@agent-native/core 0.188.0-nightly-20260925170533 → 0.188.0

package/corpus/README.md

@@ -31,4 +31,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- template files: 9957
+- template files: 9959

package/corpus/templates/analytics/CHANGELOG.md

@@ -7,10 +7,13 @@ time from the command menu (Cmd+K → "What's new") or from Settings.
 
 ### Improved
 
+- Analytics sidebar navigation and footer controls align consistently, with full-width dividers.
 - The Sessions list hides 0m recordings by default, with a filter to include them.
 
 ### Fixed
 
+- Dashboard emails now match the live dashboard's stacked area chart totals.
+- Editing a dashboard panel no longer brings back a panel you just deleted, and conflicting saves now show a clear error instead of a server error
 - Session recordings no longer cut off partway through when the daily recording budget runs low; new recordings wait for room instead.
 
 ## 2026-09-23

package/corpus/templates/assets/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable user-facing changes to Assets are documented here. Open it any
 time from the command menu (Cmd+K → "What's new") or from Settings.
 
+## 2026-09-24
+
+### Added
+
+- Builder-connected workspaces can generate brand-safe images and videos in Assets.
+
+### Fixed
+
+- Video generation avoids duplicate Gemini jobs when a start response is lost
+- Video generation runs recover after temporary provider or storage failures.
+
 ## 2026-09-23
 
 ### Fixed

package/corpus/templates/calendar/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable user-facing changes to Agent-Native Calendar are documented here. Open it any
 time from the command menu (Cmd+K → "What's new") or from Settings.
 
+## 2026-09-24
+
+### Fixed
+
+- Calendar no longer shows an internal server error banner when a shared workspace Google connection can't be authorized
+- Guest inputs wrap beneath existing guests so the active input stays visible
+
 ## 2026-09-23
 
 ### Improved

package/corpus/templates/calendar/changelog/2026-09-24-calendar-no-longer-shows-an-internal-server-error-banner-whe.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-09-24
+---
+
+Calendar no longer shows an internal server error banner when a shared workspace Google connection can't be authorized

package/corpus/templates/calendar/server/handlers/events.ts

@@ -1,20 +1,11 @@
-import { emit } from "@agent-native/core/event-bus";
 import { readBody, getSession } from "@agent-native/core/server";
 import {
   defineEventHandler,
-  getQuery,
   getRouterParam,
   setResponseStatus,
-  setResponseHeader,
   type H3Event,
 } from "h3";
 
-import { ensureOrganizerInAttendees } from "../../actions/event-action-helpers.js";
-import type { CalendarEvent } from "../../shared/api.js";
-import {
-  prepareZoomMeetingPatch,
-  shouldAutoAddGoogleMeet,
-} from "../lib/event-video-conferencing.js";
 import * as googleCalendar from "../lib/google-calendar.js";
 
 async function uEmail(event: H3Event): Promise<string> {
@@ -65,160 +56,6 @@ function handleError(event: H3Event, error: any) {
   return { error: error.message };
 }
 
-export const listEvents = defineEventHandler(async (event: H3Event) => {
-  try {
-    const email = await uEmail(event);
-    const query = getQuery(event);
-    const from = query.from as string | undefined;
-    const to = query.to as string | undefined;
-    const connected = await googleCalendar.isConnected(email);
-
-    if (!connected) {
-      return [];
-    }
-
-    if (!from || !to) {
-      return [];
-    }
-
-    const overlayEmailsParam = query.overlayEmails as string | undefined;
-
-    const { events: googleEvents, errors } = await googleCalendar.listEvents(
-      from,
-      to,
-      email,
-    );
-
-    if (googleEvents.length === 0 && errors.length > 0) {
-      setResponseStatus(event, 502);
-      return {
-        error: errors.map((e) => `${e.email}: ${e.error}`).join("; "),
-      };
-    }
-
-    // Fetch overlay people's events in parallel
-    let allEvents = googleEvents;
-    if (overlayEmailsParam) {
-      const overlayEmails = overlayEmailsParam
-        .split(",")
-        .filter(Boolean)
-        .slice(0, 10);
-      if (overlayEmails.length > 0) {
-        const { events: overlayEvents } =
-          await googleCalendar.listOverlayEvents(
-            from,
-            to,
-            overlayEmails,
-            email,
-          );
-        allEvents = [...googleEvents, ...overlayEvents];
-      }
-    }
-
-    let events = allEvents;
-    if (from) {
-      const fromDate = new Date(from);
-      events = events.filter((e) => new Date(e.end) >= fromDate);
-    }
-    if (to) {
-      const toDate = new Date(to);
-      events = events.filter((e) => new Date(e.start) <= toDate);
-    }
-
-    events.sort(
-      (a, b) => new Date(a.start).getTime() - new Date(b.start).getTime(),
-    );
-    if (errors.length > 0) {
-      setResponseHeader(event, "X-Account-Errors", JSON.stringify(errors));
-    }
-    return events;
-  } catch (error: any) {
-    console.error("[listEvents] Error:", error.message);
-    setResponseStatus(event, 500);
-    return { error: error.message };
-  }
-});
-
-export const createEvent = defineEventHandler(async (event: H3Event) => {
-  try {
-    const email = await uEmail(event);
-    const body = await readBody(event);
-
-    if (!(await googleCalendar.isConnected(email))) {
-      setResponseStatus(event, 400);
-      return {
-        error: "Google Calendar not connected. Connect via Settings first.",
-      };
-    }
-
-    const acctEmail = await resolveAccountEmail(body.accountEmail, email);
-
-    const { addGoogleMeet, addZoom, ...eventBody } = body;
-    if (addGoogleMeet === true && addZoom === true) {
-      setResponseStatus(event, 400);
-      return { error: "Choose either Google Meet or Zoom, not both." };
-    }
-
-    const calEvent: CalendarEvent = {
-      ...eventBody,
-      id: "",
-      source: "google",
-      accountEmail: acctEmail,
-      // Match Google Calendar UI: when inviting guests, include the
-      // organizer/self email in attendees so they appear in Guests.
-      attendees: ensureOrganizerInAttendees(eventBody.attendees, acctEmail),
-      createdAt: new Date().toISOString(),
-      updatedAt: new Date().toISOString(),
-    };
-
-    let zoomMeetingLink: string | undefined;
-    if (addZoom === true) {
-      const zoom = await prepareZoomMeetingPatch(email, calEvent);
-      zoomMeetingLink = zoom.meetingLink;
-      Object.assign(calEvent, zoom.patch);
-    }
-
-    const result = await googleCalendar.createEvent(calEvent, {
-      account: { ownerEmail: email, accountEmail: acctEmail },
-      addGoogleMeet: shouldAutoAddGoogleMeet(calEvent, {
-        addGoogleMeet:
-          typeof addGoogleMeet === "boolean" ? addGoogleMeet : undefined,
-        addZoom: addZoom === true,
-      }),
-    });
-    if (result.id) {
-      calEvent.id = `google-${result.id}`;
-      calEvent.googleEventId = result.id;
-    }
-    if (result.htmlLink) calEvent.htmlLink = result.htmlLink;
-    if (result.meetLink) calEvent.hangoutLink = result.meetLink;
-    if (result.conferenceData) calEvent.conferenceData = result.conferenceData;
-    if (zoomMeetingLink) calEvent.meetingLink = zoomMeetingLink;
-
-    try {
-      emit(
-        "calendar.event.created",
-        {
-          eventId: calEvent.id,
-          title: calEvent.title || eventBody.title || "",
-          startTime: calEvent.start,
-          endTime: calEvent.end,
-          attendees: calEvent.attendees ?? [],
-          createdBy: email,
-        },
-        { owner: email },
-      );
-    } catch {
-      // best-effort
-    }
-
-    setResponseStatus(event, 201);
-    return calEvent;
-  } catch (error: any) {
-    return handleError(event, error);
-  }
-});
-
 export const rsvpEvent = defineEventHandler(async (event: H3Event) => {
   try {
     const email = await uEmail(event);

package/corpus/templates/calendar/server/lib/google-calendar.ts

@@ -74,6 +74,26 @@ async function resolveManagedCalendarClient(): Promise<ManagedCalendarClient | n
   return { email: credential.accountId, accessToken: credential.accessToken };
 }
 
+/**
+ * A workspace connection can be registered and marked "connected" while its
+ * token still can't be resolved (revoked, mid-authorization, misconfigured
+ * credential). Callers that only need a yes/no read of connection status must
+ * see that as "not connected", not as a thrown error — otherwise a single
+ * flaky managed-token resolution turns every read action (list-events
+ * included) into a 500 instead of the same not-connected state the UI already
+ * shows.
+ */
+async function resolveManagedCalendarClientOrNull(): Promise<ManagedCalendarClient | null> {
+  try {
+    return await resolveManagedCalendarClient();
+  } catch {
+    // coercion-ok: null is the same typed "not connected" result callers
+    // already get for "no managed connection configured" - isConnected and
+    // getConnectedAccounts never distinguish it from a genuine read success.
+    return null;
+  }
+}
+
 const SCOPES = [
   "https://www.googleapis.com/auth/calendar.readonly",
   "https://www.googleapis.com/auth/calendar.events",
@@ -975,7 +995,20 @@ export async function getClientsForAccountsWithErrors(
     (account) => hasCalendarScope(account.tokens),
   );
   if (accounts.length === 0) {
-    const managed = await resolveManagedCalendarClient();
+    // Unlike isConnected()/getAuthStatus() - plain status reads with nowhere
+    // to put a reason - this function already has an `errors` channel its
+    // callers (listEvents, listGoogleCalendars) use to distinguish an empty
+    // calendar from a read failure. Preserve the failure there instead of
+    // coercing it into the same silent-empty shape as "no managed connection
+    // configured", matching the sibling fallback in getClientsWithErrors.
+    let managed: ManagedCalendarClient | null = null;
+    let managedError: string | undefined;
+    try {
+      managed = await resolveManagedCalendarClient();
+    } catch (err: any) {
+      managedError =
+        err?.message || "Workspace Google Calendar connection failed";
+    }
     if (!managed) {
       if (accountEmails?.length) {
         throw new Error(
@@ -984,7 +1017,9 @@ export async function getClientsForAccountsWithErrors(
       }
       return {
         clients: [],
-        errors: [],
+        errors: managedError
+          ? [{ email: "workspace", error: managedError }]
+          : [],
         requestedAccounts: [],
         resolvedAccounts: [],
       };
@@ -1225,7 +1260,7 @@ export async function isConnected(forEmail?: string): Promise<boolean> {
   if (!forEmail) return false;
   const accounts = await listOAuthAccountsByOwner("google", forEmail);
   if (accounts.some((account) => hasCalendarScope(account.tokens))) return true;
-  return Boolean(await resolveManagedCalendarClient());
+  return Boolean(await resolveManagedCalendarClientOrNull());
 }
 
 export async function getConnectedAccounts(
@@ -1236,7 +1271,7 @@ export async function getConnectedAccounts(
     (account) => hasCalendarScope(account.tokens),
   );
   if (accounts.length > 0) return accounts.map((a) => a.accountId);
-  const managed = await resolveManagedCalendarClient();
+  const managed = await resolveManagedCalendarClientOrNull();
   return managed ? [managed.email] : [];
 }
 
@@ -1276,7 +1311,7 @@ export async function getAuthStatus(
   );
 
   if (oauthAccounts.length === 0) {
-    const managed = await resolveManagedCalendarClient();
+    const managed = await resolveManagedCalendarClientOrNull();
     return managed
       ? { connected: true, accounts: [{ email: managed.email, shared: true }] }
       : { connected: false, accounts: [] };

package/corpus/templates/clips/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable user-facing changes to Clips are documented here. Open it any time
 from the command menu (Cmd+K → "What's new") or from Settings.
 
+## 2026-09-25
+
+### Improved
+
+- Shared clips remember your sidebar choice and help new viewers understand why to sign up.
+
+## 2026-09-24
+
+### Improved
+
+- Recording actions are easier to find and align clearly.
+- Share links appear after uploads finish, when clips are ready to view.
+
+### Fixed
+
+- Signed-in viewers see shared recordings in the Clips app shell with library breadcrumbs.
+- The camera bubble stays visible while you reposition it before recording, then the popover resumes its inactive auto-hide after the drag ends.
+
 ## 2026-09-23
 
 ### Improved

package/corpus/templates/clips/app/i18n/en-US.ts

@@ -359,6 +359,10 @@ const messages = {
     downloadForWindows: "Download for Windows",
     downloadForLinux: "Download for Linux",
     downloadDesktopApp: "Download desktop app",
+    commentSignupTitle: "Give your AI agent the full picture",
+    commentSignupContext: "Share transcript and timestamped frames in one link",
+    commentSignupFeedback: "Turn recorded feedback into clear next steps",
+    commentSignupDebug: "Capture console errors and failed requests",
     agentEmptyTitle: "Join the conversation",
     agentEmptyDescription:
       "Create a free Clips account to comment, react, and ask about this clip.",

package/corpus/templates/clips/app/routes/share.$shareId.tsx

@@ -17,6 +17,7 @@ import {
   DefaultSpinner,
   EnvironmentBadge,
 } from "@agent-native/core/client/ui";
+import { usePersistentSidebarCollapsed } from "@agent-native/toolkit/app-shell";
 import {
   IconAlertTriangle,
   IconDeviceDesktop,
@@ -543,7 +544,10 @@ export default function ShareRoute() {
   // viewer. Its own tab strip is the only panel navigation; the page toolbar
   // stays focused on recording actions.
   const [panel, setPanel] = useState<SharePanel>("comments");
-  const [sidePanelCollapsed, setSidePanelCollapsed] = useState(false);
+  const { collapsed: sidePanelCollapsed, setCollapsed: setSidePanelCollapsed } =
+    usePersistentSidebarCollapsed({
+      storageKey: "clips:share-sidebar-collapsed",
+    });
   const [descriptionExpanded, setDescriptionExpanded] = useState(false);
   const commentsSectionRef = useRef<HTMLElement | null>(null);
   const selectCommentsPanel = useCallback(() => {
@@ -555,7 +559,7 @@ export default function ShareRoute() {
         block: "start",
       });
     });
-  }, []);
+  }, [setSidePanelCollapsed]);
   const [downloading, setDownloading] = useState(false);
   const [accessRequestSent, setAccessRequestSent] = useState(false);
   const [accessRequestError, setAccessRequestError] = useState<string | null>(
@@ -1837,32 +1841,49 @@ export default function ShareRoute() {
                   ref={commentsSectionRef}
                   className="flex min-h-0 flex-1 flex-col overflow-hidden px-3 pb-3 pt-2"
                 >
-                  <CommentsPanel
-                    recordingId={recording.id}
-                    comments={comments}
-                    currentMs={playbackMs}
-                    getCurrentMs={resolvePlaybackMs}
-                    currentUserEmail={session?.email}
-                    currentUserName={session?.name}
-                    enableComments={recording.enableComments}
-                    canComment={viewerCanComment}
-                    onSeek={(ms) => playerRef.current?.seek(ms)}
-                    onUnauthenticated={requireSignIn}
-                    queryKey={[
-                      "public-recording",
-                      shareId,
-                      password,
-                      agentAccessToken,
-                      session?.email ?? null,
-                    ]}
-                    selectComments={(d: any) => d?.data?.comments}
-                    applyComments={(d: any, next) =>
-                      d
-                        ? { ...d, data: { ...(d.data ?? {}), comments: next } }
-                        : d
-                    }
-                    presentation="inline"
-                  />
+                  {!session &&
+                  sessionStatus !== "loading" &&
+                  sessionStatus !== "signing-out" &&
+                  comments.length === 0 ? (
+                    <PublicCommentsEmptyState
+                      signInHref={signInHref}
+                      onSignUp={() => {
+                        fireShareCtaClick("signup");
+                        openCreateAccount("comment");
+                      }}
+                      onSignIn={() => fireShareCtaClick("signin")}
+                    />
+                  ) : (
+                    <CommentsPanel
+                      recordingId={recording.id}
+                      comments={comments}
+                      currentMs={playbackMs}
+                      getCurrentMs={resolvePlaybackMs}
+                      currentUserEmail={session?.email}
+                      currentUserName={session?.name}
+                      enableComments={recording.enableComments}
+                      canComment={viewerCanComment}
+                      onSeek={(ms) => playerRef.current?.seek(ms)}
+                      onUnauthenticated={requireSignIn}
+                      queryKey={[
+                        "public-recording",
+                        shareId,
+                        password,
+                        agentAccessToken,
+                        session?.email ?? null,
+                      ]}
+                      selectComments={(d: any) => d?.data?.comments}
+                      applyComments={(d: any, next) =>
+                        d
+                          ? {
+                              ...d,
+                              data: { ...(d.data ?? {}), comments: next },
+                            }
+                          : d
+                      }
+                      presentation="inline"
+                    />
+                  )}
                 </section>
               </TabsContent>
             ) : null}
@@ -2010,6 +2031,67 @@ function formatRecordedOn(
   }).format(date);
 }
 
+function PublicCommentsEmptyState({
+  signInHref,
+  onSignUp,
+  onSignIn,
+}: {
+  signInHref: string;
+  onSignUp: () => void;
+  onSignIn: () => void;
+}) {
+  const t = useT();
+
+  return (
+    <div className="mx-auto flex min-h-0 w-full max-w-md flex-1 flex-col justify-center gap-5 overflow-y-auto px-5 py-6">
+      <div className="flex size-10 items-center justify-center rounded-lg bg-primary/10 text-primary">
+        <IconDeviceDesktop aria-hidden="true" className="size-5" />
+      </div>
+      <h2 className="text-base font-semibold tracking-tight">
+        {t("sharePage.commentSignupTitle")}
+      </h2>
+      <ul className="space-y-3 text-sm leading-5 text-muted-foreground">
+        <li className="flex items-start gap-3">
+          <span
+            aria-hidden="true"
+            className="mt-2 size-1.5 shrink-0 rounded-full bg-primary"
+          />
+          <span>{t("sharePage.commentSignupContext")}</span>
+        </li>
+        <li className="flex items-start gap-3">
+          <span
+            aria-hidden="true"
+            className="mt-2 size-1.5 shrink-0 rounded-full bg-primary"
+          />
+          <span>{t("sharePage.commentSignupFeedback")}</span>
+        </li>
+        <li className="flex items-start gap-3">
+          <span
+            aria-hidden="true"
+            className="mt-2 size-1.5 shrink-0 rounded-full bg-primary"
+          />
+          <span>{t("sharePage.commentSignupDebug")}</span>
+        </li>
+      </ul>
+      <div className="space-y-3">
+        <Button type="button" className="w-full" onClick={onSignUp}>
+          {t("signInPrompt.createAccount")}
+        </Button>
+        <p className="text-center text-xs text-muted-foreground">
+          {t("sharePage.agentEmptySignInPrompt")}{" "}
+          <a
+            href={signInHref}
+            onClick={onSignIn}
+            className="font-medium text-foreground underline underline-offset-4 hover:no-underline"
+          >
+            {t("signInPrompt.signIn")}
+          </a>
+        </p>
+      </div>
+    </div>
+  );
+}
+
 function PublicAgentEmptyState({
   signupHref,
   signInHref,

package/corpus/templates/clips/changelog/2026-09-25-shared-clips-remember-your-sidebar-choice-and-help-new-viewe.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-09-25
+---
+
+Shared clips remember your sidebar choice and help new viewers understand why to sign up.

package/corpus/templates/content/CHANGELOG.md

@@ -27,6 +27,10 @@ time from the command menu (Cmd+K → "What's new").
 
 ## 2026-09-21
 
+### Added
+
+- Choose Tabler icons, any emoji, or uploaded images for pages, collections, properties, views, callouts, and workspaces.
+
 ### Improved
 
 - Search now ranks exact and partial title matches above incidental matches in document bodies.

package/corpus/templates/design/CHANGELOG.md

@@ -3,14 +3,44 @@
 All notable user-facing changes to Design are documented here. Open it any time
 from the command menu (Cmd+K → "What's new") or from Settings.
 
+## 2026-09-25
+
+### Fixed
+
+- Cross-screen moves preserve Flex and Grid sizing through undo and redo.
+- Moving a layer from one live app screen into another now lands it instead of failing with "Could not move that layer", and a failed move no longer leaves the layer stuck to the cursor.
+
 ## 2026-09-24
 
+### Added
+
+- CSS margins can be adjusted on the canvas and in the layout inspector.
+- Organization admins can review agent runs and summarize linked designs, slide decks, and analytics from Settings.
+- Resized vectors can be point-edited, and the K scale tool shows a Scale section with a live factor.
+- Share editable live canvases and apply collaborators' visual changes
+
 ### Improved
 
+- A vector's stroke row shows Position beside Weight instead of a lone Weight field.
+- Design reviews show the real canvas beside its conversation.
+- Local visual edits stay scoped to the right design and recover cleanly when a screen reloads.
 - Pasted images now expose their sizing and adjustment controls in the inspector
 
 ### Fixed
 
+- Double-clicking text or a vector on the board starts editing it, and clicking empty canvas deselects it.
+- Interact opens a focused responsive preview without reloading the running design.
+- Interrupted cross-screen moves now restore the layer and leave the canvas ready for the next edit.
+- Keep gradient values visible and limit canvas paints to supported backgrounds
+- Open pen paths no longer paint a filled triangle after Shift+X, matching Figma.
+- Open Pen paths preserve their fill opacity when you finish editing them.
+- Pen path edits save without being blocked by delayed local retry storage.
+- Re-clicking the active responsive preview returns to the canvas even with pending edits
+- SVG paste handles mixed-case markup safely and preserves opacity edits on open Pen paths
+- SVG pastes keep valid namespace and fill data, and closing open paths preserves authored transparency.
+- Text selection remains available during line-height editing, and pasted SVGs have unsafe external styles removed.
+- Visual edit handoffs now accept current edit revisions reliably
+- While editing text, click to place the caret and double-click a word to restyle just that word.
 - Editing a vector path preserves its fill and stroke when reopened or closed.
 - Pasted images, SVGs, and Design layers preserve more of their original content and placement.
 

package/corpus/templates/mail/CHANGELOG.md

@@ -7,8 +7,20 @@ time from the command menu (Cmd+K → "What's new") or from Settings.
 
 ### Improved
 
+- Add an All inbox tab that shows every inbox thread and can be hidden in tab settings.
+- Priority sort keeps results when switching inbox tabs, and loading tabs show a skeleton
+- The composer keeps its taller layout in a narrower window.
 - The compose window opens larger, leaving more room to write with quieter toolbar icons.
 
+### Fixed
+
+- Gmail inboxes refresh reliably when push notifications are delayed.
+- Priority sorting stays in place when you return to the inbox
+
+### Security
+
+- Mail automations no longer fall back to shared deployment LLM keys; connect a provider in Settings to enable them.
+
 ## 2026-09-23
 
 ### Improved

package/corpus/templates/slides/CHANGELOG.md

@@ -3,6 +3,30 @@
 All notable user-facing changes to Agent-Native Slides are documented here. Open it any
 time from the command menu (Cmd+K → "What's new").
 
+## 2026-09-25
+
+### Fixed
+
+- Word document imports now complete successfully.
+
+## 2026-09-24
+
+### Improved
+
+- Slides completes multi-slide edits with fewer rounds of work
+
+### Fixed
+
+- Answering or skipping setup questions keeps deck generation in its original chat.
+- Deck generation progress follows its own run instead of unrelated chats.
+- Editing text on a slide no longer rewrites or restyles the rest of the slide, and clicking into text without typing no longer saves anything. Clicking text on a Markdown-layout slide no longer converts the slide to HTML; ask the agent to edit that text for now.
+- Guided questions stay available when a deck continuation cannot be delivered.
+- Restyling slides preserves their text and layout
+
+### Security
+
+- Slides image generation uses credentials saved for your account or workspace, not a shared deployment key.
+
 ## 2026-09-23
 
 ### Improved
@@ -11,6 +35,8 @@ time from the command menu (Cmd+K → "What's new").
 
 ### Fixed
 
+- Decks opened from a link or reload no longer get stuck on the generating screen when no generation is running
+- Decks with no design system now follow a theme chosen for their subject instead of a fixed default palette
 - Deck access errors leave the loading state and explain that the deck is unavailable.
 - Slide chat follows the current selection, and loaded slides remain visible when a background refresh fails
 - Slides home retries failed deck-list reads sooner.

package/dist/automation/index.d.ts

@@ -186,8 +186,8 @@ export declare function createAutomationCallbackHandler(runtime: AutomationRunti
     duplicate?: undefined;
     eventId?: undefined;
 } | {
+    error?: undefined;
     accepted: boolean;
     duplicate: boolean;
     eventId: string;
-    error?: undefined;
 }>;

package/dist/client/auth/AuthPage.d.ts

@@ -33,6 +33,7 @@ export interface AuthPageProps {
     initialView: AuthView;
     appBasePath: string;
     homePath: string;
+    initialResumeHref?: string;
     workspaceRuntime: boolean;
     trackingApp: string;
     defaultLocale: string;

package/dist/client/auth/AuthPage.js

@@ -483,9 +483,11 @@ export function shouldStartWithLocalDev(pathname, search) {
         !path.endsWith("/sign-in"));
 }
 export function AuthPage(props) {
-    const { authMode, googleOnly, initialPrompt, appBasePath, homePath, workspaceRuntime, trackingApp, defaultLocale, localeStorageKey, locales, localeMetadata, localeOptions, marketing, marketingLocales, brandMarkSrc, brandMarkLightSrc, githubUrl, showGoogle, organizationSsoEnabled = false, googleViaIdentitySso = false, signupLegalNotice, signupLocalModeNote, docsAuthUrl, identitySsoEnabled = false, identitySsoAuto = false, publicOAuthOrigin, workspaceGatewayReturnOrigin, googleAuthMode, builderPreviewLocalDevEnabled, } = props;
+    const { authMode, googleOnly, initialPrompt, appBasePath, homePath, initialResumeHref, workspaceRuntime, trackingApp, defaultLocale, localeStorageKey, locales, localeMetadata, localeOptions, marketing, marketingLocales, brandMarkSrc, brandMarkLightSrc, githubUrl, showGoogle, organizationSsoEnabled = false, googleViaIdentitySso = false, signupLegalNotice, signupLocalModeNote, docsAuthUrl, identitySsoEnabled = false, identitySsoAuto = false, publicOAuthOrigin, workspaceGatewayReturnOrigin, googleAuthMode, builderPreviewLocalDevEnabled, } = props;
     const [localePreference, setLocalePreference] = React.useState("system");
     const [locale, setLocale] = React.useState(defaultLocale);
+    const [browserLocationReady, setBrowserLocationReady] = React.useState(false);
+    React.useEffect(() => setBrowserLocationReady(true), []);
     const [localeMenuOpen, setLocaleMenuOpen] = React.useState(false);
     const [view, setView] = React.useState(props.initialView);
     const [messages, setMessages] = React.useState({});
@@ -544,9 +546,9 @@ export function AuthPage(props) {
     const apiPath = React.useCallback((path) => `${runtimeAppBasePath}${toPublicFrameworkPath(path, { publicPrefix: frameworkRoutePrefix() })}`, [runtimeAppBasePath]);
     const identityHref = React.useMemo(() => apiPath("/_agent-native/identity/login"), [apiPath]);
     const journey = React.useCallback(() => {
-        if (typeof window === "undefined") {
+        if (typeof window === "undefined" || !browserLocationReady) {
             return signInJourney({
-                at: `${runtimeAppBasePath}/`,
+                at: initialResumeHref ?? `${runtimeAppBasePath}/`,
                 basePath: runtimeAppBasePath,
                 homePath,
             });
@@ -560,8 +562,9 @@ export function AuthPage(props) {
             basePath: runtimeAppBasePath,
             homePath,
         });
-    }, [homePath, runtimeAppBasePath]);
+    }, [browserLocationReady, homePath, initialResumeHref, runtimeAppBasePath]);
     const resumeHref = React.useCallback(() => journey().resumeHref, [journey]);
+    const identityLoginHref = React.useMemo(() => `${identityHref}?${new URLSearchParams({ return: resumeHref() }).toString()}`, [identityHref, resumeHref]);
     const identityBootstrapHref = React.useCallback((target) => {
         const safeTarget = target || resumeHref();
         if (!identitySsoEnabled || isAgentNativeDesktop())
@@ -1976,6 +1979,9 @@ export function AuthPage(props) {
                 ? false
                 : shouldHideAuthSubtitle(view, localDevAvailable) }, usesMarketingWelcome ? t("welcomeSubtitle") : t(keys.subtitle)),
         React.createElement("p", { className: `upgrade-note ${upgradeVisible ? "show" : ""}`, id: "upgrade-note", "data-upgrade-copy": t("upgradeCopy"), "data-i18n-data-upgrade-copy": "upgradeCopy" }, upgradeVisible ? t("upgradeCopy") : null),
+        identitySsoEnabled && !googleOnly ? (React.createElement("div", { className: "identity-sso-entry", id: "identity-sso-entry" },
+            React.createElement("a", { className: "btn-primary btn-identity-sso", id: "identity-sso-btn", href: identityLoginHref, "aria-describedby": "identity-sso-hint", "data-i18n": "continueWithAgentNative" }, t("continueWithAgentNative")),
+            React.createElement("p", { className: "identity-sso-hint", id: "identity-sso-hint", "data-i18n": "identitySsoHint" }, t("identitySsoHint")))) : null,
         React.createElement("div", { className: "local-dev-signin", id: "local-dev-signin", hidden: !localDevAvailable },
             React.createElement("button", { type: "button", className: "btn-local-dev btn-primary", id: "local-dev-btn", title: t("localDevDescription"), "data-i18n": "localDevButton", "data-i18n-title": "localDevDescription", "aria-describedby": "local-dev-description", disabled: localDevBusy, onClick: () => void handleLocalDev() }, localDevBusy ? t("localDevSigningIn") : t("localDevButton")),
             React.createElement("p", { className: "local-dev-description", id: "local-dev-description" },

package/dist/client/org/OrgSwitcher.d.ts

@@ -10,7 +10,7 @@ export interface OrgSwitcherProps {
     className?: string;
     /** Hide entirely when the user only belongs to one org. Default: false. */
     hideWhenSingle?: boolean;
-    /** Keep the switcher's button height reserved while org state is loading. */
+    /** Keep the switcher's slot reserved when there is no organization to show. */
     reserveSpace?: boolean;
     /**
      * Icon-only trigger for collapsed sidebar rails. The popover — and with it

package/dist/client/org/OrgSwitcher.js

@@ -42,8 +42,8 @@ function organizationSettingsPath(path) {
 function ReservedOrgSwitcherSpace({ className }) {
     return _jsx("div", { "aria-hidden": "true", className: `h-8 ${className ?? ""}` });
 }
-function OrgSwitcherLoadingPlaceholder({ className }) {
-    return (_jsxs("button", { type: "button", disabled: true, "aria-label": "Loading organization", className: `${SWITCHER_BUTTON_CLASS} animate-pulse ${className ?? ""}`, children: [_jsx(IconBriefcase, { className: "h-3.5 w-3.5 shrink-0 opacity-60" }), _jsx("span", { className: "h-3 min-w-0 flex-1 rounded-sm bg-muted-foreground/20" }), _jsx(IconSelector, { className: "h-3 w-3 shrink-0 opacity-30" })] }));
+function OrgSwitcherLoadingPlaceholder({ className, compact, }) {
+    return (_jsx("button", { type: "button", disabled: true, "aria-label": "Loading organization", className: `${compact ? COMPACT_SWITCHER_BUTTON_CLASS : SWITCHER_BUTTON_CLASS} animate-pulse ${className ?? ""}`, children: compact ? (_jsx("span", { className: "size-3.5 rounded-sm bg-muted-foreground/20" })) : (_jsxs(_Fragment, { children: [_jsx(IconBriefcase, { className: "h-3.5 w-3.5 shrink-0 opacity-60" }), _jsx("span", { className: "h-3 min-w-0 flex-1 rounded-sm bg-muted-foreground/20" }), _jsx(IconSelector, { className: "h-3 w-3 shrink-0 opacity-30" })] })) }));
 }
 /**
  * Compact org switcher button. Shows the active org (or "Personal" when the
@@ -83,7 +83,7 @@ export function OrgSwitcher({ className, hideWhenSingle, reserveSpace, compact,
         await signOut();
     };
     if (!org) {
-        return reserveSpace && isLoading ? (_jsx(OrgSwitcherLoadingPlaceholder, { className: className })) : null;
+        return isLoading ? (_jsx(OrgSwitcherLoadingPlaceholder, { className: className, compact: compact })) : null;
     }
     const orgs = org.orgs ?? [];
     const pendingInvitations = org.pendingInvitations ?? [];

package/dist/file-upload/actions/upload-image.d.ts

@@ -44,9 +44,9 @@ declare const _default: import("../../action.js").ActionDefinition<{
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
+    error?: undefined;
 } | {
     url?: undefined;
     id?: undefined;

package/dist/notifications/routes.d.ts

@@ -11,14 +11,14 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
-    error?: undefined;
     count: number;
     updated?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated: number;
+    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -26,8 +26,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated?: undefined;
+    error?: undefined;
     ok: boolean;
 }>>;

package/dist/secrets/routes.d.ts

@@ -60,17 +60,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
@@ -81,13 +81,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     error: string;
     note?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -119,11 +119,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -9,7 +9,7 @@ export declare function createAgentEngineOllamaModelsHandler(): import("h3").Eve
     error: string;
     models?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     models: string[];
-    error?: undefined;
 }>>;

package/dist/server/onboarding-html.js

@@ -17,6 +17,7 @@ import { NATIVE_AUTH_COPY } from "../shared/auth-copy.js";
 import { docsUrl } from "../shared/docs-url.js";
 import { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, } from "../shared/environment-lanes.js";
 import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, } from "../shared/password-policy.js";
+import { signInJourney } from "../shared/sign-in-journey.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
 import { getAppBasePathFromViteEnv, normalizeAppBasePath, } from "./app-base-path.js";
 import { AUTH_MARKETING_LOCALE_COPY, } from "./auth-marketing-locales.js";
@@ -119,6 +120,8 @@ const EN_AUTH_COPY = {
     localDevSigningIn: "Signing in locally…",
     localDevFailed: "Local development sign-in is unavailable.",
     localDevFullOptions: "Show full sign in options",
+    continueWithAgentNative: "Continue with Agent-Native",
+    identitySsoHint: "Use the same verified email you use in your other Agent-Native apps.",
     openSource: "FREE & OPEN SOURCE",
     learnMore: "Learn more",
     useOwnGoogleClient: "Use your own Google OAuth client:",
@@ -192,6 +195,8 @@ const AUTH_LOCALE_COPY = {
         localDevSigningIn: "正在本地登录…",
         localDevFailed: "本地开发登录不可用。",
         localDevFullOptions: "显示完整登录选项",
+        continueWithAgentNative: "使用 Agent-Native 继续",
+        identitySsoHint: "使用你在其他 Agent-Native 应用中验证过的相同邮箱。",
         openSource: "100% 免费且开源",
         learnMore: "了解更多",
         useOwnGoogleClient: "使用你自己的 Google OAuth 客户端：",
@@ -263,6 +268,8 @@ const AUTH_LOCALE_COPY = {
         localDevSigningIn: "正在本機登入…",
         localDevFailed: "本機開發登入無法使用。",
         localDevFullOptions: "顯示完整登入選項",
+        continueWithAgentNative: "使用 Agent-Native 繼續",
+        identitySsoHint: "請使用你在其他 Agent-Native 應用中驗證過的相同電子郵件。",
         openSource: "100% 免費且開源",
         learnMore: "深入瞭解",
         useOwnGoogleClient: "使用你自己的 Google OAuth 用戶端：",
@@ -334,6 +341,8 @@ const AUTH_LOCALE_COPY = {
         localDevSigningIn: "Iniciando sesión localmente…",
         localDevFailed: "El inicio de sesión de desarrollo local no está disponible.",
         localDevFullOptions: "Mostrar todas las opciones de inicio de sesión",
+        continueWithAgentNative: "Continuar con Agent-Native",
+        identitySsoHint: "Usa el mismo correo verificado que en tus otras apps de Agent-Native.",
         openSource: "100% gratis y de código abierto",
         learnMore: "Más información",
         useOwnGoogleClient: "Usa tu propio cliente de Google OAuth:",
@@ -405,6 +414,8 @@ const AUTH_LOCALE_COPY = {
         localDevSigningIn: "Connexion locale…",
         localDevFailed: "La connexion de développement local est indisponible.",
         localDevFullOptions: "Afficher toutes les options de connexion",
+        continueWithAgentNative: "Continuer avec Agent-Native",
+        identitySsoHint: "Utilisez la même adresse e-mail vérifiée que dans vos autres applications Agent-Native.",
         openSource: "100 % gratuit et open source",
         learnMore: "En savoir plus",
         useOwnGoogleClient: "Utilisez votre propre client Google OAuth :",
@@ -476,6 +487,8 @@ const AUTH_LOCALE_COPY = {
         localDevSigningIn: "Lokale Anmeldung…",
         localDevFailed: "Die lokale Entwicklungsanmeldung ist nicht verfügbar.",
         localDevFullOptions: "Alle Anmeldeoptionen anzeigen",
+        continueWithAgentNative: "Mit Agent-Native fortfahren",
+        identitySsoHint: "Verwende dieselbe bestätigte E-Mail-Adresse wie in deinen anderen Agent-Native-Apps.",
         openSource: "100 % kostenlos und Open Source",
         learnMore: "Mehr erfahren",
         useOwnGoogleClient: "Eigenen Google-OAuth-Client verwenden:",
@@ -547,6 +560,8 @@ const AUTH_LOCALE_COPY = {
         localDevSigningIn: "ローカルでサインイン中…",
         localDevFailed: "ローカル開発のサインインは利用できません。",
         localDevFullOptions: "完全なサインイン オプションを表示",
+        continueWithAgentNative: "Agent-Native で続行",
+        identitySsoHint: "他の Agent-Native アプリで確認済みの同じメールアドレスを使用してください。",
         openSource: "100% 無料でオープンソース",
         learnMore: "詳細を見る",
         useOwnGoogleClient: "自分の Google OAuth クライアントを使用:",
@@ -618,6 +633,8 @@ const AUTH_LOCALE_COPY = {
         localDevSigningIn: "로컬로 로그인하는 중…",
         localDevFailed: "로컬 개발 로그인을 사용할 수 없습니다.",
         localDevFullOptions: "전체 로그인 옵션 보기",
+        continueWithAgentNative: "Agent-Native로 계속",
+        identitySsoHint: "다른 Agent-Native 앱에서 인증한 것과 같은 이메일 주소를 사용하세요.",
         openSource: "100% 무료 오픈 소스",
         learnMore: "자세히 알아보기",
         useOwnGoogleClient: "내 Google OAuth 클라이언트 사용:",
@@ -689,6 +706,8 @@ const AUTH_LOCALE_COPY = {
         localDevSigningIn: "Entrando localmente…",
         localDevFailed: "O login de desenvolvimento local não está disponível.",
         localDevFullOptions: "Mostrar todas as opções de login",
+        continueWithAgentNative: "Continuar com Agent-Native",
+        identitySsoHint: "Use o mesmo email verificado nos outros apps Agent-Native.",
         openSource: "100% grátis e open source",
         learnMore: "Saiba mais",
         useOwnGoogleClient: "Use seu próprio cliente Google OAuth:",
@@ -760,6 +779,8 @@ const AUTH_LOCALE_COPY = {
         localDevSigningIn: "स्थानीय रूप से साइन इन हो रहा है…",
         localDevFailed: "स्थानीय विकास साइन-इन उपलब्ध नहीं है।",
         localDevFullOptions: "साइन-इन के सभी विकल्प दिखाएं",
+        continueWithAgentNative: "Agent-Native के साथ जारी रखें",
+        identitySsoHint: "दूसरे Agent-Native ऐप्स में सत्यापित किया गया वही ईमेल इस्तेमाल करें।",
         openSource: "100% मुफ्त और open source",
         learnMore: "और जानें",
         useOwnGoogleClient: "अपना Google OAuth client उपयोग करें:",
@@ -831,6 +852,8 @@ const AUTH_LOCALE_COPY = {
         localDevSigningIn: "جارٍ تسجيل الدخول محليًا…",
         localDevFailed: "تسجيل دخول التطوير المحلي غير متاح.",
         localDevFullOptions: "عرض خيارات تسجيل الدخول الكاملة",
+        continueWithAgentNative: "المتابعة باستخدام Agent-Native",
+        identitySsoHint: "استخدم عنوان البريد الإلكتروني نفسه الذي تم التحقق منه في تطبيقات Agent-Native الأخرى.",
         openSource: "مجاني ومفتوح المصدر 100%",
         learnMore: "معرفة المزيد",
         useOwnGoogleClient: "استخدم عميل Google OAuth الخاص بك:",
@@ -948,6 +971,18 @@ export function getOnboardingHtml(opts = {}) {
     const configuredAppBasePath = getAppBasePathFromViteEnv();
     const appBasePath = configuredAppBasePath || workspaceBasePathFromRequest(opts.requestPath);
     const appHomePath = resolveAppHomePath(getAppConfig().app, getAppConfig().workspace);
+    const requestUrl = new URL(opts.requestPath || `${appBasePath}/`, "https://agent-native.local");
+    const requestPathname = requestUrl.pathname;
+    const isRootRequest = requestPathname === appBasePath || requestPathname === `${appBasePath}/`;
+    const initialResumeHref = signInJourney({
+        at: isRootRequest
+            ? `${appBasePath}/`
+            : `${requestPathname}${requestUrl.search}${requestUrl.hash}`,
+        continuation: isRootRequest ? null : requestUrl.searchParams.get("c"),
+        legacyReturn: isRootRequest ? null : requestUrl.searchParams.get("return"),
+        basePath: appBasePath,
+        homePath: appHomePath,
+    }).resumeHref;
     const workspaceRuntime = isWorkspaceRuntime();
     const trackingApp = getAppConfig().app.slug ??
         getAppConfig().app.template ??
@@ -1399,6 +1434,7 @@ export function getOnboardingHtml(opts = {}) {
         initialView: initialAuthView(opts, authMode, googleOnly),
         appBasePath,
         homePath: appHomePath,
+        initialResumeHref,
         workspaceRuntime,
         trackingApp,
         defaultLocale: DEFAULT_LOCALE,
@@ -1694,6 +1730,7 @@ export function getOnboardingHtml(opts = {}) {
   .card.verifying #google-btn,
   .card.verifying #google-err,
   .card.verifying #auth-divider,
+  .card.verifying #identity-sso-entry,
   .card.verifying #upgrade-note {
     display: none;
   }
@@ -1800,6 +1837,24 @@ export function getOnboardingHtml(opts = {}) {
   .local-dev-full-options[hidden] { display: none; }
   .full-auth-options { margin-top: 1rem; }
   .full-auth-options[hidden] { display: none; }
+  .identity-sso-entry { margin: 1rem 0; }
+  .btn-identity-sso {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    min-height: 2.75rem;
+    padding: 0.75rem;
+    text-align: center;
+    text-decoration: none;
+  }
+  .identity-sso-hint {
+    margin: 0.5rem 0 0;
+    color: color-mix(in srgb, currentColor 50%, transparent);
+    font-size: 0.75rem;
+    line-height: 1.45;
+    text-align: center;
+  }
+  html[data-agent-native-embedded="1"] #identity-sso-entry { display: none; }
   .sso-signin { margin-top: 0.75rem; }
   .legal-note {
     margin-top: 0.375rem;
@@ -1979,6 +2034,7 @@ export function getOnboardingHtml(opts = {}) {
   .card.magic-link-complete #google-signin,
   .card.magic-link-complete #auth-divider,
   .card.magic-link-complete #auth-tabs,
+  .card.magic-link-complete #identity-sso-entry,
   .card.magic-link-complete #upgrade-note,
   .card.magic-link-complete .form {
     display: none;

package/docs/content/cross-app-sso.mdx

@@ -49,8 +49,13 @@ eligibility check is unavailable, ordinary per-app sign-in remains available.
 
 ### Server-side federation
 
-The remaining broker and server-side callers use a short-lived,
-server-verified protocol. It is not exposed as a browser login control.
+Canonical Agent-Native sign-in pages expose an explicit **Continue with
+Agent-Native** action. It starts the same short-lived, server-verified protocol
+used by broker and server-side callers. A person with an active Dispatch
+session can continue; otherwise, Dispatch asks them to authenticate there. On
+first use, they may need to establish a Dispatch identity. The target app then
+links or creates its local user using the verified email and issues its own
+session.
 
 1. The caller requests an exact registered app binding.
 2. Dispatch authenticates the workspace identity and returns a short-lived,
@@ -100,10 +105,11 @@ credentials.
 
 <code>AGENT_NATIVE_IDENTITY_HUB_URL</code> identifies the hub for the
 server-side and browser paths when a self-hosted app needs an explicit Dispatch
-deployment. The <code>browser.identity-sso</code> rollout flag keeps browser
-federation opt-in. When enabled, a signed-in Dispatch user gets a silent
-<code>prompt=none</code> probe on app load and is provisioned without seeing a
-second login wall; the ordinary local sign-in form remains the fallback.
+deployment. Exact registered first-party apps can show the explicit browser
+action. The <code>browser.identity-sso</code> rollout flag controls silent
+<code>prompt=none</code> sign-in and post-local-login bootstrap; keep that
+automatic path limited to the selected rollout cohort. The local sign-in form
+remains available as a fallback.
 
 For a self-hosted Dispatch deployment, register every custom app with its
 exact app ID, client ID, HTTPS origin, callback path, and
@@ -138,22 +144,27 @@ After deployment:
 
 1. Verify that normal email, password, magic-link, and configured provider
    sign-in continue to work in a browser.
-2. With <code>browser.identity-sso</code> off, verify ordinary local sign-in.
-   With it on, verify the silent <code>prompt=none</code> probe and local-form
-   fallback without introducing a wildcard cookie.
+2. With <code>browser.identity-sso</code> off, verify the explicit Continue with
+   Agent-Native action and ordinary local sign-in. With it on, verify the silent
+   <code>prompt=none</code> probe and local-form fallback without introducing a
+   wildcard cookie.
 3. If Desktop workspace SSO is enabled, verify one exact registered app from
    the explicit Desktop Settings action.
 4. If organization federation is enabled, verify the exact organization ID
    and membership role in the target app.
 
-To roll back the remaining server-side or Desktop path, disable the relevant
-feature flag and remove <code>AGENT_NATIVE_IDENTITY_HUB_URL</code> from a
-self-hosted deployment, then redeploy. The additive identity and organization
-records remain available for ordinary local auth.
+To roll back the silent browser or Desktop path, disable its feature flag. To
+remove the explicit browser action from a self-hosted app, remove
+
+<code>AGENT_NATIVE_IDENTITY_HUB_URL</code> or its exact app registration, then
+redeploy. Local sign-in remains available, and additive identity and
+organization records remain intact.
 
 ## Browser identity SSO rollout runbook
 
-The browser path is intentionally a rollout, not a default switch in core.
+The silent browser path is intentionally a rollout, not a default switch in
+core. The explicit Continue with Agent-Native action is available to exact
+registered first-party clients and does not enable silent sign-in.
 For one canonical `*.agent-native.com` app:
 
 1. Keep `browser.identity-sso` disabled for the general population and enable
@@ -162,7 +173,8 @@ For one canonical `*.agent-native.com` app:
    Confirm the silent `prompt=none` probe returns the same verified account and
    that the app lands in its normal local session.
 3. Repeat with no active hub session. Confirm `login_required` returns to the
-   ordinary local sign-in form, with no Agent-Native sign-in button.
+   ordinary local sign-in form and the explicit action still lets a person
+   authenticate with Dispatch when they choose it.
 4. Widen the cohort only after checking that logout and revocation behave as
    expected. The first enablement may require one-time revocation of existing
    sessions so stale local sessions do not mask the probe result.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.188.0-nightly-20260925170533",
+  "version": "0.188.0",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -508,9 +508,9 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.32",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "^0.21.0-nightly-20260925170533",
-    "@agent-native/agentkit": "^0.2.10-nightly-20260925170533",
-    "@agent-native/recap-cli": "0.5.39"
+    "@agent-native/agentkit": "^0.2.10",
+    "@agent-native/recap-cli": "0.5.40",
+    "@agent-native/toolkit": "^0.21.0"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",