@agent-native/core 0.164.4 → 0.164.11

package/corpus/templates/clips/server/routes/_agent-native/google/auth-url.get.ts

@@ -4,10 +4,14 @@ import {
   isElectron,
   resolveGoogleSignInCredentials,
   resolveOAuthRedirectUri,
+  registerDesktopExchange,
+  prepareDesktopOAuthBrowserBinding,
   safeReturnPath,
 } from "@agent-native/core/server";
 import {
   defineEventHandler,
+  getHeader,
+  getMethod,
   getQuery,
   setResponseStatus,
   type H3Event,
@@ -54,11 +58,39 @@ export default defineEventHandler(async (event: H3Event) => {
       isElectron(event) || q.desktop === "1" || q.desktop === "true";
     const flowId =
       desktop && typeof q.flow_id === "string" ? q.flow_id : undefined;
+    if (getMethod(event) === "POST" && (!desktop || !flowId)) {
+      setResponseStatus(event, 400);
+      return { error: "Invalid desktop exchange challenge." };
+    }
+    const calendarConnect =
+      q.calendar === "1" || q.calendar === "true" || q.product === "calendar";
+    let desktopVerifierHash: string | undefined;
+    let desktopBrowserBindingHash: string | undefined;
+    if (flowId && !calendarConnect) {
+      if (getMethod(event) !== "POST" || q.redirect !== undefined) {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+      const verifier = getHeader(event, "x-agent-native-desktop-verifier");
+      if (!verifier || q.verifier !== undefined) {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+      try {
+        desktopBrowserBindingHash = prepareDesktopOAuthBrowserBinding(event);
+        desktopVerifierHash = await registerDesktopExchange(
+          flowId,
+          verifier,
+          desktopBrowserBindingHash,
+        );
+      } catch {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+    }
     const requestedReturn =
       typeof q.return === "string" ? safeReturnPath(q.return) : "/";
     const returnUrl = requestedReturn !== "/" ? requestedReturn : undefined;
-    const calendarConnect =
-      q.calendar === "1" || q.calendar === "true" || q.product === "calendar";
     const credentials = calendarConnect
       ? ((await resolveGoogleOAuthCredentialCandidates())[0] ?? null)
       : resolveGoogleSignInCredentials();
@@ -84,10 +116,16 @@ export default defineEventHandler(async (event: H3Event) => {
       redirectUri,
       owner,
       desktop,
+      desktopWebview: desktop && q.webview === "1" && !calendarConnect,
       addAccount: calendarConnect,
       app: CLIPS_GOOGLE_OAUTH_APP_ID,
-      returnUrl,
+      returnUrl:
+        desktop && q.webview === "1" && !calendarConnect
+          ? "/?desktop_auth=complete"
+          : returnUrl,
       flowId: calendarConnect ? undefined : flowId,
+      desktopVerifierHash,
+      desktopBrowserBindingHash,
     });
 
     const params = new URLSearchParams({

package/corpus/templates/clips/server/routes/_agent-native/google/auth-url.post.ts

@@ -0,0 +1 @@
+export { default } from "./auth-url.get.js";

package/corpus/templates/clips/server/routes/_agent-native/google/callback.get.ts

@@ -6,6 +6,7 @@ import {
   oauthErrorPage,
   resolveGoogleSignInCredentials,
   resolveOAuthOwner,
+  matchesDesktopOAuthBrowserBinding,
   setDesktopExchange,
   type OAuthStatePayload,
 } from "@agent-native/core/server";
@@ -31,6 +32,17 @@ async function handleGoogleSignInCallback(
 ) {
   const desktop = state.desktop;
   const flowId = state.flowId;
+  if (
+    flowId &&
+    (!state.desktopVerifierHash ||
+      !state.desktopBrowserBindingHash ||
+      !matchesDesktopOAuthBrowserBinding(
+        event,
+        state.desktopBrowserBindingHash,
+      ))
+  ) {
+    return oauthErrorPage("Desktop OAuth browser binding is invalid.");
+  }
 
   try {
     const query = getQuery(event);
@@ -107,12 +119,21 @@ async function handleGoogleSignInCallback(
     });
 
     if (flowId && sessionToken) {
-      setDesktopExchange(flowId, sessionToken, email);
+      if (!state.desktopVerifierHash) {
+        throw new Error("Missing desktop exchange challenge.");
+      }
+      await setDesktopExchange(
+        flowId,
+        sessionToken,
+        email,
+        state.desktopVerifierHash,
+      );
     }
 
     return oauthCallbackResponse(event, email, {
       sessionToken,
       desktop,
+      desktopWebview: state.desktopWebview,
       returnUrl: state.returnUrl,
       flowId,
       appName: "Clips",

package/corpus/templates/clips/server/routes/api/clips-updater.json.get.ts

@@ -1,17 +1,23 @@
-import { defineEventHandler, setResponseHeaders } from "h3";
+import { defineEventHandler, getQuery, setResponseHeaders } from "h3";
 
 /**
  * Tauri updater manifest endpoint for the Clips desktop app.
  *
  * The installed app only needs this endpoint to be valid JSON when no signed
- * updater bundle is available. If the `clips-latest` GitHub pointer release
- * exists, we proxy its signed manifest. If it does not, return a deliberately
- * old no-update manifest so the desktop UI stays quiet instead of surfacing a
+ * updater bundle is available. If the channel's GitHub pointer release exists,
+ * we proxy its signed manifest. If it does not, return a deliberately old
+ * no-update manifest so the desktop UI stays quiet instead of surfacing a
  * release-channel setup error to end users.
  */
 
-const GITHUB_MANIFEST_URL =
-  "https://github.com/BuilderIO/agent-native/releases/download/clips-latest/clips-latest.json";
+type ClipsUpdateChannel = "production" | "nightly";
+
+const GITHUB_MANIFEST_URL: Record<ClipsUpdateChannel, string> = {
+  production:
+    "https://github.com/BuilderIO/agent-native/releases/download/clips-latest/clips-latest.json",
+  nightly:
+    "https://github.com/BuilderIO/agent-native/releases/download/clips-nightly-latest/clips-nightly-latest.json",
+};
 const CACHE_TTL_MS = 5 * 60_000;
 
 // Tauri throws a red-banner error if the requesting client's target triple is
@@ -48,8 +54,8 @@ export const INERT_MANIFEST = {
   },
 };
 
-let cache: { data: unknown; ts: number } | null = null;
-let inFlight: Promise<unknown> | null = null;
+const cache = new Map<ClipsUpdateChannel, { data: unknown; ts: number }>();
+const inFlight = new Map<ClipsUpdateChannel, Promise<unknown>>();
 
 function isManifestLike(value: unknown): value is Record<string, unknown> {
   if (!value || typeof value !== "object") return false;
@@ -72,8 +78,10 @@ export function hasAllRequiredPlatforms(value: unknown): boolean {
   return REQUIRED_PLATFORM_KEYS.every((k) => k in platforms);
 }
 
-async function fetchSignedManifest(): Promise<unknown> {
-  const res = await fetch(GITHUB_MANIFEST_URL, {
+async function fetchSignedManifest(
+  channel: ClipsUpdateChannel,
+): Promise<unknown> {
+  const res = await fetch(GITHUB_MANIFEST_URL[channel], {
     headers: {
       accept: "application/json",
       "user-agent": "clips-updater-manifest",
@@ -94,38 +102,49 @@ async function fetchSignedManifest(): Promise<unknown> {
   return json;
 }
 
-async function getManifest(): Promise<unknown> {
+function normalizeChannel(value: unknown): ClipsUpdateChannel {
+  return value === "nightly" ? "nightly" : "production";
+}
+
+async function getManifest(
+  channel: ClipsUpdateChannel = "production",
+): Promise<unknown> {
   const now = Date.now();
-  if (cache && now - cache.ts < CACHE_TTL_MS) return cache.data;
-  if (inFlight) return inFlight;
-  inFlight = (async () => {
+  const cached = cache.get(channel);
+  if (cached && now - cached.ts < CACHE_TTL_MS) return cached.data;
+  const pending = inFlight.get(channel);
+  if (pending) return pending;
+  const request = (async () => {
     try {
-      const data = await fetchSignedManifest();
-      cache = { data, ts: Date.now() };
+      const data = await fetchSignedManifest(channel);
+      cache.set(channel, { data, ts: Date.now() });
       return data;
     } catch {
       // A validation or network failure may serve the last good manifest (or
       // inert fallback), but it must not make that fallback fresh again.
       // Otherwise an incomplete release manifest can indefinitely extend the
       // stale cache window on every failed refresh.
-      return cache?.data ?? INERT_MANIFEST;
+      return cache.get(channel)?.data ?? INERT_MANIFEST;
     } finally {
-      inFlight = null;
+      inFlight.delete(channel);
     }
   })();
-  return inFlight;
+  inFlight.set(channel, request);
+  return request;
 }
 
 export const __clipsUpdaterTest = {
   getManifest,
   reset() {
-    cache = null;
-    inFlight = null;
+    cache.clear();
+    inFlight.clear();
   },
 };
 
 export default defineEventHandler(async (event) => {
-  const manifest = await getManifest();
+  const query = getQuery(event);
+  const channel = normalizeChannel(query.channel);
+  const manifest = await getManifest(channel);
   setResponseHeaders(event, {
     "content-type": "application/json; charset=utf-8",
     "cache-control": "public, max-age=60",

package/corpus/templates/factory/AGENTS.md

@@ -63,7 +63,7 @@ decisions, feedback, agent runs, and provider audit records.
 | `evaluate-triage-item` | Append a decision. |
 | `record-triage-feedback` | Capture human correction for learning. |
 | `approve-factory-item` | Explicitly authorize one bounded run. |
-| `start-builder-for-item` | Govern clear-bug dispatch through Slack or Builder API. |
+| `start-builder-for-item` | Govern clear-bug dispatch through Slack or Builder API, or record a skip reason. |
 | `govern-agent-native-pull-request` | Apply PR evidence and ownership gates. |
 | `list-factory-automations` / `save-factory-automation` / `run-factory-automation` | Inspect or edit org-owned automations. |
 | `list-factory-audit` | Inspect automation runs, evidence, decisions, and provider actions. |

package/corpus/templates/factory/actions/list-factory-automations.ts

@@ -41,6 +41,10 @@ export default defineAction({
           timezone: meta.timezone ?? null,
           condition: meta.condition ?? null,
           createdBy: meta.createdBy ?? null,
+          updatedAt:
+            Number.isFinite(resource.updatedAt) && resource.updatedAt > 0
+              ? new Date(resource.updatedAt).toISOString()
+              : null,
           canUpdate,
           runs: await listAutomationRuns({
             owners: [resource.owner],

package/corpus/templates/factory/actions/start-builder-for-item.ts

@@ -153,7 +153,7 @@ async function writeMetadata(
     .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)));
 }
 
-async function recordDecision(input: {
+export async function recordAutomaticBuilderDecision(input: {
   itemId: string;
   userEmail: string;
   orgId: string;
@@ -167,6 +167,7 @@ async function recordDecision(input: {
     input.itemId,
     "automatic-builder",
   );
+  const now = new Date().toISOString();
   await getDb()
     .insert(triageDecisions)
     .values({
@@ -179,17 +180,26 @@ async function recordDecision(input: {
       guardResultsJson: JSON.stringify(input.guardResults),
       model: "factory-automation",
       promptVersion: 1,
-      createdAt: new Date().toISOString(),
+      createdAt: now,
       ownerEmail: input.userEmail,
       orgId: input.orgId,
     })
-    .onConflictDoNothing();
+    .onConflictDoUpdate({
+      target: triageDecisions.id,
+      set: {
+        outcome: input.outcome,
+        reason: input.reason,
+        guardResultsJson: JSON.stringify(input.guardResults),
+        createdAt: now,
+        ownerEmail: input.userEmail,
+      },
+    });
   return id;
 }
 
 export default defineAction({
   description:
-    "Start the governed clear-bug Builder flow for a Factory item. Slack items are kept in-thread by adding 👀 and tagging @builder.io; grouped Slack repeats share one Builder thread. GitHub issues and Sentry errors use the Builder agent run API. Owner-managed Clips, Design, and Content items are always left for their owner.",
+    "Start the governed clear-bug Builder flow for a Factory item, or record a skip with a reason when clearBug is false. Slack items are kept in-thread by adding 👀 and tagging @builder.io; grouped Slack repeats share one Builder thread. GitHub issues and Sentry errors use the Builder agent run API. Owner-managed Clips, Design, and Content items are always left for their owner.",
   schema: z.object({
     itemId: z.string().min(1),
     clearBug: z.boolean(),
@@ -340,17 +350,12 @@ export default defineAction({
         : []),
     ];
     const blocked = guardResults.some((guard) => !guard.passed);
-    const decisionId = await recordDecision({
+    const decisionId = await recordAutomaticBuilderDecision({
       itemId,
       userEmail,
       orgId,
       outcome: blocked ? "needs_manual" : "propose_fix",
-      reason: blocked
-        ? guardResults
-            .filter((guard) => !guard.passed)
-            .map((guard) => guard.reason)
-            .join(" ")
-        : reason,
+      reason,
       guardResults,
     });
     await recordFactoryAudit(
@@ -363,7 +368,7 @@ export default defineAction({
         source: item.source,
         sourceUrl: item.sourceUrl,
         status: blocked ? "skipped" : "success",
-        summary: blocked ? "Factory kept this item for manual review." : reason,
+        summary: reason,
         details: {
           decisionId,
           clearBug,
@@ -383,10 +388,7 @@ export default defineAction({
         started: false,
         needsManual: true,
         decisionId,
-        reason: guardResults
-          .filter((guard) => !guard.passed)
-          .map((guard) => guard.reason)
-          .join(" "),
+        reason,
       };
     }
 
@@ -550,7 +552,7 @@ export default defineAction({
             .where(
               and(eq(triageItems.id, related.id), eq(triageItems.orgId, orgId)),
             );
-          await recordDecision({
+          await recordAutomaticBuilderDecision({
             itemId: related.id,
             userEmail,
             orgId,

package/corpus/templates/factory/app/components/factory/FactoryAuditView.tsx

@@ -1,3 +1,4 @@
+import { requestAgentChatThreadOpen } from "@agent-native/core/client/agent-chat";
 import { useActionQuery } from "@agent-native/core/client/hooks";
 import { useT } from "@agent-native/core/client/i18n";
 import {
@@ -8,7 +9,7 @@ import {
   IconExternalLink,
   IconSearch,
 } from "@tabler/icons-react";
-import { useEffect, useMemo } from "react";
+import { useEffect, useMemo, useRef } from "react";
 import { useSearchParams } from "react-router";
 
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
@@ -70,6 +71,7 @@ export function FactoryAuditView({
 }) {
   const t = useT();
   const [searchParams, setSearchParams] = useSearchParams();
+  const viewRef = useRef<HTMLDivElement>(null);
   const selectedRunId = searchParams.get("auditRunId");
   const auditQuery = useActionQuery<FactoryAuditResponse>(
     "list-factory-audit",
@@ -109,8 +111,13 @@ export function FactoryAuditView({
     );
   }
 
+  useEffect(() => {
+    if (!selectedRunId) return;
+    viewRef.current?.scrollIntoView({ block: "start" });
+  }, [selectedRunId]);
+
   return (
-    <div className="p-4 lg:p-6">
+    <div ref={viewRef} className="p-4 lg:p-6">
       {auditQuery.isError ? (
         <Card>
           <CardContent className="flex items-start gap-2 p-4 text-sm text-destructive">
@@ -144,30 +151,38 @@ export function FactoryAuditView({
             </CardHeader>
             <CardContent className="p-0">
               <div className="grid gap-1.5 p-2">
-                {runs.map((run) => (
-                  <button
-                    key={run.id}
-                    type="button"
-                    className={`w-full cursor-pointer rounded-lg bg-muted/20 p-3 text-left transition-colors hover:bg-muted/50 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring ${selectedRun?.id === run.id ? "bg-muted/60" : ""}`}
-                    onClick={() => selectRun(run.id)}
-                  >
-                    <div className="flex items-center justify-between gap-3">
-                      <span className="min-w-0 truncate text-sm font-medium">
-                        {formatAutomationName(run.automation)}
-                      </span>
-                      <AuditStatus status={run.status} />
-                    </div>
-                    <div className="mt-1 flex items-center justify-between gap-2 text-xs text-muted-foreground">
-                      <span className="shrink-0">
-                        {formatAuditAge(run.startedAt)}
-                      </span>
-                      <span className="shrink-0">
-                        {run.events.length}{" "}
-                        {formatAuditCountLabel(run.events.length)}
-                      </span>
-                    </div>
-                  </button>
-                ))}
+                {runs.map((run) => {
+                  const selected = selectedRun?.id === run.id;
+                  return (
+                    <button
+                      key={run.id}
+                      type="button"
+                      aria-current={selected ? "true" : undefined}
+                      className={`w-full cursor-pointer rounded-lg p-3 text-left transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring ${
+                        selected
+                          ? "bg-primary/10 ring-1 ring-inset ring-primary/40"
+                          : "bg-muted/20 hover:bg-muted/50"
+                      }`}
+                      onClick={() => selectRun(run.id)}
+                    >
+                      <div className="flex items-center justify-between gap-3">
+                        <span className="min-w-0 truncate text-sm font-medium">
+                          {formatAutomationName(run.automation)}
+                        </span>
+                        <AuditStatus status={run.status} />
+                      </div>
+                      <div className="mt-1 flex items-center justify-between gap-2 text-xs text-muted-foreground">
+                        <span className="shrink-0">
+                          {formatAuditAge(run.startedAt)}
+                        </span>
+                        <span className="shrink-0">
+                          {run.events.length}{" "}
+                          {formatAuditCountLabel(run.events.length)}
+                        </span>
+                      </div>
+                    </button>
+                  );
+                })}
               </div>
             </CardContent>
           </Card>
@@ -190,7 +205,9 @@ export function FactoryAuditView({
               </div>
             </CardHeader>
             <CardContent className="pt-4">
-              {selectedRun && <AuditRunDetail run={selectedRun} />}
+              {selectedRun && (
+                <AuditRunDetail run={selectedRun} factoryId={factoryId} />
+              )}
             </CardContent>
           </Card>
         </div>
@@ -199,7 +216,13 @@ export function FactoryAuditView({
   );
 }
 
-function AuditRunDetail({ run }: { run: FactoryAuditRun }) {
+function AuditRunDetail({
+  run,
+  factoryId,
+}: {
+  run: FactoryAuditRun;
+  factoryId: string;
+}) {
   const t = useT();
   const groups = useMemo(() => groupAuditEvents(run.events), [run.events]);
   const itemCount = new Set(
@@ -229,10 +252,22 @@ function AuditRunDetail({ run }: { run: FactoryAuditRun }) {
         {run.threadId && (
           <a
             href={`/chat/${encodeURIComponent(run.threadId)}`}
-            className="ml-auto inline-flex items-center gap-1 text-primary hover:underline"
+            className="ml-auto inline-flex items-center text-primary hover:underline"
+            onClick={(event) => {
+              if (
+                event.metaKey ||
+                event.ctrlKey ||
+                event.shiftKey ||
+                event.altKey ||
+                event.button !== 0
+              ) {
+                return;
+              }
+              event.preventDefault();
+              requestAgentChatThreadOpen({ threadId: run.threadId! });
+            }}
           >
             {t("factoryRoute.auditOpenThread")}
-            <IconExternalLink className="size-3" />
           </a>
         )}
       </div>
@@ -260,7 +295,11 @@ function AuditRunDetail({ run }: { run: FactoryAuditRun }) {
         ) : (
           <div className="grid gap-1.5">
             {groups.map((group) => (
-              <AuditItemRow key={group.key} group={group} />
+              <AuditItemRow
+                key={group.key}
+                group={group}
+                factoryId={factoryId}
+              />
             ))}
           </div>
         )}
@@ -269,15 +308,20 @@ function AuditRunDetail({ run }: { run: FactoryAuditRun }) {
   );
 }
 
-function AuditItemRow({ group }: { group: AuditItemGroup }) {
+function AuditItemRow({
+  group,
+  factoryId,
+}: {
+  group: AuditItemGroup;
+  factoryId: string;
+}) {
   const t = useT();
   const decision = group.decision;
   const rationale = decision?.summary ?? group.externalAction?.summary ?? null;
-  const sourceLink =
-    group.sourceUrl ?? group.events.find((event) => event.sourceUrl)?.sourceUrl;
+  const sourceLink = resolveAuditSourceLink(group);
 
   return (
-    <details className="group rounded-lg bg-muted/20">
+    <details className="group overflow-hidden rounded-lg border border-border bg-muted/20">
       <summary className="flex cursor-pointer list-none items-center gap-3 rounded-lg px-3 py-3 hover:bg-muted/40 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-inset focus-visible:ring-ring [&::-webkit-details-marker]:hidden">
         <AuditSourceIcon source={group.source} />
         <div className="min-w-0 flex-1">
@@ -336,7 +380,7 @@ function AuditItemRow({ group }: { group: AuditItemGroup }) {
           <div className="mt-4 flex flex-wrap items-center gap-x-4 gap-y-2 bg-background/40 px-3 py-3 text-xs">
             {group.itemId && (
               <a
-                href={`/factory?tab=inbox&itemId=${encodeURIComponent(group.itemId)}`}
+                href={`/factory?factoryId=${encodeURIComponent(factoryId)}&tab=inbox&itemId=${encodeURIComponent(group.itemId)}`}
                 className="text-primary hover:underline"
               >
                 {t("factoryRoute.auditOpenItem")}
@@ -579,6 +623,26 @@ function formatAuditSource(source: string | null): string {
   return source ? formatAuditLabel(source) : "Factory";
 }
 
+function resolveAuditSourceLink(group: AuditItemGroup): string | null {
+  const storedUrl =
+    group.sourceUrl ??
+    group.events.find((event) => event.sourceUrl)?.sourceUrl ??
+    null;
+  if (storedUrl) return storedUrl;
+
+  for (const event of group.events) {
+    const channelId = readStringDetail(event.details, "channelId");
+    const threadTs = readStringDetail(event.details, "threadTs");
+    if (channelId && threadTs) return slackThreadUrl(channelId, threadTs);
+  }
+  return null;
+}
+
+function slackThreadUrl(channelId: string, threadTs: string): string {
+  const compactTs = threadTs.replace(".", "");
+  return `https://slack.com/archives/${encodeURIComponent(channelId)}/p${compactTs}?thread_ts=${encodeURIComponent(threadTs)}`;
+}
+
 function formatAutomationName(value: string): string {
   const words = value
     .replace(/^factory-/, "")

package/corpus/templates/factory/app/i18n/en-US.ts

@@ -69,6 +69,7 @@ const messages = {
     status: "Status",
     coverage: "Coverage",
     reason: "Reason",
+    updatedAt: "Updated",
     detailTitle: "Decision detail",
     selectItem: "Select an item to inspect its evidence and decisions.",
     detailError: "Could not load this observation.",
@@ -221,11 +222,14 @@ const messages = {
     automationSchedulePlaceholder: "For example, every weekday at 9:00 AM",
     automationEnabledLabel: "Automation is enabled",
     automationPrompt: "Prompt",
+    automationLastUpdated: "last updated",
     automationPromptPlaceholder: "What should Factory do when this runs?",
     promptEditorHint: "Edit here, then save the automation.",
     pastRuns: "Past runs",
     pastRunsEmpty: "No runs recorded yet.",
     saveAutomation: "Save",
+    automationSaved: "Saved",
+    automationSaveFailed: "Could not save the automation.",
     runNow: "Run now",
     automationHealthTitle: "Scheduler health",
     automationHealthDescription: