@agent-native/core 0.169.1 → 0.171.0

package/corpus/templates/analytics/server/lib/first-party-analytics.ts

@@ -1,4 +1,4 @@
-import { getDbExec } from "@agent-native/core/db";
+import { getDbExec, isPostgres } from "@agent-native/core/db";
 import { runWithRequestContext } from "@agent-native/core/server";
 import { and, eq, isNull, lt, or } from "drizzle-orm";
 
@@ -1072,6 +1072,130 @@ export function scopedAnalyticsSql(
   return { sql: rewritten, args };
 }
 
+/**
+ * Dashboard panel SQL (seeded and agent/user-authored) is written against
+ * PostgreSQL date/JSON syntax — `to_char`/`INTERVAL`/`::date`/`::jsonb ->>` —
+ * because that's the dialect this app runs against in production. A local
+ * SQLite dev database doesn't understand any of that and throws a syntax
+ * error before a row is ever read. Rather than hand-rewrite every seeded
+ * panel's SQL (this app also lets the agent/UI author new first-party SQL
+ * panels through this exact same execution path), translate the handful of
+ * Postgres-only shapes this query surface actually produces into SQLite
+ * equivalents right here at the execution boundary. PostgreSQL SQL is never
+ * touched: this only runs when the active database is not Postgres.
+ */
+export function toSqliteCompatibleFirstPartySql(sql: string): string {
+  let out = sql;
+
+  // properties::jsonb ->> 'key'  ->  json_extract(properties, '$."key"')
+  // (a quoted JSON path member tolerates keys like "$ai_model" that start
+  // with a character SQLite's unquoted path syntax can't lead with).
+  out = out.replace(
+    /([A-Za-z_][A-Za-z0-9_.]*)::jsonb\s*->>\s*'([^']*)'/g,
+    (_match, column: string, key: string) =>
+      `json_extract(${column}, '$."${key}"')`,
+  );
+
+  // Postgres chr(N) -> SQLite char(N).
+  out = out.replace(/\bchr\(/g, "char(");
+
+  // Any other Postgres type cast (::date, ::float, ::timestamptz, ...) is a
+  // no-op on SQLite's dynamically-typed columns.
+  out = out.replace(/::[A-Za-z_][A-Za-z0-9_]*/g, "");
+
+  // to_char(date_trunc('week', X), 'YYYY-MM-DD') -> Monday of X's week.
+  // ('weekday 0' finds the next Sunday, '-6 days' steps back to that week's
+  // Monday, matching Postgres's ISO week truncation.)
+  out = out.replace(
+    /to_char\(\s*date_trunc\(\s*'week'\s*,\s*([^()]+?)\s*\)\s*,\s*'YYYY-MM-DD'\s*\)/g,
+    (_match, expr: string) => `date(${expr}, 'weekday 0', '-6 days')`,
+  );
+
+  // <dateish-expr> (+|-) INTERVAL 'N days'  ->  the same day count applied
+  // through SQLite's julian-day arithmetic, immediately reformatted back to
+  // 'YYYY-MM-DD' text. Re-wrapping right away (instead of leaving a bare
+  // julian-day number) matters: this expression sometimes appears outside
+  // any to_char() call, compared directly against a text date column, and
+  // SQLite treats any numeric value as less than any text value — a bare
+  // number here would make that comparison silently always-true.
+  out = out.replace(
+    /([A-Za-z_][A-Za-z0-9_.]*|CURRENT_DATE)\s*(\+|-)\s*INTERVAL\s*'(\d+)\s*days?'/g,
+    (_match, base: string, op: string, days: string) => {
+      const juliandayBase = base === "CURRENT_DATE" ? "'now'" : base;
+      return `date(julianday(${juliandayBase}) ${op} ${days})`;
+    },
+  );
+
+  // <dateish-expr ending in "date"> (+|-) <identifier>  (no INTERVAL
+  // keyword) — e.g. `bounds.start_date + offsets.n` in a generated date
+  // series. Scoped to identifiers ending in "date" so unrelated integer
+  // arithmetic (e.g. building the offsets themselves) is left alone.
+  out = out.replace(
+    /([A-Za-z_][A-Za-z0-9_.]*date)\s*(\+|-)\s*([A-Za-z_][A-Za-z0-9_.]*)/g,
+    (_match, base: string, op: string, rhs: string) =>
+      `date(julianday(${base}) ${op} ${rhs})`,
+  );
+
+  // Every surviving to_char(expr, 'YYYY-MM-DD') now wraps an expr that
+  // already evaluates to 'YYYY-MM-DD' text (a bare CURRENT_DATE, or one of
+  // the date(...) forms produced above) — unwrap the call instead of
+  // re-wrapping it. A regex can't balance the arbitrarily nested parens
+  // `date(julianday(...) ...)` can produce, so walk the string instead.
+  out = unwrapPostgresToChar(out);
+
+  return out;
+}
+
+/**
+ * Finds each top-level `to_char(expr, 'YYYY-MM-DD')` call and replaces it
+ * with `expr` alone. Balances parens by hand rather than by regex so nested
+ * calls (`date(julianday(...) - 7)`) unwrap correctly regardless of depth.
+ */
+function unwrapPostgresToChar(sql: string): string {
+  const marker = "to_char(";
+  let out = "";
+  let i = 0;
+  while (i < sql.length) {
+    const idx = sql.indexOf(marker, i);
+    if (idx === -1) {
+      out += sql.slice(i);
+      break;
+    }
+    out += sql.slice(i, idx);
+    const openParen = idx + marker.length - 1;
+    let depth = 0;
+    let closeParen = openParen;
+    for (; closeParen < sql.length; closeParen++) {
+      if (sql[closeParen] === "(") depth++;
+      else if (sql[closeParen] === ")") {
+        depth--;
+        if (depth === 0) break;
+      }
+    }
+    const inner = sql.slice(openParen + 1, closeParen);
+    let innerDepth = 0;
+    let topLevelCommaIdx = -1;
+    for (let k = 0; k < inner.length; k++) {
+      if (inner[k] === "(") innerDepth++;
+      else if (inner[k] === ")") innerDepth--;
+      else if (inner[k] === "," && innerDepth === 0) topLevelCommaIdx = k;
+    }
+    const expr =
+      topLevelCommaIdx === -1 ? inner : inner.slice(0, topLevelCommaIdx);
+    const format =
+      topLevelCommaIdx === -1 ? "" : inner.slice(topLevelCommaIdx + 1).trim();
+    if (format === "'YYYY-MM-DD'") {
+      out += expr.trim();
+    } else {
+      // Not the to_char(expr, 'YYYY-MM-DD') shape this app's SQL uses;
+      // leave it untouched rather than guess at unfamiliar formats.
+      out += sql.slice(idx, closeParen + 1);
+    }
+    i = closeParen + 1;
+  }
+  return out;
+}
+
 function valueType(value: unknown): string {
   if (typeof value === "number") return "number";
   if (typeof value === "boolean") return "boolean";
@@ -1141,7 +1265,13 @@ export async function queryFirstPartyAnalytics(
     return queryFirstPartyAnalyticsInBigQuery(scoped.sql, scoped.args, table);
   }
   const scoped = scopedAnalyticsSql(sql, scope);
-  const wrappedSql = `SELECT * FROM (${scoped.sql}) AS first_party_analytics_query LIMIT ${MAX_QUERY_ROWS}`;
+  // Dashboard SQL is authored against Postgres date/JSON syntax; translate
+  // it for a non-Postgres sql-store (local SQLite dev) at the last possible
+  // moment so Postgres itself never sees a rewritten query.
+  const dialectSql = isPostgres()
+    ? scoped.sql
+    : toSqliteCompatibleFirstPartySql(scoped.sql);
+  const wrappedSql = `SELECT * FROM (${dialectSql}) AS first_party_analytics_query LIMIT ${MAX_QUERY_ROWS}`;
   const timeoutMs = Math.max(
     1,
     options.timeoutMs ?? FIRST_PARTY_ANALYTICS_QUERY_TIMEOUT_MS,

package/corpus/templates/analytics/server/lib/slack.ts

@@ -466,8 +466,10 @@ export async function resolveUsersWithCoverage(
   }
 
   const unresolvedUserIds = [...unresolvedUsers];
-  for (const id of unresolvedUserIds) {
-    results[id] = fallbackSlackUser(id);
+  if (!directoryError) {
+    for (const id of unresolvedUserIds) {
+      results[id] = fallbackSlackUser(id);
+    }
   }
 
   // Resolve bot users from messages that have bot_id but no user

package/corpus/templates/analytics/vitest.config.ts

@@ -14,7 +14,12 @@ export default mergeConfig(
     },
     test: {
       include: ["**/*.{test,spec}.?(c|m)[jt]s?(x)"],
-      exclude: ["**/node_modules/**", "**/.git/**", "**/dist/**"],
+      exclude: [
+        "**/node_modules/**",
+        "**/.git/**",
+        "**/dist/**",
+        "**/.react-router/**",
+      ],
     },
   }),
 );

package/corpus/templates/assets/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/corpus/templates/assets/app/routes/library.tsx

@@ -20,11 +20,13 @@ import {
 } from "@agent-native/core/client/host";
 import { useT } from "@agent-native/core/client/i18n";
 import {
-  AGENT_NATIVE_EMBED_MESSAGE_TYPES,
-  createAgentNativeEmbedEnvelope,
   createEmbeddedAppBridge,
   type EmbeddedAppBridge,
-} from "@agent-native/core/embedding";
+} from "@agent-native/core/embedding/bridge";
+import {
+  AGENT_NATIVE_EMBED_MESSAGE_TYPES,
+  createAgentNativeEmbedEnvelope,
+} from "@agent-native/core/embedding/protocol";
 import {
   EMBED_MODE_QUERY_PARAM,
   EMBED_TOKEN_QUERY_PARAM,

package/corpus/templates/assets/app/routes.ts

@@ -1,4 +1,6 @@
 import { type RouteConfig } from "@react-router/dev/routes";
 import { flatRoutes } from "@react-router/fs-routes";
 
-export default flatRoutes() satisfies RouteConfig;
+export default flatRoutes({
+  ignoredRouteFiles: ["**/*.test.{ts,tsx}", "**/*.spec.{ts,tsx}"],
+}) satisfies RouteConfig;

package/corpus/templates/assets/changelog/2026-08-22-library-page-loads-again-instead-of-crashing-on-open.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-22
+---
+
+Fixed the Library page (and the /brand-kits, /libraries, and /picker links that redirect to it) getting stuck on a loading spinner instead of showing your folders and assets.

package/corpus/templates/assets/vitest.config.ts

@@ -14,7 +14,12 @@ export default mergeConfig(
     },
     test: {
       include: ["**/*.{test,spec}.?(c|m)[jt]s?(x)"],
-      exclude: ["**/node_modules/**", "**/.git/**", "**/dist/**"],
+      exclude: [
+        "**/node_modules/**",
+        "**/.git/**",
+        "**/dist/**",
+        "**/.react-router/**",
+      ],
     },
   }),
 );

package/corpus/templates/brain/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/corpus/templates/brain/app/components/ui/pointer-lock.ts

@@ -0,0 +1 @@
+export * from "@agent-native/toolkit/ui/pointer-lock";

package/corpus/templates/brain/app/routes/sources.tsx

@@ -67,6 +67,7 @@ import {
 } from "@/components/ui/dropdown-menu";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
+import { afterBodyPointerUnlock } from "@/components/ui/pointer-lock";
 import { Progress } from "@/components/ui/progress";
 import {
   Select,
@@ -2253,7 +2254,11 @@ export default function SourcesRoute() {
         result,
         sourceKey: form.sourceKey,
       });
-      if (handoff) setIngestHandoff(handoff);
+      setSetupOpen(false);
+      if (handoff) {
+        afterBodyPointerUnlock(() => setIngestHandoff(handoff));
+      }
+      return;
     }
     setSetupOpen(false);
   }
@@ -2360,7 +2365,7 @@ export default function SourcesRoute() {
                     : undefined
                 }
                 onSync={() => syncSource.mutate({ sourceId: source.id })}
-                onTune={() => openEdit(source)}
+                onTune={() => afterBodyPointerUnlock(() => openEdit(source))}
                 onImportMarkdown={() => setMarkdownImportSource(source)}
                 onArchive={() => setArchiveSource(source)}
               />
@@ -2451,7 +2456,7 @@ export default function SourcesRoute() {
               }
               onAddSource={(provider) => {
                 setAdvancedOpen(false);
-                openCreate(provider);
+                afterBodyPointerUnlock(() => openCreate(provider));
               }}
             />
           </div>

package/corpus/templates/brain/changelog/2026-08-22-tuning-or-adding-a-source-no-longer-leaves-the-sources-page.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-22
+---
+
+Tuning or adding a source no longer leaves the Sources page unresponsive.

package/corpus/templates/brain/vitest.config.ts

@@ -11,6 +11,7 @@ export default mergeConfig(
         "**/dist/**",
         "**/.output/**",
         "**/.{idea,git,cache,output,temp}/**",
+        "**/.react-router/**",
       ],
     },
   }),

package/corpus/templates/calendar/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/corpus/templates/calendar/actions/list-booking-links.ts

@@ -1,21 +1,100 @@
 import { defineAction } from "@agent-native/core";
-import { accessFilter } from "@agent-native/core/sharing";
-import { desc } from "drizzle-orm";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server/request-context";
+import {
+  accessFilter,
+  ROLE_RANK,
+  type ShareRole,
+} from "@agent-native/core/sharing";
+import { and, desc, eq, inArray, or, sql } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
 import { rowToBookingLink } from "../server/lib/booking-link-utils.js";
 
+type EffectiveRole = "owner" | ShareRole;
+
+function normalizeEmail(email: string | undefined): string | null {
+  const normalized = email?.trim().toLowerCase();
+  return normalized || null;
+}
+
+function strongerRole(current: ShareRole | null, next: ShareRole): ShareRole {
+  if (!current || ROLE_RANK[next] > ROLE_RANK[current]) return next;
+  return current;
+}
+
 export default defineAction({
   description: "List all booking links",
   schema: z.object({}),
   http: { method: "GET" },
   run: async () => {
-    const rows = await getDb()
+    const db = getDb();
+    const userEmail = normalizeEmail(getRequestUserEmail());
+    const orgId = getRequestOrgId();
+    const rows = await db
       .select()
       .from(schema.bookingLinks)
       .where(accessFilter(schema.bookingLinks, schema.bookingLinkShares))
       .orderBy(desc(schema.bookingLinks.updatedAt));
-    return rows.map(rowToBookingLink);
+
+    if (rows.length === 0) return [];
+
+    const principalClauses: NonNullable<ReturnType<typeof and>>[] = [];
+    if (userEmail) {
+      principalClauses.push(
+        and(
+          eq(schema.bookingLinkShares.principalType, "user"),
+          sql`lower(${schema.bookingLinkShares.principalId}) = ${userEmail}`,
+        )!,
+      );
+    }
+    if (orgId) {
+      principalClauses.push(
+        and(
+          eq(schema.bookingLinkShares.principalType, "org"),
+          eq(schema.bookingLinkShares.principalId, orgId),
+        )!,
+      );
+    }
+
+    const shareRoleById = new Map<string, ShareRole>();
+    if (principalClauses.length > 0) {
+      const shareRows = await db
+        .select({
+          resourceId: schema.bookingLinkShares.resourceId,
+          role: schema.bookingLinkShares.role,
+        })
+        .from(schema.bookingLinkShares)
+        .where(
+          and(
+            inArray(
+              schema.bookingLinkShares.resourceId,
+              rows.map((row) => row.id),
+            ),
+            or(...principalClauses),
+          ),
+        );
+      for (const share of shareRows) {
+        shareRoleById.set(
+          share.resourceId,
+          strongerRole(shareRoleById.get(share.resourceId) ?? null, share.role),
+        );
+      }
+    }
+
+    return rows.map((row) => {
+      let role: EffectiveRole = shareRoleById.get(row.id) ?? "viewer";
+      if (
+        userEmail &&
+        normalizeEmail(row.ownerEmail) === userEmail &&
+        (!row.orgId || row.orgId === orgId)
+      ) {
+        role = "owner";
+      }
+      return { ...rowToBookingLink(row), accessRole: role };
+    });
   },
 });

package/corpus/templates/calendar/actions/update-booking-link.ts

@@ -57,7 +57,7 @@ export default defineAction({
     isActive: z.boolean().optional().describe("Whether the link is active"),
   }),
   run: async (args) => {
-    await assertAccess("booking-link", args.id, "editor");
+    const access = await assertAccess("booking-link", args.id, "editor");
 
     const durationInput = normalizeBookingDurationInput({
       duration: args.duration,
@@ -90,6 +90,7 @@ export default defineAction({
       .select({
         slug: schema.bookingLinks.slug,
         ownerEmail: schema.bookingLinks.ownerEmail,
+        isActive: schema.bookingLinks.isActive,
       })
       .from(schema.bookingLinks)
       .where(eq(schema.bookingLinks.id, args.id));
@@ -116,7 +117,7 @@ export default defineAction({
           ? JSON.stringify(args.conferencing)
           : null,
         color: args.color ? args.color.trim() : null,
-        isActive: args.isActive ?? true,
+        isActive: args.isActive ?? current.isActive,
         updatedAt: new Date().toISOString(),
       })
       .where(eq(schema.bookingLinks.id, args.id));
@@ -140,6 +141,6 @@ export default defineAction({
       .where(eq(schema.bookingLinks.id, args.id));
 
     if (!updated) throw new Error("Booking link not found");
-    return rowToBookingLink(updated);
+    return { ...rowToBookingLink(updated), accessRole: access.role };
   },
 });

package/corpus/templates/calendar/app/components/calendar/EventDetailPanel.tsx

@@ -74,6 +74,7 @@ interface EventDetailPanelProps {
   onClose: () => void;
   onDelete: (eventId: string) => void;
   onTitleSave?: (eventId: string, title: string, accountEmail?: string) => void;
+  timezone?: string;
 }
 
 function formatDuration(start: string, end: string): string {
@@ -121,6 +122,7 @@ export function EventDetailPanel({
   onClose,
   onDelete,
   onTitleSave,
+  timezone,
 }: EventDetailPanelProps) {
   const t = useT();
   const workingLocationLabels = createWorkingLocationDisplayLabels(t);
@@ -451,7 +453,9 @@ export function EventDetailPanel({
                           {format(
                             getDisplayDateInTimezone(
                               event.start,
-                              event.startTimeZone ?? event.endTimeZone,
+                              timezone ??
+                                event.startTimeZone ??
+                                event.endTimeZone,
                             ),
                             "h:mm a",
                           )}
@@ -459,7 +463,9 @@ export function EventDetailPanel({
                           {format(
                             getDisplayDateInTimezone(
                               event.end,
-                              event.endTimeZone ?? event.startTimeZone,
+                              timezone ??
+                                event.endTimeZone ??
+                                event.startTimeZone,
                             ),
                             "h:mm a",
                           )}
@@ -471,7 +477,9 @@ export function EventDetailPanel({
                           {format(
                             getDisplayDateInTimezone(
                               event.start,
-                              event.startTimeZone ?? event.endTimeZone,
+                              timezone ??
+                                event.startTimeZone ??
+                                event.endTimeZone,
                             ),
                             "EEE MMM d",
                           )}

package/corpus/templates/calendar/app/components/calendar/EventDetailPopover.tsx

@@ -489,7 +489,7 @@ export function EventDetailPopover({
   const t = useT();
   const workingLocationLabels = createWorkingLocationDisplayLabels(t);
   const isMobile = useIsMobile();
-  const eventTimezone = event.startTimeZone || timezone || getLocalTimezone();
+  const eventTimezone = timezone || event.startTimeZone || getLocalTimezone();
   const [open, setOpen] = useState(defaultOpen);
   const [editingTitle, setEditingTitle] = useState(
     defaultOpen ? getEditableEventTitle(event) : "",