@agent-native/core 0.161.23 → 0.163.0

package/dist/sharing/schema.js

@@ -49,7 +49,7 @@ export function ownableColumns() {
  * Columns:
  * - `id`              — share row id (generated by the share action)
  * - `resourceId`      — id of the parent resource
- * - `principalType`   — `'user' | 'org'`
+ * - `principalType`   — `'user' | 'group' | 'org'`
  * - `principalId`     — email (for user) or org id (for org)
  * - `role`            — `'viewer' | 'commenter' | 'editor' | 'admin'`
  * - `createdBy`       — email of the user who created the share
@@ -65,7 +65,7 @@ export function createSharesTable(tableName) {
         id: text("id").primaryKey(),
         resourceId: text("resource_id").notNull(),
         principalType: text("principal_type", {
-            enum: ["user", "org"],
+            enum: ["user", "group", "org"],
         }).notNull(),
         principalId: text("principal_id").notNull(),
         role: text("role", {

package/dist/templates/chat/.agents/skills/real-time-sync/SKILL.md

@@ -50,7 +50,7 @@ The agent modifies data in SQL, but the UI runs in the browser. SSE bridges same
 
    For list/sidebar queries, use the same pattern — pass the counter into the queryKey of every list query you want to keep fresh.
 
-4. **Fallback** polling calls `/_agent-native/poll?since=N`. It runs every 2 seconds until SSE is connected, then relaxes to 15 seconds (`SSE_FALLBACK_INTERVAL_MS`). If SSE is disabled or unavailable (e.g., edge/serverless deployments), polling continues at the 2 s cadence. Polling is the universal serverless fallback: new framework writes are read from the durable `sync_events` log, while the older DB timestamp scan remains as a slower safety net for direct SQL writes and older processes.
+4. **Fallback** polling calls `/_agent-native/poll?since=N`. It polls every 2 seconds only while an agent run is in flight; otherwise it idles at 60 seconds whether or not SSE is connected (`SSE_FALLBACK_INTERVAL_MS` and `IDLE_POLL_INTERVAL_MS`, both 60 s). A hidden tab polls no faster than every 10 seconds (`HIDDEN_POLL_INTERVAL_MS`). Polling is the universal serverless fallback: new framework writes are read from the durable `sync_events` log, while the older DB timestamp scan remains as a slower safety net for direct SQL writes and older processes.
 
 5. When the agent writes to the database, the version increments, SSE/polling detects it, and React Query refetches the affected queries.
 

package/dist/templates/chat/.agents/skills/sharing/SKILL.md

@@ -18,6 +18,11 @@ Any resource a user **creates** (dashboards, documents, forms, decks, compositio
 
 This is the framework-level primitive. Every ownable resource gets it for free — same API, same UI, same skill.
 
+Workspace apps are the intentional organization-scoped exception: their default
+visibility is `org`, configurable by an organization owner/admin. The creator is
+stored as the app owner, and the creator or an organization owner/admin can
+change the app's visibility or manage its share grants.
+
 ## Concepts
 
 ### Three visibility levels
@@ -26,7 +31,8 @@ This is the framework-level primitive. Every ownable resource gets it for free
 - **`org`** — owner + explicit grants + anyone in the same org (read-only).
 - **`public`** — owner + explicit grants + **anyone with the link** (read-only). Public docs do NOT appear in other users' list/sidebar/search results — `accessFilter` omits them by default. They're reachable by id (`resolveAccess` admits them) so direct links and SSR routes like `/p/:id` keep working. If a list endpoint legitimately needs cross-user public discovery (a template gallery, etc.), pass `accessFilter(table, shares, ctx, minRole, { includePublic: true })`.
 
-Visibility is coarse. Explicit share grants are fine-grained (per user or per org).
+Visibility is coarse. Explicit share grants are fine-grained (per user, reusable
+organization group, or per org).
 
 ### Roles on a share grant
 
@@ -101,6 +107,7 @@ registerShareableResource({
   // ...
   allowPublic: false, // hides "Public" in the share dialog and rejects it server-side
   requireOrgMemberForUserShares: true, // user shares must target an org member or pending invitee
+  supportsGroupShares: true, // enable reusable organization groups for this resource
 });
 ```
 
@@ -111,6 +118,21 @@ Use both for resources that execute code or expose privileged data with the *vie
 
 Defaults match historical behaviour: `allowPublic: true`, `requireOrgMemberForUserShares: false`. Resources that don't set the flags work as before.
 
+### Reusable organization groups
+
+The workspace organization model stores reusable groups in
+`workspace_user_groups`. Organization owners/admins manage the groups and their
+members through the existing group actions. Set `supportsGroupShares: true` on a
+resource registration to enable `principalType: "group"` in the generic share
+actions and the shared popover's autocomplete. Group ids are always checked
+against the resource's organization, and membership is evaluated at access time
+so group changes apply to existing shares.
+
+Workspace apps opt into this flag and use the organization default visibility
+setting. The app creator is the durable `owner_email`, while organization
+owners/admins receive admin access through the registration's
+`canManageAccess` callback.
+
 ## Filter list/read queries
 
 ```ts
@@ -197,6 +219,9 @@ All app share popovers should use the same compact surface contract:
 - Add `ShareAgentsSection` only when the resource has a real agent-readable
   link or prompt. Keep it collapsed by default and supply domain-specific
   content through the shared section shell.
+- When `supportsGroupShares` is enabled, keep the existing people input as the
+  only entry point and include organization groups in its autocomplete. Do not
+  add a separate group-management surface to each resource.
 - App-specific tabs or controls may remain when they represent a real domain
   action (for example, an embed-code editor), but they should retain the same
   trigger, copy-row, access, and spacing language.
@@ -211,7 +236,7 @@ The framework auto-mounts these actions in every template — no per-template bo
 
 | Action                     | Args                                                                           | Purpose                                   |
 | -------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------- |
-| `share-resource`           | `resourceType, resourceId, principalType, principalId, role, notify?, resourceUrl?, message?` | Grant a user or org access. `notify` defaults to true for individual user shares; `resourceUrl` can provide the direct app link and `message` an optional short note for the notification email. |
+| `share-resource`           | `resourceType, resourceId, principalType, principalId, role, notify?, resourceUrl?, message?` | Grant a user, group, or org access. `notify` defaults to true for individual user shares; `resourceUrl` can provide the direct app link and `message` an optional short note for the notification email. |
 | `unshare-resource`         | `resourceType, resourceId, principalType, principalId`                         | Revoke access.                            |
 | `list-resource-shares`     | `resourceType, resourceId`                                                     | Current visibility + all share grants.    |
 | `set-resource-visibility`  | `resourceType, resourceId, visibility`                                         | Change to `private` / `org` / `public`.  |

package/dist/templates/default/.agents/skills/real-time-sync/SKILL.md

@@ -50,7 +50,7 @@ The agent modifies data in SQL, but the UI runs in the browser. SSE bridges same
 
    For list/sidebar queries, use the same pattern — pass the counter into the queryKey of every list query you want to keep fresh.
 
-4. **Fallback** polling calls `/_agent-native/poll?since=N`. It runs every 2 seconds until SSE is connected, then relaxes to 15 seconds (`SSE_FALLBACK_INTERVAL_MS`). If SSE is disabled or unavailable (e.g., edge/serverless deployments), polling continues at the 2 s cadence. Polling is the universal serverless fallback: new framework writes are read from the durable `sync_events` log, while the older DB timestamp scan remains as a slower safety net for direct SQL writes and older processes.
+4. **Fallback** polling calls `/_agent-native/poll?since=N`. It polls every 2 seconds only while an agent run is in flight; otherwise it idles at 60 seconds whether or not SSE is connected (`SSE_FALLBACK_INTERVAL_MS` and `IDLE_POLL_INTERVAL_MS`, both 60 s). A hidden tab polls no faster than every 10 seconds (`HIDDEN_POLL_INTERVAL_MS`). Polling is the universal serverless fallback: new framework writes are read from the durable `sync_events` log, while the older DB timestamp scan remains as a slower safety net for direct SQL writes and older processes.
 
 5. When the agent writes to the database, the version increments, SSE/polling detects it, and React Query refetches the affected queries.
 

package/dist/templates/default/.agents/skills/sharing/SKILL.md

@@ -18,6 +18,11 @@ Any resource a user **creates** (dashboards, documents, forms, decks, compositio
 
 This is the framework-level primitive. Every ownable resource gets it for free — same API, same UI, same skill.
 
+Workspace apps are the intentional organization-scoped exception: their default
+visibility is `org`, configurable by an organization owner/admin. The creator is
+stored as the app owner, and the creator or an organization owner/admin can
+change the app's visibility or manage its share grants.
+
 ## Concepts
 
 ### Three visibility levels
@@ -26,7 +31,8 @@ This is the framework-level primitive. Every ownable resource gets it for free
 - **`org`** — owner + explicit grants + anyone in the same org (read-only).
 - **`public`** — owner + explicit grants + **anyone with the link** (read-only). Public docs do NOT appear in other users' list/sidebar/search results — `accessFilter` omits them by default. They're reachable by id (`resolveAccess` admits them) so direct links and SSR routes like `/p/:id` keep working. If a list endpoint legitimately needs cross-user public discovery (a template gallery, etc.), pass `accessFilter(table, shares, ctx, minRole, { includePublic: true })`.
 
-Visibility is coarse. Explicit share grants are fine-grained (per user or per org).
+Visibility is coarse. Explicit share grants are fine-grained (per user, reusable
+organization group, or per org).
 
 ### Roles on a share grant
 
@@ -101,6 +107,7 @@ registerShareableResource({
   // ...
   allowPublic: false, // hides "Public" in the share dialog and rejects it server-side
   requireOrgMemberForUserShares: true, // user shares must target an org member or pending invitee
+  supportsGroupShares: true, // enable reusable organization groups for this resource
 });
 ```
 
@@ -111,6 +118,21 @@ Use both for resources that execute code or expose privileged data with the *vie
 
 Defaults match historical behaviour: `allowPublic: true`, `requireOrgMemberForUserShares: false`. Resources that don't set the flags work as before.
 
+### Reusable organization groups
+
+The workspace organization model stores reusable groups in
+`workspace_user_groups`. Organization owners/admins manage the groups and their
+members through the existing group actions. Set `supportsGroupShares: true` on a
+resource registration to enable `principalType: "group"` in the generic share
+actions and the shared popover's autocomplete. Group ids are always checked
+against the resource's organization, and membership is evaluated at access time
+so group changes apply to existing shares.
+
+Workspace apps opt into this flag and use the organization default visibility
+setting. The app creator is the durable `owner_email`, while organization
+owners/admins receive admin access through the registration's
+`canManageAccess` callback.
+
 ## Filter list/read queries
 
 ```ts
@@ -197,6 +219,9 @@ All app share popovers should use the same compact surface contract:
 - Add `ShareAgentsSection` only when the resource has a real agent-readable
   link or prompt. Keep it collapsed by default and supply domain-specific
   content through the shared section shell.
+- When `supportsGroupShares` is enabled, keep the existing people input as the
+  only entry point and include organization groups in its autocomplete. Do not
+  add a separate group-management surface to each resource.
 - App-specific tabs or controls may remain when they represent a real domain
   action (for example, an embed-code editor), but they should retain the same
   trigger, copy-row, access, and spacing language.
@@ -211,7 +236,7 @@ The framework auto-mounts these actions in every template — no per-template bo
 
 | Action                     | Args                                                                           | Purpose                                   |
 | -------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------- |
-| `share-resource`           | `resourceType, resourceId, principalType, principalId, role, notify?, resourceUrl?, message?` | Grant a user or org access. `notify` defaults to true for individual user shares; `resourceUrl` can provide the direct app link and `message` an optional short note for the notification email. |
+| `share-resource`           | `resourceType, resourceId, principalType, principalId, role, notify?, resourceUrl?, message?` | Grant a user, group, or org access. `notify` defaults to true for individual user shares; `resourceUrl` can provide the direct app link and `message` an optional short note for the notification email. |
 | `unshare-resource`         | `resourceType, resourceId, principalType, principalId`                         | Revoke access.                            |
 | `list-resource-shares`     | `resourceType, resourceId`                                                     | Current visibility + all share grants.    |
 | `set-resource-visibility`  | `resourceType, resourceId, visibility`                                         | Change to `private` / `org` / `public`.  |

package/dist/templates/workspace-core/.agents/skills/real-time-sync/SKILL.md

@@ -50,7 +50,7 @@ The agent modifies data in SQL, but the UI runs in the browser. SSE bridges same
 
    For list/sidebar queries, use the same pattern — pass the counter into the queryKey of every list query you want to keep fresh.
 
-4. **Fallback** polling calls `/_agent-native/poll?since=N`. It runs every 2 seconds until SSE is connected, then relaxes to 15 seconds (`SSE_FALLBACK_INTERVAL_MS`). If SSE is disabled or unavailable (e.g., edge/serverless deployments), polling continues at the 2 s cadence. Polling is the universal serverless fallback: new framework writes are read from the durable `sync_events` log, while the older DB timestamp scan remains as a slower safety net for direct SQL writes and older processes.
+4. **Fallback** polling calls `/_agent-native/poll?since=N`. It polls every 2 seconds only while an agent run is in flight; otherwise it idles at 60 seconds whether or not SSE is connected (`SSE_FALLBACK_INTERVAL_MS` and `IDLE_POLL_INTERVAL_MS`, both 60 s). A hidden tab polls no faster than every 10 seconds (`HIDDEN_POLL_INTERVAL_MS`). Polling is the universal serverless fallback: new framework writes are read from the durable `sync_events` log, while the older DB timestamp scan remains as a slower safety net for direct SQL writes and older processes.
 
 5. When the agent writes to the database, the version increments, SSE/polling detects it, and React Query refetches the affected queries.
 

package/dist/templates/workspace-core/.agents/skills/sharing/SKILL.md

@@ -18,6 +18,11 @@ Any resource a user **creates** (dashboards, documents, forms, decks, compositio
 
 This is the framework-level primitive. Every ownable resource gets it for free — same API, same UI, same skill.
 
+Workspace apps are the intentional organization-scoped exception: their default
+visibility is `org`, configurable by an organization owner/admin. The creator is
+stored as the app owner, and the creator or an organization owner/admin can
+change the app's visibility or manage its share grants.
+
 ## Concepts
 
 ### Three visibility levels
@@ -26,7 +31,8 @@ This is the framework-level primitive. Every ownable resource gets it for free
 - **`org`** — owner + explicit grants + anyone in the same org (read-only).
 - **`public`** — owner + explicit grants + **anyone with the link** (read-only). Public docs do NOT appear in other users' list/sidebar/search results — `accessFilter` omits them by default. They're reachable by id (`resolveAccess` admits them) so direct links and SSR routes like `/p/:id` keep working. If a list endpoint legitimately needs cross-user public discovery (a template gallery, etc.), pass `accessFilter(table, shares, ctx, minRole, { includePublic: true })`.
 
-Visibility is coarse. Explicit share grants are fine-grained (per user or per org).
+Visibility is coarse. Explicit share grants are fine-grained (per user, reusable
+organization group, or per org).
 
 ### Roles on a share grant
 
@@ -101,6 +107,7 @@ registerShareableResource({
   // ...
   allowPublic: false, // hides "Public" in the share dialog and rejects it server-side
   requireOrgMemberForUserShares: true, // user shares must target an org member or pending invitee
+  supportsGroupShares: true, // enable reusable organization groups for this resource
 });
 ```
 
@@ -111,6 +118,21 @@ Use both for resources that execute code or expose privileged data with the *vie
 
 Defaults match historical behaviour: `allowPublic: true`, `requireOrgMemberForUserShares: false`. Resources that don't set the flags work as before.
 
+### Reusable organization groups
+
+The workspace organization model stores reusable groups in
+`workspace_user_groups`. Organization owners/admins manage the groups and their
+members through the existing group actions. Set `supportsGroupShares: true` on a
+resource registration to enable `principalType: "group"` in the generic share
+actions and the shared popover's autocomplete. Group ids are always checked
+against the resource's organization, and membership is evaluated at access time
+so group changes apply to existing shares.
+
+Workspace apps opt into this flag and use the organization default visibility
+setting. The app creator is the durable `owner_email`, while organization
+owners/admins receive admin access through the registration's
+`canManageAccess` callback.
+
 ## Filter list/read queries
 
 ```ts
@@ -197,6 +219,9 @@ All app share popovers should use the same compact surface contract:
 - Add `ShareAgentsSection` only when the resource has a real agent-readable
   link or prompt. Keep it collapsed by default and supply domain-specific
   content through the shared section shell.
+- When `supportsGroupShares` is enabled, keep the existing people input as the
+  only entry point and include organization groups in its autocomplete. Do not
+  add a separate group-management surface to each resource.
 - App-specific tabs or controls may remain when they represent a real domain
   action (for example, an embed-code editor), but they should retain the same
   trigger, copy-row, access, and spacing language.
@@ -211,7 +236,7 @@ The framework auto-mounts these actions in every template — no per-template bo
 
 | Action                     | Args                                                                           | Purpose                                   |
 | -------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------- |
-| `share-resource`           | `resourceType, resourceId, principalType, principalId, role, notify?, resourceUrl?, message?` | Grant a user or org access. `notify` defaults to true for individual user shares; `resourceUrl` can provide the direct app link and `message` an optional short note for the notification email. |
+| `share-resource`           | `resourceType, resourceId, principalType, principalId, role, notify?, resourceUrl?, message?` | Grant a user, group, or org access. `notify` defaults to true for individual user shares; `resourceUrl` can provide the direct app link and `message` an optional short note for the notification email. |
 | `unshare-resource`         | `resourceType, resourceId, principalType, principalId`                         | Revoke access.                            |
 | `list-resource-shares`     | `resourceType, resourceId`                                                     | Current visibility + all share grants.    |
 | `set-resource-visibility`  | `resourceType, resourceId, visibility`                                         | Change to `private` / `org` / `public`.  |

package/dist/vite/client.d.ts

@@ -193,6 +193,11 @@ export interface AgentNativeVitePluginOptions extends Omit<ClientConfigOptions,
 }
 export declare function stripMountedDevApiPath(reqUrl: string | undefined, base: string | undefined): string | undefined;
 export declare function isFrameworkDevPath(reqUrl: string, base: string | undefined): boolean;
+/**
+ * Framework-owned dynamic dev paths whose responses are served by the h3 app:
+ * the `/_agent-native/*` API surface plus framework `/.well-known/*` documents.
+ */
+export declare function isFrameworkDynamicDevPath(reqUrl: string, base: string | undefined): boolean;
 declare function nitroModuleGraphSignature(environment: unknown): string | null;
 declare function nitroStartupGate(options?: {
     now?: () => number;

package/dist/vite/client.js

@@ -7,7 +7,7 @@ import { renderDesignSystemThemeCss, } from "@agent-native/toolkit/design-system
 import { loadEnv, } from "vite";
 import { mergePendingChangelog, parsePendingEntry, } from "../changelog/parse.js";
 import { getViteDevRecoveryScript } from "../client/vite-dev-recovery-script.js";
-import { mergeAgentNativeConfigs, resolveAgentNativeConfig, } from "../config.js";
+import { inferAgentNativeDeploymentEnvironment, mergeAgentNativeConfigs, resolveAgentNativeConfig, } from "../config.js";
 import { writeAgentNativeNitroPresetMarker } from "../deploy/nitro-preset.js";
 import { findWorkspaceRoot } from "../scripts/utils.js";
 import { verifyEmbedSessionToken } from "../server/embed-session.js";
@@ -1432,6 +1432,41 @@ function baseRedirectGuard() {
         },
     };
 }
+/**
+ * Force Nitro's dev middleware to treat extension-bearing framework endpoints
+ * as dynamic so they reach the h3 server instead of Vite's static pipeline.
+ *
+ * Nitro's Vite dev middleware routes paths with asset-like extensions through
+ * Vite unless a Nitro route matches them. Framework endpoints are registered
+ * as h3 middleware, so mounted `/_agent-native/*` and `/.well-known/*` paths
+ * can otherwise become dev-only 404s before reaching the framework handler.
+ */
+function frameworkDevDynamicForwarder() {
+    return {
+        name: "agent-native-framework-dev-dynamic-forwarder",
+        apply: "serve",
+        configureServer(server) {
+            server.middlewares.use((req, _res, next) => {
+                const url = req.url;
+                if (url && isFrameworkDynamicDevPath(url, server.config.base)) {
+                    const accept = req.headers["accept"];
+                    if (typeof accept !== "string" || !/\btext\/html\b/.test(accept)) {
+                        req.headers["accept"] = accept
+                            ? `text/html,${accept}`
+                            : "text/html";
+                    }
+                    // Embed-start uses document/iframe to select its transplant response.
+                    // Only supply the classifier hint when the browser did not provide a
+                    // destination; never overwrite the request's original intent.
+                    if (req.headers["sec-fetch-dest"] === undefined) {
+                        req.headers["sec-fetch-dest"] = "empty";
+                    }
+                }
+                next();
+            });
+        },
+    };
+}
 const VITE_RUNTIME_PATH_PREFIXES = [
     "/@fs/",
     "/@id/",
@@ -1872,6 +1907,23 @@ export function isFrameworkDevPath(reqUrl, base) {
     return (pathname === `${normalizedBase}/_agent-native` ||
         pathname.startsWith(`${normalizedBase}/_agent-native/`));
 }
+/**
+ * Framework-owned dynamic dev paths whose responses are served by the h3 app:
+ * the `/_agent-native/*` API surface plus framework `/.well-known/*` documents.
+ */
+export function isFrameworkDynamicDevPath(reqUrl, base) {
+    if (isFrameworkDevPath(reqUrl, base))
+        return true;
+    const pathname = devPathname(reqUrl);
+    if (pathname.startsWith("/.well-known/"))
+        return true;
+    if (base && base !== "/") {
+        const normalizedBase = base.endsWith("/") ? base.slice(0, -1) : base;
+        if (pathname.startsWith(`${normalizedBase}/.well-known/`))
+            return true;
+    }
+    return false;
+}
 /**
  * Work around a Rolldown bug where Nitro passes service entries as objects
  * ({index: "path"}) but Rolldown expects strings. This plugin normalizes
@@ -2679,6 +2731,7 @@ function createAgentNativePlugins(options, { command, includeReactTransform, use
         fullReloadOnOptimizeDep504(),
         embedDevFrameHeaders(),
         baseRedirectGuard(),
+        frameworkDevDynamicForwarder(),
         portExposer(),
         nitroStartupGate(),
         reactRouterVirtualInvalidationMirrorPlugin(),
@@ -2755,6 +2808,15 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
     const appConfig = resolveAgentNativeConfig(mergeAgentNativeConfigs(readAgentNativeJsonConfig(cwd), projectConfigInput
         ? resolveAgentNativeConfig(projectConfigInput, configContext)
         : {}), configContext);
+    const inferredDeploymentEnvironment = appConfig.deployment?.environment ??
+        inferAgentNativeDeploymentEnvironment(process.env, mode);
+    const resolvedAppConfig = appConfig.deployment?.environment === undefined &&
+        inferredDeploymentEnvironment !== undefined
+        ? {
+            ...appConfig,
+            deployment: { environment: inferredDeploymentEnvironment },
+        }
+        : appConfig;
     const buildId = process.env.DEPLOY_ID?.trim() ||
         process.env.COMMIT_REF?.trim() ||
         process.env.VERCEL_GIT_COMMIT_SHA?.trim() ||
@@ -2844,7 +2906,7 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
             ...(options.define ?? {}),
             __AGENT_NATIVE_BUILD_ID__: JSON.stringify(buildId),
             __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__: JSON.stringify(options.clientCompatibilityVersion?.trim() || ""),
-            __AGENT_NATIVE_APP_CONFIG__: JSON.stringify(appConfig),
+            __AGENT_NATIVE_APP_CONFIG__: JSON.stringify(resolvedAppConfig),
             __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__: JSON.stringify(process.env.GA_MEASUREMENT_ID?.trim() || ""),
             "process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID": JSON.stringify(process.env.GA_MEASUREMENT_ID?.trim() || ""),
             // The release migration owner is configured at build time. Netlify's

package/dist/workspace-connections/actions/list-workspace-user-groups.d.ts

@@ -1,2 +1,10 @@
-declare const _default: import("../../action.js").ActionDefinition<Record<string, never>, import("../groups.js").WorkspaceUserGroup[]>;
+declare const _default: import("../../action.js").ActionDefinition<Record<string, never>, {
+    id: string;
+    orgId: string;
+    name: string;
+    createdByEmail: string;
+    createdAt: string;
+    updatedAt: string;
+    memberEmails: any[];
+}[]>;
 export default _default;

package/dist/workspace-connections/actions/list-workspace-user-groups.js

@@ -1,13 +1,18 @@
 import { z } from "zod";
 import { defineAction } from "../../action.js";
-import { assertWorkspaceUserGroupManager, listWorkspaceUserGroupsForOrg, } from "../groups.js";
+import { listWorkspaceUserGroupsForOrg, workspaceUserGroupRole, } from "../groups.js";
 export default defineAction({
-    description: "List reusable workspace user groups. Group management is restricted to workspace owners and admins.",
+    description: "List reusable workspace user groups. Workspace members can see group names for sharing; only owners and admins receive member details and can manage groups.",
     schema: z.object({}),
     http: { method: "GET" },
     readOnly: true,
     run: async (_args, ctx) => {
-        await assertWorkspaceUserGroupManager(ctx?.orgId, ctx?.userEmail);
-        return listWorkspaceUserGroupsForOrg(ctx?.orgId ?? "");
+        const role = await workspaceUserGroupRole(ctx?.orgId, ctx?.userEmail);
+        if (!role)
+            throw new Error("Workspace membership is required.");
+        const groups = await listWorkspaceUserGroupsForOrg(ctx?.orgId ?? "");
+        if (role === "owner" || role === "admin")
+            return groups;
+        return groups.map((group) => ({ ...group, memberEmails: [] }));
     },
 });

package/dist/workspace-connections/groups.d.ts

@@ -20,12 +20,14 @@ export interface UpdateWorkspaceUserGroupMembersInput {
     operation: "add" | "remove";
     orgId?: string | null;
 }
+export declare function workspaceUserGroupsTable(): string;
 export declare function normalizeWorkspaceUserGroupIds(value: unknown): string[];
 export declare function ensureWorkspaceUserGroupsTable(): Promise<void>;
 export declare function listWorkspaceUserGroupsForOrg(orgId: string, groupIds?: string[]): Promise<WorkspaceUserGroup[]>;
 export declare function listWorkspaceUserGroups(): Promise<WorkspaceUserGroup[]>;
 export declare function assertWorkspaceUserGroupIds(groupIds: string[] | undefined, orgId: string | null | undefined): Promise<string[] | undefined>;
 export declare function assertWorkspaceUserGroupManager(orgId: string | null | undefined, userEmail: string | undefined): Promise<void>;
+export declare function workspaceUserGroupRole(orgId: string | null | undefined, userEmail: string | undefined): Promise<"owner" | "admin" | "member" | null>;
 export declare function upsertWorkspaceUserGroup(input: UpsertWorkspaceUserGroupInput): Promise<WorkspaceUserGroup>;
 export declare function updateWorkspaceUserGroupMembers(input: UpdateWorkspaceUserGroupMembersInput): Promise<WorkspaceUserGroup>;
 export declare function deleteWorkspaceUserGroup(id: string, orgId?: string | null): Promise<boolean>;

package/dist/workspace-connections/groups.js

@@ -3,7 +3,7 @@ import { getDbExec, intType, isPostgres, retryOnDdlRace, safeJsonParse, } from "
 import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
 import { isOrgMember } from "../org/membership.js";
 import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
-function workspaceUserGroupsTable() {
+export function workspaceUserGroupsTable() {
     return isPostgres()
         ? "public.workspace_user_groups"
         : "workspace_user_groups";
@@ -171,19 +171,25 @@ export async function assertWorkspaceUserGroupIds(groupIds, orgId) {
     return normalized;
 }
 export async function assertWorkspaceUserGroupManager(orgId, userEmail) {
+    const role = await workspaceUserGroupRole(orgId, userEmail);
+    if (role === "owner" || role === "admin")
+        return;
+    throw new Error("Only workspace admins can manage user groups.");
+}
+export async function workspaceUserGroupRole(orgId, userEmail) {
     const normalizedOrgId = orgId?.trim();
     const normalizedEmail = userEmail?.trim().toLowerCase();
     if (!normalizedOrgId || !normalizedEmail) {
-        throw new Error("Only workspace admins can manage user groups.");
+        return null;
     }
     const { rows } = await getDbExec().execute({
         sql: `SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,
         args: [normalizedOrgId, normalizedEmail],
     });
     const role = String(rows[0]?.role ?? "");
-    if (role !== "owner" && role !== "admin") {
-        throw new Error("Only workspace admins can manage user groups.");
-    }
+    return role === "owner" || role === "admin" || role === "member"
+        ? role
+        : null;
 }
 export async function upsertWorkspaceUserGroup(input) {
     const requestScope = requireWorkspaceUserGroupScope();
@@ -283,6 +289,11 @@ export async function workspaceUserGroupsIncludeUser(orgId, groupIds, userEmail)
     if (!normalizedOrgId || !normalizedEmail || normalizedIds.length === 0) {
         return false;
     }
+    // Group rows can outlive roster membership. A stale email in the JSON
+    // member list must not keep granting access after that person leaves the
+    // organization.
+    if (!(await isOrgMember(normalizedOrgId, normalizedEmail)))
+        return false;
     const groups = await listWorkspaceUserGroupsForOrg(normalizedOrgId, normalizedIds);
     return groups.some((group) => group.memberEmails.includes(normalizedEmail));
 }

package/dist/workspace-files/actions.d.ts

@@ -14,14 +14,7 @@ export type WorkspaceFileActionResult = z.infer<typeof workspaceFileResultSchema
 export declare const showWorkspaceFileAction: import("../action.js").ActionDefinition<{
     path: string;
 }, {
-    file: {
-        resourceId: string;
-        path: string;
-        name: string;
-        contentType: string;
-        sizeBytes: number;
-        updatedAt: string;
-    };
+    file: import("./store.js").WorkspaceFileCard;
 }>;
 export declare function createWorkspaceFileActionEntries(): Record<string, ActionEntry>;
 export {};

package/dist/workspace-files/actions.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { ACTION_CHAT_UI_WORKSPACE_FILE_RENDERER } from "../action-ui.js";
 import { defineAction } from "../action.js";
 import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
-import { getWorkspaceFileMeta } from "./store.js";
+import { getWorkspaceFileMeta, toWorkspaceFileCard, } from "./store.js";
 const workspaceFileResultSchema = z.object({
     file: z.object({
         resourceId: z.string().min(1),
@@ -22,13 +22,6 @@ function currentWorkspaceScope() {
         return { scope: "user", scopeId: userEmail };
     throw new Error("show-workspace-file requires an authenticated request context.");
 }
-function fileName(path) {
-    return path.split("/").at(-1) || path;
-}
-function isTextWorkspaceFile(contentType) {
-    const mimeType = contentType.split(";")[0].trim().toLowerCase();
-    return mimeType.startsWith("text/") || mimeType === "application/json";
-}
 export const showWorkspaceFileAction = defineAction({
     description: "Render a workspace file as a downloadable card in chat. Call this after writing a user-requested export or other durable file with workspaceWrite; a file export is not complete until this action succeeds and the download card appears. The path must exactly match an existing file in the current organization or personal workspace.",
     schema: z.object({
@@ -52,19 +45,10 @@ export const showWorkspaceFileAction = defineAction({
         if (!file) {
             throw new Error(`Workspace file not found: "${path}"`);
         }
-        if (!isTextWorkspaceFile(file.contentType)) {
-            throw new Error(`Workspace file "${path}" has unsupported content type "${file.contentType}". show-workspace-file currently supports text files and application/json.`);
-        }
-        return {
-            file: {
-                resourceId: file.id,
-                path: file.path,
-                name: fileName(file.path),
-                contentType: file.contentType,
-                sizeBytes: file.sizeBytes,
-                updatedAt: file.updatedAt,
-            },
-        };
+        // The card only ever renders name/size/type + a download link — it never
+        // inlines file content — so every content type, binary included, is safe
+        // to show here.
+        return { file: toWorkspaceFileCard(file) };
     },
 });
 export function createWorkspaceFileActionEntries() {

package/dist/workspace-files/index.d.ts

@@ -1,2 +1,2 @@
-export { writeWorkspaceFile, appendWorkspaceFile, readWorkspaceFile, getWorkspaceFileMeta, listWorkspaceFiles, deleteWorkspaceFile, grepWorkspaceFiles, validatePath, MAX_FILE_BYTES, MAX_SCOPE_BYTES, SAVE_TO_FILE_MAX_BYTES, type WorkspaceFilesScope, type WorkspaceFile, type WorkspaceFileMeta, } from "./store.js";
+export { writeWorkspaceFile, appendWorkspaceFile, readWorkspaceFile, getWorkspaceFileMeta, listWorkspaceFiles, deleteWorkspaceFile, grepWorkspaceFiles, validatePath, isScratchWorkspacePath, fileNameFromPath, toWorkspaceFileCard, MAX_FILE_BYTES, MAX_SCOPE_BYTES, SAVE_TO_FILE_MAX_BYTES, type WorkspaceFilesScope, type WorkspaceFile, type WorkspaceFileMeta, type WorkspaceFileCard, } from "./store.js";
 export { createWorkspaceFilesTool } from "./tool.js";

package/dist/workspace-files/index.js

@@ -1,2 +1,2 @@
-export { writeWorkspaceFile, appendWorkspaceFile, readWorkspaceFile, getWorkspaceFileMeta, listWorkspaceFiles, deleteWorkspaceFile, grepWorkspaceFiles, validatePath, MAX_FILE_BYTES, MAX_SCOPE_BYTES, SAVE_TO_FILE_MAX_BYTES, } from "./store.js";
+export { writeWorkspaceFile, appendWorkspaceFile, readWorkspaceFile, getWorkspaceFileMeta, listWorkspaceFiles, deleteWorkspaceFile, grepWorkspaceFiles, validatePath, isScratchWorkspacePath, fileNameFromPath, toWorkspaceFileCard, MAX_FILE_BYTES, MAX_SCOPE_BYTES, SAVE_TO_FILE_MAX_BYTES, } from "./store.js";
 export { createWorkspaceFilesTool } from "./tool.js";

package/dist/workspace-files/store.d.ts

@@ -20,6 +20,8 @@ export interface WorkspaceFilesScope {
     scope: "user" | "org";
     scopeId: string;
 }
+/** True for `scratch/...` paths — hidden agent staging, never durable. */
+export declare function isScratchWorkspacePath(path: string): boolean;
 /**
  * Validate a workspace file path.
  * - Non-empty, no leading slash, no ".." components, no null bytes.
@@ -44,6 +46,22 @@ export interface WorkspaceFileMeta {
     createdAt: string;
     updatedAt: string;
 }
+/** Display name for a workspace path — the last path segment. */
+export declare function fileNameFromPath(path: string): string;
+export interface WorkspaceFileCard {
+    resourceId: string;
+    path: string;
+    name: string;
+    contentType: string;
+    sizeBytes: number;
+    updatedAt: string;
+}
+/**
+ * Shape any workspace-file creator can spread into its own tool result as
+ * `{ file: toWorkspaceFileCard(meta) }` to get a download card in chat —
+ * the chat renderer matches on this shape alone, no per-caller wiring needed.
+ */
+export declare function toWorkspaceFileCard(meta: WorkspaceFileMeta): WorkspaceFileCard;
 /**
  * Write (create or overwrite) a workspace file.
  * Enforces per-file limits for the compatibility API; persistence is handled by