@agent-native/core 0.200.0 → 0.200.1-nightly-20261002213029

package/dist/server/agent-chat/browser-team-tools.js

@@ -123,7 +123,7 @@ export function createBuilderBrowserTool(deps) {
     const entries = {
         "connect-file-storage": {
             tool: {
-                description: "Render the inline file-storage setup card when an image or file attachment could not be durably uploaded. The card lets the user connect Builder for managed object storage or open the same custom-key setup used by onboarding. Call it immediately when the attachment context says storage is missing; do not ask the user to upload the file again.",
+                description: "Render the inline file-storage setup card when an image or file attachment could not be durably uploaded. The card lets the user use Builder.io for managed object storage or open the same custom-key setup used by onboarding. Call it immediately when the attachment context says storage is missing; do not ask the user to upload the file again.",
                 parameters: {
                     type: "object",
                     properties: {},
@@ -148,7 +148,7 @@ export function createBuilderBrowserTool(deps) {
                     properties: {
                         prompt: {
                             type: "string",
-                            description: "The user's feature / change request, verbatim. Forwarded to Builder's cloud agent when the user clicks Send. Omit only for generic 'connect Builder' requests that aren't tied to a specific code change.",
+                            description: "The user's feature / change request, verbatim. Forwarded to Builder's cloud agent when the user clicks Send. Omit only for generic 'use Builder.io' requests that aren't tied to a specific code change.",
                         },
                         extensionId: {
                             type: "string",
@@ -293,7 +293,7 @@ export function createBuilderBrowserTool(deps) {
         },
         "activate-browser": {
             tool: {
-                description: "Activate browser automation tools. Call this when you need to interact with a real browser — e.g. to extract design tokens from a rendered page, take screenshots, read computed styles from JS-heavy sites, or test a live URL. After activation, chrome-devtools MCP tools (navigate, click, evaluate_script, take_screenshot, etc.) become available on your next action. Requires a Builder.io connection (free tier available).",
+                description: "Activate browser automation tools. Call this when you need to interact with a real browser — e.g. to extract design tokens from a rendered page, take screenshots, read computed styles from JS-heavy sites, or test a live URL. After activation, chrome-devtools MCP tools (navigate, click, evaluate_script, take_screenshot, etc.) become available on your next action. Requires Builder.io to be set up (free tier available).",
                 parameters: {
                     type: "object",
                     properties: {
@@ -310,7 +310,7 @@ export function createBuilderBrowserTool(deps) {
                 if (!creds.privateKey || !creds.publicKey) {
                     return JSON.stringify({
                         error: "builder-not-connected",
-                        message: "Builder.io is not connected. Call `connect-builder` first to enable browser automation.",
+                        message: "Builder.io is not connected. Call `connect-builder` first so the user can use browser automation.",
                     });
                 }
                 const { requestBuilderBrowserConnection } = await import("../builder-browser.js");

package/dist/server/agent-chat/context-tools.js

@@ -101,9 +101,9 @@ When you finish a task that has obvious recurring value — daily inbox triage,
 If the user says yes, call \`manage-jobs\` (action: "create") with the original prompt as the job's instructions and the cadence they confirmed.
 
 Do NOT add this offer for one-shot work: lookups (find Alice, what's the schema, who reported X), single drafts/replies, navigation requests, or any task whose value is in the moment. Skip it when the prompt is already explicitly recurring (the user said "every morning…" — you'd be asking what they already told you). One short sentence at most; do not turn it into a list of cadence options.`,
-    builder: `### Connecting Builder.io
+    builder: `### Using Builder.io
 
-When the user asks to connect Builder.io or you hit a "Builder not configured" error, call the \`connect-builder\` tool. It renders a Connect/code-change card inline — do NOT write out multi-step setup instructions yourself. Inspect the returned \`builderEnabled\` flag: \`true\` means Builder Cloud Agents can take the code-change handoff, while \`false\` means this requires a code change and the user should edit locally or use Builder.io to edit this code in the cloud and continue customizing the app any way they like. If Builder Cloud Agents are not available for this workspace, never send the user to Builder org settings or beta settings.`,
+When the user asks to use Builder.io or you hit a "Builder not configured" error, call the \`connect-builder\` tool. It renders a Builder.io setup/code-change card inline — do NOT write out multi-step setup instructions yourself. Inspect the returned \`builderEnabled\` flag: \`true\` means Builder Cloud Agents can take the code-change handoff, while \`false\` means this requires a code change and the user should edit locally or use Builder.io to edit this code in the cloud and continue customizing the app any way they like. If Builder Cloud Agents are not available for this workspace, never send the user to Builder org settings or beta settings.`,
     browser: `### Browser Automation
 
 You can activate a real Chrome browser via Builder.io for tasks that need full page rendering:

package/dist/server/agent-chat-ai-setup.js

@@ -76,7 +76,7 @@ export async function requireAgentChatAiSetup() {
         return;
     throw createError({
         statusCode: 403,
-        statusMessage: "Connect Builder AI or a provider API key before chatting.",
+        statusMessage: "Use Builder.io or a provider API key before chatting.",
         data: { code: AGENT_CHAT_AI_SETUP_REQUIRED_CODE },
     });
 }

package/dist/server/agent-chat-plugin.d.ts

@@ -115,11 +115,11 @@ export declare function resolveFetchToolKeyAllowlist(keyName: string, resolvedKe
 export declare function resolveHostedBuilderHandoff(browserTools: Record<string, ActionEntry>, canToggle: boolean): Record<string, ActionEntry>;
 /** Setup CTAs that must be callable on the very first request.
  *
- *  Both are recovery actions: the agent should answer "connect Builder for me"
+ *  Both are recovery actions: the agent should answer "use Builder.io for me"
  *  or a failed upload by rendering the inline card, not by spending a turn in
  *  `tool-search` first. `connect-builder` is registered in every registry that
  *  receives `browserTools`, local dev included, so naming it only through the
- *  hosted-only handoff left local dev advertising "Connect Builder.io" in the
+ *  hosted-only handoff left local dev advertising "Use Builder.io" in the
  *  UI while the agent was never told the tool existed. Names the registry does
  *  not have are dropped by `filterInitialEngineTools`, so listing both here is
  *  safe for lean registries. */

package/dist/server/agent-chat-plugin.js

@@ -578,11 +578,11 @@ export function resolveHostedBuilderHandoff(browserTools, canToggle) {
 }
 /** Setup CTAs that must be callable on the very first request.
  *
- *  Both are recovery actions: the agent should answer "connect Builder for me"
+ *  Both are recovery actions: the agent should answer "use Builder.io for me"
  *  or a failed upload by rendering the inline card, not by spending a turn in
  *  `tool-search` first. `connect-builder` is registered in every registry that
  *  receives `browserTools`, local dev included, so naming it only through the
- *  hosted-only handoff left local dev advertising "Connect Builder.io" in the
+ *  hosted-only handoff left local dev advertising "Use Builder.io" in the
  *  UI while the agent was never told the tool existed. Names the registry does
  *  not have are dropped by `filterInitialEngineTools`, so listing both here is
  *  safe for lean registries. */
@@ -5040,7 +5040,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         : null;
                     const { isBuilderGatewayDeployConfigured } = await import("./credential-provider.js");
                     return {
-                        active: true,
+                        active: run.inFlight,
                         runId: run.runId,
                         threadId: run.threadId,
                         turnId: run.turnId,
@@ -5383,7 +5383,11 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 const incomingScope = parseScopeFromBody(body.scope);
                                 await setThreadScope(threadId, owner, incomingScope);
                             }
-                            return { ok: true };
+                            // The scope the thread really has now (a detach can land
+                            // between the read above and this save), so the client records
+                            // what the server holds instead of guessing from the page.
+                            const saved = await resolveThreadAccess(owner, threadId, "editor", { orgId });
+                            return { ok: true, scope: saved?.scope ?? null };
                         });
                     }
                     // POST /threads/:id/queued — apply a single queue mutation against
@@ -5765,7 +5769,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         code: AGENT_CHAT_AI_SETUP_REQUIRED_CODE,
                         message: error.statusMessage ??
                             error.message ??
-                            "Connect Builder AI or a provider API key before chatting.",
+                            "Use Builder.io or a provider API key before chatting.",
                     },
                 });
             };

package/dist/server/agent-engine-api-key-route.d.ts

@@ -65,6 +65,7 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     error: any;
     code: any;
 } | {
+    error?: undefined;
     errorCode?: undefined;
     code?: undefined;
     ok: boolean;
@@ -72,6 +73,5 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
     defaultModel?: import("./agent-engine-default-model-route.js").SavedKeyDefaultModelOutcome;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-engine-default-model-route.d.ts

@@ -8,8 +8,8 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  * resolveEngine's credential detection.
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
     scope?: undefined;
 } | {
     ok: boolean;

package/dist/server/builder-api-auth.js

@@ -50,7 +50,7 @@ async function resolveBuilderPublishAuthorization(ownerEmail, orgId) {
         if (!server)
             continue;
         if (!server.oauthSecretKey) {
-            throw new ActionContractError("Builder Publish is configured without OAuth custody. Reconnect Builder.io Publish in Settings to continue.", {
+            throw new ActionContractError("Builder.io Publish is configured without OAuth custody. Sign in to Builder.io Publish again in Settings to continue.", {
                 errorCode: "builder_oauth_reauthorization_required",
                 statusCode: 400,
             });
@@ -77,7 +77,7 @@ async function resolveBuilderPublishAuthorization(ownerEmail, orgId) {
             !resourceBound ||
             !scopes.has("mcp:publish:read") ||
             [...scopes].some((scope) => scope !== "mcp:publish:read" && scope !== "offline_access")) {
-            throw new ActionContractError("Builder Publish access needs re-authorizing to grant mcp:publish:read. Open Settings and reconnect Builder.io Publish.", {
+            throw new ActionContractError("Builder.io Publish access needs re-authorizing to grant mcp:publish:read. Open Settings and authorize Builder.io Publish again.", {
                 errorCode: "builder_oauth_reauthorization_required",
                 statusCode: 400,
             });
@@ -86,7 +86,7 @@ async function resolveBuilderPublishAuthorization(ownerEmail, orgId) {
         const authorization = config.headers?.Authorization;
         const match = authorization?.match(/^Bearer\s+(.+)$/i);
         if (!match?.[1]) {
-            throw new ActionContractError("Builder Publish access expired. Reconnect Builder.io Publish in Settings to continue.", {
+            throw new ActionContractError("Builder.io Publish access expired. Sign in to Builder.io Publish again in Settings to continue.", {
                 errorCode: "builder_oauth_reauthorization_required",
                 statusCode: 400,
             });
@@ -101,7 +101,7 @@ async function resolveBuilderPublishAuthorization(ownerEmail, orgId) {
     if (ownerEmail) {
         const personalServer = (await listRemoteServers("user", ownerEmail)).find((entry) => isBuilderPublishResource(entry.url));
         if (personalServer) {
-            throw new ActionContractError("Builder Publish is connected only for this user. Remove it and reconnect Builder.io Publish for the workspace.", {
+            throw new ActionContractError("Builder.io Publish is connected only for this user. Remove it and sign in to Builder.io Publish for the workspace.", {
                 errorCode: "builder_oauth_reauthorization_required",
                 statusCode: 400,
             });
@@ -117,7 +117,7 @@ export async function resolveBuilderRequestAuthorization(input = {}) {
         if (publishAuthorization)
             return publishAuthorization;
         if (ownerEmail && (await readOAuthCustody(ownerEmail, orgId))) {
-            throw new ActionContractError("Builder Publish access is not connected for this workspace. Connect Builder.io Publish in Settings to grant mcp:publish:read.", {
+            throw new ActionContractError("Builder.io Publish access is not connected for this workspace. Sign in to Builder.io Publish in Settings to grant mcp:publish:read.", {
                 errorCode: "builder_oauth_reauthorization_required",
                 statusCode: 400,
             });

package/dist/server/builder-browser.js

@@ -1561,7 +1561,7 @@ async function resolveBuilderApiAuthorization(requiredScope) {
         requiredScope,
     });
     if (!authorization) {
-        throw new ActionContractError("Builder.io is not connected. Connect Builder.io in Settings.", { errorCode: "builder_not_connected", statusCode: 400 });
+        throw new ActionContractError("Builder.io is not connected. Sign in to Builder.io in Settings to continue.", { errorCode: "builder_not_connected", statusCode: 400 });
     }
     if (authorization.source === "legacy" && !authorization.legacyPublicKey) {
         throw new ActionContractError("Builder legacy credentials require BUILDER_PUBLIC_KEY for this request.", { errorCode: "builder_legacy_public_key_required", statusCode: 400 });

package/dist/server/builder-design-systems.js

@@ -404,7 +404,7 @@ async function resolveBuilderDesignSystemAuthorization(requiredScope) {
         (authorization.source === "legacy" && !authorization.legacyPublicKey)) {
         throw new FeatureNotConfiguredError({
             requiredCredential: "BUILDER_PRIVATE_KEY",
-            message: "Connect Builder.io (free tier available) before indexing a design system from Figma or code.",
+            message: "Use Builder.io (free tier available) to index a design system from Figma or code.",
             builderConnectUrl: "/_agent-native/builder/connect",
         });
     }

package/dist/server/core-routes-plugin.d.ts

@@ -88,11 +88,11 @@ export declare function resolveBuilderOrgMutation(event: H3Event, options?: {
     deny: string | null;
     whoCanFix?: CredentialFixer;
 }>;
-export declare const BUILDER_CONNECT_NEEDS_ORGANIZATION = "Builder.io connects through an organization. Switch to one you belong to, or ask an organization owner or admin to invite you, then connect Builder again.";
-export declare const BUILDER_CONNECT_SESSION_NOT_SHARED = "This window can't see your sign-in, which happens in previews and embedded browsers. Open the app in its own browser tab, sign in, then connect Builder there.";
-export declare const BUILDER_ORG_MEMBERSHIP_UNREADABLE = "Couldn't check your organization membership. Try connecting Builder again in a moment.";
-export declare const BUILDER_ORG_ALREADY_CONNECTED = "Your organization already has a Builder.io connection, and a new account would take its place. An organization owner or admin can reconnect it in Settings.";
-export declare const BUILDER_ORG_RECONNECT_BY_LOGIN = "Your organization already has a Builder.io account. Log in to Builder to reconnect it.";
+export declare const BUILDER_CONNECT_NEEDS_ORGANIZATION = "Builder.io access is managed through an organization. Switch to one you belong to, or ask an organization owner or admin to invite you, then set up Builder.io again.";
+export declare const BUILDER_CONNECT_SESSION_NOT_SHARED = "This window can't see your sign-in, which happens in previews and embedded browsers. Open the app in its own browser tab, sign in, then set up Builder.io there.";
+export declare const BUILDER_ORG_MEMBERSHIP_UNREADABLE = "Couldn't check your organization membership. Try starting Builder.io setup again in a moment.";
+export declare const BUILDER_ORG_ALREADY_CONNECTED = "Your organization already has a Builder.io connection, and a new account would take its place. An organization owner or admin can sign in to Builder.io again in Settings.";
+export declare const BUILDER_ORG_RECONNECT_BY_LOGIN = "Your organization already has a Builder.io account. Sign in to Builder.io to use it.";
 /** Query/body field naming which Builder.io connection a request targets. */
 export declare const BUILDER_CONNECTION_SCOPE_PARAM = "scope";
 /**
@@ -665,12 +665,6 @@ interface BuilderAccountActivationInput {
  * mode both run exactly this, after `authorizeBuilderConnectScope`.
  */
 export declare function activateBuilderAccount(event: H3Event, input: BuilderAccountActivationInput): Promise<BuilderAccountActivationResult>;
-/**
- * The popup-era account activation: answers with a page that hands the result
- * to its opener and closes. The error row is the opener's fallback channel,
- * read by its status poll when the page's message never arrives.
- */
-export declare function sendBuilderActivationPopup(event: H3Event, input: BuilderAccountActivationInput): Promise<string>;
 /**
  * `POST /_agent-native/builder/provision` — one-click Builder.io account
  * activation as a single JSON request, no popup. Session cookies are

package/dist/server/core-routes-plugin.js

@@ -59,7 +59,7 @@ import { getSession } from "./auth.js";
 import { createAutomationFailureUnsubscribeHandler } from "./automation-failure-notifications.js";
 import { getBetterAuthInternalAdapter, getBetterAuthSync, } from "./better-auth-instance.js";
 import { resolveBuilderRequestAuthorization } from "./builder-api-auth.js";
-import { BUILDER_CONNECT_PARAM, BUILDER_CONNECT_MODE_PARAM, BUILDER_AGENT_NATIVE_PROVISION_MODE, BUILDER_PROVISIONING_TOKEN_PARAM, BUILDER_CONNECT_ATTEMPT_PARAM, BUILDER_CONNECT_STATE_COOKIE, BUILDER_ENV_KEYS, BUILDER_OPENER_PARAM, BUILDER_RELAY_FLOW_HEADER, BUILDER_RELAY_SIGNATURE_HEADER, BUILDER_RELAY_STATE_PARAM, BUILDER_RELAY_TIMESTAMP_HEADER, appendBuilderConnectToken, appendBuilderConnectStateCookie, builderConnectTrackingProperties, BUILDER_UPSTREAM_FAILURE_STATUS, createBuilderConnectState, createBuilderBrowserCallbackErrorPage, createBuilderBrowserCallbackPage, createBuilderRelayRequest, getBuilderConnectTrackingParams, getBuilderBrowserOriginForEvent, getBuilderBrowserStatusForEvent, isBuilderAccountAlreadyExistsError, isBuilderAccountProvisioningEnabled, isBuilderConnectCallbackUrlAllowed, isSignedBuilderConnectState, normalizeBuilderAgentContext, parseBuilderConnectStateCookie, provisionBuilderAccount, resolveBuilderBranchProjectId, resolveBuilderConnectCallbackUrl, resolveBuilderConnectCallbackState, resolveBuilderPreviewRelayParentOrigin, removeBuilderConnectStateCookie, runBuilderAgent, sendBuilderPopupErrorPage, verifyBuilderRelayRequest, verifyBuilderPreviewRelayStateForCallback, verifyBuilderConnectTokenAndGetOwner, signBuilderProvisioningToken, verifyBuilderProvisioningToken, withBuilderConnectTrackingParams, } from "./builder-browser.js";
+import { BUILDER_CONNECT_PARAM, BUILDER_CONNECT_MODE_PARAM, BUILDER_AGENT_NATIVE_PROVISION_MODE, BUILDER_CONNECT_ATTEMPT_PARAM, BUILDER_CONNECT_STATE_COOKIE, BUILDER_ENV_KEYS, BUILDER_OPENER_PARAM, BUILDER_RELAY_FLOW_HEADER, BUILDER_RELAY_SIGNATURE_HEADER, BUILDER_RELAY_STATE_PARAM, BUILDER_RELAY_TIMESTAMP_HEADER, appendBuilderConnectToken, appendBuilderConnectStateCookie, builderConnectTrackingProperties, BUILDER_UPSTREAM_FAILURE_STATUS, createBuilderConnectState, createBuilderBrowserCallbackErrorPage, createBuilderBrowserCallbackPage, createBuilderRelayRequest, getBuilderConnectTrackingParams, getBuilderBrowserOriginForEvent, getBuilderBrowserStatusForEvent, isBuilderAccountAlreadyExistsError, isBuilderAccountProvisioningEnabled, isBuilderConnectCallbackUrlAllowed, isSignedBuilderConnectState, normalizeBuilderAgentContext, parseBuilderConnectStateCookie, provisionBuilderAccount, resolveBuilderBranchProjectId, resolveBuilderConnectCallbackUrl, resolveBuilderConnectCallbackState, resolveBuilderPreviewRelayParentOrigin, removeBuilderConnectStateCookie, runBuilderAgent, sendBuilderPopupErrorPage, verifyBuilderRelayRequest, verifyBuilderPreviewRelayStateForCallback, verifyBuilderConnectTokenAndGetOwner, signBuilderProvisioningToken, verifyBuilderProvisioningToken, withBuilderConnectTrackingParams, } from "./builder-browser.js";
 import { BUILDER_ASSETS_WRITE_SCOPE, BUILDER_OAUTH_SCOPE, builderOAuthScopeFor, canRoleConnectPersonalBuilder, deleteBuilderOAuthSession, exchangeBuilderOAuthAuthorization, getBuilderOAuthGrants, getBuilderOAuthStoredScope, hasStoredBuilderOAuthGrant, isBuilderOrgManagerRole, isPersonalBuilderGrantAllowed, saveBuilderOAuthCredentials, startBuilderOAuthAuthorization, } from "./builder-oauth.js";
 import { captureError, registerErrorCaptureProvider } from "./capture-error.js";
 import { createChatGPTSubscriptionOAuthCallbackHandler, createChatGPTSubscriptionOAuthStartHandler, } from "./chatgpt-subscription-oauth.js";
@@ -274,11 +274,11 @@ export async function resolveBuilderOrgMutation(event, options = {}) {
     return { orgId, role, deny: null };
 }
 const BUILDER_ORG_CONNECTION_DENIED = "Only an organization owner or admin can change the shared Builder connection.";
-export const BUILDER_CONNECT_NEEDS_ORGANIZATION = "Builder.io connects through an organization. Switch to one you belong to, or ask an organization owner or admin to invite you, then connect Builder again.";
-export const BUILDER_CONNECT_SESSION_NOT_SHARED = "This window can't see your sign-in, which happens in previews and embedded browsers. Open the app in its own browser tab, sign in, then connect Builder there.";
-export const BUILDER_ORG_MEMBERSHIP_UNREADABLE = "Couldn't check your organization membership. Try connecting Builder again in a moment.";
-export const BUILDER_ORG_ALREADY_CONNECTED = "Your organization already has a Builder.io connection, and a new account would take its place. An organization owner or admin can reconnect it in Settings.";
-export const BUILDER_ORG_RECONNECT_BY_LOGIN = "Your organization already has a Builder.io account. Log in to Builder to reconnect it.";
+export const BUILDER_CONNECT_NEEDS_ORGANIZATION = "Builder.io access is managed through an organization. Switch to one you belong to, or ask an organization owner or admin to invite you, then set up Builder.io again.";
+export const BUILDER_CONNECT_SESSION_NOT_SHARED = "This window can't see your sign-in, which happens in previews and embedded browsers. Open the app in its own browser tab, sign in, then set up Builder.io there.";
+export const BUILDER_ORG_MEMBERSHIP_UNREADABLE = "Couldn't check your organization membership. Try starting Builder.io setup again in a moment.";
+export const BUILDER_ORG_ALREADY_CONNECTED = "Your organization already has a Builder.io connection, and a new account would take its place. An organization owner or admin can sign in to Builder.io again in Settings.";
+export const BUILDER_ORG_RECONNECT_BY_LOGIN = "Your organization already has a Builder.io account. Sign in to Builder.io to use it.";
 /** Query/body field naming which Builder.io connection a request targets. */
 export const BUILDER_CONNECTION_SCOPE_PARAM = "scope";
 /**
@@ -291,8 +291,8 @@ export function parseBuilderConnectionScope(value) {
         return null;
     return value === "org" || value === "personal" ? value : "invalid";
 }
-const BUILDER_PERSONAL_CONNECTION_DENIED = "Owners and admins connect Builder.io for the organization.";
-const BUILDER_CONNECTION_MEMBERSHIP_ENDED = "You're no longer a member of the organization this Builder.io connection started in. Restart it from Settings.";
+const BUILDER_PERSONAL_CONNECTION_DENIED = "Owners and admins set up Builder.io for the organization.";
+const BUILDER_CONNECTION_MEMBERSHIP_ENDED = "You're no longer a member of the organization this Builder.io setup started in. Start it again from Settings.";
 /**
  * Who may start a connect for the named Builder.io connection. The org
  * connection needs owner/admin; a personal one is for members only, and only
@@ -1527,10 +1527,10 @@ export async function activateBuilderAccount(event, input) {
     }
     if (!session?.token ||
         !verifyBuilderProvisioningToken(input.provisioningToken, ownerEmail, session.token)) {
-        return fail(403, "This activation link is expired. Close this popup and click Activate again.", "provision_token_invalid");
+        return fail(403, "This activation link is expired. Refresh Builder.io setup and try again.", "provision_token_invalid");
     }
     if (session.emailVerified !== true) {
-        return fail(403, "Verify your email before connecting Builder.", "email_not_verified");
+        return fail(403, "Verify your email before using Builder.io.", "email_not_verified");
     }
     try {
         const activation = await decideBuilderActivation(event, {
@@ -1570,35 +1570,11 @@ export async function activateBuilderAccount(event, input) {
     catch (error) {
         console.error("[builder] Agent-Native account provisioning failed:", error instanceof Error ? error.message : error);
         if (isBuilderAccountAlreadyExistsError(error)) {
-            return fail(409, "A Builder account already exists for this email. Log in to connect it.", "account_exists", "account_exists");
+            return fail(409, "A Builder.io account already exists for this email. Sign in to Builder.io to use it.", "account_exists", "account_exists");
         }
-        return fail(BUILDER_UPSTREAM_FAILURE_STATUS, "Couldn't create your Builder account. Try again or connect an existing account.", "provision_failed");
+        return fail(BUILDER_UPSTREAM_FAILURE_STATUS, "Couldn't create your Builder.io account. Try again or sign in with an existing account.", "provision_failed");
     }
 }
-/**
- * The popup-era account activation: answers with a page that hands the result
- * to its opener and closes. The error row is the opener's fallback channel,
- * read by its status poll when the page's message never arrives.
- */
-export async function sendBuilderActivationPopup(event, input) {
-    const result = await activateBuilderAccount(event, input);
-    const parentOrigin = getBuilderBrowserOriginForEvent(event);
-    const attempt = input.connectAttemptId
-        ? { attemptId: input.connectAttemptId }
-        : {};
-    if (!result.ok) {
-        const code = result.code ? { code: result.code } : {};
-        await putSetting(getBuilderConnectErrorKey(input.ownerEmail, input.connectAttemptId), { message: result.message, at: Date.now(), ...code, ...attempt }).catch(() => { });
-        return sendBuilderPopupErrorPage(event, result.status, result.message, {
-            parentOrigin,
-            ...attempt,
-            ...code,
-        });
-    }
-    setResponseHeader(event, "Cache-Control", "no-store");
-    setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
-    return createBuilderBrowserCallbackPage(`${parentOrigin}${getAppBasePath() || "/"}`, { parentOrigin, ...attempt });
-}
 const builderProvisionBodySchema = z.object({
     // Checked by activateBuilderAccount, so a missing token is refused like an
     // expired one and the client's refresh-and-retry covers both.
@@ -2850,7 +2826,7 @@ export function createCoreRoutesPlugin(options = {}) {
                                         ? "Builder connection status could not be read. Retry in a moment."
                                         : error instanceof Error
                                             ? error.message
-                                            : "Builder access expired. Reconnect Builder.io.",
+                                            : "Builder access expired. Sign in to Builder.io again.",
                                     at: Date.now(),
                                 },
                             });
@@ -3026,9 +3002,9 @@ export function createCoreRoutesPlugin(options = {}) {
                     isAnonymousWaitlistSessionEmail(ownerEmail)) {
                     setResponseStatus(event, 401);
                     setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
-                    return createBuilderBrowserCallbackErrorPage("Sign in to connect Builder.", {
+                    return createBuilderBrowserCallbackErrorPage("Sign in to use Builder.io.", {
                         title: "Sign in required",
-                        body: "Builder OAuth is tied to a signed-in account. Sign in, then try Connect Builder again.",
+                        body: "Builder OAuth is tied to a signed-in account. Sign in, then start Builder.io setup again.",
                         parentOrigin: getBuilderBrowserOriginForEvent(event),
                         ...(connectAttemptId ? { attemptId: connectAttemptId } : {}),
                     });
@@ -3046,8 +3022,8 @@ export function createCoreRoutesPlugin(options = {}) {
                 // local desktop popups stamped as same-site/cross-site by the browser.
                 if (!isSameOriginConnect(event) && !hasValidConnectToken) {
                     const crossOriginMessage = connectToken
-                        ? "This Builder connect link is expired or belongs to a different deployment. Close this popup and click Connect account again."
-                        : "Builder connect opened without a fresh signed link. Close this popup and click Connect account again.";
+                        ? "This Builder.io setup link is expired or belongs to a different deployment. Close this popup and start Builder.io setup again from the app."
+                        : "Builder.io setup opened without a fresh signed link. Close this popup and start setup again from the app.";
                     await trackBuilderLifecycle(event, "builder connect failed", ownerEmail, {
                         ...builderConnectTrackingProperties(connectTracking),
                         reason: "cross_origin",
@@ -3071,14 +3047,14 @@ export function createCoreRoutesPlugin(options = {}) {
                     setResponseStatus(event, 403);
                     setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
                     return createBuilderBrowserCallbackErrorPage(crossOriginMessage, {
-                        title: "Couldn't start Builder connection",
-                        body: "The connect popup did not include a valid signed link for this app.",
-                        closeHint: "Close this popup, refresh the app, and try Connect account again.",
+                        title: "Couldn't start Builder.io setup",
+                        body: "The Builder.io setup popup did not include a valid signed link for this app.",
+                        closeHint: "Close this popup, refresh the app, and start Builder.io setup again.",
                         parentOrigin: getBuilderBrowserOriginForEvent(event),
                         ...(connectAttemptId ? { attemptId: connectAttemptId } : {}),
                     });
                 }
-                const denyConnect = async (status, message, reason) => {
+                const denyConnect = async (status, message, reason, title = "Not allowed to use Builder.io for this organization") => {
                     await putSetting(getBuilderConnectErrorKey(ownerEmail, connectAttemptId), {
                         message,
                         at: Date.now(),
@@ -3092,7 +3068,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     setResponseStatus(event, status);
                     setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
                     return createBuilderBrowserCallbackErrorPage(message, {
-                        title: "Not allowed to connect Builder for this organization",
+                        title,
                         body: message,
                         parentOrigin: getBuilderBrowserOriginForEvent(event),
                         ...(connectAttemptId ? { attemptId: connectAttemptId } : {}),
@@ -3111,18 +3087,10 @@ export function createCoreRoutesPlugin(options = {}) {
                     return denyConnect(403, scopeAuthorization.deny.message, scopeAuthorization.deny.reason);
                 }
                 const scopedConnectAuthorization = scopeAuthorization.member;
-                // Clients that still open a popup to create an account land here;
-                // current clients call POST /builder/provision instead.
+                // Account creation always uses POST /builder/provision so it never
+                // depends on a popup or a browser's popup policy.
                 if (shouldProvisionAgentNativeAccount) {
-                    return sendBuilderActivationPopup(event, {
-                        ownerEmail,
-                        session: ownerContext.session,
-                        provisioningToken: requestUrl.searchParams.get(BUILDER_PROVISIONING_TOKEN_PARAM),
-                        requestedScope: requestedConnectionScope,
-                        member: scopedConnectAuthorization,
-                        connectAttemptId,
-                        tracking: connectTracking,
-                    });
+                    return denyConnect(400, "Use Builder.io setup in the app to create or activate an account.", "popup_provision_not_supported", "Use Builder.io setup in the app");
                 }
                 // Clear any prior failure row from a previous attempt — otherwise
                 // useBuilderStatus polling sees the stale error and aborts the
@@ -3195,7 +3163,7 @@ export function createCoreRoutesPlugin(options = {}) {
                         reason: "pending_storage_unavailable",
                         stage: "connect",
                     });
-                    const msg = "Could not initiate Builder connect — storage unavailable. Try again.";
+                    const msg = "Could not start Builder.io setup — storage unavailable. Try again.";
                     console.error("[builder] Could not store pending-connect state:", err?.message ?? err);
                     // Best-effort: also write the error row so the parent's
                     // /builder/status poll picks it up if BroadcastChannel doesn't.
@@ -3439,7 +3407,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     if (!privateKey || !publicKey) {
                         setResponseStatus(event, 400);
                         setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
-                        return createBuilderBrowserCallbackErrorPage("Builder didn't return credentials. Restart the connect flow from settings.", {
+                        return createBuilderBrowserCallbackErrorPage("Builder didn't return credentials. Start Builder.io setup again from Settings.", {
                             parentOrigin: relayParentOrigin,
                             ...(requestConnectAttemptId
                                 ? { attemptId: requestConnectAttemptId }
@@ -3563,11 +3531,11 @@ export function createCoreRoutesPlugin(options = {}) {
                     if (resetStateCookie && carriesOAuthResult) {
                         deleteCookie(event, BUILDER_CONNECT_STATE_COOKIE, { path: "/" });
                     }
-                    return fail(403, "No active Builder connect flow found. Restart the connection from Settings.");
+                    return fail(403, "No active Builder.io setup was found. Start it again from Settings.");
                 }
                 const pending = await readBuilderConnectPendingState(state);
                 if (!pending) {
-                    return fail(403, "No active Builder connect flow found. Restart the connection from Settings.");
+                    return fail(403, "No active Builder.io setup was found. Start it again from Settings.");
                 }
                 callbackAttemptId =
                     typeof pending.attemptId === "string"
@@ -3597,7 +3565,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     if (Date.now() >= expiresAt) {
                         await deleteSetting(`builder-connect-pending:${state}`).catch(() => false); // coercion-ok: expired pending cleanup is best-effort; callback already failed verification
                     }
-                    return fail(403, "Builder connect callback could not be verified. Restart the connection.", ownerEmail ?? undefined, "callback_verification_failed", tracking);
+                    return fail(403, "Builder.io setup could not be verified. Start the setup again.", ownerEmail ?? undefined, "callback_verification_failed", tracking);
                 }
                 const denied = requestUrl.searchParams.get("error");
                 const code = requestUrl.searchParams.get("code");
@@ -3618,11 +3586,11 @@ export function createCoreRoutesPlugin(options = {}) {
                     });
                 }
                 catch {
-                    return fail(BUILDER_UPSTREAM_FAILURE_STATUS, "Builder could not exchange the authorization code. Restart the connection.", ownerEmail, "code_exchange_failed", tracking);
+                    return fail(BUILDER_UPSTREAM_FAILURE_STATUS, "Builder could not exchange the authorization code. Start Builder.io setup again.", ownerEmail, "code_exchange_failed", tracking);
                 }
                 const requestedConnectionScope = parseBuilderConnectionScope(pending.connectionScope);
                 if (requestedConnectionScope === "invalid") {
-                    return fail(403, "Builder connect callback could not be verified. Restart the connection.", ownerEmail, "callback_verification_failed", tracking);
+                    return fail(403, "Builder.io setup could not be verified. Start the setup again.", ownerEmail, "callback_verification_failed", tracking);
                 }
                 const pendingOrgId = typeof pending.orgId === "string" ? pending.orgId : null;
                 // Authority is read again after the external OAuth round trip, in
@@ -3660,11 +3628,11 @@ export function createCoreRoutesPlugin(options = {}) {
                     });
                 }
                 catch {
-                    return fail(500, "Builder credentials could not be saved. Restart the connection.", ownerEmail, "credential_write_failed", tracking);
+                    return fail(500, "Builder credentials could not be saved. Start Builder.io setup again.", ownerEmail, "credential_write_failed", tracking);
                 }
                 const consumed = await consumeBuilderConnectPendingState(state);
                 if (!consumed) {
-                    return fail(403, "No active Builder connect flow found. Restart the connection from Settings.", ownerEmail, "callback_verification_failed", tracking);
+                    return fail(403, "No active Builder.io setup was found. Start it again from Settings.", ownerEmail, "callback_verification_failed", tracking);
                 }
                 dropConnectStateCookie(state);
                 try {
@@ -3674,7 +3642,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     ]);
                 }
                 catch {
-                    return fail(500, "Builder credentials could not be saved. Restart the connection.", ownerEmail, "credential_write_failed", tracking);
+                    return fail(500, "Builder credentials could not be saved. Start Builder.io setup again.", ownerEmail, "credential_write_failed", tracking);
                 }
                 await trackBuilderLifecycle(event, "builder connect succeeded", ownerEmail, {
                     ...builderConnectTrackingProperties(tracking),
@@ -4251,7 +4219,7 @@ export function createCoreRoutesPlugin(options = {}) {
                 }
                 setResponseStatus(event, 503);
                 return {
-                    error: "No object storage is connected. Connect Builder.io (free) or add your own S3-compatible storage keys in Settings → File uploads.",
+                    error: "No object storage is connected. Use Builder.io's managed storage (free) or add your own S3-compatible storage keys in Settings → File uploads.",
                 };
             }));
             // ─── Voice transcription (Whisper) ───────────────────────────────

package/dist/server/credential-provider.js

@@ -69,7 +69,7 @@ export class FeatureNotConfiguredError extends Error {
     byokDocsUrl;
     constructor(opts) {
         super(opts.message ??
-            `Feature requires credential "${opts.requiredCredential}". Connect Builder (free tier available) or set your own key.`);
+            `Feature requires credential "${opts.requiredCredential}". Use Builder.io (free tier available) or set your own key.`);
         this.name = "FeatureNotConfiguredError";
         this.requiredCredential = opts.requiredCredential;
         this.builderConnectUrl = opts.builderConnectUrl;
@@ -864,7 +864,7 @@ export async function getBuilderCredentialAuthFailure(creds = {}) {
             fingerprint,
             message: typeof row.message === "string" && row.message
                 ? row.message
-                : "Builder rejected the connected credentials. Reconnect Builder.io (free tier available).",
+                : "Builder rejected the connected credentials. Sign in to Builder.io again (free tier available).",
             status: typeof row.status === "number" ? row.status : undefined,
             code: typeof row.code === "string" ? row.code : undefined,
             at,
@@ -888,7 +888,7 @@ export async function recordBuilderCredentialAuthFailure(details) {
         await putSetting(settingKey, {
             fingerprint,
             message: details?.message ||
-                "Builder rejected the connected credentials. Reconnect Builder.io (free tier available).",
+                "Builder rejected the connected credentials. Sign in to Builder.io again (free tier available).",
             ...(typeof details?.status === "number" && { status: details.status }),
             ...(details?.code && { code: details.code }),
             strikes,

package/dist/server/deep-link.d.ts

@@ -1,6 +1,8 @@
 export declare const OPEN_ROUTE_SUBPATH = "/open";
 export declare const DESKTOP_OPEN_URL = "agentnative://open";
 export declare const VSCODE_OPEN_URL = "vscode://builder.agent-native/open";
+export declare function isSameOriginUrl(urlOrPath: string, origin?: string): boolean;
+export declare function isAgentNativeOpenUrl(urlOrPath: string, origin?: string, basePath?: string): boolean;
 export interface DeepLinkInput {
     app?: string;
     view: string;

package/dist/server/deep-link.js

@@ -1,9 +1,31 @@
-import { withCollapsedAgentSidebarParam } from "../shared/agent-sidebar-url.js";
-import { getConfiguredAppBasePath, normalizeAppBasePath, } from "./app-base-path.js";
-import { publicFrameworkPath } from "./framework-route-prefix.js";
+import { AGENT_NATIVE_OPEN_PATH, withCollapsedAgentSidebarParam, } from "../shared/agent-sidebar-url.js";
+import { getConfiguredAppBasePath, normalizeAppBasePath, stripAppBasePath, } from "./app-base-path.js";
+import { canonicalFrameworkPathname, publicFrameworkPath, } from "./framework-route-prefix.js";
 export const OPEN_ROUTE_SUBPATH = "/open";
 export const DESKTOP_OPEN_URL = "agentnative://open";
 export const VSCODE_OPEN_URL = "vscode://builder.agent-native/open";
+export function isSameOriginUrl(urlOrPath, origin) {
+    const hasAuthority = /^[a-z][a-z0-9+.-]*:/i.test(urlOrPath) || urlOrPath.startsWith("//");
+    if (!hasAuthority)
+        return true;
+    if (!origin)
+        return false;
+    if (!URL.canParse(origin) || !URL.canParse(urlOrPath, origin))
+        return false;
+    return new URL(urlOrPath, origin).origin === new URL(origin).origin;
+}
+export function isAgentNativeOpenUrl(urlOrPath, origin, basePath = getConfiguredAppBasePath()) {
+    const base = origin ?? "http://agent-native.invalid";
+    if (!URL.canParse(urlOrPath, base))
+        return false;
+    const url = new URL(urlOrPath, base);
+    if (url.protocol === "agentnative:" && url.host === "open")
+        return true;
+    if (!isSameOriginUrl(urlOrPath, origin))
+        return false;
+    return (canonicalFrameworkPathname(stripAppBasePath(url.pathname, basePath)) ===
+        AGENT_NATIVE_OPEN_PATH);
+}
 function buildQuery(input) {
     const sp = new URLSearchParams();
     if (input.app)
@@ -24,6 +46,11 @@ export function buildDeepLink(input) {
 export function toAbsoluteOpenUrl(urlOrPath, origin) {
     if (/^[a-z][a-z0-9+.-]*:\/\//i.test(urlOrPath))
         return urlOrPath;
+    if (urlOrPath.startsWith("//")) {
+        return origin && URL.canParse(urlOrPath, origin)
+            ? new URL(urlOrPath, origin).toString()
+            : urlOrPath;
+    }
     const basePath = getConfiguredAppBasePath();
     const path = withBasePath(urlOrPath, basePath);
     if (!origin)

package/dist/server/fusion-app.js

@@ -34,7 +34,7 @@ async function resolveFusionAuth(requiredScope) {
         requiredScope,
     });
     if (!authorization) {
-        throw new Error("Builder.io is not connected. Connect Builder.io in Settings.");
+        throw new Error("Builder.io is not connected. Sign in to Builder.io in Settings to continue.");
     }
     if (authorization.source === "legacy" && !authorization.legacyPublicKey) {
         throw new Error("Builder legacy credentials require BUILDER_PUBLIC_KEY for this request.");