@agent-native/core 0.165.0 → 0.165.1

package/corpus/README.md

@@ -31,4 +31,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- template files: 8484
+- template files: 8485

package/corpus/templates/dispatch/changelog/2026-08-20-dispatch-chat-loads-openrouter-provider-reliably.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-20
+---
+
+Dispatch chat now loads its OpenRouter provider reliably in production.

package/corpus/templates/dispatch/package.json

@@ -19,9 +19,11 @@
     "@agent-native/toolkit": "workspace:*",
     "@fontsource-variable/inter": "^5.2.8",
     "@libsql/client": "^0.15.8",
+    "@openrouter/ai-sdk-provider": "^2.9.1",
     "@radix-ui/react-tooltip": "^1.2.7",
     "@tabler/icons-react": "catalog:",
     "@tanstack/react-query": "^5.99.2",
+    "ai": "6.0.258",
     "h3": "catalog:",
     "isbot": "^5",
     "next-themes": "^0.4.6",

package/corpus/templates/macros/netlify.toml

@@ -12,6 +12,8 @@ NPM_CONFIG_PRODUCTION = "false"
 
 [context.production.environment]
 AGENT_NATIVE_HOSTED_HARNESS = "true"
+AGENT_NATIVE_ENABLE_KEEP_WARM = "1"
+AGENT_NATIVE_DISABLE_KEEP_WARM_BACKGROUND = "1"
 # Macros owns its schema at release time (`migrate:production` above), so
 # production request functions must not probe the database for migrations.
 # Preview functions still run request-path migrations because previews do not

package/dist/client/integrations/IntegrationsPanel.js

@@ -239,6 +239,15 @@ function compareMcpUrl(value) {
         return value.trim().replace(/\/+$/, "");
     }
 }
+function startMcpOAuthReconnect(server) {
+    const returnUrl = `${window.location.pathname}${window.location.search}${window.location.hash}`;
+    const params = new URLSearchParams({
+        serverId: server.id,
+        scope: server.scope,
+        return: returnUrl,
+    });
+    window.location.assign(agentNativePath(`/_agent-native/mcp/servers/oauth/start?${params}`));
+}
 function McpServerStatus({ server, onReconnect, reconnecting = false, reconnectError, }) {
     const t = useT();
     if (server.status.state === "connected") {
@@ -362,7 +371,9 @@ function McpIntegrationsSection({ query }) {
                                 return (_jsxs("div", { className: "flex items-start gap-3 py-3.5", children: [_jsx("span", { className: "mt-0.5 flex size-9 shrink-0 items-center justify-center rounded-lg border border-border/70 bg-background text-muted-foreground", children: _jsx(IconServer, { className: "size-4" }) }), _jsxs("div", { className: "min-w-0 flex-1", children: [_jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [_jsx("span", { className: "truncate text-sm font-medium text-foreground", children: server.name }), _jsx("span", { className: "text-[11px] text-muted-foreground", children: server.scope === "user"
                                                                 ? t("mcpIntegrations.personal")
                                                                 : t("mcpIntegrations.sharedWithWorkspace") })] }), _jsx(McpServerStatus, { server: server, onReconnect: server.status.state === "error"
-                                                        ? () => void reconnect(server)
+                                                        ? () => server.authMode === "oauth"
+                                                            ? startMcpOAuthReconnect(server)
+                                                            : void reconnect(server)
                                                         : undefined, reconnecting: reconnectingKey === key, reconnectError: reconnectError?.key === key
                                                         ? reconnectError.message
                                                         : undefined })] }), canRemove && (_jsx("button", { type: "button", onClick: () => void removeServer(server), disabled: deleteServer.isPending, className: "shrink-0 rounded-md border border-border px-2.5 py-1.5 text-xs font-medium text-foreground transition-colors hover:bg-accent disabled:opacity-50", children: deleteTarget === key ? "Confirm" : "Remove" }))] }, key));

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/mcp-client/oauth-routes.d.ts

@@ -16,6 +16,7 @@ export interface McpOAuthFlow {
     clientInformation: StoredOAuthClientInformation;
     discoveryState?: McpOAuthDiscoveryState;
     returnUrl?: string;
+    replaceServerId?: string;
     expiresAt: number;
 }
 export interface McpOAuthRoutesOptions {

package/dist/mcp-client/oauth-routes.js

@@ -8,7 +8,7 @@ import { getH3App } from "../server/framework-request-handler.js";
 import { getAppUrl, resolveOAuthRedirectUri } from "../server/google-oauth.js";
 import { runWithRequestContext } from "../server/request-context.js";
 import { finishMcpOAuthAuthorization, startMcpOAuthAuthorization, validateMcpOAuthCallbackIssuer, } from "./oauth-client.js";
-import { addOAuthRemoteServer, normalizeServerName, validateRemoteUrl, } from "./remote-store.js";
+import { addOAuthRemoteServer, listRemoteServers, normalizeServerName, replaceOAuthRemoteServer, validateRemoteUrl, } from "./remote-store.js";
 const FLOW_COOKIE = "an_mcp_oauth_flow";
 const FLOW_TTL_SECONDS = 10 * 60;
 const FLOW_COOKIE_CHUNK_SIZE = 2_800;
@@ -69,8 +69,33 @@ async function handleMcpOAuthStart(event) {
     if (!session?.email)
         return unauthorized(event);
     const query = getQuery(event);
-    const rawUrl = text(query.url);
-    const rawName = text(query.name);
+    const reconnectServerId = text(query.serverId);
+    const reconnectScope = query.scope === "org" ? "org" : "user";
+    const reconnectOrg = reconnectScope === "org" ? await getOrgContext(event) : null;
+    const reconnectScopeId = reconnectScope === "user" ? session.email : (reconnectOrg?.orgId ?? "");
+    let reconnectServer;
+    if (reconnectServerId) {
+        if (reconnectScope === "org" &&
+            (!reconnectScopeId || !isOrgAdmin(reconnectOrg?.role))) {
+            setResponseStatus(event, reconnectScopeId ? 403 : 400);
+            return {
+                error: reconnectScopeId
+                    ? "Only organization owners and admins can reconnect an org MCP server."
+                    : "Join an organization before reconnecting an org MCP server.",
+            };
+        }
+        reconnectServer = (await listRemoteServers(reconnectScope, reconnectScopeId)).find((server) => server.id === reconnectServerId);
+        if (!reconnectServer) {
+            setResponseStatus(event, 404);
+            return { error: "MCP server was not found." };
+        }
+        if (!reconnectServer.oauthSecretKey) {
+            setResponseStatus(event, 400);
+            return { error: "This MCP server does not use OAuth credentials." };
+        }
+    }
+    const rawUrl = reconnectServer?.url ?? text(query.url);
+    const rawName = reconnectServer?.name ?? text(query.name);
     const returnUrl = text(query.return);
     if (!rawUrl || !rawName) {
         setResponseStatus(event, 400);
@@ -159,6 +184,7 @@ async function handleMcpOAuthStart(event) {
                 ? { discoveryState: started.discoveryState }
                 : {}),
             ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),
+            ...(reconnectServerId ? { replaceServerId: reconnectServerId } : {}),
             expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
         };
         setMcpOAuthFlowCookie(event, flow, redirectUri.startsWith("https://"));
@@ -245,12 +271,14 @@ async function handleMcpOAuthCallback(event, options) {
             authorizationCode: code,
             iss,
         }));
-        const result = await addOAuthRemoteServer(flow.scope, flow.scopeId, {
-            name: flow.name,
-            url: flow.url,
-            description: flow.description,
-            credentials: finished.credentials,
-        });
+        const result = flow.replaceServerId
+            ? await replaceOAuthRemoteServer(flow.scope, flow.scopeId, flow.replaceServerId, finished.credentials)
+            : await addOAuthRemoteServer(flow.scope, flow.scopeId, {
+                name: flow.name,
+                url: flow.url,
+                description: flow.description,
+                credentials: finished.credentials,
+            });
         if (!result.ok) {
             setResponseStatus(event, 400);
             return { error: result.error };

package/dist/mcp-client/remote-store.d.ts

@@ -107,6 +107,18 @@ export declare function addOAuthRemoteServer(scope: RemoteMcpScope, scopeId: str
     ok: false;
     error: string;
 }>;
+/**
+ * Replace the OAuth grant for an existing server without changing its id or
+ * display name. Reconnect must update the saved grant in place; registering a
+ * second row makes the original connection impossible to repair.
+ */
+export declare function replaceOAuthRemoteServer(scope: RemoteMcpScope, scopeId: string, serverId: string, credentials: McpOAuthCredentialBundle): Promise<{
+    ok: true;
+    server: StoredRemoteMcpServer;
+} | {
+    ok: false;
+    error: string;
+}>;
 export declare function addFirstPartyRemoteServer(orgId: string, input: {
     appId: string;
     name: string;

package/dist/mcp-client/remote-store.js

@@ -193,6 +193,77 @@ export async function addOAuthRemoteServer(scope, scopeId, input) {
         };
     }
 }
+/**
+ * Replace the OAuth grant for an existing server without changing its id or
+ * display name. Reconnect must update the saved grant in place; registering a
+ * second row makes the original connection impossible to repair.
+ */
+export async function replaceOAuthRemoteServer(scope, scopeId, serverId, credentials) {
+    const credentialResource = validateRemoteUrl(credentials.serverUrl);
+    if (!credentialResource.ok || !credentialResource.url) {
+        return {
+            ok: false,
+            error: "MCP server URL must match the OAuth credential resource URL",
+        };
+    }
+    const existing = await readList(scope, scopeId);
+    const index = existing.findIndex((server) => server.id === serverId);
+    const current = index >= 0 ? existing[index] : undefined;
+    if (!current)
+        return { ok: false, error: "MCP server was not found" };
+    if (!current.oauthSecretKey) {
+        return {
+            ok: false,
+            error: "This MCP server does not use OAuth credentials",
+        };
+    }
+    if (current.url !== credentialResource.url.toString()) {
+        return {
+            ok: false,
+            error: "MCP server URL must match the saved OAuth connection",
+        };
+    }
+    const nextSecretKey = `mcp_oauth:${shortId()}`;
+    const nextCredentials = {
+        ...credentials,
+        serverUrl: credentialResource.url.toString(),
+    };
+    try {
+        await saveMcpOAuthCredentials({
+            key: nextSecretKey,
+            scope,
+            scopeId,
+            credentials: nextCredentials,
+        });
+        const server = {
+            ...current,
+            url: nextCredentials.serverUrl,
+            oauthSecretKey: nextSecretKey,
+        };
+        const next = [...existing];
+        next[index] = server;
+        await writeList(scope, scopeId, next);
+        await revokeMcpOAuthCredentials({
+            key: current.oauthSecretKey,
+            scope,
+            scopeId,
+            serverUrl: current.url,
+        }).catch(() => undefined);
+        return { ok: true, server };
+    }
+    catch (err) {
+        await revokeMcpOAuthCredentials({
+            key: nextSecretKey,
+            scope,
+            scopeId,
+            serverUrl: nextCredentials.serverUrl,
+        }).catch(() => undefined);
+        return {
+            ok: false,
+            error: `Failed to replace MCP OAuth credentials: ${err?.message ?? err}`,
+        };
+    }
+}
 export async function addFirstPartyRemoteServer(orgId, input) {
     const trust = await isFirstPartyRemoteEndpointTrusted(orgId, input.appId, input.url);
     if (!trust.ok)

package/dist/notifications/routes.d.ts

@@ -13,13 +13,13 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
     updated?: undefined;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated: number;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated?: undefined;
@@ -28,6 +28,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/resources/handlers.d.ts

@@ -51,8 +51,8 @@ export declare function handleDeleteResource(event: any): Promise<{
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -73,10 +73,10 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
+    error?: undefined;
     url: string;
     provider: string;
     storageSetupRequired?: undefined;
-    error?: undefined;
 } | {
     error: string;
     storageSetupRequired: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.165.0",
+  "version": "0.165.1",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -427,8 +427,8 @@
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.32",
     "zod": "^4.3.6",
-    "@agent-native/recap-cli": "0.5.5",
-    "@agent-native/toolkit": "^0.16.8"
+    "@agent-native/toolkit": "^0.16.8",
+    "@agent-native/recap-cli": "0.5.5"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",