@agent-native/core 0.209.0-nightly-20261014153330 → 0.209.0

package/dist/triggers/actions/manage-automation.d.ts

@@ -13,8 +13,6 @@ declare const _default: import("../../action.js").ActionDefinition<{
     executionEngine?: string;
     executionCwd?: string;
 }, {
-    deleted?: undefined;
-    enabled?: undefined;
     created: boolean;
     name: string;
     scope: "organization" | "personal";
@@ -25,31 +23,33 @@ declare const _default: import("../../action.js").ActionDefinition<{
     reasoningEffort: "auto" | "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh";
     webhookPath: string;
     nextRun: string;
+    deleted?: undefined;
+    enabled?: undefined;
     executionHostId?: undefined;
     executionEngine?: undefined;
     executionCwd?: undefined;
 } | {
-    enabled?: undefined;
-    nextRun?: undefined;
     created?: undefined;
     scope?: undefined;
     triggerType?: undefined;
     event?: undefined;
     deleted: boolean;
     name: string;
+    enabled?: undefined;
     schedule?: undefined;
     timezone?: undefined;
     reasoningEffort?: undefined;
     executionHostId?: undefined;
     executionEngine?: undefined;
     executionCwd?: undefined;
+    nextRun?: undefined;
     webhookPath?: undefined;
 } | {
-    deleted?: undefined;
     created?: undefined;
     scope?: undefined;
     triggerType?: undefined;
     event?: undefined;
+    deleted?: undefined;
     name: string;
     enabled: boolean;
     schedule: string;

package/docs/content/agent-surfaces.mdx

@@ -202,6 +202,67 @@ framework guidance and spawned sub-agents inherit the same surface. Trusted
 shell tools are automatically reduced to the request-filtered sandbox because
 an unrestricted shell cannot enforce a hard action boundary.
 
+### Request-scoped additional actions
+
+Use `resolveAdditionalActions` when the actions a caller can use are only known
+at request time, such as tools a user registers while the server runs. The
+callback runs once per authenticated interactive chat run (production and dev),
+before `tool-search` and `resolveActionSurface`, so both see the returned
+entries. They join that caller's registry for that run only. A2A tasks and MCP
+`ask_app` calls receive them only when you list those surfaces in
+`additionalActionSurfaces`; `surface` tells the callback which one is asking.
+
+```ts
+createAgentChatPlugin({
+  actions,
+  additionalActionSurfaces: ["a2a"],
+  resolveAdditionalActions: async ({ surface, ownerEmail, orgId }) =>
+    loadUserTools(ownerEmail, orgId, {
+      includeEditorTools: surface === "chat",
+    }),
+});
+```
+
+Treat returned entries as untrusted input. The framework ignores an entry, and
+logs a warning once, when its name is not 1–64 letters, digits, `_`, or `-`;
+when the name belongs to any template, framework, dev, or MCP action, including
+actions hidden from the agent; when it is an `mcp__` name the caller cannot
+see; or when its tool definition is unusable. Descriptions lose hidden control
+characters and are capped. `parameters` must be a bounded schema of plain JSON
+data with an `object` root, using only common validation and annotation
+keywords. Unknown keywords, `pattern`, `patternProperties`, `uniqueItems`,
+`$async`, `$id`, anchors, and any `$ref` that is recursive or points outside
+the schema are refused. The model sees the checked copy of the schema, and a
+call whose arguments are too large to validate against it is refused. Flags such as
+`readOnly` and `access` are your app's own declarations, which the framework
+trusts as it trusts `run`: set them from what your code does, never from
+metadata a user registered.
+
+Each entry is bound to the caller it was resolved for. Every call, whichever
+dispatcher makes it, refuses to run for a different user or organization,
+enforces the entry's `access` policy, and validates the arguments against its
+schema without type coercion.
+
+Names are pinned only when a hosted chat turn continues as a durable background
+run. The callback runs again, and the turn keeps its original names for these
+entries and the caller's MCP tools alike: new entries stay out, a name that
+disappeared returns an error when called, and a name that remains runs its
+current definition. Every other request resolves fresh, including each
+continuation on a local sidecar, and a dropped stream that reattaches to its run
+resolves nothing.
+
+Put the binding's identity in the name, such as a window id or scope
+(`notes_window_42_insert`), so a rebind reads as one tool leaving and another
+appearing. "Always allow" approvals follow the tool name, so they carry over
+when the same name later means something new.
+
+These entries are native tools for the agent loop only. Like the caller's MCP
+tools, they aren't reachable from `run-code` or `tool-orchestration`.
+
+`event` is set for `chat` and `a2a`; `ask_app` calls have none. The callback
+is not called for anonymous requests, scheduled jobs, automations, or agent-team
+sub-agents. An error the callback throws fails the request.
+
 ## Native inline UI {#native-inline-ui}
 
 Use this when your actions return structured data — a list of records, a chart dataset, a status summary — that should render as a real UI component inside the chat thread rather than a plain text description. You define a `chatUI` renderer on the action, and Agent-Native renders it as a first-party React component: no iframes, no separate rendering path.

package/docs/content/observability.mdx

@@ -435,6 +435,8 @@ Core also records metrics once the host registers a meter provider with `registe
 
 On metrics, `gen_ai.tool.name` is a framework action's name or `other`, and `gen_ai.request.model` is the model id only when the engine lists it as supported, otherwise `_OTHER`. App-defined tools and caller-supplied model ids therefore cannot create unbounded series; spans keep the exact values.
 
+A failed model call's `error.type` on `gen_ai.client.operation.duration` is the provider's HTTP status when the call returned a 4xx or 5xx (`http_429`, `http_529`), otherwise `rate_limit`, `context_overflow`, `provider_error`, or `no_model_connected` when the engine's error code names one, otherwise `_OTHER`. Each retry is its own call with its own `error.type`, so a run that retries a throttled request several times records several `http_429` calls even if it finishes.
+
 `http.route` is set on every request and comes from a closed set: a framework endpoint's route template (`/_agent-native/auth/session`, `/_agent-native/agent-chat/runs/:runId/events`), an action's declared template, the app's own Nitro file route (`/api/clips/:id`), or a bucket. The buckets are `/_agent-native/*`, `/mcp/*`, and `/.well-known/*` for an unlisted path in those namespaces, `/api/*` for any other API path, `static` for file requests, `page` for any other `GET` or `HEAD`, and `other`. A raw request path is never recorded. The `http.server` span carries the same value.
 
 ## Connecting an OpenTelemetry back end {#otel-provider}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.209.0-nightly-20261014153330",
+  "version": "0.209.0",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -660,6 +660,7 @@
   "dependencies": {
     "@anthropic-ai/sdk": "^0.90.0",
     "@babel/parser": "8.0.7",
+    "@better-auth/core": "1.7.6",
     "@clack/prompts": "^1.7.0",
     "@mcp-b/webmcp-polyfill": "^5.1.0",
     "@modelcontextprotocol/client": "2.0.0",
@@ -703,8 +704,8 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/agentkit": "^0.209.0-nightly-20261014153330",
-    "@agent-native/recap-cli": "^0.5.71"
+    "@agent-native/agentkit": "^0.209.0",
+    "@agent-native/recap-cli": "^0.5.72"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",
@@ -774,7 +775,7 @@
     "xlsx": "^0.18.5"
   },
   "peerDependencies": {
-    "@agent-native/core-corpus": "0.209.0-nightly-20261014153330",
+    "@agent-native/core-corpus": ">=0.196.0",
     "@ai-sdk/anthropic": ">=3",
     "@ai-sdk/cohere": ">=3",
     "@ai-sdk/google": ">=3",

package/src/templates/workspace-core/.agents/skills/turn-into-app/references/attachments.md

@@ -12,7 +12,6 @@ Images and PDFs use an upload attachment with a matching base64 data URL:
   contentType: "image/webp" | "image/png" | "image/jpeg" | "image/gif" | "application/pdf",
   name: string,
   dataUrl: "data:<contentType>;base64,<BASE64_CONTENT>",
-  size: number,
   id: string
 }
 ```
@@ -26,12 +25,11 @@ Text and JSON files provide decoded contents instead of a data URL:
   name: string,
   dataUrl: "",
   text: string,
-  size: number,
   id: string
 }
 ```
 
-Set `size` to the UTF-8 byte length of `text`. Use a stable or unique `id` for each attachment.
+Send any other text-based file (Markdown, CSV, source code, plain text) as `text/plain` with its real file name, for example `notes.md`. Use a stable or unique `id` for each attachment. A malformed attachment is rejected with `invalid_attachment` and a message naming the problem; fix that attachment and retry, because an unchanged retry fails the same way.
 
 ## Public URLs
 

package/src/templates/workspace-core/.agents/skills/turn-into-app/references/fresh-project.md

@@ -21,14 +21,19 @@ On a browser host the host is an orchestrator, not the build environment:
    (archetype, direction, first viewport, sample-data plan, agent moments).
 2. Call `start-workspace-app-creation` on the Agent-Native Dispatch MCP
    connector (`agent-native-dispatch`). Put the brief and the design decisions
-   in `prompt`; pass an `appId`, a short `description`, the `template`, the
-   selected `resourceIds`, and source files as `attachments`
-   ([attachments.md](attachments.md)). The tool's schema describes each
-   argument. Reference resources by id; never paste whole knowledge files or
-   binary data into `prompt`, and do not assume an attachment becomes a file in
-   the generated workspace. A workbook cannot be attached (attachments take
-   images, PDF, text, and JSON): pass a bounded CSV rendering as text, or a
-   public URL, and say what was left out.
+   in `prompt`; pass an `appId`, a short `description`, and the `template`.
+   The tool's schema describes each argument. Send the Project's own text as
+   `attachments` ([attachments.md](attachments.md)), never as a summary: the
+   Project instructions as `project-instructions.md` and every knowledge file,
+   each verbatim as `text/plain`. Never paste whole knowledge files or binary
+   data into `prompt`. Attachments are model context
+   and are not copied into the generated workspace, so tell the Builder agent in
+   `prompt` to persist what the app needs: knowledge files as app resources, the
+   instructions as the in-app agent's instructions. If a file cannot be
+   reproduced verbatim (not in context, too large), say so in the brief and the
+   report; never swap in a digest silently. A workbook cannot be attached
+   (attachments take images, PDF, text, and JSON): pass a bounded CSV rendering
+   as text, or a public URL, and say what was left out.
 3. Report what Dispatch actually returned: the branch, the path, and the status.
    The browser host cannot run or inspect the app, and a returned path can 404
    until the branch merges and deploys, so the report ends at pending or

package/src/templates/workspace-core/.agents/skills/turn-into-app/references/source-brief.md

@@ -20,7 +20,7 @@ heading; write `n/a` where a heading does not apply.
 Source and provenance: type (thread, skill, Project, spreadsheet, export), file names, ids, what was read and what was not
 Project goal: the user and the repeatable job, in one sentence
 Configuration and constraints: audience, rules, output standards, approved tools
-Knowledge sources: reference files the app ships with, by name or id
+Knowledge sources: reference files the app ships with, by name
 Repeatable workflow: the job's trigger, steps, and outcome, in the source's own words
 Inputs and outputs: what comes in, what the user gets back, fixed output shapes
 Judgment and review points: 1-3 agent moments, each tied to the object it acts on; what the user confirms
@@ -38,7 +38,7 @@ App design: archetype, direction, first-viewport sketch, sample-data plan
 
 - Name the latest successful, repeatable job. A walkthrough of one example is
   evidence for the job, not the job.
-- Keep references bounded: a file name, URL, resource id, or short summary
+- Keep references bounded: a file name, URL, or short summary
   instead of a pasted document. No secrets, credentials, or customer data.
 - Corrections the user made in the source are product rules. Record each one
   as an invariant.