@agent-native/core 0.225.2-nightly-20261106152255 → 0.226.0

package/dist/server/agent-chat-plugin.js

@@ -50,6 +50,7 @@ import { RECURRING_JOBS_SWEEP_PATH } from "../jobs/scheduler-dispatch.js";
 import { RECURRING_SWEEP_BUDGET_MS } from "../jobs/sweep-hooks.js";
 import { CHATGPT_SUBSCRIPTION_LAB } from "../labs/core-labs.js";
 import { getUserLabEnabled } from "../labs/store.js";
+import { workspaceIntegrationMessagesForUser } from "../localization/workspace-integration-messages.js";
 import { mcpToolsToActionEntries, mountMcpServersRoutes, mountMcpHubRoutes, getHubStatus, isHubServeEnabled, } from "../mcp-client/index.js";
 import { normalizeMcpPrincipal, principalFromRequestContext, } from "../mcp-client/principal.js";
 import { declaredMcpToolNames, getMcpDirectoryWidgetResourceUri, } from "../mcp/build-server.js";
@@ -5149,13 +5150,64 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 // `resolveAccess` when querying ownable tables. Without this,
                 // a provider that searches `decks` (or any sharable resource)
                 // would see every row regardless of ownership.
-                const mentionsOwner = await getOwnerFromEvent(event).catch(() => undefined);
+                const mentionsOwner = await getOwnerFromEvent(event).catch((error) => {
+                    if (error &&
+                        typeof error === "object" &&
+                        (("statusCode" in error && error.statusCode === 401) ||
+                            ("status" in error && error.status === 401)))
+                        return undefined;
+                    throw error;
+                });
+                const referenceMessages = await workspaceIntegrationMessagesForUser(mentionsOwner ?? "");
                 const mentionsOrgId = await resolveResourceOrgId(event, options?.resolveOrgId);
+                const mentionContext = {
+                    ...(mentionsOwner ? { userEmail: mentionsOwner } : {}),
+                    ...(mentionsOrgId ? { orgId: mentionsOrgId } : {}),
+                    ...((mentionsOrgId === null ||
+                        (mentionsOrgId === undefined &&
+                            getRequestContext()?.orgScope === "personal")) && {
+                        orgScope: "personal",
+                    }),
+                };
                 const query = getQuery(event);
                 const q = typeof query.q === "string" ? query.q.toLowerCase() : "";
                 const matchesQuery = (item) => !q ||
                     item.label.toLowerCase().includes(q) ||
                     (item.description?.toLowerCase().includes(q) ?? false);
+                if (query.source !== undefined) {
+                    const source = typeof query.source === "string" ? query.source : "";
+                    const mentionErrorResponse = (status, code, message) => new Response(JSON.stringify({ error: { code, message, source } }), {
+                        status,
+                        headers: {
+                            "Content-Type": "application/json",
+                            "Cache-Control": "no-cache",
+                        },
+                    });
+                    const provider = Object.prototype.hasOwnProperty.call(mentionProviders, source)
+                        ? mentionProviders[source]
+                        : undefined;
+                    if (!provider)
+                        return mentionErrorResponse(404, "mention_source_not_found", referenceMessages.referenceUnknown);
+                    if (!mentionsOwner)
+                        return mentionErrorResponse(401, "unauthorized", referenceMessages.referenceSignIn);
+                    let items;
+                    try {
+                        items = await runWithRequestContext(mentionContext, () => provider.search(q, event));
+                    }
+                    catch {
+                        return mentionErrorResponse(503, "mention_source_unavailable", referenceMessages.referenceUnavailable);
+                    }
+                    setResponseHeader(event, "Content-Type", "application/x-ndjson");
+                    setResponseHeader(event, "Cache-Control", "no-cache");
+                    return (JSON.stringify({
+                        items: items.slice(0, 50).map((item) => ({
+                            ...item,
+                            source,
+                            section: provider.label,
+                            icon: item.icon || provider.icon || "file",
+                        })),
+                    }) + "\n");
+                }
                 const enc = new TextEncoder();
                 // Stream NDJSON — each source flushes its batch as soon as it's ready.
                 setResponseHeader(event, "Content-Type", "application/x-ndjson");
@@ -5166,15 +5218,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 const mentionsAbort = new AbortController();
                 const stream = new ReadableStream({
                     start(controller) {
-                        const inheritedPersonalScope = mentionsOrgId === undefined &&
-                            getRequestContext()?.orgScope === "personal";
-                        return runWithRequestContext({
-                            userEmail: mentionsOwner,
-                            orgId: mentionsOrgId ?? undefined,
-                            ...((mentionsOrgId === null || inheritedPersonalScope) && {
-                                orgScope: "personal",
-                            }),
-                        }, () => mentionsStreamWork(controller));
+                        return runWithRequestContext(mentionContext, () => mentionsStreamWork(controller));
                     },
                     cancel() {
                         // Client disconnected — stop enqueuing and let in-flight source
@@ -5210,6 +5254,22 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             }
                         }
                     };
+                    const reportSourceFailure = (source) => {
+                        if (cancelled || mentionsAbort.signal.aborted)
+                            return;
+                        try {
+                            controller.enqueue(enc.encode(JSON.stringify({
+                                error: {
+                                    code: "mention_source_unavailable",
+                                    message: referenceMessages.referenceUnavailable,
+                                    source,
+                                },
+                            }) + "\n"));
+                        }
+                        catch {
+                            cancelled = true;
+                        }
+                    };
                     // All sources run in parallel; each flushes independently.
                     const sources = [];
                     // 1. Resources from SQL (fast — flush first)
@@ -5242,7 +5302,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 };
                             }));
                         }
-                        catch { }
+                        catch {
+                            reportSourceFailure("resources");
+                        }
                     })());
                     // 2. Codebase files (dev mode only — can be slow on large repos)
                     if (currentDevMode) {
@@ -5251,7 +5313,10 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             try {
                                 await collectFiles(process.cwd(), "", 0, codebaseFiles);
                             }
-                            catch { }
+                            catch {
+                                reportSourceFailure("codebase");
+                                return;
+                            }
                             flush(codebaseFiles.map((f) => ({
                                 id: `codebase:${f.path}`,
                                 label: f.name,
@@ -5291,32 +5356,35 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 })));
                             }
                             catch (e) {
+                                reportSourceFailure(key);
                                 console.error(`[agent-native] Mention provider "${key}" failed:`, e);
                             }
                         })());
                     }
                     // 4. Custom workspace agents
-                    sources.push((async () => {
-                        try {
-                            const owner = await getOwnerFromEvent(event);
-                            const { listAccessibleCustomAgents } = await import("../resources/agents.js");
-                            const agents = await listAccessibleCustomAgents(owner);
-                            flush(agents.map((agent) => ({
-                                id: `custom-agent:${agent.id}`,
-                                label: agent.name,
-                                description: agent.description || agent.path,
-                                icon: "agent",
-                                source: "agent:custom",
-                                refType: "custom-agent",
-                                refPath: agent.path,
-                                refId: agent.id,
-                                section: "Agents",
-                            })));
-                        }
-                        catch (e) {
-                            console.error("[agent-native] Custom agent discovery failed:", e);
-                        }
-                    })());
+                    if (mentionsOwner)
+                        sources.push((async () => {
+                            try {
+                                const owner = await getOwnerFromEvent(event);
+                                const { listAccessibleCustomAgents } = await import("../resources/agents.js");
+                                const agents = await listAccessibleCustomAgents(owner);
+                                flush(agents.map((agent) => ({
+                                    id: `custom-agent:${agent.id}`,
+                                    label: agent.name,
+                                    description: agent.description || agent.path,
+                                    icon: "agent",
+                                    source: "agent:custom",
+                                    refType: "custom-agent",
+                                    refPath: agent.path,
+                                    refId: agent.id,
+                                    section: "Agents",
+                                })));
+                            }
+                            catch (e) {
+                                reportSourceFailure("custom-agents");
+                                console.error("[agent-native] Custom agent discovery failed:", e);
+                            }
+                        })());
                     // 5. Peer agent discovery (network call — often slowest)
                     sources.push((async () => {
                         try {
@@ -5334,6 +5402,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             })));
                         }
                         catch (e) {
+                            reportSourceFailure("connected-agents");
                             console.error("[agent-native] Agent discovery failed:", e);
                         }
                     })());

package/dist/server/agent-engine-api-key-route.d.ts

@@ -54,21 +54,21 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
     error: string;
 }>;
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
-    errorCode?: undefined;
     code?: undefined;
+    errorCode?: undefined;
+    error: string;
 } | {
+    code?: undefined;
     error: string;
     errorCode: string;
-    code?: undefined;
 } | {
     errorCode?: undefined;
     error: string;
     code: ProviderKeyCheckCode;
 } | {
     error?: undefined;
-    errorCode?: undefined;
     code?: undefined;
+    errorCode?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string | undefined;

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -1,6 +1,6 @@
 export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
     models?: undefined;
 } | {
     error?: undefined;

package/dist/server/auth.js

@@ -12,6 +12,7 @@ import { FIRST_RUN_ONBOARDING_COOKIE, FIRST_RUN_ONBOARDING_MAX_AGE, } from "../s
 import { FIRST_TOUCH_SERVER_PATH } from "../shared/first-touch-persistence.js";
 import { isGoogleProfileImageUrl } from "../shared/google-profile-image.js";
 import { corsAllowHeadersFor, EMBED_TRANSPLANT_HEADER, isExplicitCorsAllowedOrigin, isMcpEmbedCorsOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, shouldAllowMcpEmbedCredentials, } from "../shared/mcp-embed-headers.js";
+import { bindBuilderSignupAttempt, BUILDER_SIGNUP_COOKIE, } from "./builder-signup-experiment.js";
 import { createConsentHandler, createConsentRegionHandler, requestAllowsConsentCategory, } from "./consent-route.js";
 import { readDevActionDiscoveryFile } from "./dev-action-discovery.js";
 import { devLoopbackAuthHint } from "./dev-origin-hint.js";
@@ -153,6 +154,16 @@ function requestWithSignupAttribution(request, signupAttribution) {
 function headersWithSignupAttribution(headers, cookieHeader) {
     return addSignupAttributionHeader(headers, signupAttributionContextFromCookieHeader(cookieHeader));
 }
+async function recordBuilderSignupBinding(event, attemptId, method, email) {
+    if (typeof attemptId !== "string" && !getCookie(event, BUILDER_SIGNUP_COOKIE))
+        return;
+    try {
+        await bindBuilderSignupAttempt(event, attemptId, method, email);
+    }
+    catch (error) {
+        captureAuthError(error, { route: "signup", email });
+    }
+}
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -4223,6 +4234,10 @@ async function mountBetterAuthRoutes(app, options) {
                 flowId: flowId ?? undefined,
                 desktopVerifierHash,
                 desktopBrowserBindingHash,
+                builderSignupAttemptId: typeof q.builder_signup_attempt === "string" &&
+                    q.builder_signup_attempt.length <= 128
+                    ? q.builder_signup_attempt
+                    : undefined,
                 signupAttribution,
                 signupAnonymousId,
                 signupSessionId,
@@ -4304,7 +4319,7 @@ async function mountBetterAuthRoutes(app, options) {
                     });
                     return oauthErrorPage(AUTH_GOOGLE_START_FALLBACK);
                 }
-                const { redirectUri, desktop, mobile, returnUrl, flowId, desktopVerifierHash, desktopBrowserBindingHash, signupAttribution, signupAnonymousId, signupSessionId, mcpSignupAttribution, } = state;
+                const { redirectUri, desktop, mobile, returnUrl, flowId, desktopVerifierHash, desktopBrowserBindingHash, builderSignupAttemptId, signupAttribution, signupAnonymousId, signupSessionId, mcpSignupAttribution, } = state;
                 callbackFlowId = flowId;
                 callbackDesktop = desktop ?? false;
                 callbackMobile = mobile ?? false;
@@ -4435,6 +4450,8 @@ async function mountBetterAuthRoutes(app, options) {
                         isNewUser: isNewGoogleUser,
                     },
                 });
+                if (isNewGoogleUser)
+                    await recordBuilderSignupBinding(event, builderSignupAttemptId, "google", email);
                 logGoogleOAuthDebug(event, "callback-session-created", {
                     flowId,
                     desktop,
@@ -5412,6 +5429,9 @@ async function mountBetterAuthRoutes(app, options) {
         const rawReturn = Array.isArray(query.return)
             ? query.return[0]
             : query.return;
+        const signupSession = await getSession(event);
+        if (signupSession?.emailVerified)
+            await recordBuilderSignupBinding(event, query.builder_signup_attempt, "magic-link", signupSession.email);
         setFirstRunOnboardingCookie(event);
         return queryEchoSafeRedirect(event, redirectWithStagedCookies(event, safeReturnPath(rawReturn), 302));
     }));
@@ -5501,6 +5521,8 @@ async function mountBetterAuthRoutes(app, options) {
                 }, getAuthSecret())
                 : undefined;
             const newUserCallbackUrl = new URL(`${getAppBasePath()}${publicFrameworkPath("/_agent-native/auth/magic-link/new-user")}?return=${encodeURIComponent(callbackPath)}`, getOrigin(event));
+            if (typeof body?.builderSignupAttemptId === "string")
+                newUserCallbackUrl.searchParams.set("builder_signup_attempt", body.builderSignupAttemptId);
             if (attributionToken) {
                 newUserCallbackUrl.searchParams.set(MAGIC_LINK_ATTRIBUTION_PARAM, attributionToken);
             }
@@ -5577,6 +5599,7 @@ async function mountBetterAuthRoutes(app, options) {
                 },
                 headers: headersWithSignupAttribution(event.headers, getHeader(event, "cookie") ?? null),
             }));
+            await recordBuilderSignupBinding(event, body?.builderSignupAttemptId, "password", email);
             setFirstRunOnboardingCookie(event);
             return { ok: true };
         }
@@ -5785,6 +5808,7 @@ function mountAuthFallbackRoutes(app) {
                 body: { email, password, name: email.split("@")[0] },
                 headers: headersWithSignupAttribution(event.headers, getHeader(event, "cookie") ?? null),
             }));
+            await recordBuilderSignupBinding(event, body?.builderSignupAttemptId, "password", email);
             setFirstRunOnboardingCookie(event);
             return { ok: true };
         }

package/dist/server/better-auth-instance.d.ts

@@ -212,6 +212,7 @@ export interface BetterAuthInternalAdapter {
             image?: string | null;
             emailVerified?: boolean;
             onboardingRole?: string | null;
+            createdAt?: Date | string;
         };
         accounts: Array<{
             id: string;

package/dist/server/builder-browser.d.ts

@@ -323,6 +323,8 @@ export interface BuilderProjectResult {
 }
 export declare function isBuilderAccountProvisioningEnabled(): boolean;
 export declare function provisionBuilderAccount(input: {
+    /** Version 3 is rejected by older servers rather than connecting an existing account. */
+    newAccountOnly?: boolean;
     email: string;
     name?: string;
     agentNativeApp?: string;

package/dist/server/builder-browser.js

@@ -1880,9 +1880,11 @@ export async function provisionBuilderAccount(input) {
     const name = input.name?.trim().slice(0, 120) || email.slice(0, email.indexOf("@"));
     const agentNativeApp = cleanTrackingParam(input.agentNativeApp);
     const agentNativeTemplate = cleanTrackingParam(input.agentNativeTemplate);
-    const version = agentNativeApp || agentNativeTemplate
-        ? "agent-native-account-v2"
-        : "agent-native-account-v1";
+    const version = input.newAccountOnly
+        ? "agent-native-account-v3"
+        : agentNativeApp || agentNativeTemplate
+            ? "agent-native-account-v2"
+            : "agent-native-account-v1";
     const timestamp = String(Date.now());
     const requestId = randomBytes(32).toString("base64url");
     const signaturePayload = [
@@ -1891,9 +1893,10 @@ export async function provisionBuilderAccount(input) {
         requestId,
         email,
         name,
-        ...(version === "agent-native-account-v2"
+        ...(version !== "agent-native-account-v1"
             ? [agentNativeApp ?? "", agentNativeTemplate ?? ""]
             : []),
+        ...(input.newAccountOnly ? ["new-account-only"] : []),
     ].join("\n");
     const signature = createHmac("sha256", builderAccountProvisioningSecret())
         .update(signaturePayload)
@@ -1910,6 +1913,7 @@ export async function provisionBuilderAccount(input) {
         body: JSON.stringify({
             email,
             name,
+            ...(input.newAccountOnly ? { newAccountOnly: true } : {}),
             ...(agentNativeApp ? { agentNativeApp } : {}),
             ...(agentNativeTemplate ? { agentNativeTemplate } : {}),
         }),

package/dist/server/builder-signup-experiment.d.ts

@@ -0,0 +1,67 @@
+import { type H3Event } from "h3";
+import { z } from "zod";
+import type { AuthSession } from "./auth.js";
+export declare const BUILDER_SIGNUP_EXPERIMENT = "design_builder_signup_v1";
+export declare const BUILDER_SIGNUP_POLICY = "builder-signup-2026-11-06";
+export declare const BUILDER_SIGNUP_COOKIE = "an_builder_signup";
+declare const assignmentSchema: z.ZodObject<{
+    id: z.ZodString;
+    variant: z.ZodEnum<{
+        automatic: "automatic";
+        control: "control";
+    }>;
+    issuedAt: z.ZodNumber;
+    acceptedAt: z.ZodOptional<z.ZodNumber>;
+    attemptId: z.ZodOptional<z.ZodString>;
+    method: z.ZodOptional<z.ZodEnum<{
+        google: "google";
+        "magic-link": "magic-link";
+        password: "password";
+    }>>;
+    email: z.ZodOptional<z.ZodString>;
+    policy: z.ZodLiteral<"builder-signup-2026-11-06">;
+}, z.core.$strip>;
+type Assignment = z.infer<typeof assignmentSchema>;
+export declare function encodeBuilderSignupAssignment(assignment: Assignment): string;
+export declare function decodeBuilderSignupAssignment(value: string | undefined): Assignment | null;
+export declare function isBuilderSignupExperimentEnabled(): boolean;
+export declare function bindBuilderSignupAttempt(event: H3Event, attemptId: unknown, method: "password" | "magic-link" | "google", email: string): Promise<boolean>;
+export declare function getBuilderSignupConnectError(userId: string | undefined): Promise<{
+    code: "account_exists";
+    message: string;
+    at: number;
+} | undefined>;
+export declare function createBuilderSignupExperimentHandler(dependencies: {
+    getSession: (event: H3Event) => Promise<AuthSession | null>;
+    sameOrigin: (event: H3Event) => boolean;
+    activate: (event: H3Event, session: AuthSession) => Promise<{
+        ok: boolean;
+        code?: string;
+        message?: string;
+    }>;
+}): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    status: "unavailable";
+    code: string;
+} | {
+    status: "disabled";
+} | {
+    id: string;
+    variant: "automatic" | "control";
+    issuedAt: number;
+    acceptedAt?: number | undefined;
+    attemptId?: string | undefined;
+    method?: "google" | "magic-link" | "password" | undefined;
+    email?: string | undefined;
+    policy: "builder-signup-2026-11-06";
+    status: "assigned";
+} | {
+    status: "not_required";
+} | {
+    status: "accepted";
+} | {
+    status: "connected" | "fallback";
+    code?: string | undefined;
+} | {
+    status: "pending";
+}>>;
+export {};