@agent-native/core 0.203.1-nightly-20261007183952 → 0.203.1

package/dist/server/core-routes-plugin.js

@@ -2,13 +2,15 @@ import { createHash } from "node:crypto";
 import { assertBodySize, defineEventHandler, setResponseStatus, setResponseHeader, getMethod, getHeader, getRequestURL, getRequestIP, readRawBody, getCookie, setCookie, deleteCookie, } from "h3";
 import { readMultipartFormData } from "h3";
 import { z } from "zod";
+import { readAgentAppModelDefaultSettings, normalizeAgentAppModelDefaultAppId, } from "../agent/app-model-defaults.js";
 import { CHATGPT_SUBSCRIPTION_CALLBACK_PATH } from "../agent/chatgpt-subscription-contract.js";
 import { readDefaultAgentEngineSetting } from "../agent/default-agent-engine.js";
-import { DEFAULT_MODEL } from "../agent/default-model.js";
+import { resolveAgentEngineStatus, } from "../agent/engine-status.js";
 import { registerBuiltinEngines } from "../agent/engine/builtin.js";
 import { OPENAI_BASE_URL_ENV_VAR, PROVIDER_ENV_META, } from "../agent/engine/provider-env-vars.js";
-import { isAgentEngineSettingConfigured, getAgentEngineEntry, detectEngineFromEnv, detectEngineFromUserSecrets, isStoredEngineUsableForRequest, normalizeModelForEngine, } from "../agent/engine/registry.js";
+import { detectEngineFromEnv, detectEngineFromUserSecrets, isStoredEngineUsableForRequest, } from "../agent/engine/registry.js";
 import { canUpdateAgentLoopSettings, readAgentLoopSettings, resetAgentLoopSettings, validateMaxIterationsInput, writeAgentLoopSettings, } from "../agent/loop-settings.js";
+export { normalizeAgentEngineStatusModel, resolveAgentEngineStatus, } from "../agent/engine-status.js";
 import { getAppConfig } from "../app-config/index.js";
 import { getState, putState, compareAndSetState, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, getStateMany, APP_STATE_ANONYMOUS_OWNER_CONTEXT_KEY, } from "../application-state/handlers.js";
 import { recordOrgAdminAuditEvent } from "../audit/org-admin.js";
@@ -86,7 +88,7 @@ import { createPollEventsHandler, validateSseMaxDurationMs, } from "./poll-event
 import { createPollHandler } from "./poll.js";
 import { isHostedRealtimeTransport, realtimeRegistrationUnavailable, } from "./realtime-registration.js";
 import { createRealtimeTokenHandler, resolveActiveRealtimeChannel, } from "./realtime-token.js";
-import { getRequestContext, hasRequestContext, runWithRequestContext, } from "./request-context.js";
+import { getRequestContext, getRequestOrgId, getRequestUserEmail, hasRequestContext, runWithRequestContext, } from "./request-context.js";
 import { isSameOriginRequest } from "./request-origin.js";
 import { findUnsupportedScopedKeyNames, saveKeyValuesToScopedSecrets, ScopedKeyStorageError, } from "./scoped-key-storage.js";
 import { createSpeakHandler } from "./speak.js";
@@ -103,97 +105,18 @@ import { createWorkspaceProviderOAuthHandler } from "./workspace-provider-oauth.
 export const FRAMEWORK_ROUTE_PREFIX = "/_agent-native";
 export const FRAMEWORK_EVENTS_ROUTE = `${FRAMEWORK_ROUTE_PREFIX}/events`;
 export const LEGACY_FRAMEWORK_EVENTS_ROUTE = `${FRAMEWORK_ROUTE_PREFIX}/poll-events`;
-export function normalizeAgentEngineStatusModel(entry, model) {
-    if (!entry)
-        return model ?? DEFAULT_MODEL;
-    return normalizeModelForEngine(entry, model ?? entry.defaultModel);
-}
-/**
- * Resolve "does this request have a usable AI provider" for one identity.
- *
- * Every call site pays for these lookups on a user-visible path (the agent
- * composer blocks on the status probe), so the two identity-independent reads
- * start together and the expensive `app_secrets` sweep only runs when the
- * cheaper sources have not already answered.
- */
-export async function resolveAgentEngineStatus(deps) {
-    const lookupEntry = (deps.lookupEntry ?? getAgentEngineEntry);
-    const [stored, openAiBaseUrlConfigured] = await Promise.all([
-        deps.readStoredEngine(),
-        deps.readOpenAiBaseUrlConfigured(),
-    ]);
-    if (isAgentEngineSettingConfigured(stored)) {
-        const engine = stored.engine;
-        const entry = lookupEntry(engine);
-        return {
-            configured: true,
-            engine,
-            model: normalizeAgentEngineStatusModel(entry, stored?.model),
-            source: "settings",
-            openAiBaseUrlConfigured,
-        };
-    }
-    const configuredEngine = getAppConfig().agent.engine;
-    const envEntry = configuredEngine ? lookupEntry(configuredEngine) : undefined;
-    if (envEntry) {
-        if (await deps.isStoredEngineUsable({ engine: envEntry.name }, envEntry)) {
-            return {
-                configured: true,
-                engine: envEntry.name,
-                model: envEntry.defaultModel ?? DEFAULT_MODEL,
-                source: "env",
-                envVar: "AGENT_ENGINE",
-                openAiBaseUrlConfigured,
-            };
-        }
-        if (getRequestContext()?.isSyntheticTraffic !== true) {
-            return { configured: false, openAiBaseUrlConfigured };
-        }
-    }
-    // Stored provider selections win over an existing Builder connection, so
-    // this is checked before the app_secrets sweep — and the sweep is skipped
-    // entirely when it answers.
-    if (stored && typeof stored.engine === "string") {
-        const entry = lookupEntry(stored.engine);
-        if (entry && (await deps.isStoredEngineUsable(stored, entry))) {
-            return {
-                configured: true,
-                engine: stored.engine,
-                model: normalizeAgentEngineStatusModel(entry, stored.model),
-                source: "env",
-                envVar: entry.requiredEnvVars[0],
-                openAiBaseUrlConfigured,
-            };
-        }
-    }
-    // Per-user app_secrets — a user who connected Builder (or pasted their own
-    // provider key) may not have any deploy-level env vars set.
-    const detectedFromUser = await deps.detectFromUserSecrets();
-    if (detectedFromUser) {
-        return {
-            configured: true,
-            engine: detectedFromUser.name,
-            model: detectedFromUser.defaultModel ?? DEFAULT_MODEL,
-            source: "app_secrets",
-            envVar: detectedFromUser.requiredEnvVars[0],
-            openAiBaseUrlConfigured,
-        };
-    }
-    const detected = await deps.detectFromEnv();
-    if (detected) {
-        return {
-            configured: true,
-            engine: detected.name,
-            model: detected.defaultModel ?? DEFAULT_MODEL,
-            source: "env",
-            envVar: detected.requiredEnvVars[0],
-            openAiBaseUrlConfigured,
-        };
-    }
-    return { configured: false, openAiBaseUrlConfigured };
-}
 function requestAgentEngineStatusDeps() {
     return {
+        readAppDefault: async () => {
+            const app = getAppConfig().app;
+            const appId = normalizeAgentAppModelDefaultAppId(app.id ?? app.template ?? app.slug);
+            if (!appId)
+                return null;
+            const settings = await readAgentAppModelDefaultSettings({ userEmail: getRequestUserEmail(), orgId: getRequestOrgId() }, appId);
+            return settings.engine && settings.model
+                ? { engine: settings.engine, model: settings.model }
+                : null;
+        },
         readStoredEngine: async () => (await readDefaultAgentEngineSetting()),
         readOpenAiBaseUrlConfigured: async () => {
             try {

package/dist/templates/workspace-core/.agents/skills/recurring-jobs/SKILL.md

@@ -46,10 +46,25 @@ and pass normalized action items to an app's idempotent `import` action.
 
 | Tool          | Action     | Purpose                                                    |
 | ------------- | ---------- | ---------------------------------------------------------- |
-| `manage-jobs` | `create`   | Create a recurring job (name, cron schedule, instructions) |
+| `manage-jobs` | `create`   | Create a recurring job (name, cron schedule, instructions); fails if the name exists |
 | `manage-jobs` | `list`     | List all jobs and their status                             |
 | `manage-jobs` | `update`   | Update schedule, instructions, or toggle enabled           |
 
+## Job files an app owns
+
+`create` never replaces an existing job file, so a name that collides with an
+app's file (Factory's `factories/<id>/<name>`) is refused instead of reset.
+An app that stores its own settings in a job's frontmatter marks the file with
+`triggerType`, which makes `list`, `update`, and `delete` skip it and sends the
+caller to `manage-automations`. Edit those files only through the owning app's
+actions, and patch fields in place; rebuilding a file from the fields the writer
+knows drops the rest while the job keeps running.
+
+Any write to a `jobs/` file that removes a frontmatter field other than run
+bookkeeping is recorded as a `job-fields-dropped` audit event (org admins read
+it with `list-audit-events` and `action: "job-fields-dropped"`). Its input names
+the writer, the dropped fields, and the agent thread and run that made it.
+
 ## UI Surface
 
 `/agent#jobs` is the stable compatibility URL for the Agent page's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.203.1-nightly-20261007183952",
+  "version": "0.203.1",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -682,8 +682,8 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/agentkit": "^0.203.1-nightly-20261007183952",
-    "@agent-native/recap-cli": "^0.5.64"
+    "@agent-native/agentkit": "^0.203.1",
+    "@agent-native/recap-cli": "^0.5.65"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",
@@ -753,7 +753,7 @@
     "xlsx": "^0.18.5"
   },
   "peerDependencies": {
-    "@agent-native/core-corpus": "0.203.1-nightly-20261007183952",
+    "@agent-native/core-corpus": ">=0.196.0",
     "@ai-sdk/anthropic": ">=3",
     "@ai-sdk/cohere": ">=3",
     "@ai-sdk/google": ">=3",

package/src/templates/workspace-core/.agents/skills/recurring-jobs/SKILL.md

@@ -46,10 +46,25 @@ and pass normalized action items to an app's idempotent `import` action.
 
 | Tool          | Action     | Purpose                                                    |
 | ------------- | ---------- | ---------------------------------------------------------- |
-| `manage-jobs` | `create`   | Create a recurring job (name, cron schedule, instructions) |
+| `manage-jobs` | `create`   | Create a recurring job (name, cron schedule, instructions); fails if the name exists |
 | `manage-jobs` | `list`     | List all jobs and their status                             |
 | `manage-jobs` | `update`   | Update schedule, instructions, or toggle enabled           |
 
+## Job files an app owns
+
+`create` never replaces an existing job file, so a name that collides with an
+app's file (Factory's `factories/<id>/<name>`) is refused instead of reset.
+An app that stores its own settings in a job's frontmatter marks the file with
+`triggerType`, which makes `list`, `update`, and `delete` skip it and sends the
+caller to `manage-automations`. Edit those files only through the owning app's
+actions, and patch fields in place; rebuilding a file from the fields the writer
+knows drops the rest while the job keeps running.
+
+Any write to a `jobs/` file that removes a frontmatter field other than run
+bookkeeping is recorded as a `job-fields-dropped` audit event (org admins read
+it with `list-audit-events` and `action: "job-fields-dropped"`). Its input names
+the writer, the dropped fields, and the agent thread and run that made it.
+
 ## UI Surface
 
 `/agent#jobs` is the stable compatibility URL for the Agent page's