@agent-native/core 0.169.1 → 0.170.0

package/corpus/templates/design/shared/pen-path.ts

@@ -52,6 +52,43 @@ export function createSmoothNode(
   };
 }
 
+/**
+ * Per-drag memory for Figma's Alt-breaks-the-handle-pair gesture on a new pen
+ * anchor. Owned by the drag state, not by a single move event.
+ */
+export interface PenCuspLatch {
+  broken: boolean;
+  handleIn?: PenPoint;
+}
+
+export function createPenCuspLatch(): PenCuspLatch {
+  return { broken: false };
+}
+
+/**
+ * Builds the anchor a new-anchor drag is currently describing.
+ *
+ * Alt is a one-way latch for the life of the drag: releasing it does not
+ * re-mirror the pair, and breaking it freezes `handleIn` at the tangent it
+ * had when Alt went down rather than deleting it, so the segment already
+ * drawn keeps its curve. Alt held from the first tick has no earlier tangent
+ * to keep, leaving the incoming side a corner.
+ */
+export function createPenDragNode(
+  anchor: PenPoint,
+  handleOut: PenPoint,
+  latch: PenCuspLatch,
+  altKey: boolean,
+): PenNode {
+  if (altKey) latch.broken = true;
+  if (!latch.broken) latch.handleIn = mirrorPoint(anchor, handleOut);
+  return {
+    point: { ...anchor },
+    handleIn: latch.handleIn ? { ...latch.handleIn } : undefined,
+    handleOut: { ...handleOut },
+  };
+}
+
 export function appendPenNode(path: PenPath | null, node: PenNode): PenPath {
   return {
     nodes: [...(path?.nodes ?? []), clonePenNode(node)],

package/corpus/templates/design/vitest.config.ts

@@ -15,7 +15,13 @@ export default mergeConfig(
     test: {
       include: ["**/*.{test,spec}.?(c|m)[jt]s?(x)"],
       // e2e/ holds Playwright (@playwright/test) specs; run via `pnpm e2e`, not vitest.
-      exclude: ["**/node_modules/**", "**/.git/**", "**/dist/**", "**/e2e/**"],
+      exclude: [
+        "**/node_modules/**",
+        "**/.git/**",
+        "**/dist/**",
+        "**/.react-router/**",
+        "**/e2e/**",
+      ],
     },
   }),
 );

package/corpus/templates/dispatch/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/corpus/templates/dispatch/actions/list-workspace-connections.ts

@@ -8,6 +8,10 @@ import {
   isProviderApiId,
   listProviderApiCatalog,
 } from "@agent-native/core/provider-api";
+import {
+  hasWorkspaceProviderOAuthCredentials,
+  isGoogleWorkspaceOAuthProvider,
+} from "@agent-native/core/server";
 import {
   getWorkspaceConnectionAppAccess,
   listWorkspaceConnectionGrants,
@@ -46,6 +50,8 @@ type GrantSummary = {
   lastUsedAt?: string | null;
 };
 
+type GoogleOAuthAvailability = "configured" | "unconfigured";
+
 function unique(values: string[]) {
   return Array.from(
     new Set(values.map((value) => value.trim()).filter(Boolean)),
@@ -117,21 +123,40 @@ export default defineAction({
   }),
   http: { method: "GET" },
   run: async (args) => {
-    const providers = listWorkspaceConnectionProviders({
+    const catalogProviders = listWorkspaceConnectionProviders({
       capability: args.capability as WorkspaceConnectionCapability | undefined,
       templateUse: args.templateUse as
         | WorkspaceConnectionTemplateUse
         | undefined,
     });
-    const connections = await listWorkspaceConnections({
+    const googleOAuthAvailability: GoogleOAuthAvailability =
+      (await hasWorkspaceProviderOAuthCredentials("gmail"))
+        ? "configured"
+        : "unconfigured";
+    const googleOAuthConfigured = googleOAuthAvailability === "configured";
+    const providers = catalogProviders.filter(
+      (provider) =>
+        googleOAuthConfigured || !isGoogleWorkspaceOAuthProvider(provider.id),
+    );
+    const allConnections = await listWorkspaceConnections({
       provider: args.provider,
       appId: args.appId,
       includeDisabled: args.includeDisabled,
     });
-    const explicitGrants = await listWorkspaceConnectionGrants({
+    const connections = allConnections.filter(
+      (connection) =>
+        googleOAuthConfigured ||
+        !isGoogleWorkspaceOAuthProvider(connection.provider),
+    );
+    const allExplicitGrants = await listWorkspaceConnectionGrants({
       provider: args.provider,
       appId: args.appId,
     });
+    const explicitGrants = allExplicitGrants.filter(
+      (grant) =>
+        googleOAuthConfigured ||
+        !isGoogleWorkspaceOAuthProvider(grant.provider),
+    );
     const grantApps = await listGrantApps();
     const legacyGrants = connections.flatMap<GrantSummary>((connection) => {
       if (connection.allowedApps.length === 0) {
@@ -246,6 +271,12 @@ export default defineAction({
     });
 
     return {
+      availability: {
+        googleOAuth: {
+          status: googleOAuthAvailability,
+          retryable: false,
+        },
+      },
       providers: providersWithReadiness,
       connections,
       grants,

package/corpus/templates/dispatch/app/routes/integrations.tsx

@@ -5,8 +5,10 @@ import {
 } from "@agent-native/core/client/hooks";
 import { useT } from "@agent-native/core/client/i18n";
 import {
+  GoogleProductLogo,
   IntegrationConnectionChoice,
   IntegrationGrid,
+  startWorkspaceProviderOAuth as startManagedWorkspaceProviderOAuth,
 } from "@agent-native/core/client/integrations";
 import { useAppRoles, useOrgRole } from "@agent-native/core/client/org";
 import {
@@ -361,7 +363,8 @@ interface SetupWizardFormState {
 
 interface ProviderChoice {
   provider: WorkspaceConnectionProvider;
-  personalIntegration: DefaultMcpIntegration;
+  personalIntegration?: DefaultMcpIntegration;
+  personalOAuth?: boolean;
 }
 
 const EMPTY_RESPONSE: WorkspaceConnectionsResponse = {
@@ -433,9 +436,18 @@ const MCP_INTEGRATIONS_BY_ID = new Map(
   ]),
 );
 
-const PROVIDER_LOGO_IDS: Record<string, string> = {
-  google_drive: "google-workspace",
-};
+const GOOGLE_PRODUCT_BY_PROVIDER = {
+  gmail: "gmail",
+  google_calendar: "calendar",
+  google_docs: "docs",
+  google_drive: "drive",
+  google_sheets: "sheets",
+  google_slides: "slides",
+} as const;
+
+function isGoogleWorkspaceProvider(providerId: string): boolean {
+  return providerId in GOOGLE_PRODUCT_BY_PROVIDER;
+}
 
 function cx(...classes: Array<string | false | null | undefined>) {
   return classes.filter(Boolean).join(" ");
@@ -446,9 +458,14 @@ function iconForProvider(providerId: string): IconComponent {
 }
 
 function logoForProvider(providerId: string, providerName: string): ReactNode {
-  const integration = MCP_INTEGRATIONS_BY_ID.get(
-    PROVIDER_LOGO_IDS[providerId] ?? providerId,
-  );
+  const googleProduct =
+    GOOGLE_PRODUCT_BY_PROVIDER[
+      providerId as keyof typeof GOOGLE_PRODUCT_BY_PROVIDER
+    ];
+  if (googleProduct) {
+    return <GoogleProductLogo product={googleProduct} className="size-7" />;
+  }
+  const integration = MCP_INTEGRATIONS_BY_ID.get(providerId);
   if (!integration?.logoUrl) {
     const Icon = iconForProvider(providerId);
     return <Icon size={18} />;
@@ -766,7 +783,10 @@ function summarizeUserAccess(
   return `${labels.join(", ")}${suffix}`;
 }
 
-function startWorkspaceProviderOAuth(provider: WorkspaceConnectionProvider) {
+function startWorkspaceProviderOAuth(
+  provider: WorkspaceConnectionProvider,
+  scope: "user" | "organization" = "organization",
+) {
   const returnPath = `${window.location.pathname}${window.location.search}`;
   if (provider.id === "slack") {
     const params = new URLSearchParams({ return: returnPath });
@@ -777,15 +797,11 @@ function startWorkspaceProviderOAuth(provider: WorkspaceConnectionProvider) {
     );
     return;
   }
-  const params = new URLSearchParams({
+  startManagedWorkspaceProviderOAuth(provider.id, {
     appId: "dispatch",
-    return: returnPath,
+    returnPath,
+    scope,
   });
-  window.location.assign(
-    agentNativePath(
-      `/_agent-native/connections/oauth/${provider.id}/start?${params.toString()}`,
-    ),
-  );
 }
 
 function providerHasOAuth(provider: WorkspaceConnectionProvider): boolean {
@@ -820,7 +836,10 @@ function ConnectionRow({
   canManageGrant: (appId: string) => boolean;
 }) {
   const t = useT();
-  const Icon = iconForProvider(connection.provider);
+  const providerLogo = logoForProvider(
+    connection.provider,
+    provider?.label ?? connection.provider,
+  );
   const missingKeys = missingRequiredCredentialKeys(
     provider,
     connection.credentialRefs,
@@ -837,7 +856,7 @@ function ConnectionRow({
           <div className="flex flex-wrap items-start justify-between gap-3">
             <div className="flex min-w-0 items-start gap-3">
               <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-md bg-background/80">
-                <Icon size={18} className="text-muted-foreground" />
+                {providerLogo}
               </div>
               <div className="min-w-0">
                 <div className="flex flex-wrap items-center gap-2">
@@ -2787,6 +2806,10 @@ export default function WorkspaceIntegrationsRoute() {
   }
 
   function openProviderConnection(provider: WorkspaceConnectionProvider) {
+    if (isGoogleWorkspaceProvider(provider.id)) {
+      setProviderChoice({ provider, personalOAuth: true });
+      return;
+    }
     const personalIntegration = personalIntegrations.get(provider.id);
     if (personalIntegration) {
       setProviderChoice({ provider, personalIntegration });
@@ -3195,14 +3218,16 @@ export default function WorkspaceIntegrationsRoute() {
                     actionLabel: connected
                       ? canManageConnection(active[0])
                         ? "Manage"
-                        : personalIntegrations.has(provider.id)
+                        : personalIntegrations.has(provider.id) ||
+                            isGoogleWorkspaceProvider(provider.id)
                           ? "Connect for me"
                           : "Admin only"
                       : "Connect",
                     disabled:
                       !connected &&
                       !canManageConnections &&
-                      !personalIntegrations.has(provider.id),
+                      !personalIntegrations.has(provider.id) &&
+                      !isGoogleWorkspaceProvider(provider.id),
                     onAction: () =>
                       connected
                         ? canManageConnection(active[0])
@@ -3416,14 +3441,23 @@ export default function WorkspaceIntegrationsRoute() {
               )}
               showWorkspaceOption={canManageConnections}
               onPersonal={() => {
-                setPersonalIntegrationId(providerChoice.personalIntegration.id);
+                const provider = providerChoice.provider;
                 setProviderChoice(null);
+                if (providerChoice.personalOAuth) {
+                  startWorkspaceProviderOAuth(provider, "user");
+                  return;
+                }
+                if (providerChoice.personalIntegration) {
+                  setPersonalIntegrationId(
+                    providerChoice.personalIntegration.id,
+                  );
+                }
               }}
               onWorkspace={() => {
                 const provider = providerChoice.provider;
                 setProviderChoice(null);
                 if (providerHasOAuth(provider)) {
-                  startWorkspaceProviderOAuth(provider);
+                  startWorkspaceProviderOAuth(provider, "organization");
                 } else {
                   openSetup(provider);
                 }

package/corpus/templates/dispatch/app/routes.ts

@@ -15,4 +15,6 @@ import { flatRoutes } from "@react-router/fs-routes";
  * route here via `app/routes/<name>.tsx`, then register the tab in
  * `app/dispatch-extensions.tsx`.
  */
-export default flatRoutes() satisfies RouteConfig;
+export default flatRoutes({
+  ignoredRouteFiles: ["**/*.test.{ts,tsx}", "**/*.spec.{ts,tsx}"],
+}) satisfies RouteConfig;

package/corpus/templates/factory/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/corpus/templates/factory/.env.example

@@ -29,13 +29,8 @@ BUILDER_PROJECT_ID=
 BUILDER_PRIVATE_KEY=
 FACTORY_BUILDER_WEBHOOK_SECRET=
 
-# Optional deployment fallbacks. Prefer Dispatch Vault and leave these blank
-# when the shared workspace secret rows are available.
-SLACK_BOT_TOKEN=
-GITHUB_TOKEN=
-SENTRY_SERVER_TOKEN=
-SENTRY_AUTH_TOKEN=
-SENTRY_ORG_SLUG=
+# Provider credentials and account identifiers belong in standard shared
+# integrations and the org/workspace vault. Do not put provider keys in .env.
 
 # Skip login/signup (local dev / preview only)
 # AUTH_DISABLED=true

package/corpus/templates/factory/AGENTS.md

@@ -31,6 +31,9 @@ decisions, feedback, agent runs, and provider audit records.
 - Provider credentials belong to Dispatch/shared workspace integrations, never
   to a Factory or Factory graph. Agents use shared provider APIs and connected
   MCP tools through the workspace grant boundary.
+- Never put provider keys or account identifiers in `.env`, deployment env, or
+  Factory actions/bootstrap. Configure standard integrations and resolve them
+  from the multitenant org/workspace vault.
 - For external integrations, inspect the workspace/provider connection catalog first; reuse its scoped resolver.
 
 ## Application state

package/corpus/templates/factory/README.md

@@ -37,9 +37,11 @@ If Dispatch synced the vault into a different organization, set
 
 Connect providers in Dispatch or in Settings -> Integrations. Factory resolves
 Slack, GitHub, Sentry, Builder, and other supported provider credentials from
-the shared workspace vault and only uses matching deployment env vars as a
-last-resort fallback. Factory never stores keys per factory. All apps that read
-shared `app_secrets` rows must use the same
+the shared workspace vault. Provider deployment environment variables are not
+supported for Factory. To migrate an existing deployment, add the provider
+connection in the standard workspace integration surface, verify it, and then
+remove the old deployment variables. Factory never stores keys per factory. All
+apps that read shared `app_secrets` rows must use the same
 `WORKSPACE_SECRETS_ENCRYPTION_KEY` (or the workspace's existing shared
 encryption fallback). Never copy raw tokens between apps or add a second
 env-only read in a provider client.

package/corpus/templates/factory/actions/create-factory.ts

@@ -20,6 +20,7 @@ import {
 } from "../server/lib/factory-automation-plan.js";
 import {
   assertUniqueSlackChannelForFactory,
+  builderSlackUserIdSchema,
   factoryConfigRowId,
   resolveUniqueFactoryId,
 } from "../server/lib/factory-scope.js";
@@ -40,8 +41,10 @@ export default defineAction({
   schema: z.object({
     name: z.string().trim().min(1).max(120),
     description: z.string().trim().max(500).optional(),
+    slackWorkspace: z.enum(["primary", "secondary"]).optional(),
     slackChannelId: z.string().trim().max(128).optional(),
     slackChannelName: z.string().trim().max(200).optional(),
+    builderSlackUserId: builderSlackUserIdSchema.optional(),
     observeSlack: z.boolean().optional(),
     repository: z.string().trim().max(256).optional(),
     observeGithub: z.boolean().optional(),
@@ -111,7 +114,16 @@ export default defineAction({
             orgId,
           });
 
-          if (automationPlan.hasConfig) {
+          const shouldWriteConfig =
+            automationPlan.hasConfig ||
+            Boolean(input.slackChannelId?.trim()) ||
+            Boolean(input.slackChannelName?.trim()) ||
+            Boolean(input.builderSlackUserId?.trim()) ||
+            Boolean(input.slackWorkspace) ||
+            Boolean(input.sentryOrgSlug?.trim()) ||
+            Boolean(input.sentryProjectSlug?.trim()) ||
+            Boolean(input.sentryEnvironment?.trim());
+          if (shouldWriteConfig) {
             const slackChannelId = input.slackChannelId?.trim() || null;
             await assertUniqueSlackChannelForFactory(
               tx as unknown as typeof db,
@@ -122,10 +134,11 @@ export default defineAction({
             await tx.insert(triageConfig).values({
               id: factoryConfigRowId(orgId, factoryId),
               factoryId,
-              slackWorkspace: "primary",
+              slackWorkspace:
+                input.slackWorkspace === "secondary" ? "secondary" : "primary",
               slackChannelId,
               slackChannelName: input.slackChannelName?.trim() || null,
-              builderSlackUserId: null,
+              builderSlackUserId: input.builderSlackUserId?.trim() || null,
               pollingEnabled: automationPlan.pollingEnabled ? 1 : 0,
               githubPollingEnabled: automationPlan.githubPollingEnabled ? 1 : 0,
               sentryPollingEnabled: automationPlan.sentryPollingEnabled ? 1 : 0,

package/corpus/templates/factory/actions/get-slack-feedback-context.ts

@@ -72,6 +72,8 @@ export default defineAction({
           threadTs: item.threadTs,
           coverage: hasMore ? "partial" : "complete",
           messageCount: messages.length,
+          itemTitle: item.title,
+          itemSummary: item.summary,
         },
       },
       factoryId,

package/corpus/templates/factory/actions/get-triage-item.ts

@@ -95,6 +95,8 @@ export default defineAction({
           feedbackCount: matchingFeedback.length,
           runCount: runs.length,
           coverage: item.coverage,
+          itemTitle: item.title,
+          itemSummary: item.summary,
         },
       },
       factoryId,

package/corpus/templates/factory/actions/list-factory-audit.ts

@@ -7,9 +7,17 @@ import { and, desc, eq, inArray } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb } from "../server/db/index.js";
-import { factoryAuditEvents } from "../server/db/schema.js";
+import {
+  factoryAuditEvents,
+  triageItems,
+  triageRuns,
+} from "../server/db/schema.js";
+import { projectFactoryAuditReport } from "../server/lib/factory-audit-report.js";
 import {
   factoryIdSchema,
+  orgFactoryItemFilter,
+  orgFactoryRunFilter,
+  readAutomationDisplayName,
   readAutomationFactoryId,
 } from "../server/lib/factory-scope.js";
 import {
@@ -39,23 +47,30 @@ export default defineAction({
     const factoryDefinitions = definitions.filter(
       ({ meta, name, resource }) =>
         meta.domain === "factory" &&
-        readAutomationFactoryId(meta, resource.content) === factoryId &&
+        readAutomationFactoryId(meta, resource.content, resource.path) ===
+          factoryId &&
         (!automation || name === automation),
     );
     const runGroups = await Promise.all(
-      factoryDefinitions.map(async ({ name, resource }) =>
-        listAutomationRuns({
+      factoryDefinitions.map(async ({ name, resource }) => {
+        const runs = await listAutomationRuns({
           owners: [resource.owner],
           automation: name,
           appId: "factory",
           limit,
-        }),
-      ),
+        });
+        // Absent must stay distinguishable from a stored label so the client
+        // can derive its own fallback instead of rendering the nested path.
+        const displayName = readAutomationDisplayName(resource.content);
+        return runs.map((run) => ({ run, displayName }));
+      }),
     );
-    const runs = runGroups.flat().sort((a, b) => b.startedAt - a.startedAt);
-    const boundedRuns = runs.slice(0, limit);
-    const runIds = boundedRuns
-      .map((run) => run.runId)
+    const entries = runGroups
+      .flat()
+      .sort((a, b) => b.run.startedAt - a.run.startedAt);
+    const boundedEntries = entries.slice(0, limit);
+    const runIds = boundedEntries
+      .map(({ run }) => run.runId)
       .filter((runId): runId is string => Boolean(runId));
 
     const db = getDb();
@@ -80,33 +95,98 @@ export default defineAction({
       eventsByRun.set(event.automationRunId, current);
     }
 
+    const itemIds = [
+      ...new Set(
+        events.flatMap((event) => {
+          const ids: string[] = [];
+          if (event.itemId) ids.push(event.itemId);
+          const details = parseDetails(event.detailsJson);
+          const listed = details.itemIds;
+          if (Array.isArray(listed)) {
+            for (const value of listed) {
+              if (typeof value === "string" && value) ids.push(value);
+            }
+          }
+          return ids;
+        }),
+      ),
+    ];
+    const itemRows = itemIds.length
+      ? await db
+          .select({
+            id: triageItems.id,
+            title: triageItems.title,
+            summary: triageItems.summary,
+            source: triageItems.source,
+            sourceUrl: triageItems.sourceUrl,
+          })
+          .from(triageItems)
+          .where(
+            and(
+              orgFactoryItemFilter(orgId, factoryId),
+              inArray(triageItems.id, itemIds),
+            ),
+          )
+      : [];
+    const runRows = itemIds.length
+      ? await db
+          .select({
+            itemId: triageRuns.itemId,
+            status: triageRuns.status,
+            error: triageRuns.error,
+            provider: triageRuns.provider,
+            startedAt: triageRuns.startedAt,
+          })
+          .from(triageRuns)
+          .where(
+            and(
+              orgFactoryRunFilter(orgId, factoryId),
+              inArray(triageRuns.itemId, itemIds),
+            ),
+          )
+      : [];
+
     return {
-      runs: boundedRuns.map((run) => ({
-        id: run.id,
-        automation: run.automation,
-        runId: run.runId,
-        threadId: run.threadId,
-        status: run.status,
-        startedAt: run.startedAt,
-        finishedAt: run.finishedAt,
-        error: run.error,
-        events: (eventsByRun.get(run.runId ?? "") ?? []).map((event) => ({
-          id: event.id,
-          automationRunId: event.automationRunId,
-          automationThreadId: event.automationThreadId,
-          automationName: event.automationName,
-          itemId: event.itemId,
-          source: event.source,
-          sourceUrl: event.sourceUrl,
-          action: event.action,
-          kind: event.kind,
-          status: event.status,
-          summary: event.summary,
-          details: parseDetails(event.detailsJson),
-          createdAt: event.createdAt,
-        })),
-      })),
-      count: boundedRuns.length,
+      runs: boundedEntries.map(({ run, displayName }) => {
+        const mappedEvents = (eventsByRun.get(run.runId ?? "") ?? []).map(
+          (event) => ({
+            id: event.id,
+            automationRunId: event.automationRunId,
+            automationThreadId: event.automationThreadId,
+            automationName: event.automationName,
+            itemId: event.itemId,
+            source: event.source,
+            sourceUrl: event.sourceUrl,
+            action: event.action,
+            kind: event.kind,
+            status: event.status,
+            summary: event.summary,
+            details: parseDetails(event.detailsJson),
+            createdAt: event.createdAt,
+          }),
+        );
+        const report = projectFactoryAuditReport(
+          mappedEvents,
+          itemRows,
+          runRows,
+          { startedAt: run.startedAt, finishedAt: run.finishedAt },
+        );
+        return {
+          id: run.id,
+          automation: run.automation,
+          displayName,
+          runId: run.runId,
+          threadId: run.threadId,
+          status: run.status,
+          startedAt: run.startedAt,
+          finishedAt: run.finishedAt,
+          error: run.error,
+          counts: report.counts,
+          items: report.items,
+          trace: report.trace,
+        };
+      }),
+      count: boundedEntries.length,
     };
   },
 });

package/corpus/templates/factory/actions/list-factory-automations.ts

@@ -43,7 +43,8 @@ export default defineAction({
     const scoped = definitions.filter(
       ({ meta, resource }) =>
         meta.domain === "factory" &&
-        readAutomationFactoryId(meta, resource.content) === factoryId,
+        readAutomationFactoryId(meta, resource.content, resource.path) ===
+          factoryId,
     );
     return Promise.all(
       scoped.map(async ({ resource, name, meta, body, canUpdate }) => {