@agent-native/core 0.176.1 → 0.176.2-nightly-20260831184159

package/corpus/templates/forms/server/lib/integrations.ts

@@ -55,6 +55,14 @@ interface SubmissionPayload {
   clientSurface?: string | null;
 }
 
+export interface IntegrationDeliverySnapshot {
+  id: string;
+  type: IntegrationType;
+  name: string;
+  url: string;
+  payload: unknown;
+}
+
 /** Human-readable label for a client-surface token. */
 function clientSurfaceLabel(surface: string): string {
   switch (surface) {
@@ -142,7 +150,7 @@ function formatDebugContext(submission: SubmissionPayload): string[] {
     );
   }
   if (submission.activeRunId) {
-    lines.push(`Run: \`${submission.activeRunId}\``);
+    lines.push(`Request ID: \`${submission.activeRunId}\``);
   }
   if (submission.pageUrl) {
     const appLabel = appLabelFromUrl(submission.pageUrl);
@@ -308,20 +316,89 @@ const payloadBuilders: Record<
   webhook: buildWebhookPayload,
 };
 
+export function buildIntegrationDeliverySnapshot(
+  integration: FormIntegration,
+  submission: SubmissionPayload,
+): IntegrationDeliverySnapshot {
+  const buildPayload = payloadBuilders[integration.type] ?? buildWebhookPayload;
+  return {
+    id: integration.id,
+    type: integration.type,
+    name: integration.name,
+    url: integration.url,
+    payload: buildPayload(submission),
+  };
+}
+
+export function buildIntegrationDeliverySnapshots(
+  integrations: FormIntegration[],
+  submission: SubmissionPayload,
+): IntegrationDeliverySnapshot[] {
+  return integrations
+    .filter((integration) => integration.enabled && integration.url)
+    .map((integration) =>
+      buildIntegrationDeliverySnapshot(integration, submission),
+    );
+}
+
+export async function deliverIntegrationDelivery(
+  snapshot: IntegrationDeliverySnapshot,
+  idempotencyKey?: string,
+): Promise<void> {
+  if (!isWebhookUrlAllowed(snapshot.url)) {
+    throw new Error("blocked URL");
+  }
+  const result = await deliverJsonWebhook({
+    url: snapshot.url,
+    payload: snapshot.payload,
+    ...(idempotencyKey
+      ? { headers: { "Idempotency-Key": idempotencyKey } }
+      : {}),
+  });
+  if (result.ok) return;
+  if (result.blocked) throw new Error("blocked URL");
+  throw new Error(
+    result.status
+      ? `destination returned ${result.status}`
+      : "destination request failed",
+  );
+}
+
 // ---------------------------------------------------------------------------
 // Fire integrations
 // ---------------------------------------------------------------------------
 
-/** Fire all enabled integrations for a submission. Never throws. */
+export type DeliveryStatus = "pending" | "succeeded" | "failed";
+export type DeliveryStatuses = Record<string, DeliveryStatus>;
+
+export function integrationDeliveryKey(integrationId: string): string {
+  return `integration:${integrationId}`;
+}
+
+interface FireIntegrationsOptions {
+  deliveryStatus?: Readonly<DeliveryStatuses>;
+  onStatusChange?: (
+    destination: string,
+    status: DeliveryStatus,
+  ) => Promise<void> | void;
+}
+
+/** Fire enabled integrations, skipping destinations already delivered. */
 export async function fireIntegrations(
   integrations: FormIntegration[],
   submission: SubmissionPayload,
-): Promise<void> {
+  options: FireIntegrationsOptions = {},
+): Promise<DeliveryStatuses> {
   const enabled = integrations.filter((i) => i.enabled && i.url);
-  if (enabled.length === 0) return;
+  const statuses: DeliveryStatuses = { ...(options.deliveryStatus ?? {}) };
+  if (enabled.length === 0) return statuses;
 
-  await Promise.allSettled(
+  const results = await Promise.allSettled(
     enabled.map(async (integration) => {
+      const destination = integrationDeliveryKey(integration.id);
+      if (options.deliveryStatus?.[destination] === "succeeded") return;
+
+      let status: DeliveryStatus = "failed";
       // SSRF guard — a form-author can persist any URL in their integration
       // config. Anonymous submissions then trigger a server-side POST. Block
       // private IPs, cloud-metadata endpoints, and non-http(s) schemes
@@ -330,38 +407,28 @@ export async function fireIntegrations(
         console.warn(
           `[integrations] ${integration.type} "${integration.name}" rejected: blocked URL`,
         );
-        return;
-      }
-
-      const buildPayload =
-        payloadBuilders[integration.type] ?? buildWebhookPayload;
-      const payload = buildPayload(submission);
-
-      try {
-        const result = await deliverJsonWebhook({
-          url: integration.url,
-          payload,
-        });
-        if (!result.ok) {
-          if (result.blocked) {
-            console.warn(
-              `[integrations] ${integration.type} "${integration.name}" rejected: blocked URL`,
-            );
-            return;
-          }
+      } else {
+        try {
+          await deliverIntegrationDelivery(
+            buildIntegrationDeliverySnapshot(integration, submission),
+          );
+          status = "succeeded";
+        } catch (err) {
           console.warn(
-            result.status
-              ? `[integrations] ${integration.type} "${integration.name}" returned ${result.status}`
-              : `[integrations] ${integration.type} "${integration.name}" failed:`,
-            result.error,
+            `[integrations] ${integration.type} "${integration.name}" failed:`,
+            err,
           );
         }
-      } catch (err) {
-        console.warn(
-          `[integrations] ${integration.type} "${integration.name}" failed:`,
-          err,
-        );
       }
+
+      statuses[destination] = status;
+      await options.onStatusChange?.(destination, status);
     }),
   );
+
+  const rejected = results.find(
+    (result): result is PromiseRejectedResult => result.status === "rejected",
+  );
+  if (rejected) throw rejected.reason;
+  return statuses;
 }

package/corpus/templates/forms/server/middleware/00-public-cors.ts

@@ -28,7 +28,7 @@ export default defineEventHandler((event) => {
   setResponseHeader(
     event,
     "Access-Control-Allow-Headers",
-    "Content-Type,Accept",
+    "Content-Type,Accept,Idempotency-Key",
   );
 
   if (getMethod(event) === "OPTIONS") {

package/corpus/templates/forms/server/plugins/auth.ts

@@ -1,6 +1,7 @@
 import { createAuthPlugin } from "@agent-native/core/server";
 
 export default createAuthPlugin({
+  workspaceAppPublicPaths: ["/"],
   marketing: {
     appName: "Forms",
     tagline:

package/corpus/templates/forms/server/plugins/core-routes.ts

@@ -1,6 +1,7 @@
 import { createCoreRoutesPlugin } from "@agent-native/core/server";
 
 export default createCoreRoutesPlugin({
+  googleOAuthManagedConnection: "not_applicable",
   envKeys: [
     { key: "DATABASE_URL", label: "Database URL", required: false },
     {

package/corpus/templates/forms/server/plugins/db.ts

@@ -150,6 +150,46 @@ CREATE INDEX IF NOT EXISTS form_shares_resource_idx ON form_shares (resource_id,
         sqlite: `ALTER TABLE responses ADD COLUMN IF NOT EXISTS client_surface TEXT`,
       },
     },
+    {
+      version: 13,
+      name: "responses-idempotency-key",
+      sql: {
+        postgres: `ALTER TABLE responses ADD COLUMN IF NOT EXISTS idempotency_key TEXT;
+CREATE UNIQUE INDEX IF NOT EXISTS responses_form_idempotency_key_idx ON responses (form_id, idempotency_key)`,
+        sqlite: `ALTER TABLE responses ADD COLUMN IF NOT EXISTS idempotency_key TEXT;
+CREATE UNIQUE INDEX IF NOT EXISTS responses_form_idempotency_key_idx ON responses (form_id, idempotency_key)`,
+      },
+    },
+    {
+      version: 14,
+      name: "responses-delivery-status",
+      sql: {
+        postgres: `ALTER TABLE responses ADD COLUMN IF NOT EXISTS delivery_status TEXT`,
+        sqlite: `ALTER TABLE responses ADD COLUMN IF NOT EXISTS delivery_status TEXT`,
+      },
+    },
+    {
+      version: 15,
+      name: "response-delivery-snapshots",
+      sql: `ALTER TABLE responses ADD COLUMN IF NOT EXISTS delivery_snapshot TEXT;
+CREATE TABLE IF NOT EXISTS response_deliveries (
+  id TEXT PRIMARY KEY,
+  response_id TEXT NOT NULL REFERENCES responses(id),
+  destination TEXT NOT NULL,
+  kind TEXT NOT NULL,
+  payload TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending',
+  claim_token TEXT,
+  claimed_at TEXT,
+  error_message TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS response_deliveries_response_destination_idx
+  ON response_deliveries (response_id, destination);
+CREATE INDEX IF NOT EXISTS response_deliveries_status_idx
+  ON response_deliveries (status, claimed_at)`,
+    },
   ],
   { table: "forms_migrations" },
 );

package/corpus/templates/macros/.agents/skills/frontend-design/SKILL.md

@@ -68,6 +68,10 @@ is the target: a surface full of information and nearly empty of narration. So
 "make it minimal" is never satisfied by removing data or by burying it behind
 extra clicks, and never blocked by deleting a sentence.
 
+Keep on-screen text and badging minimal: show the shortest label needed for the
+next action, remove decorative or duplicate status chips, and put context in a
+tooltip or progressive disclosure when it is not needed to decide.
+
 Do not add, unless asked:
 
 - A page title that repeats the nav item or route the user just clicked, or a

package/corpus/templates/macros/.agents/skills/secrets/SKILL.md

@@ -31,6 +31,53 @@ standard workspace connections and org/workspace vault scopes; never put them
 in `.env` or deployment environment variables, and never add a provider-specific
 action or startup bootstrap just to write a credential for one organization.
 
+## Google OAuth triage
+
+| Observation | Meaning | Next action |
+| --- | --- | --- |
+| `invalid_grant` from a deliberately fake code | Google accepted the client pair and rejected only the code | Do not rotate credentials; check flow state and callback registration |
+| `invalid_client` | Google rejected the client id/secret pair | Verify the exact pair and deployment source before rotating |
+| `redirect_uri_mismatch` | The client, host, callback path, and Google registration disagree | Compare that exact tuple in Google Cloud Console; publish a new deploy if site-scoped or build-time configuration changes |
+
+Do not reason about this from memory. The probe checks both contracts: the
+unqualified `/health/google` endpoint reports the sign-in contract, while
+`/health/google?client=managed` reports deployment-level managed OAuth. It asks
+Google directly whether each live `(client_id, redirect_uri)` pair is
+registered:
+
+```bash
+pnpm check:google-redirect-uris -- --env all
+```
+
+The sign-in health path calls `checkGoogleSignInCredential()`, which prefers
+the active Better Auth pair and otherwise uses `resolveGoogleSignInCredentials()`
+from `packages/core/src/server/google-oauth-credentials.ts`. Managed health
+calls `checkGoogleManagedCredential()`, which resolves
+`["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"]` through `resolveSecretPair()` in
+`packages/core/src/server/credential-provider.ts`. App provider handlers use
+`resolveGoogleProviderCredentialCandidatesWithReader()` with `resolveSecret`
+under request context. These are separate flows and can intentionally land on
+different Google clients, so a clean result for one says nothing about the
+other. Read both contracts before changing anything:
+
+```bash
+curl -s https://HOST/_agent-native/health/google | jq '{clientId,mismatchedPairs,credentialSource}'
+curl -s "https://HOST/_agent-native/health/google?client=managed" | jq '{clientId,mismatchedPairs,credentialSource}'
+```
+
+Different `clientId` values across those two, or `mismatchedPairs: true`, is a
+divergence to understand, not damage to undo. Never repair it by rotating a
+secret: writing a fresh value into whichever namespace the failing flow does
+not read verifies clean and changes nothing. Do not collapse the namespaces
+without first confirming which flow uses which client; separate sign-in and
+managed clients on one host can be deliberate. For prebuilt Netlify deploys,
+uploaded Functions read site-scoped secrets at runtime, and the health route
+resolves them per request. The build may receive masked placeholder values.
+After changing a site-scoped env var, publish a new deploy before verifying
+live behavior. Call it a rebuild when the changed value is baked into build
+output or static assets; a runtime-only secret does not need to be baked into
+the bundle.
+
 ## Credential Modeling Preflight
 
 Before registering a provider's fields, inspect the workspace/provider connection

package/corpus/templates/macros/actions/view-screen.ts

@@ -10,7 +10,7 @@ export default defineAction({
   run: async () => {
     const navigation = await readAppState("navigation");
     return {
-      navigation: navigation || { view: "entry", path: "/" },
+      navigation: navigation || { view: "entry", path: "/home" },
       hint: "Use list-meals, list-exercises, or list-weights with the date from navigation to see the user's data",
     };
   },

package/corpus/templates/macros/app/components/layout/AppLayout.tsx

@@ -1,10 +1,10 @@
 import { AgentSidebar } from "@agent-native/core/client/agent-chat";
-import { agentNativePath, appPath } from "@agent-native/core/client/api-path";
+import { agentNativePath } from "@agent-native/core/client/api-path";
 import { DevDatabaseLink } from "@agent-native/core/client/db-admin";
 import { useT } from "@agent-native/core/client/i18n";
 import { openCommandMenu } from "@agent-native/core/client/navigation";
 import { OrgSwitcher } from "@agent-native/core/client/org";
-import { FeedbackButton } from "@agent-native/core/client/ui";
+import { AgentNativeIcon, FeedbackButton } from "@agent-native/core/client/ui";
 import {
   HeaderActionsProvider,
   SidebarFooterActions,
@@ -39,7 +39,7 @@ import { cn } from "@/lib/utils";
 import { Header } from "./Header";
 
 const navItems = [
-  { icon: IconFlame, labelKey: "navigation.entry", href: "/" },
+  { icon: IconFlame, labelKey: "navigation.entry", href: "/home" },
   { icon: IconChartBar, labelKey: "navigation.analytics", href: "/analytics" },
 ];
 
@@ -123,7 +123,7 @@ export function AppLayout({ children }: { children: React.ReactNode }) {
       } else if (cmd.view === "agent") {
         void navigate("/settings/agent");
       } else if (cmd.view === "entry") {
-        void navigate("/");
+        void navigate("/home");
       }
       // Clear the command
       fetch(agentNativePath("/_agent-native/application-state/navigate"), {
@@ -251,21 +251,9 @@ function SidebarContent({
       >
         {!collapsed && (
           <div className="flex min-w-0 flex-1 items-center gap-2">
-            <img
-              src={appPath("/agent-native-icon-light.svg")}
-              alt=""
+            <AgentNativeIcon
               aria-hidden="true"
-              width={28}
-              height={16}
-              className="block h-4 w-7 shrink-0 object-contain object-center dark:hidden"
-            />
-            <img
-              src={appPath("/agent-native-icon-dark.svg")}
-              alt=""
-              aria-hidden="true"
-              width={28}
-              height={16}
-              className="hidden h-4 w-7 shrink-0 object-contain object-center dark:block"
+              className="h-3.5 w-6 shrink-0 text-foreground"
             />
             <span className="font-logo truncate text-sm font-bold tracking-tight text-foreground">
               {t("navigation.brand")}
@@ -279,8 +267,8 @@ function SidebarContent({
           const Icon = item.icon;
           const label = t(item.labelKey);
           const isActive =
-            item.href === "/"
-              ? pathname === "/" || pathname === "/entry"
+            item.href === "/home"
+              ? pathname === "/home" || pathname === "/entry"
               : pathname.startsWith(item.href);
           const link = (
             <Link
@@ -345,7 +333,7 @@ function SidebarContent({
 
       {!collapsed && (
         <>
-          <div className="space-y-2 px-3 py-2">
+          <div className="space-y-2 px-3 py-2 empty:hidden">
             <DevDatabaseLink />
             <OrgSwitcher />
           </div>

package/corpus/templates/macros/app/components/layout/Header.tsx

@@ -8,7 +8,7 @@ import { IconMenu2 } from "@tabler/icons-react";
 import { useLocation } from "react-router";
 
 const pageTitles: Record<string, string> = {
-  "/": "header.entry",
+  "/home": "header.entry",
   "/entry": "header.entry",
   "/analytics": "header.analytics",
   "/agent": "settings.agentTitle",

package/corpus/templates/macros/app/root.tsx

@@ -21,6 +21,7 @@ import {
   Outlet,
   Scripts,
   ScrollRestoration,
+  useLocation,
   useNavigate,
 } from "react-router";
 import type { LinksFunction } from "react-router";
@@ -180,6 +181,20 @@ function MacrosCommandMenu({
   );
 }
 
+function AppContent() {
+  const [cmdkOpen, setCmdkOpen] = useState(false);
+  useCommandMenuShortcut(useCallback(() => setCmdkOpen(true), []));
+  return (
+    <>
+      <DbSyncSetup />
+      <MacrosCommandMenu open={cmdkOpen} onOpenChange={setCmdkOpen} />
+      <AppLayout>
+        <Outlet />
+      </AppLayout>
+    </>
+  );
+}
+
 export default function Root() {
   const [queryClient] = useState(() =>
     createAgentNativeQueryClient({
@@ -192,23 +207,22 @@ export default function Root() {
       },
     }),
   );
-  const [cmdkOpen, setCmdkOpen] = useState(false);
-  useCommandMenuShortcut(useCallback(() => setCmdkOpen(true), []));
+  const location = useLocation();
+  const isMarketingPath = location.pathname === "/";
 
   return (
     <AppToolkitProvider>
       <AppProviders
         queryClient={queryClient}
         defaultTheme="dark"
+        isPublicPath={isMarketingPath}
         tooltipDelayDuration={300}
-        toaster={<Toaster richColors position="bottom-left" />}
+        toaster={
+          isMarketingPath ? null : <Toaster richColors position="bottom-left" />
+        }
         i18n={{ catalog: i18nCatalog }}
       >
-        <DbSyncSetup />
-        <MacrosCommandMenu open={cmdkOpen} onOpenChange={setCmdkOpen} />
-        <AppLayout>
-          <Outlet />
-        </AppLayout>
+        {isMarketingPath ? <Outlet /> : <AppContent />}
       </AppProviders>
     </AppToolkitProvider>
   );