6,6 +6,7 @@ import { z } from "zod";
 
 import { formatSlideHtml } from "../server/lib/slide-content-patch.js";
 import { summarizeSlideAnimationTargets } from "../server/lib/validate-slide-animations.js";
+import { normalizeOwnerEmail } from "../shared/ownership.js";
 import { hashSlideContent } from "../shared/slide-fit.js";
 import "../server/db/index.js"; // ensure registerShareableResource runs
 
@@ -112,6 +113,7 @@ export default defineAction({
     const data = JSON.parse(row.data);
     const slides = data?.slides || [];
     const ownerEmail = getRequestUserEmail();
+    const normalizedOwnerEmail = normalizeOwnerEmail(ownerEmail);
     const selectedSlideIndex =
       args.slideId === undefined
         ? -1
@@ -198,7 +200,9 @@ export default defineAction({
       id: row.id,
       title: row.title || data?.title,
       visibility: row.visibility,
-      createdByMe: ownerEmail ? row.ownerEmail === ownerEmail : false,
+      createdByMe:
+        normalizedOwnerEmail !== null &&
+        normalizeOwnerEmail(row.ownerEmail) === normalizedOwnerEmail,
       designSystemId: row.designSystemId ?? null,
       slideCount: slides.length,
       slideNumbering:

package/corpus/templates/slides/actions/list-decks.ts

@@ -2,10 +2,11 @@ import { defineAction } from "@agent-native/core";
 import { buildDeepLink } from "@agent-native/core/server";
 import { getRequestUserEmail } from "@agent-native/core/server/request-context";
 import { accessFilter } from "@agent-native/core/sharing";
-import { and, desc, eq } from "drizzle-orm";
+import { and, desc, eq, sql } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { normalizeOwnerEmail } from "../shared/ownership.js";
 import { getDeckUrl } from "./_app-url.js";
 
 function slidesDeepLink(): string {
@@ -47,24 +48,28 @@ export default defineAction({
   run: async (args, ctx) => {
     const db = getDb();
     const ownerEmail = getRequestUserEmail();
+    const normalizedOwnerEmail = normalizeOwnerEmail(ownerEmail);
     if (
       args.includeSlides === "true" &&
       ctx?.caller === "frontend" &&
-      !ownerEmail
+      normalizedOwnerEmail === null
     ) {
       const err = new Error("Unauthorized") as Error & { statusCode?: number };
       err.statusCode = 401;
       throw err;
     }
 
-    if (args.createdBy === "me" && !ownerEmail) {
+    if (args.createdBy === "me" && normalizedOwnerEmail === null) {
       return { count: 0, decks: [] };
     }
 
     const visibleDecks = accessFilter(schema.decks, schema.deckShares);
     const where =
-      args.createdBy === "me" && ownerEmail
-        ? and(visibleDecks, eq(schema.decks.ownerEmail, ownerEmail))
+      args.createdBy === "me" && normalizedOwnerEmail !== null
+        ? and(
+            visibleDecks,
+            sql`lower(trim(${schema.decks.ownerEmail})) = ${normalizedOwnerEmail}`,
+          )
         : visibleDecks;
 
     if (args.light === "true") {
@@ -79,11 +84,23 @@ export default defineAction({
           title: schema.decks.title,
           updatedAt: schema.decks.updatedAt,
           visibility: schema.decks.visibility,
+          ownerEmail: schema.decks.ownerEmail,
         })
         .from(schema.decks)
         .where(where)
         .orderBy(desc(schema.decks.updatedAt));
-      return { count: rows.length, decks: rows };
+      return {
+        count: rows.length,
+        decks: rows.map((row) => ({
+          id: row.id,
+          title: row.title,
+          updatedAt: row.updatedAt,
+          visibility: row.visibility,
+          createdByMe:
+            normalizedOwnerEmail !== null &&
+            normalizeOwnerEmail(row.ownerEmail) === normalizedOwnerEmail,
+        })),
+      };
     }
 
     if (args.includeSlides !== "true") {
@@ -112,7 +129,9 @@ export default defineAction({
           url: getDeckUrl(row.id),
           visibility: row.visibility,
           designSystemId: row.designSystemId ?? null,
-          createdByMe: ownerEmail ? row.ownerEmail === ownerEmail : false,
+          createdByMe:
+            normalizedOwnerEmail !== null &&
+            normalizeOwnerEmail(row.ownerEmail) === normalizedOwnerEmail,
           createdAt: row.createdAt,
           updatedAt: row.updatedAt,
         })),
@@ -138,7 +157,9 @@ export default defineAction({
           id: row.id,
           title: row.title,
           visibility: row.visibility,
-          createdByMe: ownerEmail ? row.ownerEmail === ownerEmail : false,
+          createdByMe:
+            normalizedOwnerEmail !== null &&
+            normalizeOwnerEmail(row.ownerEmail) === normalizedOwnerEmail,
           designSystemId: row.designSystemId ?? data.designSystemId ?? null,
           createdAt:
             typeof data.createdAt === "string" ? data.createdAt : row.createdAt,

package/corpus/templates/slides/actions/view-screen.ts

@@ -8,6 +8,7 @@ import { and, desc, eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { normalizeOwnerEmail } from "../shared/ownership.js";
 import { hashSlideContent, type DeckFitState } from "../shared/slide-fit.js";
 import { readAppStateForCurrentTab } from "./_tab-state.js";
 
@@ -369,11 +370,14 @@ export default defineAction({
       .where(accessFilter(schema.decks, schema.deckShares))
       .orderBy(desc(schema.decks.updatedAt));
 
-    const userEmail = getRequestUserEmail();
+    const normalizedUserEmail = normalizeOwnerEmail(getRequestUserEmail());
     const filteredRows =
       navigation?.deckFilter === "created-by-me"
-        ? userEmail
-          ? rows.filter((row) => row.ownerEmail === userEmail)
+        ? normalizedUserEmail !== null
+          ? rows.filter(
+              (row) =>
+                normalizeOwnerEmail(row.ownerEmail) === normalizedUserEmail,
+            )
           : []
         : rows;
     const lines: string[] = [];

package/corpus/templates/slides/changelog/2026-08-18-decks-appear-under-mine.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-18
+---
+
+Decks now appear correctly under Mine.

package/corpus/templates/slides/shared/ownership.ts

@@ -0,0 +1,6 @@
+export function normalizeOwnerEmail(
+  email: string | null | undefined,
+): string | null {
+  const normalized = email?.trim().toLowerCase();
+  return normalized || null;
+}

package/corpus/templates/tasks/.agents/skills/adding-a-feature/SKILL.md

@@ -76,6 +76,16 @@ Builder/internal data, or customer data in the action, UI, seed data, fixtures,
 docs, prompts, or generated extension/app content. Register required secrets,
 use OAuth helpers, or read scoped values from the vault/credential store.
 
+Before writing custom setup or credential UI, perform the shared-primitive
+preflight from `agent-native-toolkit`: inspect the workspace/provider connection
+catalog first, then settings, secrets/vault, OAuth, onboarding, and provider API
+support. Reuse an existing connection's app grant and scoped credential
+resolver; only use app-local vault or OAuth primitives when no reusable
+connection exists. Keep any wizard thin and provider-specific - it may explain
+prerequisites, ordering, or readiness, but must not become a second vault or
+custom credential transport. Do not mark each field `required` by reflex;
+model onboarding around the logical connection outcome.
+
 If the feature involves attachments, images, recordings, screenshots, exports,
 or other file-like payloads, design the upload path in the same change:
 provider upload first, then URL/id/blob handle in SQL. Do not add base64/binary

package/corpus/templates/tasks/.agents/skills/agent-native-toolkit/SKILL.md

@@ -152,6 +152,30 @@ preference, notification preference, or usage/billing surface, register it as a
 settings tab or app settings panel first. Only add sidebar UI when it is needed
 in the moment of agent use.
 
+## Integration Setup Preflight
+
+Before building any setup, settings, credential, OAuth, or connection surface,
+search the workspace/provider connection catalog first. If the provider already
+has a reusable connection, use its catalog, app grant, and scoped credential
+resolver rather than registering a parallel secret. Only then classify fields
+that still need app-local setup by lifecycle and scope:
+
+| Need | Default primitive |
+| --- | --- |
+| Deploy- or app-level configuration | Runtime configuration or deployment env vars |
+| Existing workspace/provider connection | Workspace-connection catalog/grant plus `resolveWorkspaceConnectionCredential(s)ForApp` |
+| App-local API/service key with no reusable connection | `registerRequiredSecret({ kind: "api-key" })` and the vault |
+| Authorization-code or refresh-token flow | `kind: "oauth"` with `@agent-native/core/oauth-tokens` |
+| Account, customer, or other non-secret identifiers | Scoped connection metadata or app data |
+| Provider-specific prerequisites, sequencing, or health | A thin app-local guide over the shared primitives |
+
+Do not register every provider field as a generic secret, mark every field as
+required, or create a second credential-management surface. One logical
+connection should normally produce one onboarding outcome. A custom setup page
+is appropriate only when it adds domain-specific guidance or readiness checks;
+it should link to or call the shared settings, OAuth, and action surfaces rather
+than duplicating their storage or transport.
+
 ## Reusable Kits
 
 - **Settings kit**: a searchable settings page with account, workspace, AI

package/corpus/templates/tasks/.agents/skills/secrets/SKILL.md

@@ -3,8 +3,8 @@ name: secrets
 description: >-
   Declaratively register API keys and service credentials a template needs so
   they appear in the agent sidebar settings UI and the onboarding checklist.
-  Use for any third-party API key (OpenAI, Stripe, Twilio, etc.) and for
-  surfacing OAuth connections in the unified settings UI.
+  Use before adding any third-party credential or setup UI so API keys, OAuth
+  connections, and scoped configuration use the correct shared primitive.
 scope: dev
 metadata:
   internal: true
@@ -24,6 +24,33 @@ encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
 `${keys.NAME}` substitution. Examples must use obvious placeholders such as
 `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
 
+## Credential Modeling Preflight
+
+Before registering a provider's fields, inspect the workspace/provider connection
+catalog first. If a reusable connection exists, use its app grant and scoped
+`resolveWorkspaceConnectionCredential(s)ForApp` path instead of registering a
+parallel secret. Only classify fields for app-local setup when no reusable
+connection exists:
+
+- **API or service key** - register it as `kind: "api-key"` with the narrowest
+  correct `scope`, a human label, a description, a docs link, and a validator.
+- **OAuth authorization or refresh token** - use the OAuth token store and
+  register a `kind: "oauth"` entry so the shared UI renders Connect and the
+  runtime owns status, refresh, and reauthorization.
+- **Deploy- or app-level configuration** - use deployment/runtime
+  configuration, not a per-user secret row.
+- **Account, customer, manager, or other non-secret identifier** - store it as
+  scoped connection metadata or app data, not as a masked secret field.
+
+`required: true` is for a logical setup requirement. If a provider needs
+several values, do not automatically create one required checklist item per
+field; use one composite onboarding step or a registered connection readiness
+check.
+
+Custom setup UI is allowed for provider-specific prerequisites, ordering, or
+health checks, but it must delegate credential storage and connection state to
+the shared vault/OAuth/settings surfaces.
+
 ## When to use
 
 Use this for any external credential your template needs: API keys, service

package/corpus/templates/tasks/AGENTS.md

@@ -14,6 +14,7 @@ Read the matching skill before acting. This file is the always-on layer; the ski
 ## Core Rules
 
 - Never hardcode API keys, tokens, webhook URLs, signing secrets, private Builder/internal data, customer data, or credential-looking literals. Use secrets/OAuth/runtime configuration and obvious placeholders in examples.
+- For external integrations, inspect the workspace/provider connection catalog first; reuse its scoped resolver.
 - Follow the root framework contract: data in SQL, actions first, application state for navigation/selection, and shared agent chat for AI work.
 - Do not use `db-query` for normal task operations.
 - Call `view-screen` first when the user's visible task context matters (especially on `/tasks`).

package/dist/action.js

@@ -393,11 +393,53 @@ const TYPE_SUBSTITUTE_KEYS = [
     "$ref",
     "not",
 ];
+/**
+ * `format` values OpenAI's function-schema validator accepts. Anything else --
+ * `uri` from `z.string().url()`, `binary`, `regex`, … -- is answered with
+ * "'<x>' is not a valid format" and a 400 for the WHOLE request.
+ *
+ * Dropping an unknown format only widens what the schema accepts, and the
+ * action's own zod schema still validates the value server-side, so nothing is
+ * actually loosened. Kept as an allowlist rather than a denylist: a new format
+ * we have not heard of should degrade to "unconstrained", not to a 400 that
+ * takes every other tool in the payload down with it.
+ */
+const PROVIDER_SUPPORTED_FORMATS = new Set([
+    "date-time",
+    "time",
+    "date",
+    "duration",
+    "email",
+    "hostname",
+    "ipv4",
+    "ipv6",
+    "uuid",
+]);
+/**
+ * Keywords that only ever CONSTRAIN a value and that OpenAI's validator rejects
+ * outright. Removing a constraint can never make a previously-valid document
+ * invalid, so this is safe in a way that rewriting structure would not be.
+ */
+const PROVIDER_REJECTED_KEYWORDS = [
+    "propertyNames",
+    "patternProperties",
+    "dependentSchemas",
+    "dependentRequired",
+    "if",
+    "then",
+    "else",
+    "not",
+];
 export function stripUnsupportedSchemaKeywords(node) {
     if (!node || typeof node !== "object" || Array.isArray(node))
         return node;
     const obj = node;
-    delete obj.propertyNames;
+    for (const keyword of PROVIDER_REJECTED_KEYWORDS)
+        delete obj[keyword];
+    if (typeof obj.format === "string" &&
+        !PROVIDER_SUPPORTED_FORMATS.has(obj.format)) {
+        delete obj.format;
+    }
     for (const key of SUBSCHEMA_VALUE_KEYS) {
         // `items`/`additionalItems` may also be an array of subschemas.
         const value = obj[key];

package/dist/app-config/schema.d.ts

@@ -40,6 +40,8 @@ export declare const appConfigSchema: z.ZodObject<{
         publicUploadFallback: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
     workspace: z.ZodPrefault<z.ZodObject<{
+        isWorkspace: z.ZodOptional<z.ZodBoolean>;
+        appsJson: z.ZodOptional<z.ZodString>;
         gatewayUrl: z.ZodOptional<z.ZodString>;
         oauthOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;

package/dist/app-config/workspace.d.ts

@@ -16,6 +16,8 @@ import { z } from "zod";
  * in the process down with it.
  */
 export declare const workspaceConfig: z.ZodObject<{
+    isWorkspace: z.ZodOptional<z.ZodBoolean>;
+    appsJson: z.ZodOptional<z.ZodString>;
     gatewayUrl: z.ZodOptional<z.ZodString>;
     oauthOrigin: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;

package/dist/app-config/workspace.js

@@ -16,6 +16,24 @@ import { z } from "zod";
  * in the process down with it.
  */
 export const workspaceConfig = z.object({
+    isWorkspace: z
+        .boolean()
+        .optional()
+        .meta({
+        env: ["AGENT_NATIVE_WORKSPACE", "VITE_AGENT_NATIVE_WORKSPACE"],
+        doc: "Whether this app is mounted inside a shared workspace gateway.",
+    }),
+    appsJson: z
+        .string()
+        .min(1)
+        .optional()
+        .meta({
+        env: [
+            "AGENT_NATIVE_WORKSPACE_APPS_JSON",
+            "VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON",
+        ],
+        doc: "Serialized workspace app manifest used by mounted app runtimes.",
+    }),
     gatewayUrl: z
         .string()
         .min(1)

package/dist/catalog.json

@@ -7,28 +7,28 @@
   "@radix-ui/react-popover": "^1.1.19",
   "@radix-ui/react-select": "^2.3.3",
   "@radix-ui/react-tooltip": "^1.2.12",
-  "@tiptap/core": "3.28.0",
-  "@tiptap/extension-blockquote": "3.28.0",
-  "@tiptap/extension-bubble-menu": "3.28.0",
-  "@tiptap/extension-code-block-lowlight": "3.28.0",
-  "@tiptap/extension-collaboration": "3.28.0",
-  "@tiptap/extension-collaboration-caret": "3.28.0",
-  "@tiptap/extension-color": "3.28.0",
-  "@tiptap/extension-horizontal-rule": "3.28.0",
-  "@tiptap/extension-image": "3.28.0",
-  "@tiptap/extension-link": "3.28.0",
-  "@tiptap/extension-list": "3.28.0",
-  "@tiptap/extension-placeholder": "3.28.0",
-  "@tiptap/extension-table": "3.28.0",
-  "@tiptap/extension-table-cell": "3.28.0",
-  "@tiptap/extension-table-header": "3.28.0",
-  "@tiptap/extension-table-row": "3.28.0",
-  "@tiptap/extension-task-item": "3.28.0",
-  "@tiptap/extension-task-list": "3.28.0",
-  "@tiptap/extension-text-style": "3.28.0",
-  "@tiptap/pm": "3.28.0",
-  "@tiptap/react": "3.28.0",
-  "@tiptap/starter-kit": "3.28.0",
+  "@tiptap/core": "3.30.1",
+  "@tiptap/extension-blockquote": "3.30.1",
+  "@tiptap/extension-bubble-menu": "3.30.1",
+  "@tiptap/extension-code-block-lowlight": "3.30.1",
+  "@tiptap/extension-collaboration": "3.30.1",
+  "@tiptap/extension-collaboration-caret": "3.30.1",
+  "@tiptap/extension-color": "3.30.1",
+  "@tiptap/extension-horizontal-rule": "3.30.1",
+  "@tiptap/extension-image": "3.30.1",
+  "@tiptap/extension-link": "3.30.1",
+  "@tiptap/extension-list": "3.30.1",
+  "@tiptap/extension-placeholder": "3.30.1",
+  "@tiptap/extension-table": "3.30.1",
+  "@tiptap/extension-table-cell": "3.30.1",
+  "@tiptap/extension-table-header": "3.30.1",
+  "@tiptap/extension-table-row": "3.30.1",
+  "@tiptap/extension-task-item": "3.30.1",
+  "@tiptap/extension-task-list": "3.30.1",
+  "@tiptap/extension-text-style": "3.30.1",
+  "@tiptap/pm": "3.30.1",
+  "@tiptap/react": "3.30.1",
+  "@tiptap/starter-kit": "3.30.1",
   "@tiptap/y-tiptap": "3.0.7",
   "@tabler/icons-react": "^3.41.1",
   "@tailwindcss/vite": "^4.2.4",
@@ -56,5 +56,5 @@
   "vite": "8.1.0",
   "vitest": "^4.1.5",
   "y-protocols": "^1.0.7",
-  "yjs": "^13.6.31"
+  "yjs": "^13.6.32"
 }

package/dist/client/analytics.d.ts

@@ -18,6 +18,7 @@ declare global {
             appUrl?: string;
             workspaceGatewayUrl?: string;
             workspaceOAuthOrigin?: string;
+            workspaceRuntime?: boolean;
             sentryDsn?: string;
             sentryEnvironment?: string;
             /**

package/dist/client/api-path.js

@@ -1,3 +1,4 @@
+import { isTruthyRuntimeValue } from "../shared/runtime-config.js";
 import { initializeAgentNativeClient } from "./client-bootstrap.js";
 const FRAMEWORK_ROUTE_PREFIX = "/_agent-native";
 function normalizeBasePath(value) {
@@ -34,8 +35,11 @@ function pathMatchesBasePath(pathname, basePath) {
 }
 function isWorkspaceRuntime() {
     const env = clientEnv();
-    return (env?.VITE_AGENT_NATIVE_WORKSPACE === "1" ||
-        env?.AGENT_NATIVE_WORKSPACE === "1" ||
+    const projected = typeof window !== "undefined" &&
+        window.__AGENT_NATIVE_CONFIG__?.workspaceRuntime === true;
+    return (projected ||
+        isTruthyRuntimeValue(env?.VITE_AGENT_NATIVE_WORKSPACE) ||
+        isTruthyRuntimeValue(env?.AGENT_NATIVE_WORKSPACE) ||
         typeof env?.VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON === "string");
 }
 function workspacePathBasePath() {
@@ -78,7 +82,7 @@ export function appBasePath() {
     const configured = configuredBasePath();
     const derived = pathDerivedBasePath();
     if (!configured)
-        return derived;
+        return derived || workspacePathBasePath();
     if (typeof window === "undefined")
         return configured;
     const pathname = window.location.pathname;

package/dist/client/chat/run-recovery.js

@@ -158,7 +158,7 @@ export function BuilderSetupContent({ onConnected, layout = "default", }) {
     return (_jsxs("div", { className: cn("agent-builder-setup-content", sidebarLayout && "agent-builder-setup-card--sidebar"), children: [_jsxs("div", { className: cn("agent-builder-setup-card__content flex flex-col sm:flex-row sm:items-center sm:justify-between", sidebarLayout ? "gap-2" : "gap-3"), children: [_jsxs("div", { className: "agent-builder-setup-card__copy min-w-0", children: [_jsx("h3", { className: "text-[13px] font-medium text-foreground", children: t("agentPanel.connectAi", { defaultValue: "Connect AI" }) }), _jsx("p", { className: "mt-0.5 text-[11px] leading-relaxed text-muted-foreground", children: t("agentPanel.builderOrOwnKeys", {
                                     defaultValue: "Choose Builder.io or custom keys.",
                                 }) })] }), _jsxs("div", { className: cn("agent-builder-setup-card__actions flex shrink-0", sidebarLayout
-                            ? "flex-col items-start gap-1 sm:items-center"
+                            ? "flex-row items-center gap-1"
                             : "flex-nowrap items-center gap-2"), children: [_jsx(BuilderConnectCta, { variant: "compact", onConnected: onConnected }), _jsx("button", { type: "button", onClick: () => setKeyOpen((open) => !open), className: cn("agent-builder-setup-card__key-button inline-flex shrink-0 items-center whitespace-nowrap rounded-md text-[11px] font-medium", sidebarLayout
                                     ? "h-7 border-0 bg-transparent px-0 text-muted-foreground hover:bg-transparent hover:text-foreground"
                                     : "h-8 border border-border bg-background px-3 text-foreground hover:bg-accent"), "aria-expanded": keyOpen, children: t("agentPanel.addOwnKeys", {