@agent-native/core 0.200.0 → 0.200.1-nightly-20261002213029

package/dist/client/use-chat-threads.js

@@ -81,6 +81,26 @@ export function appendChatThreadScopeParams(params, scope) {
     params.set("scopeType", scope.type);
     params.set("scopeId", scope.id);
 }
+/**
+ * The scope a thread save reports for the thread: a scope, `null` when the
+ * server holds the thread unscoped, `undefined` when the response says nothing
+ * (an older server or an unreadable body), so the local scope is left alone.
+ */
+function savedThreadScope(body) {
+    const record = body;
+    if (!record || typeof record !== "object" || !("scope" in record)) {
+        return undefined;
+    }
+    const scope = record.scope;
+    if (scope === null)
+        return null;
+    if (!scope || typeof scope !== "object")
+        return undefined;
+    const { type, id } = scope;
+    return typeof type === "string" && typeof id === "string"
+        ? scope
+        : undefined;
+}
 function withChatThreadScope(url, scope) {
     const params = new URLSearchParams();
     appendChatThreadScopeParams(params, scope);
@@ -239,6 +259,9 @@ export function useChatThreads(apiUrl = agentNativePath("/_agent-native/agent-ch
         ? new Set([initialActiveThreadRef.current.id])
         : new Set());
     const explicitlyOpenedThreadIdsRef = useRef(new Set());
+    // Bumped when a thread's scope is changed on purpose (detach), so a save
+    // response that was in flight across the change cannot restore the old scope.
+    const scopeMutationsRef = useRef(new Map());
     const optimisticThreadScopesRef = useRef(new Map());
     const knownThreadScopesRef = useRef(new Map());
     const serverConfirmedThreadIdsRef = useRef(new Set());
@@ -728,6 +751,8 @@ export function useChatThreads(apiUrl = agentNativePath("/_agent-native/agent-ch
         routeThreadId,
     ]);
     const detachThread = useCallback(async (threadId) => {
+        const bumpScopeMutation = () => scopeMutationsRef.current.set(threadId, (scopeMutationsRef.current.get(threadId) ?? 0) + 1);
+        bumpScopeMutation();
         try {
             const res = await fetch(withChatThreadScope(`${apiUrl}/threads/${encodeURIComponent(threadId)}`, historyScope), {
                 method: "PUT",
@@ -738,6 +763,7 @@ export function useChatThreads(apiUrl = agentNativePath("/_agent-native/agent-ch
                 await fetchThreads();
                 return;
             }
+            bumpScopeMutation();
             knownThreadScopesRef.current.set(threadId, null);
             optimisticThreadScopesRef.current.set(threadId, null);
             const wasActive = activeThreadIdRef.current === threadId;
@@ -969,6 +995,7 @@ export function useChatThreads(apiUrl = agentNativePath("/_agent-native/agent-ch
     // rides only on creation: a periodic save must never move an existing thread
     // between resources, however stale this client's guess is.
     const saveThreadData = useCallback(async (id, data) => {
+        const scopeEpoch = scopeMutationsRef.current.get(id) ?? 0;
         try {
             const { titleSource, ...threadDataPayload } = data;
             const localThread = threadsRef.current.find((t) => t.id === id);
@@ -1004,6 +1031,13 @@ export function useChatThreads(apiUrl = agentNativePath("/_agent-native/agent-ch
             }
             if (!response.ok)
                 return;
+            const reportedScope = savedThreadScope(
+            // coercion-ok: a save response without a readable body carries no scope, and the local scope stays as it was.
+            await response.json().catch(() => null));
+            // A response that was in flight across a detach describes the thread
+            // as it was before it, so it must not put the old scope back.
+            const scopeChangedDuringSave = (scopeMutationsRef.current.get(id) ?? 0) !== scopeEpoch;
+            const savedScope = scopeChangedDuringSave ? undefined : reportedScope;
             serverConfirmedThreadIdsRef.current.add(id);
             clearClientDraftThreadMarker(id);
             newlyCreatedRef.current.delete(id);
@@ -1021,10 +1055,21 @@ export function useChatThreads(apiUrl = agentNativePath("/_agent-native/agent-ch
                             ...(data.messageCount != null && {
                                 messageCount: data.messageCount,
                             }),
+                            // The run adopts the scope it was sent with, which the
+                            // visible page at save time may no longer be; take the
+                            // server's, or the active pointer stays under the
+                            // unscoped key and a reload here starts fresh.
+                            ...(savedScope !== undefined
+                                ? { scope: savedScope }
+                                : {}),
                             updatedAt: Date.now(),
                         }
                         : t));
                 }
+                // A thread the list no longer holds because it was detached while
+                // this save ran must not come back under the page's current scope.
+                if (scopeChangedDuringSave)
+                    return prev;
                 const now = Date.now();
                 return sortThreadSummaries([
                     {
@@ -1034,7 +1079,9 @@ export function useChatThreads(apiUrl = agentNativePath("/_agent-native/agent-ch
                         messageCount: data.messageCount ?? 0,
                         createdAt: now,
                         updatedAt: now,
-                        scope: scopeRef.current ?? null,
+                        scope: savedScope !== undefined
+                            ? savedScope
+                            : (scopeRef.current ?? null),
                     },
                     ...prev,
                 ]);

package/dist/collab/awareness.d.ts

@@ -38,19 +38,19 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/deploy/build.js

@@ -18,6 +18,7 @@ import { normalizeAppBasePath } from "../server/app-base-path.js";
 import { frameworkSessionHintCookieName, resolveAuthCookieNamespace, } from "../server/cookie-namespace.js";
 import { resolveAgentNativeBuildId } from "../shared/build-id.js";
 import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, SSR_QUERY_CACHE_KEY_HEADER, } from "../shared/cache-control.js";
+import { EMBED_TARGET_QUERY_PARAM, EMBED_TOKEN_QUERY_PARAM, } from "../shared/embed-auth.js";
 import { normalizeFrameworkRoutePrefix } from "../shared/framework-route-prefix.js";
 import { mcpEmbedStaticAssetRouteRules } from "../shared/mcp-embed-headers.js";
 import { isTruthyRuntimeValue } from "../shared/runtime-config.js";
@@ -1100,6 +1101,10 @@ function normalizeAppBasePath(value) {
 // CLASSIFICATION happens here; the h3 boundary inside the handler is what
 // translates the public prefix to the internal one, exactly once.
 const builtFrameworkRoutePrefix = ${JSON.stringify(builtFrameworkRoutePrefix)};
+const embedActionQueryParams = new Set(${JSON.stringify([
+        EMBED_TARGET_QUERY_PARAM,
+        EMBED_TOKEN_QUERY_PARAM,
+    ])});
 
 function getAppBasePath() {
   const builtAppBasePath = ${JSON.stringify(builtAppBasePath)};
@@ -1126,9 +1131,10 @@ function parseActionSearchParams(searchParams) {
   const params = {};
   for (const [rawKey, value] of searchParams.entries()) {
     const isArrayKey = rawKey.endsWith("[]");
+    const key = isArrayKey ? rawKey.slice(0, -2) : rawKey;
+    if (embedActionQueryParams.has(key)) continue;
     // The core client serializes arrays as key[]=value so one-item arrays
     // survive GET action parsing in generated worker deployments.
-    const key = isArrayKey ? rawKey.slice(0, -2) : rawKey;
     const current = params[key];
     if (current === undefined) {
       params[key] = isArrayKey ? [value] : value;

package/dist/extensions/web-search-tool.js

@@ -178,7 +178,7 @@ export function createWebSearchToolEntry(opts = {}) {
     return {
         "web-search": {
             tool: {
-                description: "Search the public web. Use to find API documentation, endpoints, current information, or any topic. Returns ranked results from BYOK providers or a grounded Builder-managed summary. Follow up with web-request or provider-api-docs using responseMode:'markdown' or responseMode:'matches' to fetch clean text, links, or compact snippets from promising URLs. Requires either Connect Builder.io (free tier available) or one of: BRAVE_SEARCH_API_KEY, TAVILY_API_KEY, EXA_API_KEY, or FIRECRAWL_API_KEY.",
+                description: "Search the public web. Use to find API documentation, endpoints, current information, or any topic. Returns ranked results from BYOK providers or a grounded Builder-managed summary. Follow up with web-request or provider-api-docs using responseMode:'markdown' or responseMode:'matches' to fetch clean text, links, or compact snippets from promising URLs. Requires either Builder.io (free tier available) or one of: BRAVE_SEARCH_API_KEY, TAVILY_API_KEY, EXA_API_KEY, or FIRECRAWL_API_KEY.",
                 parameters: {
                     type: "object",
                     properties: {
@@ -235,7 +235,7 @@ export function createWebSearchToolEntry(opts = {}) {
                     else {
                         return [
                             "No web-search backend configured.",
-                            "Connect Builder.io (free tier available) in Settings, or add one of the following keys via app settings or environment variables:",
+                            "Use Builder.io (free tier available) in Settings, or add one of the following keys via app settings or environment variables:",
                             "  • BRAVE_SEARCH_API_KEY  — https://brave.com/search/api/",
                             "  • TAVILY_API_KEY        — https://tavily.com/",
                             "  • EXA_API_KEY           — https://exa.ai/",

package/dist/file-upload/actions/upload-image.d.ts

@@ -42,8 +42,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
     configured?: undefined;
+    error?: undefined;
 } | {
     url?: undefined;
     id?: undefined;

package/dist/file-upload/actions/upload-image.js

@@ -417,7 +417,7 @@ async function fetchRemote(url) {
 function uploadNotConfiguredError() {
     return [
         "No object storage is connected.",
-        "Connect Builder.io (free) or configure your own S3-compatible storage keys in Settings → File uploads.",
+        "Use Builder.io's managed storage (free) or configure your own S3-compatible storage keys in Settings → File uploads.",
     ].join(" ");
 }
 export default defineAction({

package/dist/file-upload/builder.js

@@ -197,11 +197,11 @@ async function assetAuthorization(options = {}) {
     const privateKey = credentials.privateKey?.trim();
     const publicKey = credentials.publicKey?.trim();
     if (!privateKey || !publicKey) {
-        throw new Error("Builder personal access token connection is missing its space id. Reconnect Builder.io to continue.");
+        throw new Error("Builder personal access token connection is missing its space id. Sign in to Builder.io again to continue.");
     }
     const authorized = authorization.replace(/^Bearer\s+/i, "").trim();
     if (privateKey !== authorized) {
-        throw new Error("Builder credential scope mismatch: the connection holding the upload space is not the one authorized for this request. Reconnect Builder.io to continue.");
+        throw new Error("Builder credential scope mismatch: the connection holding the upload space is not the one authorized for this request. Sign in to Builder.io again to continue.");
     }
     return { authorization, apiKey: publicKey };
 }

package/dist/file-upload/registry.js

@@ -90,7 +90,7 @@ export async function uploadFile(input) {
     if (!warnedFallbackRef.value) {
         warnedFallbackRef.value = true;
         console.warn("[agent-native] No file upload provider configured. " +
-            "Connect or reconnect Builder.io (free tier available) in Settings → File uploads, " +
+            "Use Builder.io (free tier available) in Settings → File uploads, " +
             "or register a custom provider (S3, R2, GCS, …) via registerFileUploadProvider().");
     }
     return null;

package/dist/ingestion/pptx.d.ts

@@ -155,5 +155,7 @@ export interface ParsedPptxPresentation {
     };
     hiddenSlideCount?: number;
 }
-export declare function parsePptxPresentation(fileBuffer: Uint8Array): Promise<ParsedPptxPresentation>;
+export declare function parsePptxPresentation(fileBuffer: Uint8Array, options?: {
+    includeHiddenSlides?: boolean;
+}): Promise<ParsedPptxPresentation>;
 export declare function parsePptxSlideMetadata(value: unknown): ParsedPptxSlideMetadata;

package/dist/ingestion/pptx.js

@@ -1,5 +1,5 @@
 import { loadOptionalPeer } from "../shared/optional-peer.js";
-export async function parsePptxPresentation(fileBuffer) {
+export async function parsePptxPresentation(fileBuffer, options = {}) {
     const dependencies = await loadPptxDependencies();
     const loadZip = dependencies.loadZip.bind(dependencies);
     const parseXml = dependencies.parseXml.bind(dependencies);
@@ -102,7 +102,8 @@ export async function parsePptxPresentation(fileBuffer) {
             droppedSlides.push(`${slidePath} could not be parsed: ${error instanceof Error ? error.message : String(error)}`);
             continue;
         }
-        if (stringValue(record(record(slide)?.["p:sld"])?.["@_show"]) === "0") {
+        if (stringValue(record(record(slide)?.["p:sld"])?.["@_show"]) === "0" &&
+            !options.includeHiddenSlides) {
             hiddenSlideCount += 1;
             continue;
         }

package/dist/jobs/actions/manage-recurring-job.d.ts

@@ -11,9 +11,9 @@ declare const _default: import("../../action.js").ActionDefinition<{
     enabled?: undefined;
     nextRun?: undefined;
 } | {
-    deleted?: undefined;
     name: string;
     enabled: boolean;
     nextRun: string;
+    deleted?: undefined;
 }>;
 export default _default;

package/dist/localization/default-messages.js

@@ -38,7 +38,7 @@ const messages = {
     composer: {
         sendMessage: "Send message",
         queueMessage: "Queue message",
-        connectBuilder: "Connect Builder.io",
+        connectBuilder: "Use Builder.io",
     },
     home: {
         settingsTitle: "Settings",
@@ -83,8 +83,8 @@ const messages = {
         openBackgroundAgentSettings: "Open Background Agent settings",
         fileStorage: {
             title: "Connect storage to upload files",
-            description: "Connect Builder.io (free) or configure your own S3-compatible object storage.",
-            reconnectBuilder: "Reconnect Builder.io",
+            description: "Use Builder.io's managed storage (free) or configure your own S3-compatible object storage.",
+            reconnectBuilder: "Sign in to Builder.io again",
             custom: "Use custom keys",
             customDescription: "Configure an S3-compatible bucket with a stable public URL.",
         },
@@ -658,9 +658,9 @@ const messages = {
         askAgentTitle: "Ask the agent",
         askAgentPlaceholder: "Tell the agent what you want to do…",
         connectAi: "Connect AI",
-        builderOrOwnKeys: "Choose Builder.io or custom keys.",
-        connectBuilderIo: "Connect Builder.io",
-        connectingBuilder: "Connecting Builder.io…",
+        builderOrOwnKeys: "Use Builder.io or custom keys.",
+        connectBuilderIo: "Use Builder.io",
+        connectingBuilder: "Setting up Builder.io…",
         builderModelCredits: "Free credits for Claude, OpenAI & Gemini",
         addOwnKeys: "Custom keys",
         configureProviderKeys: "Choose a provider.",
@@ -720,8 +720,8 @@ const messages = {
             promptTitle: "Use your voice",
             promptDescription: "Voice mode keeps listening while the agent navigates and takes actions.",
             setupTitle: "Set up voice mode",
-            setupDescription: "Connect Builder.io to use managed voice with free credits, or add your own keys.",
-            connectBuilder: "Connect Builder.io",
+            setupDescription: "Use Builder.io for managed voice with free credits, or add your own keys.",
+            connectBuilder: "Use Builder.io",
             useOpenAiKey: "Custom keys",
             startWithOpenAiKey: "Start with OpenAI key",
             start: "Start voice chat",
@@ -1045,8 +1045,8 @@ const messages = {
         builderAgentDescription: "Let our cloud agent make the changes for you. You'll get a link to preview and deploy.",
         codeChangeTitle: "This requires a code change",
         codeChangeBadge: "Code change",
-        connectBuilderTitle: "Connect Builder.io",
-        connectBuilderDescription: "Connect Builder (free tier available) to enable cloud-based code changes from this app.",
+        connectBuilderTitle: "Use Builder.io",
+        connectBuilderDescription: "Use Builder.io (free tier available) to enable cloud-based code changes from this app.",
         setupRequired: "Setup required",
         branchCreated: "Branch created",
         close: "Close",
@@ -1313,7 +1313,7 @@ const messages = {
         networkError: "Network error reaching the server",
         back: "Back",
         agentEngineRequired: "Agent engine required",
-        agentEngineDescription: "Connect Builder.io (free tier available) or an LLM key before {{platform}} can answer.",
+        agentEngineDescription: "Use Builder.io (free tier available) or an LLM key before {{platform}} can answer.",
         openLlm: "Open LLM",
         setup: "Setup",
         shareDocumentsWith: "Share documents with",

package/dist/mcp/build-server.js

@@ -7,10 +7,10 @@ import { getAppConfig } from "../app-config/store.js";
 import { isMcpActionResult } from "../mcp-client/app-result.js";
 import { writeActionChangeMarker } from "../server/action-change-marker-write.js";
 import { getConfiguredAppBasePath } from "../server/app-base-path.js";
-import { buildDeepLink, toAbsoluteOpenUrl, toDesktopOpenUrl, toVsCodeOpenUrl, } from "../server/deep-link.js";
+import { buildDeepLink, isAgentNativeOpenUrl, isSameOriginUrl, toAbsoluteOpenUrl, toDesktopOpenUrl, toVsCodeOpenUrl, } from "../server/deep-link.js";
 import { getRequestContext, getRequestOrgId, getRequestUserEmail, runWithRequestContext, } from "../server/request-context.js";
 import { agentNativeMcpInstructions, agentNativeToolTitle, } from "../shared/agent-mcp-metadata.js";
-import { isAgentNativeOpenDeepLink, withCollapsedAgentSidebarParam, } from "../shared/agent-sidebar-url.js";
+import { withCollapsedAgentSidebarParam } from "../shared/agent-sidebar-url.js";
 import { MCP_APP_CHAT_BRIDGE_QUERY_PARAM } from "../shared/embed-auth.js";
 import { describeMcpError, readClientInfoFromRequest, trackMcpResourceRead, trackMcpResourcesList, trackMcpToolCall, trackMcpToolsList, } from "./analytics.js";
 import { consumeMcpApprovalGrant, createMcpApprovalGrant, } from "./approval-store.js";
@@ -550,6 +550,9 @@ function mcpAppEmbedOpenLinkMeta(result, resource, meta) {
     const safeOpenUrl = explicitOpenUrl
         ? toAbsoluteOpenUrl(explicitOpenUrl, meta?.origin)
         : null;
+    const isNativeOpenUrl = safeOpenUrl
+        ? isAgentNativeOpenUrl(safeOpenUrl, meta?.origin, meta?.basePath)
+        : false;
     const desktopDeepLinkUrl = (() => {
         if (!safeOpenUrl)
             return null;
@@ -558,9 +561,11 @@ function mcpAppEmbedOpenLinkMeta(result, resource, meta) {
             : undefined;
         if (!app)
             return safeOpenUrl;
-        if (isAgentNativeOpenDeepLink(safeOpenUrl)) {
+        if (isNativeOpenUrl) {
             return toDesktopOpenUrl(safeOpenUrl);
         }
+        if (!isSameOriginUrl(safeOpenUrl, meta?.origin))
+            return safeOpenUrl;
         const targetRoute = routePathFromOpenUrl(safeOpenUrl);
         if (!targetRoute)
             return safeOpenUrl;
@@ -657,11 +662,12 @@ export function buildLinkArtifacts(entry, args, result, meta) {
         const lk = entry.link({ args: args ?? {}, result });
         if (!lk?.url)
             return {};
-        const linkUrl = isAgentNativeOpenDeepLink(lk.url)
+        const isNativeOpenUrl = isAgentNativeOpenUrl(lk.url, meta?.origin, meta?.basePath);
+        const linkUrl = isNativeOpenUrl
             ? withCollapsedAgentSidebarParam(lk.url)
             : lk.url;
         const webUrl = toAbsoluteOpenUrl(linkUrl, meta?.origin);
-        const desktopUrl = toDesktopOpenUrl(linkUrl);
+        const desktopUrl = isNativeOpenUrl ? toDesktopOpenUrl(linkUrl) : webUrl;
         const vscodeUrl = toVsCodeOpenUrl(webUrl);
         const markdownUrl = meta?.target === "desktop" ? desktopUrl : webUrl;
         return {

package/dist/mcp-client/manager.js

@@ -313,10 +313,12 @@ export class McpClientManager {
         });
         let handshakeComplete = false;
         let callbackError;
+        let callbackErrorsAreHttp400 = true;
         const recordConnectionError = (error) => {
             const message = formatMcpConnectError(error);
             entry.error = message;
             callbackError ??= error;
+            callbackErrorsAreHttp400 &&= httpStatusFromError(error) === 400;
             if (handshakeComplete)
                 this.emitChange();
             if (this.debug) {
@@ -330,8 +332,18 @@ export class McpClientManager {
         try {
             const timeoutMs = mcpConnectTimeoutMs(this.connectTimeoutMs);
             await withConnectTimeout(Promise.resolve(client.connect(transport)), `MCP server ${entry.id} connect`, timeoutMs);
-            if (callbackError)
-                throw callbackError;
+            if (callbackError) {
+                // Auto-negotiation can report its rejected probe before fallback succeeds.
+                const negotiatedAfterProbe = cfg.type === "http" &&
+                    httpStatusFromError(callbackError) === 400 &&
+                    callbackErrorsAreHttp400 &&
+                    typeof client.getNegotiatedProtocolVersion === "function" &&
+                    Boolean(client.getNegotiatedProtocolVersion());
+                if (!negotiatedAfterProbe)
+                    throw callbackError;
+                callbackError = undefined;
+                entry.error = undefined;
+            }
             const listed = await withConnectTimeout(Promise.resolve(client.listTools()), `MCP server ${entry.id} tools/list`, timeoutMs);
             if (callbackError)
                 throw callbackError;

package/dist/notifications/routes.d.ts

@@ -1,12 +1,12 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
-    error?: undefined;
     count: number;
     updated?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated: number;
+    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -14,8 +14,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/observability/metrics.js

@@ -11,6 +11,10 @@ const METER_NAME = "@agent-native/core";
 // The SDK default is dense below 100ms, which serverless requests don't need.
 const HTTP_SERVER_DURATION_BUCKETS_S = [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5, 10];
 export const OBSERVABILITY_FLUSH_TIMEOUT_MS = 2_000;
+// A timer that fires this much past its deadline means the process was frozen
+// mid-flush (the runtime suspended it after the response), not that the export
+// was slow.
+const FLUSH_SUSPENDED_SLACK_MS = 1_000;
 const KNOWN_HTTP_METHODS = new Set([
     "CONNECT",
     "DELETE",
@@ -81,8 +85,13 @@ export async function flushObservability() {
     if (!provider)
         return;
     let timer;
+    const startedAt = Date.now();
     const timeout = new Promise((resolve) => {
-        timer = setTimeout(() => resolve("timeout"), OBSERVABILITY_FLUSH_TIMEOUT_MS);
+        timer = setTimeout(() => {
+            const late = Date.now() - startedAt - OBSERVABILITY_FLUSH_TIMEOUT_MS >
+                FLUSH_SUSPENDED_SLACK_MS;
+            resolve(late ? "suspended" : "timeout");
+        }, OBSERVABILITY_FLUSH_TIMEOUT_MS);
         timer.unref?.();
     });
     try {

package/dist/onboarding/app-profile.js

@@ -250,7 +250,7 @@ const PROFILES = {
                 label: "Builder executor",
                 required: true,
                 builderIncluded: true,
-                keySummary: "Connect Builder for managed agent runs",
+                keySummary: "Use Builder.io for managed agent runs",
                 why: "The executor runs approved code and review workflows for Factory items.",
             },
             {

package/dist/onboarding/default-steps.js

@@ -54,7 +54,7 @@ const JEV_KEY_METHOD = {
     id: "jev-key",
     kind: "form",
     label: "Decision model (Jev)",
-    description: "Optional direct Jev API key for smarter tool and skill selection. Builder-managed Jev may be available through Connect Builder, so both are not required.",
+    description: "Optional direct Jev API key for smarter tool and skill selection. Builder-managed Jev may be available through Builder.io, so both are not required.",
     badge: "recommended",
     payload: {
         writeScope: "user",
@@ -77,7 +77,7 @@ const llmStep = {
         {
             id: "builder",
             kind: "builder-cli-auth",
-            label: "Connect Builder",
+            label: "Use Builder.io",
             description: "Builder.io's free tier includes AI credits.",
             primary: true,
             badge: "free",
@@ -356,8 +356,8 @@ const fileStorageStep = {
         {
             id: "builder",
             kind: "builder-cli-auth",
-            label: "Connect Builder",
-            description: "Builder includes managed file storage alongside its AI connection.",
+            label: "Use Builder.io",
+            description: "Builder.io includes managed file storage alongside its AI service.",
             primary: true,
             badge: "free",
             payload: { scope: "llm" },

package/dist/private-blob/attachment-errors.js

@@ -39,7 +39,7 @@ function describeStorageUnavailable(failure, operation) {
     const cause = (() => {
         switch (failure.reason) {
             case "not_configured":
-                return "No object storage is connected. Connect Builder.io (free) or configure your own S3-compatible storage keys in Settings → File uploads.";
+                return "No object storage is connected. Use Builder.io's managed storage (free) or configure your own S3-compatible storage keys in Settings → File uploads.";
             case "encryption_key_unavailable":
                 return "File storage is unavailable because this deployment has no encryption key configured.";
             case "misconfigured":

package/dist/progress/routes.d.ts

@@ -2,6 +2,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/resources/handlers.js

@@ -534,7 +534,7 @@ export async function handleUploadResource(event) {
         }
         setResponseStatus(event, 503);
         return {
-            error: "File storage is not configured. Connect Builder.io (free tier available) or register an S3/R2/GCS file upload provider before uploading binary resources.",
+            error: "File storage is not configured. Use Builder.io (free tier available) or register an S3/R2/GCS file upload provider before uploading binary resources.",
             storageSetupRequired: true,
         };
     }

package/dist/secrets/routes.d.ts

@@ -73,32 +73,32 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
-    error?: undefined;
     errorCode?: undefined;
     retryable?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     ok?: undefined;
     error: string;
     note?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -126,11 +126,11 @@ export declare function createAdHocSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/action-routes.js

@@ -10,7 +10,7 @@ import { isFeatureFlagAdminEmail } from "../feature-flags/permissions.js";
 import { isFederationMembershipValidatedForEvent, resolveOrgByDomain, resolveOrgIdForEmail, } from "../org/context.js";
 import { LLM_PROVIDER_MISSING_ERROR_CODE, LLM_PROVIDER_MISSING_STATUS, } from "../shared/action-error-codes.js";
 import { agentNativeMcpInstructions, agentNativeToolTitle, } from "../shared/agent-mcp-metadata.js";
-import { EMBED_TARGET_HEADER } from "../shared/embed-auth.js";
+import { EMBED_TARGET_HEADER, EMBED_TARGET_QUERY_PARAM, EMBED_TOKEN_QUERY_PARAM, } from "../shared/embed-auth.js";
 import { isMcpEmbedCorsOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, shouldAllowMcpEmbedCredentials, } from "../shared/mcp-embed-headers.js";
 import { countActionFailure, countCredentialState, } from "../tracking/failure-counters.js";
 import { redact, redactErrorStack } from "../tracking/redaction.js";
@@ -45,6 +45,10 @@ import { getH3App } from "./framework-request-handler.js";
 import { getRequestIdentityAuthenticatedAtMs, getRequestIdentitySessionToken, hasExplicitPersonalOrgScope, markExplicitPersonalOrgScope, runWithRequestContext, } from "./request-context.js";
 const ROUTE_PREFIX = "/_agent-native/actions";
 const FRONTEND_MUTATION_METHODS = new Set(["POST", "PUT", "DELETE"]);
+const EMBED_ACTION_QUERY_PARAMS = new Set([
+    EMBED_TARGET_QUERY_PARAM,
+    EMBED_TOKEN_QUERY_PARAM,
+]);
 async function resolveFeatureFlagA2ACaller(event, actionName) {
     const required = actionName === "list-feature-flags"
         ? "flags:read"
@@ -80,6 +84,8 @@ async function resolveFeatureFlagA2ACaller(event, actionName) {
 export function parseActionSearchParams(searchParams) {
     const params = {};
     for (const [rawKey, value] of searchParams.entries()) {
+        if (EMBED_ACTION_QUERY_PARAMS.has(actionParamKey(rawKey)))
+            continue;
         appendActionParam(params, rawKey, value);
     }
     return params;
@@ -87,6 +93,8 @@ export function parseActionSearchParams(searchParams) {
 function parseActionQueryObject(query) {
     const params = {};
     for (const [rawKey, rawValue] of Object.entries(query)) {
+        if (EMBED_ACTION_QUERY_PARAMS.has(actionParamKey(rawKey)))
+            continue;
         const values = Array.isArray(rawValue) ? rawValue : [rawValue];
         for (const value of values) {
             if (value != null)
@@ -96,8 +104,8 @@ function parseActionQueryObject(query) {
     return params;
 }
 function appendActionParam(params, rawKey, value) {
-    const isArrayKey = rawKey.endsWith("[]");
-    const key = isArrayKey ? rawKey.slice(0, -2) : rawKey;
+    const key = actionParamKey(rawKey);
+    const isArrayKey = key !== rawKey;
     const current = params[key];
     if (current === undefined) {
         params[key] = isArrayKey ? [value] : value;
@@ -109,6 +117,9 @@ function appendActionParam(params, rawKey, value) {
         params[key] = [current, value];
     }
 }
+function actionParamKey(rawKey) {
+    return rawKey.endsWith("[]") ? rawKey.slice(0, -2) : rawKey;
+}
 function readTimezoneHeader(event) {
     try {
         const raw = getHeader(event, "x-user-timezone");