@agent-native/core 0.169.1 → 0.170.0

package/dist/user-profile/actions/get-auth-methods.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { defineAction } from "../../action.js";
-import { getBetterAuth } from "../../server/better-auth-instance.js";
+import { getBetterAuthInternalAdapter } from "../../server/better-auth-instance.js";
 export default defineAction({
     description: "Get the signed-in user's available authentication methods.",
     schema: z.object({}),
@@ -11,12 +11,25 @@ export default defineAction({
         if (!ctx?.userEmail || !ctx.requestHeaders) {
             throw new Error("Not authenticated.");
         }
-        const auth = await getBetterAuth();
-        const accounts = await auth.api.listUserAccounts({
-            headers: ctx.requestHeaders,
+        // Look accounts up by the framework-resolved ctx.userEmail through
+        // Better Auth's internal adapter rather than replaying ctx.requestHeaders
+        // through auth.api.listUserAccounts: that call re-derives identity from
+        // its own cookie-based session lookup, which throws for any caller the
+        // framework authenticated without a Better Auth session cookie (an
+        // AUTH_DISABLED dev session, a BYOA identity, ...) even though
+        // ctx.userEmail is already a trustworthy resolved identity. An unresolved
+        // adapter means the auth backend couldn't be read at all and must fail
+        // loudly — only a resolved adapter finding no matching user record means
+        // there is no Better Auth credential to report.
+        const adapter = await getBetterAuthInternalAdapter();
+        if (!adapter) {
+            throw new Error("Better Auth internal adapter is unavailable.");
+        }
+        const existing = await adapter.findUserByEmail(ctx.userEmail, {
+            includeAccounts: true,
         });
         return {
-            hasPassword: accounts.some((account) => account.providerId === "credential"),
+            hasPassword: existing?.accounts.some((account) => account.providerId === "credential") ?? false,
         };
     },
 });

package/dist/vite/client.js

@@ -1457,10 +1457,17 @@ function frameworkDevDynamicForwarder() {
                             ? `text/html,${accept}`
                             : "text/html";
                     }
-                    // Embed-start uses document/iframe to select its transplant response.
-                    // Only supply the classifier hint when the browser did not provide a
-                    // destination; never overwrite the request's original intent.
-                    if (req.headers["sec-fetch-dest"] === undefined) {
+                    // Embed-start uses document/iframe to select its transplant response,
+                    // and Nitro's own dev classifier already treats document/iframe/frame
+                    // as non-asset, so those (and an already-"empty" value) pass through
+                    // untouched. Everything else — undefined, or a real browser's
+                    // destination for a fetch this route never anticipated, like
+                    // "speculationrules" for the native Speculation-Rules auto-fetch —
+                    // gets normalized to "empty" so Nitro's classifier falls back to its
+                    // extension check instead of treating the request as a static asset.
+                    const fetchDest = req.headers["sec-fetch-dest"];
+                    if (fetchDest === undefined ||
+                        !/^(document|iframe|frame|empty)$/.test(String(fetchDest))) {
                         req.headers["sec-fetch-dest"] = "empty";
                     }
                 }
@@ -1960,6 +1967,18 @@ function rolldownInputFix() {
  * The template lists the packages in its `defineConfig({ ssrStubs })` call —
  * the framework never hardcodes package names.
  */
+/**
+ * Optional peers reached only through a `React.lazy` boundary whose module body
+ * guards on `typeof window === "undefined"`. The server can never import them,
+ * so their SSR chunk is pure unpack weight in every app that ships a terminal
+ * surface. Defaulted here rather than repeated in sixteen vite configs, where
+ * it would drift.
+ */
+const ALWAYS_SSR_STUBBED = [
+    "@xterm/xterm",
+    "@xterm/addon-fit",
+    "@xterm/addon-web-links",
+];
 function ssrStubPlugin(packages) {
     if (!packages.length)
         return null;
@@ -2729,7 +2748,7 @@ function createAgentNativePlugins(options, { command, includeReactTransform, use
         // don't bloat the edge worker. Opt-in per template — the framework
         // hardcodes nothing (e.g. docs sites legitimately import `shiki` on
         // the server, so we can't blanket-stub it here).
-        ssrStubPlugin(options.ssrStubs ?? []),
+        ssrStubPlugin([...ALWAYS_SSR_STUBBED, ...(options.ssrStubs ?? [])]),
         ...userPlugins,
         appChangelogRawPlugin(),
         actionTypesPlugin(),

package/docs/content/actions-access-control.mdx

@@ -1,25 +1,26 @@
 ---
 title: "Access & Authorization"
-description: "Who can call an action: exposure flags (agentTool, toolCallable), ctx-based scoping, accessFilter/assertAccess, and the authorize guard."
+description: "Who can call an action: exposure flags (agentTool, mcpTool, toolCallable), ctx-based scoping, accessFilter/assertAccess, and the authorize guard."
 ---
 
 # Access & Authorization
 
-Five settings decide who can call an action: the agent, the frontend, an extension, an outside API caller, or nobody without a human's approval first. Most actions never need to touch any of these, since the defaults already fit normal UI-and-agent use.
+Six settings decide who can call an action: the agent, the frontend, an extension, an outside API caller, or nobody without a human's approval first. Most actions never need to touch any of these, since the defaults already fit normal UI-and-agent use.
 
 ### Exposure flags {#exposure-flags}
 
-All five flags default to the permissive value, so you only set one when you need to tighten a specific surface. The table below is a quick summary. The sections after it add the one detail each flag needs.
+All six default to the permissive value — `mcpTool` by inheriting `agentTool` — so you only set one when you need to tighten a specific surface. The table below is a quick summary. The sections after it add the one detail each flag needs.
 
 | Flag            | Default       | Restrictive value → who can still call                                      | Typical use                                                          |
 | --------------- | ------------- | --------------------------------------------------------------------------- | -------------------------------------------------------------------- |
 | `agentTool`     | `true`        | `false` → UI, HTTP, and CLI only (hidden from the model, MCP, and A2A)      | UI-only or programmatic actions that shouldn't take up a tool slot   |
+| `mcpTool`       | `agentTool`   | `false` → your own app's agent only (hidden from MCP and A2A)               | Actions that need an in-app screen or session on the other end       |
 | `toolCallable`  | `true`        | `false` → everything **except** the sandboxed extension iframe bridge (403) | Sensitive account or org changes (delete account, change membership) |
 | `publicAgent`   | off (private) | `{ expose: true }` → adds the action to **public** MCP/A2A/OpenAPI surfaces | Safe read or ingest tools that don't require authentication          |
 | `needsApproval` | `false`       | `true` → the agent **pauses**, and a human must approve the specific call   | Consequential side effects (send email, charge a card, delete)       |
 | `authorize`     | none          | a guard function → only callers it accepts, on **every** surface            | Operations restricted to a role (per-app RBAC, admin-only ops)       |
 
-These flags are independent, so setting one doesn't change the others. `agentTool` controls what the model sees, see [Hide from the model](#agent-tool) below. `toolCallable` controls only the extension iframe, see [Block extension iframes](#tool-callable) below. `publicAgent` adds an opt-in public surface, and a public web route never implies public tool exposure, see [Expose to public agents](#public-agent) below. `needsApproval` gates execution after the call is already made, see [Require human approval](#needs-approval) below. `authorize` decides whether this caller may run the action at all, on every dispatch path, before `run()` is entered, see [Restrict callers by role](#authorize) below.
+These flags are independent, with one exception: an undeclared `mcpTool` inherits `agentTool`. `agentTool` controls what the model sees, see [Hide from the model](#agent-tool) below. `mcpTool` narrows that to outside agents only, see [Hide from external agents](#mcp-tool) below. `toolCallable` controls only the extension iframe, see [Block extension iframes](#tool-callable) below. `publicAgent` adds an opt-in public surface, and a public web route never implies public tool exposure, see [Expose to public agents](#public-agent) below. `needsApproval` gates execution after the call is already made, see [Require human approval](#needs-approval) below. `authorize` decides whether this caller may run the action at all, on every dispatch path, before `run()` is entered, see [Restrict callers by role](#authorize) below.
 
 ## Hide from the model {#agent-tool}
 
@@ -39,6 +40,44 @@ export default defineAction({
 
 Use this when you add a UI-only or purely programmatic action, or when the UI stops using an action that would otherwise stay exposed to the model.
 
+## Hide from external agents {#mcp-tool}
+
+`agentTool` is all-or-nothing: an action is a tool for every agent, or for none. `mcpTool` splits that in two, so an action can stay a normal tool for your own app's agent while never reaching Claude, Cursor, or a sibling app over MCP and A2A:
+
+```ts
+export default defineAction({
+  description: "Open the record inspector beside the current selection.",
+  mcpTool: false, // needs a live screen on the other end
+  schema: z.object({ recordId: z.string() }),
+  run: async ({ recordId }) => {
+    /* ... */
+  },
+});
+```
+
+Use it for actions whose result only means something with your app's UI, an open session, or the current selection in front of the caller. `mcpTool` can only narrow `agentTool`, never widen it: an action with `agentTool: false` stays hidden everywhere. It governs the external tool surface itself, not what your own agent may do while answering an `ask_app` question — that run is your agent's, and it keeps its whole tool list.
+
+Left undeclared, `mcpTool` follows `agentTool` rather than defaulting to a flat `true`, so hiding an action from the agent hides it from outside agents too and one flag stays one decision.
+
+The opposite value has a second job. External agents are served a small, curated catalog by default rather than your whole action registry, and `mcpTool: true` is how an action declares itself part of it:
+
+```ts
+export default defineAction({
+  description: "List the databases connected to this workspace.",
+  mcpTool: true, // served to external agents, not just discoverable
+  http: { method: "GET" },
+  run: async () => {
+    /* ... */
+  },
+});
+```
+
+This is the same catalog as the plugin's `mcp: { connectorCatalog: [...] }` list, declared on the action instead of in a separate array that has to be kept in sync as actions are renamed. Both forms work, and an app can move over one action at a time. Everything left out stays discoverable through `tool-search`.
+
+Pairing the two flags the other way — `agentTool: false` with `mcpTool: true` — makes an action **MCP-only**: outside agents get it, your own app's agent never sees it. Use it for the export, sync, or handoff an outside tool needs and your own agent has no reason to call.
+
+Membership is not permission. An external caller still has to pass the OAuth scope check, the `externalAgents` policy, and — for the direct, no-model A2A path — the `publicAgent` opt-in below.
+
 ## Block extension iframes {#tool-callable}
 
 Extensions ([Alpine.js mini-apps in sandboxed iframes](/docs/extensions)) call actions through `appAction(name, params)`, running with the viewer's own permissions, secrets, and SQL scope. For sensitive operations, that's too much trust by default. Set `toolCallable: false` to make the extension bridge return a 403, while keeping the action callable from the UI, agent, CLI, MCP, and A2A:

package/docs/content/actions-defining.mdx

@@ -115,6 +115,21 @@ The framework auto-discovers every file in `actions/` and mounts it on startup.
           description:
             "Set false to hide from every agent tool list. See Access & Authorization.",
         },
+        {
+          name: "mcpTool",
+          type: "boolean",
+          optional: true,
+          default: "agentTool",
+          description:
+            "Defaults to agentTool. Set false to hide from external agents over MCP and A2A, or true to declare curated catalog membership (with agentTool: false, MCP-only). See Access & Authorization.",
+        },
+        {
+          name: "deferLoading",
+          type: "boolean",
+          optional: true,
+          description:
+            "Set false to keep the action in the agent's first tool list, true to load it on demand through tool-search. See Keep the action surface small below.",
+        },
         {
           name: "toolCallable",
           type: "boolean",
@@ -261,6 +276,7 @@ Every action the agent can see takes up a slot in the model's tool list, and a l
 - Prefer **one CRUD-style `update` action** that takes a patch of optional fields, over many per-field actions like `update-name`, `update-order`, and `update-color`. The caller only sends the fields that changed.
 - Before adding a new read action for every query or filter, consider a more general option first: the [provider API trio](/docs/template-dispatch-vault-integrations#provider-api) (`provider-api-catalog`, `provider-api-docs`, and `provider-api-request`) for provider data, or the dev `db-query` tool for app data.
 - Mark UI-only or programmatic actions [`agentTool: false`](/docs/actions-access-control#agent-tool). They stay callable from the frontend or over HTTP, without taking a slot in the model's tool list.
+- Mark the handful of actions the agent reaches for constantly `deferLoading: false`. Those are the schemas sent on the first model request; everything else loads on demand through `tool-search` when the agent needs it. As soon as one action opts out this way, every unmarked action is deferred, so mark the whole starter set at once rather than one action at a time. This is about what the first turn costs, not about access: a deferred action is callable the moment `tool-search` returns it. It is the per-action form of the plugin's `initialToolNames` array, and an app can use either.
 - Delete or hide actions the UI no longer uses, instead of leaving them exposed to the model.
 
 The repo includes an advisory helper, `node scripts/audit-template-actions.mjs [template ...]` (alias `pnpm actions:audit`). It scans a template's `actions/` folder and flags actions the UI may no longer use, along with groups of per-field actions that could be combined into one. It always exits with code 0 and never fails CI, and its heuristics are conservative, so treat its output as a suggestion, not an error.

package/docs/content/template-clips-capture-everywhere.mdx

@@ -1,14 +1,14 @@
 ---
-title: "Capturing Everywhere: Desktop, Mobile, and Screen Memory"
-description: "Every way to get a recording into Clips — the desktop tray app, the mobile companion, Rewind quick-save, local-only Screen Memory, and the Chrome extension for browser logs."
-search: "Clips desktop app mobile companion Rewind quick save Screen Memory Chrome extension browser logs"
+title: "Capturing Everywhere: Desktop, Mobile, and Rewind"
+description: "Every way to get a recording into Clips: the desktop tray app, the mobile companion, the local-only Rewind memory, and the Chrome extension for browser logs."
+search: "Clips desktop app mobile companion Rewind memory add what happened before Screen Memory Chrome extension browser logs"
 ---
 
 # Capturing everywhere
 
-Clips isn't only a browser recorder. This page covers every place you can start a capture — the desktop tray app, the mobile companion app, pulling in a moment you forgot to record, the local-only Screen Memory buffer, and the Chrome extension for browser logs — and who each one is for.
+Clips isn't only a browser recorder. This page covers every place you can start a capture, and who each one is for: the desktop tray app, the mobile companion app, the local-only Rewind memory, and the Chrome extension for browser logs.
 
-<Diagram id="doc-block-clips1" title="Capture surfaces" summary={"Desktop, mobile, and the Chrome extension all land in your shared Clips library. Screen Memory is the one exception — it never leaves your machine."}>
+<Diagram id="doc-block-clips1" title="Capture surfaces" summary={"Desktop, mobile, and the Chrome extension all land in your shared Clips library. Rewind is the one exception. It never leaves your device unless you approve it."}>
 
 ```html
 <div class="diagram-flow">
@@ -20,17 +20,17 @@ Clips isn't only a browser recorder. This page covers every place you can start
   <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
   <div class="diagram-box" data-rough>
     Clips library<br /><small class="diagram-muted"
-      >hosted, SQL — searchable and shareable</small
+      >hosted, SQL, searchable and shareable</small
     >
   </div>
 </div>
 <div class="diagram-flow" style="margin-top: 14px">
-  <div class="diagram-node">Screen Memory</div>
+  <div class="diagram-node">Rewind</div>
   <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
   <div class="diagram-panel center">
-    <span class="diagram-pill">Your machine only</span
+    <span class="diagram-pill">Your device only</span
     ><small class="diagram-muted"
-      >local files, off by default, never uploaded</small
+      >local files, off by default, shared only when you approve it</small
     >
   </div>
 </div>
@@ -64,50 +64,49 @@ Clips isn't only a browser recorder. This page covers every place you can start
 
 ## Desktop recorder and the desktop tray app
 
-Clips ships a desktop companion built for the smoothest everyday capture path: screen and webcam recording with a draggable camera bubble, live transcription while you record, calendar meeting reminders, and Hold-Fn dictation — all without keeping a browser tab open.
+Clips ships a desktop companion built for the smoothest everyday capture path: screen and webcam recording with a draggable camera bubble, live transcription while you record, calendar meeting reminders, and Hold-Fn dictation, all without keeping a browser tab open.
 
 The first time you record your screen, your operating system will ask you to grant Screen Recording permission (on a Mac: System Settings → Privacy & Security → Screen Recording). That's an OS-level permission, not a Clips setting, and Clips can't record without it.
 
-While a meeting app like Zoom or Microsoft Teams is in the foreground, the desktop app can also offer a quick "Take notes?" prompt so you don't have to remember to start a recording yourself — see [Recording, importing, and meetings](/docs/template-clips#recording-importing-and-meetings) for what happens once you accept.
+While a meeting app like Zoom or Microsoft Teams is in the foreground, the desktop app can also offer a quick "Take notes?" prompt so you don't have to remember to start a recording yourself. See [Recording, importing, and meetings](/docs/template-clips#recording-importing-and-meetings) for what happens once you accept.
 
 ## Mobile companion capture
 
-The Agent Native mobile app (iOS/Android) brings capture to your phone: dictate, join or record a meeting, shoot a quick video, or import a clip — from the phone's home screen or an OS quick action.
+The Agent Native mobile app (iOS/Android) brings capture to your phone: dictate, join or record a meeting, shoot a quick video, or import a clip, all from the phone's home screen or an OS quick action.
 
 A few things are different from desktop:
 
 - **Meeting audio is microphone-only.** Phones can't capture another app's call audio the way a desktop can, so mobile meeting recordings don't get the same per-attendee action-item attribution as a desktop capture with both mic and system audio. Mobile is a good fit for in-person rooms or for capturing audio playing from a separate device.
 - **Dictation is tap-to-start/stop**, not press-and-hold like the desktop Fn-hold flow.
-- **Uploads are durable.** The audio or video file saves to your phone before any network request, so a dropped connection never loses the capture — it resumes the upload automatically once you're back online. You don't need to keep the app open or re-record after a failed upload.
+- **Uploads are durable.** The audio or video file saves to your phone before any network request, so a dropped connection never loses the capture. The upload resumes automatically once you're back online. You don't need to keep the app open or re-record after a failed upload.
 
-## Rewind quick-save
+## Rewind
 
-If you use [Rewind](https://www.rewind.ai) (a local screen-recall app) on your Mac and realize, after the fact, that a moment was worth keeping, Clips can pull in the last 30 seconds or 5 minutes of your local Rewind history and prepend it to a private clip.
+Rewind is an optional local memory that keeps a rolling recording of your screen (and audio, if you turn it on), stored locally on your device.
 
-A few rules keep this predictable:
-
-- Only the clip's owner can request it, and only on a **private** clip with no one else already granted direct access — removing anyone else's access first keeps the pulled-in Rewind footage from being retroactively shared.
-- It replaces the clip's media with the combined recording. The transcript, chapters, comments, and reactions all shift automatically so their timestamps still line up with the new, earlier start time.
-- It's explicit and per-clip — Rewind quick-save never runs automatically in the background.
+<Callout id="doc-block-clips2" tone="info">
+  Rewind is off by default. Nothing is captured until you turn it on in the
+  desktop tray's settings, and nothing leaves your device unless you approve it
+  (per-request review is on by default and can be turned off in Rewind's
+  settings). You can export, search, or clear the buffer yourself at any time.
+</Callout>
 
-## Screen Memory
+The feature can be enabled under the Rewind tab in Settings. When enabled, you can ask the agent things like "what was I looking at 20 minutes ago?" and the agent reads the text excerpts from the local buffer of on-screen text, app and window context, and transcript snippets. The agent never receives the recordings themselves. The only exception is a request you review and approve, which turns an exact range into a private Clip (see below).
 
-Screen Memory is a different, optional feature: a local-only buffer that quietly notes which app or window was in front of you recently, entirely on your own machine.
+### Add what happened before
 
-<Callout id="doc-block-clips2" tone="info">
-  Screen Memory is off by default. Nothing is captured until you turn it on, and
-  nothing ever leaves your machine automatically — you export or clear it
-  yourself from the desktop tray's settings.
-</Callout>
+In the clip's editor, **Add what happened before** pulls the previous 30 seconds or 5 minutes from your local Rewind history and adds it to the start of the clip. The clip must have been recorded on this device while Rewind was on, and the moments must still be within Rewind's retained history.
 
-When it's enabled, you can ask the agent things like "what was I looking at 20 minutes ago?" and it checks the local buffer before answering. It is never a hosted or shareable Clips recording, and it never exposes raw screen images to the agent — only bounded text snippets of app and window context.
+- The clip must be private, with no one else granted direct access. Rewind history can contain context from before you chose to record, so Clips makes the clip private first and stops if anyone else still has access.
+- The clip's media is replaced with the combined recording. The transcript, chapters, comments, and reactions shift so their timestamps still line up, and the timeline marks where the original clip started.
+- It runs once per clip and only when you ask. Nothing is added from Rewind automatically.
 
 ## Browser logs with the Chrome extension
 
-Install the Clips Chrome extension when you want a recording plus the browser logs and network activity from the tab you're debugging — useful for reporting product bugs and browser-only repros.
+Install the Clips Chrome extension when you want a recording plus the browser logs and network activity from the tab you're debugging. It's useful for reporting product bugs and browser-only repros.
 
 - It only watches the tab you're actively recording, and only while the recording is running.
-- It saves console messages and basic per-request info (method, a redacted URL, status, duration, and whether a request failed) — never request or response bodies, headers, or cookies.
+- It saves console messages and basic per-request info (method, a redacted URL, status, duration, and whether a request failed). It never saves request or response bodies, headers, or cookies.
 - Use the desktop app for the smoothest everyday recording; reach for the Chrome extension specifically when you need those browser logs attached.
 
 See [Extending Clips](/docs/template-clips-developers) for the extension's install link and how to configure it on a self-hosted deployment.

package/docs/content/template-clips-developers.mdx

@@ -100,7 +100,7 @@ This pilot requires the reporter to already have an active session in the Clips
 
 All data lives in SQL via Drizzle ORM. Schema: `templates/clips/server/db/schema.ts`. Recordings, meetings, dictations, calendar accounts, and vocabulary all carry the standard `ownableColumns` and have a matching framework shares table, so they slot into the per-user / per-org sharing model.
 
-Two things live outside this schema on purpose: organization/member/invitation rows are framework-owned tables (`organizations`, `org_members`, `org_invitations`), with `organization_settings` as the Clips-specific sidecar keyed by organization id; and the Rewind quick-save request lifecycle and mobile-capture-state live in `application_state`, not a SQL table, since they're short-lived, per-session status rather than durable app data.
+Two things live outside this schema on purpose: organization/member/invitation rows are framework-owned tables (`organizations`, `org_members`, `org_invitations`), with `organization_settings` as the Clips-specific sidecar keyed by organization id; and the "Add what happened before" (Rewind pre-roll) request lifecycle and mobile-capture-state live in `application_state`, not a SQL table, since they're short-lived, per-session status rather than durable app data.
 
 <DataModel
   id="doc-block-oitg2"
@@ -313,7 +313,7 @@ Recordings and transcripts are intentionally separate tables so the library and
     },
     {
       path: "actions/request-rewind-extension.ts",
-      note: "Local Rewind quick-save request lifecycle",
+      note: "Add-what-happened-before (Rewind pre-roll) request lifecycle",
     },
     {
       path: "app/routes/",
@@ -349,7 +349,7 @@ Every agent-callable operation is a TypeScript file in `templates/clips/actions/
 - **Sharing, comments & engagement** — framework sharing actions (`share-resource`, `set-resource-visibility`, `list-resource-shares`) plus `build-embed-url`, `create-recording-agent-link`, `create-cta` / `update-cta` / `delete-cta`, `add-comment` / `reply-to-comment` / `resolve-comment` / `react-to-comment` / `delete-comment`, `react-to-recording`, `list-viewers`, `list-clip-views`.
 - **Organizations & members** — `create-organization`, `set-organization-branding`, `invite-member` / `accept-invite` / `decline-invite` / `get-invite`, `remove-member`, `update-member-role`, `list-organization-state`, `list-notifications`.
 - **Screen Memory** — `get-screen-memory-status`, `query-screen-memory-context`. Both read bounded local files on the current machine only; neither ever returns media bytes or images.
-- **Rewind quick-save** — `request-rewind-extension`, `get-rewind-extension-request`, `list-rewind-extension-requests`, `update-rewind-extension-request`, `make-recording-private-for-rewind`, `apply-rewind-extension`.
+- **Add what happened before (Rewind pre-roll)** — `request-rewind-extension`, `get-rewind-extension-request`, `list-rewind-extension-requests`, `update-rewind-extension-request`, `make-recording-private-for-rewind`, `apply-rewind-extension`.
 - **Mobile companion** — `set-mobile-capture-state` records the privacy-safe view/phase of the mobile capture UI; it's not agent-callable (`agentTool: false`).
 - **CRM & Brain export** — `prepare-crm-call-evidence`, `export-to-brain`.
 - **Search & insights** — `search-recordings` (matches titles, descriptions, transcript text, and comments, with timestamps), `get-recording-insights`, `get-organization-insights`, `export-insights-csv`, `list-ai-requests` / `update-ai-request-status`.
@@ -372,7 +372,7 @@ The agent edits routes, components, the transcript pipeline, and the schema as n
 ## What's next
 
 - [**Clips**](/docs/template-clips) — the overview
-- [**Capturing Everywhere**](/docs/template-clips-capture-everywhere) — desktop, mobile, Rewind, Screen Memory, and the Chrome extension from a user's perspective
+- [**Capturing Everywhere**](/docs/template-clips-capture-everywhere) — desktop, mobile, Rewind, and the Chrome extension from a user's perspective
 - [**Sharing, Teams, and Agent-Readable Clips**](/docs/template-clips-sharing-and-teams) — the sharing model this data model backs
 - [**AI Pipeline, Editing, and Insights**](/docs/template-clips-ai-and-editing) — the transcription and editing pipeline these actions power
 - [**Templates**](/docs/cloneable-saas) — the Cloneable SaaS model

package/docs/content/template-clips.mdx

@@ -110,7 +110,9 @@ Live demo: [clips.agent-native.com](https://clips.agent-native.com).
 
 ## What's next
 
-- [**Capturing Everywhere**](/docs/template-clips-capture-everywhere) — the desktop app, the mobile companion, Rewind quick-save, Screen Memory, and the Chrome extension.
+{/* i18n-copy-ignore: formatting-only line break; localized copies predate this link list, so no translated prose changed. */}
+
+- [**Capturing Everywhere**](/docs/template-clips-capture-everywhere) — the desktop app, the mobile companion, Rewind, and the Chrome extension.
 - [**Sharing, Teams, and Agent-Readable Clips**](/docs/template-clips-sharing-and-teams) — visibility, passwords, organizations, and pasting a clip link into an agent.
 - [**AI Pipeline, Editing, and Insights**](/docs/template-clips-ai-and-editing) — transcription, non-destructive editing, and view analytics.
 - [**Extending Clips**](/docs/template-clips-developers) — for anyone customizing or extending the template.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.169.1",
+  "version": "0.170.0",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -429,7 +429,7 @@
     "yjs": "^13.6.32",
     "zod": "^4.3.6",
     "@agent-native/recap-cli": "0.5.8",
-    "@agent-native/toolkit": "^0.16.10"
+    "@agent-native/toolkit": "^0.16.11"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",

package/src/eject/workspace-connections.ts

@@ -17,7 +17,11 @@ export const WORKSPACE_CONNECTION_PROVIDERS: WorkspaceConnectionProvider[] = [
   "figma",
   "notion",
   "gmail",
+  "google_calendar",
   "google_drive",
+  "google_docs",
+  "google_sheets",
+  "google_slides",
   "hubspot",
   "salesforce",
   "jira",

package/src/templates/chat/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/src/templates/chat/app/routes.ts

@@ -1,4 +1,6 @@
 import { type RouteConfig } from "@react-router/dev/routes";
 import { flatRoutes } from "@react-router/fs-routes";
 
-export default flatRoutes() satisfies RouteConfig;
+export default flatRoutes({
+  ignoredRouteFiles: ["**/*.test.{ts,tsx}", "**/*.spec.{ts,tsx}"],
+}) satisfies RouteConfig;

package/src/templates/chat/vitest.config.ts

@@ -11,4 +11,12 @@ export default defineConfig({
       "@shared": path.resolve(__dirname, "./shared"),
     },
   },
+  test: {
+    exclude: [
+      "**/node_modules/**",
+      "**/.git/**",
+      "**/dist/**",
+      "**/.react-router/**",
+    ],
+  },
 });

package/src/templates/default/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/src/templates/default/app/routes.ts

@@ -1,4 +1,6 @@
 import { type RouteConfig } from "@react-router/dev/routes";
 import { flatRoutes } from "@react-router/fs-routes";
 
-export default flatRoutes() satisfies RouteConfig;
+export default flatRoutes({
+  ignoredRouteFiles: ["**/*.test.{ts,tsx}", "**/*.spec.{ts,tsx}"],
+}) satisfies RouteConfig;

package/src/templates/headless/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/src/templates/workspace-core/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight