@agent-native/core 0.192.0-nightly-20260926081002 → 0.192.0

package/corpus/templates/chat/app/routes/_index.tsx

@@ -1,37 +1 @@
-import { appPath } from "@agent-native/core/client/api-path";
-import { MarketingHome } from "@agent-native/toolkit/marketing";
-
-import { APP_TITLE } from "@/lib/app-config";
-
-const SEO_TITLE = APP_TITLE + " - Open Source AI app starter with actions";
-const SEO_DESCRIPTION =
-  "Open Source starter for agent-native apps with durable chat, shared actions, UI state, tools, and a backend your agent can extend.";
-
-export function meta() {
-  return [
-    { title: SEO_TITLE },
-    { name: "description", content: SEO_DESCRIPTION },
-    { property: "og:title", content: SEO_TITLE },
-    { property: "og:description", content: SEO_DESCRIPTION },
-    { name: "twitter:card", content: "summary" },
-    { name: "twitter:title", content: SEO_TITLE },
-    { name: "twitter:description", content: SEO_DESCRIPTION },
-  ];
-}
-
-export default function MarketingHomeRoute() {
-  return (
-    <MarketingHome
-      appName={APP_TITLE}
-      tagline="Start from a chat-first agent-native app and add actions, screens, and workflows as you grow."
-      description={SEO_DESCRIPTION}
-      valueProps={[
-        "Full-page chat with durable threads and tool call history",
-        "Use shared actions from chat, UI, HTTP, MCP, A2A, and CLI",
-        "Plug in your own agent runtime or use the included app-agent loop",
-      ]}
-      primaryActionHref={appPath("/home")}
-      secondaryActionHref={appPath("/sign-in")}
-    />
-  );
-}
+export { signInLandingLoader as loader } from "@agent-native/core/client/sign-in-landing";

package/corpus/templates/chat/server/plugins/auth.ts

@@ -7,9 +7,6 @@ export default createAuthPlugin({
   workspaceAppPublicPaths: ["/"],
   marketing: {
     appName: appTitle,
-    screenshotPath: "/auth-marketing/chat.webp",
-    screenshotWidth: 914,
-    screenshotHeight: 818,
     learnMoreUrl: "https://agent-native.com/apps/chat",
     tagline:
       "Start from a chat-first agent-native app and add actions, screens, and workflows as you grow.",

package/corpus/templates/clips/CHANGELOG.md

@@ -3,15 +3,25 @@
 All notable user-facing changes to Clips are documented here. Open it any time
 from the command menu (Cmd+K → "What's new") or from Settings.
 
+## 2026-09-26
+
+### Changed
+
+- The app entry now opens the shared sign-in and sign-up screen instead of a separate marketing page.
+
 ## 2026-09-25
 
 ### Improved
 
+- Connect Builder storage by creating an account in one click.
+- Public clip embeds and meeting notes show richer link previews.
 - The no-comments sidebar gives viewers a concise reason to try Clips and a clear path to sign up.
 - Shared clips remember your sidebar choice and help new viewers understand why to sign up.
 
 ### Fixed
 
+- Clips desktop sign-in now accepts authenticator codes when two-step verification is enabled.
+- Keep Builder login state after blocked popups and show feedback while retrying storage connection checks
 - Clips clears a stale recording overlay after an interrupted save
 - Concurrent workflow requests no longer replace an active generation.
 - Generated workflows stay tied to the request that created them.

package/corpus/templates/clips/app/root.tsx

@@ -382,12 +382,6 @@ function ClipsExtensionAuthBridge() {
   );
 }
 
-function AppContent() {
-  const location = useLocation();
-  if (location.pathname === "/") return <Outlet />;
-  return <PrivateAppContent />;
-}
-
 function PrivateAppContent() {
   const location = useLocation();
   const { status: sessionStatus } = useSession();
@@ -429,9 +423,7 @@ export default function Root() {
   const location = useLocation();
   const loaderData = useLoaderData<typeof loader>();
   const [queryClient] = useState(() => createAgentNativeQueryClient());
-  const isMarketingHome = location.pathname === "/";
-  const isPublicPath =
-    isMarketingHome || isStandalonePublicPath(location.pathname);
+  const isPublicPath = isStandalonePublicPath(location.pathname);
   const legacyRecordingPath = isLegacyRecordingPath(location.pathname);
   const publicSharePath = location.pathname.startsWith("/share/");
   return (
@@ -461,7 +453,7 @@ export default function Root() {
           persistPreference: !isPublicPath,
         }}
       >
-        <AppContent />
+        <PrivateAppContent />
       </AppProviders>
     </AppToolkitProvider>
   );

package/corpus/templates/clips/app/routes/_index.tsx

@@ -1,33 +1 @@
-import { appPath } from "@agent-native/core/client/api-path";
-import { MarketingHome } from "@agent-native/toolkit/marketing";
-
-const SEO_TITLE = "Clips - Open Source screen recorder";
-const SEO_DESCRIPTION =
-  "Open Source screen recorder and meeting-notes app with AI transcripts, summaries, search, dictation, and agent-readable share links.";
-
-export function meta() {
-  return [
-    { title: SEO_TITLE },
-    {
-      name: "description",
-      content: SEO_DESCRIPTION,
-    },
-    { property: "og:title", content: SEO_TITLE },
-    { property: "og:description", content: SEO_DESCRIPTION },
-    { name: "twitter:card", content: "summary" },
-    { name: "twitter:title", content: SEO_TITLE },
-    { name: "twitter:description", content: SEO_DESCRIPTION },
-  ];
-}
-
-export default function MarketingHomeRoute() {
-  return (
-    <MarketingHome
-      appName="Clips"
-      tagline={SEO_TITLE}
-      description={SEO_DESCRIPTION}
-      primaryActionHref={appPath("/home")}
-      secondaryActionHref={appPath("/sign-in")}
-    />
-  );
-}
+export { signInLandingLoader as loader } from "@agent-native/core/client/sign-in-landing";

package/corpus/templates/clips/app/routes/share.$shareId.tsx

@@ -533,9 +533,8 @@ export default function ShareRoute() {
     status: sessionStatus,
     retry: retrySession,
   } = useSession();
-  // appPath("/") always renders the public marketing shell (root.tsx's
-  // isMarketingHome), even for a signed-in viewer - never use it as a
-  // signed-in destination.
+  // The root entry is public, even for signed-in viewers; keep private
+  // destinations on the app's home route.
   const homeHref = session ? appPath("/home") : appPath("/");
   const retriedUnavailableSessionRef = useRef(false);
   const requestAccess = useActionMutation<

package/corpus/templates/clips/changelog/2026-09-26-the-app-entry-now-opens-the-shared-sign-in-and-sign-up-scree.md

@@ -0,0 +1,6 @@
+---
+type: changed
+date: 2026-09-26
+---
+
+The app entry now opens the shared sign-in and sign-up screen instead of a separate marketing page.

package/corpus/templates/clips/server/plugins/auth.ts

@@ -14,9 +14,6 @@ export default createAuthPlugin({
   mountGoogleOAuthRoutes: false,
   marketing: {
     appName: "Clips",
-    screenshotPath: "/auth-marketing/clips.webp",
-    screenshotWidth: 914,
-    screenshotHeight: 818,
     learnMoreUrl: "https://agent-native.com/apps/clips",
     tagline:
       "Your AI agent transcribes, summarizes, and searches everything you record alongside you.",

package/corpus/templates/content/app/root.tsx

@@ -417,7 +417,6 @@ export default function Root() {
   // Public document paths (/p/*) SSR real content without the ClientOnly gate
   // so crawlers and unauthenticated visitors receive full markup on first visit.
   const isPublicPath = location.pathname.startsWith("/p/");
-  const isMarketingHome = location.pathname === "/";
 
   // Content's 3-way theme cycle (system/light/dark) animates the transition;
   // pass disableThemeTransitions={false} to restore that behaviour.
@@ -426,12 +425,12 @@ export default function Root() {
   // a different toasting system.
   const contentToaster = <Sonner closeButton position="bottom-left" />;
 
-  if (isPublicPath || isMarketingHome) {
+  if (isPublicPath) {
     return (
       <AppToolkitProvider>
         <AppProviders
           queryClient={queryClient}
-          isPublicPath={isPublicPath || isMarketingHome}
+          isPublicPath={isPublicPath}
           disableThemeTransitions={false}
           toaster={contentToaster}
           i18n={{

package/corpus/templates/content/app/routes/_index.tsx

@@ -1,33 +1 @@
-import { appPath } from "@agent-native/core/client/api-path";
-import { MarketingHome } from "@agent-native/toolkit/marketing";
-
-const SEO_TITLE = "Content - Open Source, agent-friendly Obsidian alternative";
-const SEO_DESCRIPTION =
-  "Open Source MDX editor for local docs, knowledge bases, and content systems, with custom blocks and agent-assisted editing.";
-
-export function meta() {
-  return [
-    { title: SEO_TITLE },
-    {
-      name: "description",
-      content: SEO_DESCRIPTION,
-    },
-    { property: "og:title", content: SEO_TITLE },
-    { property: "og:description", content: SEO_DESCRIPTION },
-    { name: "twitter:card", content: "summary" },
-    { name: "twitter:title", content: SEO_TITLE },
-    { name: "twitter:description", content: SEO_DESCRIPTION },
-  ];
-}
-
-export default function MarketingHomeRoute() {
-  return (
-    <MarketingHome
-      appName="Content"
-      tagline={SEO_TITLE}
-      description={SEO_DESCRIPTION}
-      primaryActionHref={appPath("/home")}
-      secondaryActionHref={appPath("/sign-in")}
-    />
-  );
-}
+export { signInLandingLoader as loader } from "@agent-native/core/client/sign-in-landing";

package/corpus/templates/content/server/plugins/auth.ts

@@ -6,9 +6,6 @@ export default createAuthPlugin({
   workspaceAppPublicPaths: ["/"],
   marketing: {
     appName: "Content",
-    screenshotPath: "/auth-marketing/content.webp",
-    screenshotWidth: 914,
-    screenshotHeight: 818,
     learnMoreUrl: "https://agent-native.com/apps/content",
     tagline:
       "Open-source Obsidian for MDX: your AI agent edits local docs, creates custom blocks, and organizes everything alongside you.",

package/corpus/templates/crm/app/root.tsx

@@ -9,14 +9,7 @@ import { getLocaleInitScript } from "@agent-native/core/client/i18n";
 import { getThemeInitScript } from "@agent-native/core/client/ui";
 import { useQueryClient } from "@tanstack/react-query";
 import { useState } from "react";
-import {
-  Links,
-  Meta,
-  Outlet,
-  Scripts,
-  ScrollRestoration,
-  useLocation,
-} from "react-router";
+import { Links, Meta, Outlet, Scripts, ScrollRestoration } from "react-router";
 import type { LinksFunction } from "react-router";
 
 import { CrmCommandMenu } from "@/components/layout/CrmCommandMenu";
@@ -95,16 +88,10 @@ function AppContent() {
 
 export default function Root() {
   const [queryClient] = useState(() => createAgentNativeQueryClient());
-  const location = useLocation();
-  const isMarketingPath = location.pathname === "/";
   return (
     <AppToolkitProvider>
-      <AppProviders
-        queryClient={queryClient}
-        isPublicPath={isMarketingPath}
-        i18n={{ catalog: i18nCatalog }}
-      >
-        {isMarketingPath ? <Outlet /> : <AppContent />}
+      <AppProviders queryClient={queryClient} i18n={{ catalog: i18nCatalog }}>
+        <AppContent />
       </AppProviders>
     </AppToolkitProvider>
   );

package/corpus/templates/crm/app/routes/_index.tsx

@@ -1,36 +1 @@
-import { appPath } from "@agent-native/core/client/api-path";
-import { MarketingHome } from "@agent-native/toolkit/marketing";
-
-const SEO_TITLE =
-  "CRM - Open Source agent-native customer relationship manager";
-const SEO_DESCRIPTION =
-  "Open Source CRM for accounts, people, opportunities, tasks, and connected customer data, with safe actions your agent can use.";
-
-export function meta() {
-  return [
-    { title: SEO_TITLE },
-    { name: "description", content: SEO_DESCRIPTION },
-    { property: "og:title", content: SEO_TITLE },
-    { property: "og:description", content: SEO_DESCRIPTION },
-    { name: "twitter:card", content: "summary" },
-    { name: "twitter:title", content: SEO_TITLE },
-    { name: "twitter:description", content: SEO_DESCRIPTION },
-  ];
-}
-
-export default function MarketingHomeRoute() {
-  return (
-    <MarketingHome
-      appName="CRM"
-      tagline="A complete Native SQL CRM or a connected companion grounded in its source system."
-      description={SEO_DESCRIPTION}
-      valueProps={[
-        "Run accounts, people, opportunities, tasks, and cadence on Native SQL",
-        "Connect scoped HubSpot or Salesforce records without copying credentials",
-        "Use the same safe actions from the UI or your CRM agent",
-      ]}
-      primaryActionHref={appPath("/home")}
-      secondaryActionHref={appPath("/sign-in")}
-    />
-  );
-}
+export { signInLandingLoader as loader } from "@agent-native/core/client/sign-in-landing";

package/corpus/templates/crm/app/routes/home.tsx

@@ -8,7 +8,7 @@ export function meta() {
   return [{ title: "My work · CRM" }];
 }
 
-// Private app entry retained at /home; / serves the public marketing page.
+// Private app entry retained at /home; / redirects to shared sign-in/signup.
 export default function WorkRoute() {
   const overview = useActionQuery<CrmOverview>(
     "get-crm-overview" as never,

package/corpus/templates/design/.generated/bridge/editor-chrome.generated.ts

@@ -15967,7 +15967,6 @@ export const editorChromeBridgeScript: string = `"use strict";
         if (!dragEl) return;
         var outsideOnDrop = ev ? isOutsideIframeViewport(ev.clientX, ev.clientY) || crossScreenClaimedByHost : false;
         if (ev && !isGroupDrag && (outsideOnDrop || designCanvasBoardSurface)) {
-          var sourceDeleteRequestId = activeCrossScreenDeleteRequestId;
           postCrossScreenDrag("end", dragEl, ev, {
             duplicate: duplicatedForDrag,
             modifiers: {
@@ -15986,21 +15985,6 @@ export const editorChromeBridgeScript: string = `"use strict";
             postElementSelect(selectedEl);
           } else {
             restoreSourceDragPosition();
-            if (crossScreenClaimedByHost && sourceDeleteRequestId) {
-              var selector = getSelector(dragEl);
-              var sourceId = getSourceId(dragEl);
-              var selectorCandidates = [selector];
-              if (sourceId) {
-                selectorCandidates.push(
-                  '[data-agent-native-node-id="' + CSS.escape(sourceId) + '"]'
-                );
-              }
-              concealPendingRuntimeDelete(
-                selector,
-                selectorCandidates,
-                sourceDeleteRequestId
-              );
-            }
           }
           return;
         }
@@ -19667,8 +19651,31 @@ export const editorChromeBridgeScript: string = `"use strict";
           requestId: e.data.requestId,
           applied: Boolean(e.data.applied)
         });
+        var cancelRuntimeStructureDelete = e.data.cancelRuntimeStructureDelete;
+        var postRuntimeStructureDeleteCancellationResult = function(sourcePresentOverride) {
+          if (!cancelRuntimeStructureDelete || typeof cancelRuntimeStructureDelete.transactionId !== "string") {
+            return;
+          }
+          var restoredSource = findRuntimeTarget(
+            String(cancelRuntimeStructureDelete.selector || ""),
+            Array.isArray(cancelRuntimeStructureDelete.selectorCandidates) ? cancelRuntimeStructureDelete.selectorCandidates : []
+          );
+          window.parent.postMessage(
+            {
+              type: "runtime-structure-delete-cancelled",
+              requestId: String(e.data.requestId || ""),
+              transactionId: cancelRuntimeStructureDelete.transactionId,
+              routePath: window.location.pathname + window.location.search,
+              sourcePresent: typeof sourcePresentOverride === "boolean" ? sourcePresentOverride : Boolean(restoredSource)
+            },
+            "*"
+          );
+        };
         var move = pendingStructureMoves[e.data.requestId];
-        if (!move) return;
+        if (!move) {
+          postRuntimeStructureDeleteCancellationResult();
+          return;
+        }
         delete pendingStructureMoves[e.data.requestId];
         var moveWasInsert = Boolean(move.origin && "inserted" in move.origin);
         var moveWasRemoval = Boolean(move.origin && "removed" in move.origin);
@@ -19689,6 +19696,7 @@ export const editorChromeBridgeScript: string = `"use strict";
             }
           }
           refreshOverlays();
+          postRuntimeStructureDeleteCancellationResult();
           return;
         }
         if (moveWasRemoval) {
@@ -19706,6 +19714,9 @@ export const editorChromeBridgeScript: string = `"use strict";
             }
           }
           refreshOverlays();
+          postRuntimeStructureDeleteCancellationResult(
+            Boolean(move.el && move.el.isConnected)
+          );
           return;
         }
         if (e.data.applied) {
@@ -19730,6 +19741,7 @@ export const editorChromeBridgeScript: string = `"use strict";
             }
             if (hoveredEl === move.el) hoveredEl = null;
             refreshOverlays();
+            postRuntimeStructureDeleteCancellationResult();
             return;
           }
           if (move.el && move.el.isConnected && move.origin && "prevParent" in move.origin && move.origin.prevParent && move.origin.prevParent.isConnected) {
@@ -19752,6 +19764,7 @@ export const editorChromeBridgeScript: string = `"use strict";
             postElementSelect(selectedEl);
           }
         }
+        postRuntimeStructureDeleteCancellationResult();
         return;
       }
       if (e.data.type === "replace-document-content") {

package/corpus/templates/design/CHANGELOG.md

@@ -3,19 +3,49 @@
 All notable user-facing changes to Design are documented here. Open it any time
 from the command menu (Cmd+K → "What's new") or from Settings.
 
+## 2026-09-26
+
+### Fixed
+
+- Canvas focus stays on toolbar controls when a live preview finishes loading
+
+### Changed
+
+- The app entry now opens the shared sign-in and sign-up screen instead of a separate marketing page.
+
 ## 2026-09-25
 
 ### Added
 
+- Design home quick actions now adapt to your onboarding role and appear only when an AI provider is ready.
 - Chat messages can be reverted to their autosaved version, including a shortcut to restore the start of a chat.
 
 ### Improved
 
+- Attach Figma frames and websites from focused dialogs while keeping prompt drafts and uploaded design.md files intact.
+- Recent designs now use the same consistent library card layout as templates.
+- Start designs from a focused prompt with editable suggestions, template previews, and a searchable recent-design library.
+- Open an editable template with one click, or use its menu to preview interactive screens without changing your draft.
+- Run Design template HTML as an interactive live preview, including working controls and safe navigation between local template files.
+- Browse design systems and references from the shared context menu, create a design system from its empty state, and manage uploaded files directly inside the prompt.
+- Shared designs, systems, and templates show their titles and descriptions in previews.
+- Start designs in one click, attach design, slide, and Figma references in the home composer, or open Figma imports directly from the toolbar.
+- Import Figma files directly from the toolbar and find design references in a simpler context menu.
+- Use templates directly from full preview
+- Use text-first menus for import and template actions
+- Welcome new creators with a more encouraging first-design prompt.
 - Design-system empty states show one creation action
 - Live preview snapshots stay private until an editor signs in and enables collaboration.
 
 ### Fixed
 
+- Failed Figma imports no longer leave empty designs behind, and malformed preview links stay safely on the current screen.
+- Fix live visual-edit recovery, handoff, and interaction workflows.
+- Human Review previews show the actual design when you have organization admin access.
+- Live screens recover safely from interrupted cross-screen moves and keep pending edits accessible before switching to Interact.
+- Searching shared designs stays visible even when you have no designs of your own.
+- Shared-only work now opens in the Recent library without requiring a manual filter change, and template copies can safely retry.
+- Template retries now start a fresh copy when the request changes while preserving safe retries for the same request.
 - Builder design-system failures preserve readable JSON errors behind Cloudflare.
 - Standalone HTML exports with multiple screens now show each screen in its own
   viewport instead of overlapping.
@@ -24,6 +54,7 @@ from the command menu (Cmd+K → "What's new") or from Settings.
 - Live canvas sharing requires an account, with a sign-up path for signed-out owners.
 - Cross-screen moves preserve Flex and Grid sizing through undo and redo.
 - Moving a layer from one live app screen into another now lands it instead of failing with "Could not move that layer", and a failed move no longer leaves the layer stuck to the cursor.
+- Timed-out live move rollbacks retry before another move is admitted.
 
 ## 2026-09-24
 

package/corpus/templates/design/actions/connect-localhost.ts

@@ -212,7 +212,7 @@ export default defineAction({
       ? normalizeBridgeUrl(args.bridgeUrl)
       : undefined;
     const rootPath = args.routeManifest?.rootPath ?? args.rootPath;
-    const id =
+    let id =
       args.id ?? stableConnectionId(devServerUrl, rootPath, ownerEmail, orgId);
     const rawRoutes = args.routeManifest?.routes ?? args.routes ?? [];
     const routes = rawRoutes.map((route) => ({
@@ -253,10 +253,13 @@ export default defineAction({
     // from devServerUrl + rootPath without user scoping, so two users on the
     // same devcontainer image collide). Detect that up front and fail with a
     // clear error instead of crashing on the primary-key insert below.
-    const existing = await db
+    let existing = await db
       .select({
+        id: schema.designLocalhostConnections.id,
         ownerEmail: schema.designLocalhostConnections.ownerEmail,
         orgId: schema.designLocalhostConnections.orgId,
+        devServerUrl: schema.designLocalhostConnections.devServerUrl,
+        rootPath: schema.designLocalhostConnections.rootPath,
         bridgeUrl: schema.designLocalhostConnections.bridgeUrl,
         previewToken: schema.designLocalhostConnections.previewToken,
         bridgeToken: schema.designLocalhostConnections.bridgeToken,
@@ -265,6 +268,55 @@ export default defineAction({
       .where(eq(schema.designLocalhostConnections.id, id))
       .limit(1);
 
+    // Older CLI versions used a non-user-scoped connection ID. Reuse that
+    // credential only when this owner/org has one unambiguous row for the
+    // exact app URL and root; otherwise a new row could mint a token that an
+    // already-running bridge does not have.
+    if (!args.id && !existing[0] && rootPath) {
+      const priorConnections = await db
+        .select({
+          id: schema.designLocalhostConnections.id,
+          ownerEmail: schema.designLocalhostConnections.ownerEmail,
+          orgId: schema.designLocalhostConnections.orgId,
+          devServerUrl: schema.designLocalhostConnections.devServerUrl,
+          rootPath: schema.designLocalhostConnections.rootPath,
+          bridgeUrl: schema.designLocalhostConnections.bridgeUrl,
+          previewToken: schema.designLocalhostConnections.previewToken,
+          bridgeToken: schema.designLocalhostConnections.bridgeToken,
+        })
+        .from(schema.designLocalhostConnections)
+        .where(
+          and(
+            ownerOrgScope,
+            eq(schema.designLocalhostConnections.devServerUrl, devServerUrl),
+            eq(schema.designLocalhostConnections.rootPath, rootPath),
+            ...(requestedBridgeUrl
+              ? [
+                  eq(
+                    schema.designLocalhostConnections.bridgeUrl,
+                    requestedBridgeUrl,
+                  ),
+                ]
+              : []),
+          ),
+        )
+        .limit(2);
+      if (priorConnections.length > 1) {
+        throw new Error(
+          "Multiple existing localhost connections match this app. Pass the connection ID to choose which bridge to reuse.",
+        );
+      }
+      const prior = priorConnections[0];
+      if (
+        prior &&
+        prior.ownerEmail === ownerEmail &&
+        (prior.orgId ?? null) === orgId
+      ) {
+        id = prior.id;
+        existing = [prior];
+      }
+    }
+
     if (
       existing[0] &&
       (existing[0].ownerEmail !== ownerEmail ||
@@ -317,44 +369,53 @@ export default defineAction({
       updatedAt: now,
     };
 
-    // Keep the read-only credential paired with the bridge credential on every
-    // reconnect. A legacy row may contain an unrelated preview token from
-    // before the deterministic pairing contract; preserving it makes the
-    // next daemon restart fail again. setWhere keeps a cross-user conflict a
-    // no-op, and the read-back below returns the winning row after a race.
-    await db
-      .insert(schema.designLocalhostConnections)
-      .values({
-        ...baseValues,
-        previewToken: nextPreviewToken,
-        bridgeToken: nextBridgeToken,
-        createdAt: now,
-      })
-      .onConflictDoUpdate({
-        target: schema.designLocalhostConnections.id,
-        set: {
+    // The conflict update can keep a concurrently inserted bridge token.
+    // Derive and persist its preview token under the same row lock so the pair
+    // is committed atomically, including for legacy rows with a stale preview.
+    const {
+      bridgeToken: effectiveBridgeToken,
+      previewToken: effectivePreviewToken,
+    } = await db.transaction(async (tx) => {
+      const [stored] = await tx
+        .insert(schema.designLocalhostConnections)
+        .values({
           ...baseValues,
-          bridgeToken: explicitToken
-            ? nextBridgeToken
-            : sql`coalesce(${schema.designLocalhostConnections.bridgeToken}, excluded.bridge_token)`,
           previewToken: nextPreviewToken,
-        },
-        setWhere: ownerOrgScope,
-      });
+          bridgeToken: nextBridgeToken,
+          createdAt: now,
+        })
+        .onConflictDoUpdate({
+          target: schema.designLocalhostConnections.id,
+          set: {
+            ...baseValues,
+            bridgeToken: explicitToken
+              ? nextBridgeToken
+              : sql`coalesce(${schema.designLocalhostConnections.bridgeToken}, excluded.bridge_token)`,
+            previewToken: nextPreviewToken,
+          },
+          setWhere: ownerOrgScope,
+        })
+        .returning({
+          bridgeToken: schema.designLocalhostConnections.bridgeToken,
+        });
+      if (!stored?.bridgeToken) {
+        throw Object.assign(
+          new Error(
+            "The localhost connection could not be confirmed for this account. Refresh the connection and retry.",
+          ),
+          { errorCode: "localhost_connection_conflict" },
+        );
+      }
 
-    // Return the token the row actually holds (owner-scoped, so a cross-user
-    // no-op never leaks another user's token), not the one we minted — so
-    // concurrent callers converge on the winner (no 401 on a lost race).
-    const [stored] = await db
-      .select({
-        bridgeToken: schema.designLocalhostConnections.bridgeToken,
-        previewToken: schema.designLocalhostConnections.previewToken,
-      })
-      .from(schema.designLocalhostConnections)
-      .where(and(eq(schema.designLocalhostConnections.id, id), ownerOrgScope))
-      .limit(1);
-    const effectiveBridgeToken = stored?.bridgeToken ?? nextBridgeToken;
-    const effectivePreviewToken = derivePreviewToken(effectiveBridgeToken);
+      const previewToken = derivePreviewToken(stored.bridgeToken);
+      await tx
+        .update(schema.designLocalhostConnections)
+        .set({ previewToken })
+        .where(
+          and(eq(schema.designLocalhostConnections.id, id), ownerOrgScope),
+        );
+      return { bridgeToken: stored.bridgeToken, previewToken };
+    });
 
     return {
       id,