@agent-native/core 0.206.0 → 0.206.1-nightly-20261009213000

package/dist/templates/factory/.agents/skills/review-latest-feedback/SKILL.md

@@ -245,27 +245,25 @@ Do not change code for an unrelated product idea, praise, status update, merge
 or review request, irrelevant bot forward, duplicate, or work outside the
 invocation's ownership.
 
-**Keep subjective UI changes human-in-the-loop.** Automatically fix only
-objective UI defects: broken interactions, misalignment, overlap or clipping,
-unusable controls, or removing clear excess clutter. A reporter request is not
-product signoff. Discoverability complaints and preferences do not authorize
-adding, promoting, moving, or duplicating buttons or other persistent chrome.
-Check overflow, keyboard, Cmd+K, and contextual surfaces first. Adding or
-promoting chrome requires the invoking user's explicit current-task request or
-  :upvote:` below. Otherwise mark **Skipped**. If this run already claimed it,
-  keep our `👀`
-  and post **Skipped** once if the thread does not state it; do not ask the
-  reporter to decide. Measure failures with `text-heavy-ui`.
-
-Requests for a new capability still follow the invoking identity's `:upvote:`
-gate. Content remains Alice's area unless the invocation claims it.
+**Subjective UX proposals need human review.** Adding buttons/chrome or changing
+visibility, placement, emphasis, or discoverability (including “hard to find”)
+is a product proposal, not a defect. Check overflow, keyboard, Cmd+K, and
+contextual surfaces first. Recap the ask, findings, options, recommendation,
+and tradeoff; mark **Skipped**. A report or `:upvote:` never authorizes automatic
+implementation; only a user-directed task may implement an approved approach.
+If claimed, keep 👀, post **Skipped** once, and don't ask the reporter to choose.
+
+Auto-fix objective defects only: broken behavior/results, misalignment,
+overlap/clipping, illegibility, unusable focus/targets, jank, jitter,
+measurable slowness, regressions. Separate defects from preferences; measure
+failures with `text-heavy-ui`. Content remains Alice's unless claimed.
 
 ### `:upvote:` authorizes feature requests
 
 An `:upvote:` from **the invoking identity** - not from anyone else - promotes
-an otherwise out-of-scope item into scope and authorizes the work. It is the
-endorsement that settles the product question: the person who would otherwise
-route this away has read it and decided it should happen. Build it.
+an otherwise out-of-scope item into scope and authorizes the work. Subjective
+UX proposals are the exception: an upvote routes them for human review, not
+implementation by this sweep.
 
 Find them alongside the newest-message scan:
 
@@ -279,10 +277,11 @@ the query also returns ordinary replies and old polls that happen to carry the
 reaction. Take the ones that name a concrete improvement; skip the rest
 without comment.
 
-An upvote endorses a **feature or UX change** and skips only the clear-bug bar;
-it does not change ownership, reaction, verification, or question-budget rules.
-Build the smallest endorsed version, name Sid or Alice, and state requested
-versus actual behavior in the recap. Add `👀` before investigation or
+An upvote endorses an otherwise out-of-scope **feature request** and skips only
+the clear-bug bar; it does not change ownership, reaction, verification, or
+question-budget rules. Subjective UX proposals remain review-only as above.
+Build the smallest eligible endorsed version, name Sid or Alice, and state
+requested versus actual behavior in the recap. Add `👀` before investigation or
 delegation and read it back. Keep it evidence-limited until Phase 2's four bars
 hold; then use **Shipped**, adding `✅` only if it meets **Fixed**.
 

package/dist/testing.d.ts

@@ -1,3 +1,4 @@
 export { createGetDb } from "./db/create-get-db.js";
 export { startLocalPlanBridge } from "./cli/plan-local.js";
 export { prepareDesignConnectManifest, startDesignConnectBridge, type DesignConnectBridge, } from "./cli/design-connect.js";
+export { assertNoInlineImageBytes } from "./shared/inline-bytes.js";

package/dist/testing.js

@@ -1,3 +1,4 @@
 export { createGetDb } from "./db/create-get-db.js";
 export { startLocalPlanBridge } from "./cli/plan-local.js";
 export { prepareDesignConnectManifest, startDesignConnectBridge, } from "./cli/design-connect.js";
+export { assertNoInlineImageBytes } from "./shared/inline-bytes.js";

package/dist/tracking/registry.d.ts

@@ -9,11 +9,12 @@ export interface TrackingMeta {
     userId?: string;
     authUserId?: string;
     anonymousId?: string;
-    sessionId?: string;
+    /** Null pins session absence and disables request-context fallback. */
+    sessionId?: string | null;
     occurredAt?: number;
     telemetryOrigin?: TrackingEventOrigin;
 }
-export type TrackingSource = TrackingMeta | ActionRunContext;
+export type TrackingSource = TrackingMeta | (ActionRunContext & Pick<TrackingMeta, "sessionId">);
 export declare function track(name: string, properties?: Record<string, unknown>, source?: TrackingSource): void;
 export declare function identify(userId: string, traits?: Record<string, unknown>): void;
 export declare function flushTracking(): Promise<void[]>;

package/dist/tracking/registry.js

@@ -57,12 +57,17 @@ function resolveTrackingSource(source) {
     }
     if (isActionRunContext(source)) {
         const callerMatchesRequest = source.userEmail === requestContext?.userEmail;
+        const explicitSessionId = source.sessionId;
         return {
             userId: source.userEmail,
             ...(callerMatchesRequest
                 ? { authUserId: requestContext?.authUserId }
                 : {}),
-            sessionId: callerMatchesRequest ? ambientSessionId : undefined,
+            sessionId: explicitSessionId === undefined
+                ? callerMatchesRequest
+                    ? ambientSessionId
+                    : undefined
+                : (explicitSessionId ?? undefined),
             telemetryOrigin: "server",
         };
     }
@@ -76,7 +81,11 @@ function resolveTrackingSource(source) {
         authUserId: source.authUserId ??
             (canUseAmbientIdentity ? requestContext?.authUserId : undefined),
         anonymousId: source.anonymousId,
-        sessionId: source.sessionId ?? (canUseAmbientSession ? ambientSessionId : undefined),
+        sessionId: source.sessionId === undefined
+            ? canUseAmbientSession
+                ? ambientSessionId
+                : undefined
+            : (source.sessionId ?? undefined),
         occurredAt: source.occurredAt,
         telemetryOrigin: source.telemetryOrigin ?? "server",
     };
@@ -158,7 +167,7 @@ function emitTrackingEvent(name, properties, source) {
         timestamp: new Date(source.occurredAt || Date.now()).toISOString(),
         userId: source.userId,
         anonymousId: source.anonymousId,
-        sessionId: source.sessionId,
+        sessionId: source.sessionId ?? undefined,
     };
     for (const provider of getRegistry().values()) {
         if (properties.test_identity === true &&

package/dist/vite/client.js

@@ -3785,7 +3785,7 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
     const forcePollingWatch = process.env.CHOKIDAR_USEPOLLING === "1";
     const pollingWatchInterval = Number(process.env.CHOKIDAR_INTERVAL ?? 1000);
     const userWatch = userConfig.server?.watch ?? {};
-    const { rollupOptions: _buildRollupOptionsAlias, ...userBuild } = userConfig.build ?? {};
+    const { rollupOptions: _buildRollupOptionsAlias, rolldownOptions: _buildRolldownOptions, ...userBuild } = userConfig.build ?? {};
     const { rollupOptions: _depsRollupOptionsAlias, ...userOptimizeDeps } = userConfig.optimizeDeps ?? {};
     return {
         nitro: {
@@ -3891,6 +3891,11 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
         },
         build: {
             ...userBuild,
+            rolldownOptions: {
+                experimental: {
+                    lazyBarrel: userConfig.build?.rolldownOptions?.experimental?.lazyBarrel ?? true,
+                },
+            },
             outDir: options.outDir ?? userConfig.build?.outDir ?? "dist/spa",
             cssMinify: userConfig.build?.cssMinify ?? "esbuild",
             cssTarget: userConfig.build?.cssTarget ?? ["es2020", "safari18"],

package/docs/content/observability.mdx

@@ -421,14 +421,17 @@ Spans are finished with OK/ERROR status and record a fixed code-derived message
 
 Core also records metrics once the host registers a meter provider with `registerObservabilityProvider()` from `@agent-native/core/server`. Metrics are recorded for every request and run, with no sampling:
 
-| Instrument                              | Attributes                                                                                   |
-| --------------------------------------- | -------------------------------------------------------------------------------------------- |
-| `http.server.request.duration`          | `http.request.method`, `http.response.status_code`, `http.route`, `error.type`               |
-| `gen_ai.client.operation.duration`      | `gen_ai.operation.name`, `gen_ai.provider.name`, `gen_ai.request.model`, `error.type`        |
-| `gen_ai.client.token.usage`             | `gen_ai.operation.name`, `gen_ai.provider.name`, `gen_ai.request.model`, `gen_ai.token.type` |
-| `agent_native.agent.runs`               | `status`, `terminal_reason`, `gen_ai.provider.name`, `gen_ai.request.model`                  |
-| `agent_native.tool.calls`               | `gen_ai.tool.name`, `error.type`                                                             |
-| `agent_native.telemetry.flush_failures` | `error.type`, `agent_native.telemetry.signal`                                                |
+| Instrument                                  | Attributes                                                                                   |
+| ------------------------------------------- | -------------------------------------------------------------------------------------------- |
+| `http.server.request.duration`              | `http.request.method`, `http.response.status_code`, `http.route`, `error.type`               |
+| `agent_native.http.server.handoff.duration` | `http.request.method`, `http.response.status_code`, `http.route`, `error.type`               |
+| `gen_ai.client.operation.duration`          | `gen_ai.operation.name`, `gen_ai.provider.name`, `gen_ai.request.model`, `error.type`        |
+| `gen_ai.client.token.usage`                 | `gen_ai.operation.name`, `gen_ai.provider.name`, `gen_ai.request.model`, `gen_ai.token.type` |
+| `agent_native.agent.runs`                   | `status`, `terminal_reason`, `gen_ai.provider.name`, `gen_ai.request.model`                  |
+| `agent_native.tool.calls`                   | `gen_ai.tool.name`, `error.type`                                                             |
+| `agent_native.telemetry.flush_failures`     | `error.type`, `agent_native.telemetry.signal`                                                |
+
+`agent_native.http.server.handoff.duration` has the same attributes and buckets as `http.server.request.duration`, but it ends when the response hook hands the response back to the runtime instead of when the hook starts. When its percentiles pull away from `http.server.request.duration`'s, finished responses are being held, for example by an inline telemetry flush. The gap is a signal, not any one request's wait, since the two percentiles can come from different requests. Without `waitUntil`, core records the sample after that flush, so it reaches the back end with the next one.
 
 On metrics, `gen_ai.tool.name` is a framework action's name or `other`, and `gen_ai.request.model` is the model id only when the engine lists it as supported, otherwise `_OTHER`. App-defined tools and caller-supplied model ids therefore cannot create unbounded series; spans keep the exact values.
 
@@ -472,9 +475,11 @@ A later call replaces the earlier provider. The returned function unregisters th
 
 ### Flushing on serverless {#otel-flush}
 
-Serverless functions freeze between invocations, so an SDK's export timer may never fire. When a registered provider implements `forceFlush()`, core calls it from the response hook after every request and waits for it. Each flush races one shared 2-second timeout, so telemetry never holds a response longer than that.
+Serverless functions freeze between invocations, so an SDK's export timer may never fire. When a registered provider implements `forceFlush()`, core calls it from the response hook after every request and waits for it. Each flush races one shared 2-second timeout, so telemetry never holds a response longer than that. When the platform provides `waitUntil` (Cloudflare, or the Netlify invocation context), core hands the flush to it and sends the response first instead of waiting.
 
-When a flush fails or times out, core stops waiting for it and adds 1 to `agent_native.telemetry.flush_failures`, which the next flush exports. A timed-out export keeps running and can still arrive, unless the runtime freezes the process first. The failure's `error.type` is `timeout`, `suspended` when the runtime froze the process mid-flush, or the error's name.
+Core calls a meter provider's `forceFlush()` at most once every 10 seconds per process and skips it on the requests in between. Each metric export re-sends every series the process holds, so this keeps upload volume from growing with request rate. Skipped points are not lost: the next export carries them, unless the instance never serves another request. A tracer provider is flushed on every request.
+
+When a flush fails or times out, core stops waiting for it and adds 1 to `agent_native.telemetry.flush_failures`, which the next flush exports. A timed-out export keeps running and can still arrive, unless the runtime freezes the process first. The failure's `error.type` is `timeout`, `suspended` when the runtime froze the process mid-flush, or the error's name. Because a collector that keeps timing out never receives that counter, core also writes one `agent-native.telemetry_flush_failed` line to the function log per signal and error type in each process.
 
 On a long-running server, a flush after every response means one export per request. Register providers without `forceFlush()` there and let the SDK's own timers export. `isServerlessRuntime()` from `@agent-native/core/server` tells the two apart. It is true on Netlify, Vercel, AWS Lambda, and Cloudflare.
 

package/docs/content/tracking.mdx

@@ -390,7 +390,7 @@ Template roots call `configureTracking()` once at startup. Browser events sent w
 - `llm_connection_source` — `app_secrets`, `settings`, or `env`
 - `llm_connection_configured` — whether an LLM connection is available
 
-The framework also tracks `builder connect clicked` when a user selects a Use Builder.io CTA, and the server-side Builder connect routes track started/succeeded/failed lifecycle events. `configureTracking()` is called automatically by the framework; you don't need to call it in your own template code.
+The framework also tracks `builder connect clicked` when a user selects a Use Builder.io CTA, and the server-side Builder connect routes track started/succeeded/failed lifecycle events. Server-side setup changes also emit `llm_credential_changed` (`change_type`, normalized `provider`, `scope`, `credential_kind`, and optional `surface`) and `llm_default_model_changed` (`engine`, `model`, optional prior engine/model, `scope`, and `operation`). These events never include credential or endpoint values. `configureTracking()` is called automatically by the framework; you don't need to call it in your own template code.
 
 </details>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.206.0",
+  "version": "0.206.1-nightly-20261009213000",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -688,8 +688,8 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/agentkit": "^0.206.0",
-    "@agent-native/recap-cli": "^0.5.68"
+    "@agent-native/recap-cli": "^0.5.68",
+    "@agent-native/agentkit": "^0.206.1-nightly-20261009213000"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",
@@ -759,7 +759,7 @@
     "xlsx": "^0.18.5"
   },
   "peerDependencies": {
-    "@agent-native/core-corpus": ">=0.196.0",
+    "@agent-native/core-corpus": "0.206.1-nightly-20261009213000",
     "@ai-sdk/anthropic": ">=3",
     "@ai-sdk/cohere": ">=3",
     "@ai-sdk/google": ">=3",

package/src/templates/factory/.agents/skills/review-latest-feedback/SKILL.md

@@ -245,27 +245,25 @@ Do not change code for an unrelated product idea, praise, status update, merge
 or review request, irrelevant bot forward, duplicate, or work outside the
 invocation's ownership.
 
-**Keep subjective UI changes human-in-the-loop.** Automatically fix only
-objective UI defects: broken interactions, misalignment, overlap or clipping,
-unusable controls, or removing clear excess clutter. A reporter request is not
-product signoff. Discoverability complaints and preferences do not authorize
-adding, promoting, moving, or duplicating buttons or other persistent chrome.
-Check overflow, keyboard, Cmd+K, and contextual surfaces first. Adding or
-promoting chrome requires the invoking user's explicit current-task request or
-  :upvote:` below. Otherwise mark **Skipped**. If this run already claimed it,
-  keep our `👀`
-  and post **Skipped** once if the thread does not state it; do not ask the
-  reporter to decide. Measure failures with `text-heavy-ui`.
-
-Requests for a new capability still follow the invoking identity's `:upvote:`
-gate. Content remains Alice's area unless the invocation claims it.
+**Subjective UX proposals need human review.** Adding buttons/chrome or changing
+visibility, placement, emphasis, or discoverability (including “hard to find”)
+is a product proposal, not a defect. Check overflow, keyboard, Cmd+K, and
+contextual surfaces first. Recap the ask, findings, options, recommendation,
+and tradeoff; mark **Skipped**. A report or `:upvote:` never authorizes automatic
+implementation; only a user-directed task may implement an approved approach.
+If claimed, keep 👀, post **Skipped** once, and don't ask the reporter to choose.
+
+Auto-fix objective defects only: broken behavior/results, misalignment,
+overlap/clipping, illegibility, unusable focus/targets, jank, jitter,
+measurable slowness, regressions. Separate defects from preferences; measure
+failures with `text-heavy-ui`. Content remains Alice's unless claimed.
 
 ### `:upvote:` authorizes feature requests
 
 An `:upvote:` from **the invoking identity** - not from anyone else - promotes
-an otherwise out-of-scope item into scope and authorizes the work. It is the
-endorsement that settles the product question: the person who would otherwise
-route this away has read it and decided it should happen. Build it.
+an otherwise out-of-scope item into scope and authorizes the work. Subjective
+UX proposals are the exception: an upvote routes them for human review, not
+implementation by this sweep.
 
 Find them alongside the newest-message scan:
 
@@ -279,10 +277,11 @@ the query also returns ordinary replies and old polls that happen to carry the
 reaction. Take the ones that name a concrete improvement; skip the rest
 without comment.
 
-An upvote endorses a **feature or UX change** and skips only the clear-bug bar;
-it does not change ownership, reaction, verification, or question-budget rules.
-Build the smallest endorsed version, name Sid or Alice, and state requested
-versus actual behavior in the recap. Add `👀` before investigation or
+An upvote endorses an otherwise out-of-scope **feature request** and skips only
+the clear-bug bar; it does not change ownership, reaction, verification, or
+question-budget rules. Subjective UX proposals remain review-only as above.
+Build the smallest eligible endorsed version, name Sid or Alice, and state
+requested versus actual behavior in the recap. Add `👀` before investigation or
 delegation and read it back. Keep it evidence-limited until Phase 2's four bars
 hold; then use **Shipped**, adding `✅` only if it meets **Fixed**.