@agent-native/core 0.165.0 → 0.165.2

package/dist/mcp-client/oauth-routes.js

@@ -8,7 +8,7 @@ import { getH3App } from "../server/framework-request-handler.js";
 import { getAppUrl, resolveOAuthRedirectUri } from "../server/google-oauth.js";
 import { runWithRequestContext } from "../server/request-context.js";
 import { finishMcpOAuthAuthorization, startMcpOAuthAuthorization, validateMcpOAuthCallbackIssuer, } from "./oauth-client.js";
-import { addOAuthRemoteServer, normalizeServerName, validateRemoteUrl, } from "./remote-store.js";
+import { addOAuthRemoteServer, listRemoteServers, normalizeServerName, replaceOAuthRemoteServer, validateRemoteUrl, } from "./remote-store.js";
 const FLOW_COOKIE = "an_mcp_oauth_flow";
 const FLOW_TTL_SECONDS = 10 * 60;
 const FLOW_COOKIE_CHUNK_SIZE = 2_800;
@@ -69,8 +69,33 @@ async function handleMcpOAuthStart(event) {
     if (!session?.email)
         return unauthorized(event);
     const query = getQuery(event);
-    const rawUrl = text(query.url);
-    const rawName = text(query.name);
+    const reconnectServerId = text(query.serverId);
+    const reconnectScope = query.scope === "org" ? "org" : "user";
+    const reconnectOrg = reconnectScope === "org" ? await getOrgContext(event) : null;
+    const reconnectScopeId = reconnectScope === "user" ? session.email : (reconnectOrg?.orgId ?? "");
+    let reconnectServer;
+    if (reconnectServerId) {
+        if (reconnectScope === "org" &&
+            (!reconnectScopeId || !isOrgAdmin(reconnectOrg?.role))) {
+            setResponseStatus(event, reconnectScopeId ? 403 : 400);
+            return {
+                error: reconnectScopeId
+                    ? "Only organization owners and admins can reconnect an org MCP server."
+                    : "Join an organization before reconnecting an org MCP server.",
+            };
+        }
+        reconnectServer = (await listRemoteServers(reconnectScope, reconnectScopeId)).find((server) => server.id === reconnectServerId);
+        if (!reconnectServer) {
+            setResponseStatus(event, 404);
+            return { error: "MCP server was not found." };
+        }
+        if (!reconnectServer.oauthSecretKey) {
+            setResponseStatus(event, 400);
+            return { error: "This MCP server does not use OAuth credentials." };
+        }
+    }
+    const rawUrl = reconnectServer?.url ?? text(query.url);
+    const rawName = reconnectServer?.name ?? text(query.name);
     const returnUrl = text(query.return);
     if (!rawUrl || !rawName) {
         setResponseStatus(event, 400);
@@ -159,6 +184,7 @@ async function handleMcpOAuthStart(event) {
                 ? { discoveryState: started.discoveryState }
                 : {}),
             ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),
+            ...(reconnectServerId ? { replaceServerId: reconnectServerId } : {}),
             expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
         };
         setMcpOAuthFlowCookie(event, flow, redirectUri.startsWith("https://"));
@@ -245,12 +271,14 @@ async function handleMcpOAuthCallback(event, options) {
             authorizationCode: code,
             iss,
         }));
-        const result = await addOAuthRemoteServer(flow.scope, flow.scopeId, {
-            name: flow.name,
-            url: flow.url,
-            description: flow.description,
-            credentials: finished.credentials,
-        });
+        const result = flow.replaceServerId
+            ? await replaceOAuthRemoteServer(flow.scope, flow.scopeId, flow.replaceServerId, finished.credentials)
+            : await addOAuthRemoteServer(flow.scope, flow.scopeId, {
+                name: flow.name,
+                url: flow.url,
+                description: flow.description,
+                credentials: finished.credentials,
+            });
         if (!result.ok) {
             setResponseStatus(event, 400);
             return { error: result.error };

package/dist/mcp-client/remote-store.d.ts

@@ -107,6 +107,18 @@ export declare function addOAuthRemoteServer(scope: RemoteMcpScope, scopeId: str
     ok: false;
     error: string;
 }>;
+/**
+ * Replace the OAuth grant for an existing server without changing its id or
+ * display name. Reconnect must update the saved grant in place; registering a
+ * second row makes the original connection impossible to repair.
+ */
+export declare function replaceOAuthRemoteServer(scope: RemoteMcpScope, scopeId: string, serverId: string, credentials: McpOAuthCredentialBundle): Promise<{
+    ok: true;
+    server: StoredRemoteMcpServer;
+} | {
+    ok: false;
+    error: string;
+}>;
 export declare function addFirstPartyRemoteServer(orgId: string, input: {
     appId: string;
     name: string;

package/dist/mcp-client/remote-store.js

@@ -193,6 +193,77 @@ export async function addOAuthRemoteServer(scope, scopeId, input) {
         };
     }
 }
+/**
+ * Replace the OAuth grant for an existing server without changing its id or
+ * display name. Reconnect must update the saved grant in place; registering a
+ * second row makes the original connection impossible to repair.
+ */
+export async function replaceOAuthRemoteServer(scope, scopeId, serverId, credentials) {
+    const credentialResource = validateRemoteUrl(credentials.serverUrl);
+    if (!credentialResource.ok || !credentialResource.url) {
+        return {
+            ok: false,
+            error: "MCP server URL must match the OAuth credential resource URL",
+        };
+    }
+    const existing = await readList(scope, scopeId);
+    const index = existing.findIndex((server) => server.id === serverId);
+    const current = index >= 0 ? existing[index] : undefined;
+    if (!current)
+        return { ok: false, error: "MCP server was not found" };
+    if (!current.oauthSecretKey) {
+        return {
+            ok: false,
+            error: "This MCP server does not use OAuth credentials",
+        };
+    }
+    if (current.url !== credentialResource.url.toString()) {
+        return {
+            ok: false,
+            error: "MCP server URL must match the saved OAuth connection",
+        };
+    }
+    const nextSecretKey = `mcp_oauth:${shortId()}`;
+    const nextCredentials = {
+        ...credentials,
+        serverUrl: credentialResource.url.toString(),
+    };
+    try {
+        await saveMcpOAuthCredentials({
+            key: nextSecretKey,
+            scope,
+            scopeId,
+            credentials: nextCredentials,
+        });
+        const server = {
+            ...current,
+            url: nextCredentials.serverUrl,
+            oauthSecretKey: nextSecretKey,
+        };
+        const next = [...existing];
+        next[index] = server;
+        await writeList(scope, scopeId, next);
+        await revokeMcpOAuthCredentials({
+            key: current.oauthSecretKey,
+            scope,
+            scopeId,
+            serverUrl: current.url,
+        }).catch(() => undefined);
+        return { ok: true, server };
+    }
+    catch (err) {
+        await revokeMcpOAuthCredentials({
+            key: nextSecretKey,
+            scope,
+            scopeId,
+            serverUrl: nextCredentials.serverUrl,
+        }).catch(() => undefined);
+        return {
+            ok: false,
+            error: `Failed to replace MCP OAuth credentials: ${err?.message ?? err}`,
+        };
+    }
+}
 export async function addFirstPartyRemoteServer(orgId, input) {
     const trust = await isFirstPartyRemoteEndpointTrusted(orgId, input.appId, input.url);
     if (!trust.ok)

package/dist/notifications/routes.d.ts

@@ -16,18 +16,18 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     ok?: undefined;
     error?: undefined;
 } | {
-    count?: undefined;
     updated: number;
     ok?: undefined;
     error?: undefined;
-} | {
     count?: undefined;
+} | {
     updated?: undefined;
     error: string;
     ok?: undefined;
-} | {
     count?: undefined;
+} | {
     updated?: undefined;
     ok: boolean;
     error?: undefined;
+    count?: undefined;
 }>>;

package/dist/provider-api/actions/provider-api.js

@@ -193,6 +193,13 @@ export function createProviderApiDocsSchema(providerSchema = z.string().min(1))
         search: WebContentSearchSchema.optional().describe("Optional post-fetch search over extracted content by default. Supports query, queries, terms, regex, source, maxMatches, and contextChars."),
     });
 }
+const STAGED_DATASET_CAP_ERROR = /Staged dataset (?:byte )?cap exceeded/i;
+function rethrowStagingError(error) {
+    if (error instanceof Error && STAGED_DATASET_CAP_ERROR.test(error.message)) {
+        throw new Error(`${error.message} Recover by deleting older staged datasets with list-staged-datasets/delete-staged-dataset, or switch this request to saveToFile / a smaller staged result before trying again.`, { cause: error });
+    }
+    throw error;
+}
 export function createProviderApiRequestAction(runtime, options = {}) {
     const schema = options.schema ?? createProviderApiRequestSchema();
     return defineAction({
@@ -244,10 +251,15 @@ export function createProviderApiRequestAction(runtime, options = {}) {
                 if (!ownerEmail) {
                     throw new Error("No authenticated context for provider API staging.");
                 }
-                return stagingExecuteRequest(args, runtime.executeRequest, {
-                    appId: options.appId,
-                    ownerEmail,
-                });
+                try {
+                    return await stagingExecuteRequest(args, runtime.executeRequest, {
+                        appId: options.appId,
+                        ownerEmail,
+                    });
+                }
+                catch (error) {
+                    rethrowStagingError(error);
+                }
             }
             return runtime.executeRequest(args);
         },

package/dist/resources/handlers.d.ts

@@ -51,8 +51,8 @@ export declare function handleDeleteResource(event: any): Promise<{
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -73,10 +73,10 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
+    error?: undefined;
     url: string;
     provider: string;
     storageSetupRequired?: undefined;
-    error?: undefined;
 } | {
     error: string;
     storageSetupRequired: boolean;

package/dist/templates/chat/CHANGELOG.md

@@ -3,8 +3,34 @@
 All notable user-facing changes to Chat are documented here. Open it any
 time from the command menu (Cmd+K → "What's new").
 
-## 2026-06-23
+Older updates live in [the changelog folder](./changelog/) and are included in the in-app "What's new" view.
 
-### Added
+## 2026-08-11
 
-- See what's new right inside Chat — a changelog now lives in the command menu (Cmd+K).
+### Fixed
+
+- Chrome no longer offers to install Chat as a desktop app.
+
+## 2026-08-10
+
+### Improved
+
+- Full-page chat now uses the available width up to 1000px for more comfortable prompts and responses.
+
+## 2026-07-31
+
+### Improved
+
+- Clicking the Agent Native logo now toggles the app sidebar.
+
+## 2026-07-29
+
+### Improved
+
+- Sidebar footers now keep Feedback, Search, and Collapse together without a separate language shortcut.
+
+## 2026-07-25
+
+### Improved
+
+- Settings navigation now keeps Manage agent as a dedicated linked destination at the bottom.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.165.0",
+  "version": "0.165.2",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/src/templates/chat/CHANGELOG.md

@@ -3,8 +3,34 @@
 All notable user-facing changes to Chat are documented here. Open it any
 time from the command menu (Cmd+K → "What's new").
 
-## 2026-06-23
+Older updates live in [the changelog folder](./changelog/) and are included in the in-app "What's new" view.
 
-### Added
+## 2026-08-11
 
-- See what's new right inside Chat — a changelog now lives in the command menu (Cmd+K).
+### Fixed
+
+- Chrome no longer offers to install Chat as a desktop app.
+
+## 2026-08-10
+
+### Improved
+
+- Full-page chat now uses the available width up to 1000px for more comfortable prompts and responses.
+
+## 2026-07-31
+
+### Improved
+
+- Clicking the Agent Native logo now toggles the app sidebar.
+
+## 2026-07-29
+
+### Improved
+
+- Sidebar footers now keep Feedback, Search, and Collapse together without a separate language shortcut.
+
+## 2026-07-25
+
+### Improved
+
+- Settings navigation now keeps Manage agent as a dedicated linked destination at the bottom.

package/corpus/templates/.retired/issues/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "issues",
-  "private": true,
-  "scripts": {
-    "build": "node ../../../scripts/build-retired-netlify-site.ts issues"
-  }
-}

package/corpus/templates/.retired/meeting-notes/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "meeting-notes",
-  "private": true,
-  "scripts": {
-    "build": "node ../../../scripts/build-retired-netlify-site.ts meeting-notes"
-  }
-}

package/corpus/templates/.retired/recruiting/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "recruiting",
-  "private": true,
-  "scripts": {
-    "build": "node ../../../scripts/build-retired-netlify-site.ts recruiting"
-  }
-}

package/corpus/templates/.retired/scheduling/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "scheduling",
-  "private": true,
-  "scripts": {
-    "build": "node ../../../scripts/build-retired-netlify-site.ts scheduling"
-  }
-}

package/corpus/templates/.retired/voice/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "voice",
-  "private": true,
-  "scripts": {
-    "build": "node ../../../scripts/build-retired-netlify-site.ts voice"
-  }
-}

package/corpus/templates/voice/.agents/skills/upgrade-agent-native/SKILL.md

@@ -1,87 +0,0 @@
----
-name: upgrade-agent-native
-description: >-
-  Bring an older Agent Native app or workspace current. Use when updating
-  @agent-native/core, fixing a broken upgrade, or when tempted to patch or
-  override core/dispatch packages to make an old branch run.
-scope: dev
-metadata:
-  internal: true
----
-
-# Upgrade Agent Native
-
-## Rule
-
-When an older Agent Native app/branch needs to run on current packages, use
-`agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
-`@agent-native/core` or `@agent-native/dispatch`.
-
-## Why
-
-Agents often respond to a failed core bump by inventing framework patches and
-dispatch behavior overrides. That hides the real app-level break, drifts from
-upstream, and makes the next upgrade worse. The supported path is bump →
-install → refresh scaffold skills → verify, then fix **app** code only.
-
-## How
-
-1. **Doctor first (optional but recommended)**
-
-   ```bash
-   npx @agent-native/core@latest upgrade check
-   ```
-
-   This reports framework overrides/patches and pending `@agent-native/*`
-   bumps. If overrides/patches are present, remove them before continuing.
-
-2. **Run the upgrade**
-
-   ```bash
-   npx @agent-native/core@latest upgrade
-   ```
-
-   Or from an already-installed CLI: `pnpm exec agent-native upgrade` /
-   `agent-native upgrade`.
-
-   What it does:
-
-   - Blocks (unless `--force`) when `@agent-native/*` overrides/patches exist
-   - Rewrites non-local `@agent-native/*` dependency pins to `latest`
-   - Runs the package manager install
-   - Runs `skills update scaffold --project`
-   - Runs `typecheck` when the project has that script
-
-3. **If upgrade or typecheck fails**
-
-   - Read the concrete error
-   - Fix **app** source, actions, config, or env — not framework packages
-   - Re-run `agent-native upgrade` or `pnpm typecheck`
-   - Stop and ask the user if you cannot fix the app-level error
-
-4. **Dry-run / partial runs**
-
-   ```bash
-   agent-native upgrade --dry-run
-   agent-native upgrade --skip-verify
-   agent-native upgrade --skip-install   # package.json bumps only
-   ```
-
-## Don't
-
-- Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
-  `patchedDependencies` for any `@agent-native/*` package
-- Don't edit `node_modules/@agent-native/core` or
-  `node_modules/@agent-native/dispatch`
-- Don't invent local "dispatch behavior" shims to paper over version skew
-- Don't keep iterating with more framework patches after a failed install
-- Don't skip `skills update scaffold --project` after a core bump (the
-  upgrade command does this for you)
-
-## Related Skills
-
-- **self-modifying-code** — Tier 4: framework packages are off limits
-- **agent-native-docs** — version-matched docs after the bump
-- **portability** — keep app code provider-agnostic across upgrades