@agent-native/core 0.227.0 → 0.228.0-nightly-20261111004142

package/dist/agent/tool-call-journal.js

@@ -3,6 +3,7 @@ import { isArtifactReceipt, } from "../artifacts/detect.js";
 import { stripInlineBytes } from "../shared/inline-bytes.js";
 import { toolCallInputSignature as inputSignature } from "./tool-call-input-signature.js";
 import { isUnknownWriteCause } from "./types.js";
+import { readWriteReceipt } from "./write-receipts.js";
 export function toolCallIdentityKey(id, executionStepId) {
     if (executionStepId !== undefined)
         return JSON.stringify(["step", executionStepId]);
@@ -241,6 +242,9 @@ function replayOutcomeIdentity(entry) {
             entry.result,
             entry.isError,
             entry.errorCode,
+            entry.receipt,
+            entry.actionSettled,
+            entry.settledOnCleanToolStop,
             entry.committed,
             entry.outcomeUnknown,
             entry.artifacts,
@@ -339,6 +343,14 @@ export function classifyToolCallJournal(events) {
                     entry.isError = true;
                 if (event.errorCode)
                     entry.errorCode = event.errorCode;
+                const receipt = readWriteReceipt({ _receipt: event.receipt });
+                if (receipt)
+                    entry.receipt = receipt;
+                if (event.actionSettled === true && event.isError !== true) {
+                    entry.actionSettled = true;
+                    if (event.settledOnCleanToolStop === true)
+                        entry.settledOnCleanToolStop = true;
+                }
                 if (event.completedSideEffect === true)
                     entry.committed = true;
                 if (event.argumentsHash)

package/dist/agent/types.d.ts

@@ -317,6 +317,12 @@ type AgentChatEventPayload = {
     notExecuted?: true;
     /** Compact action write evidence retained even when `result` is truncated. */
     receipt?: WriteReceipt;
+    /** A successful invocation explicitly settled its work. */
+    actionSettled?: true;
+    /** The model completed the tool-call round before the action ran. */
+    settledOnCleanToolStop?: true;
+    /** The action emitted warnings the model must reconcile. */
+    hasAgentWarnings?: true;
     /**
      * Exact identity of the arguments the call ran with, defaults applied. A
      * continued turn replays a committed call only for the same identity.
@@ -405,7 +411,7 @@ type AgentChatEventPayload = {
     summary: string;
 } | {
     type: "done";
-    reason?: "user" | "loop_breaker";
+    reason?: "user" | "loop_breaker" | "action_settled";
     message?: string;
 } | {
     type: "error";

package/dist/app-config/agent.d.ts

@@ -1,5 +1,8 @@
 import { z } from "zod";
 export declare const agentConfig: z.ZodObject<{
+    promptSkills: z.ZodPrefault<z.ZodObject<{
+        includeSupportingFiles: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
     engine: z.ZodOptional<z.ZodString>;
     model: z.ZodOptional<z.ZodString>;
     questionIntake: z.ZodOptional<z.ZodObject<{

package/dist/app-config/agent.js

@@ -1,5 +1,12 @@
 import { z } from "zod";
 export const agentConfig = z.object({
+    promptSkills: z
+        .object({
+        includeSupportingFiles: z.boolean().default(true).meta({
+            doc: "Include supporting files, such as references and scripts, when presenting skills to the agent.",
+        }),
+    })
+        .prefault({}),
     engine: z
         .string()
         .min(1)

package/dist/app-config/schema.d.ts

@@ -86,6 +86,9 @@ export declare const appConfigSchema: z.ZodObject<{
         }, z.core.$strip>>;
     }, z.core.$strip>>;
     agent: z.ZodPrefault<z.ZodObject<{
+        promptSkills: z.ZodPrefault<z.ZodObject<{
+            includeSupportingFiles: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>>;
         engine: z.ZodOptional<z.ZodString>;
         model: z.ZodOptional<z.ZodString>;
         questionIntake: z.ZodOptional<z.ZodObject<{

package/dist/application-state/handlers.d.ts

@@ -36,18 +36,18 @@ export declare const listComposeDrafts: import("h3").EventHandlerWithFetch<impor
 export declare const getComposeDraft: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<Record<string, unknown> | null>>;
 export declare const putComposeDraft: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<any>>;
 export declare const saveComposeDraft: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    errorCode?: undefined;
-    error: string;
     value?: undefined;
+    error: string;
     revision?: undefined;
+    errorCode?: undefined;
     details?: undefined;
 } | {
-    errorCode?: undefined;
     error?: undefined;
     value: {
         id: string;
     };
     revision: string;
+    errorCode?: undefined;
     details?: undefined;
 } | {
     value?: undefined;

package/dist/application-state/handlers.js

@@ -2,7 +2,8 @@ import { createError, defineEventHandler, getRouterParam, getHeader, getQuery, s
 import { isSaveConflict, saveRevisionOf } from "../save-conflict/index.js";
 import { readBrowserTabIdHeader } from "../server/agent-run-context.js";
 import { readBody } from "../server/h3-helpers.js";
-import { APP_STATE_BATCH_ROUTE_HEADER, APP_STATE_SEQ_HEADER, APP_STATE_WRITER_HEADER, TAB_SCOPED_APP_STATE_KEYS, } from "../shared/app-state-routes.js";
+import { APP_STATE_BATCH_ROUTE_HEADER, APP_STATE_SEQ_HEADER, APP_STATE_WRITER_HEADER, BROWSER_TAB_USED_APP_STATE_KEY, TAB_SCOPED_APP_STATE_KEYS, } from "../shared/app-state-routes.js";
+import { browserTabUsedKey } from "./last-used-tab.js";
 import { appStateSaveIfCurrent } from "./save-if-current.js";
 import { appStateKeyForBrowserTab } from "./script-helpers.js";
 import { appStateGet, appStateGetManyEntries, appStatePut, appStateCompareAndSet, appStateDelete, appStateList, appStateDeleteByPrefix, } from "./store.js";
@@ -54,6 +55,10 @@ function headerSeq(event) {
     return seq !== undefined && /^[0-9]{1,16}$/.test(seq) ? Number(seq) : seq;
 }
 function requestScopedKey(key, event) {
+    if (key === BROWSER_TAB_USED_APP_STATE_KEY) {
+        const browserTabId = readBrowserTabIdHeader(event);
+        return browserTabId ? browserTabUsedKey(browserTabId) : key;
+    }
     return TAB_SCOPED_APP_STATE_KEYS.has(key)
         ? appStateKeyForBrowserTab(key, readBrowserTabIdHeader(event))
         : key;

package/dist/application-state/index.d.ts

@@ -1,4 +1,5 @@
-export { appStateGet, appStateGetMany, appStateGetManyEntries, appStatePut, appStateDelete, appStateCompareAndSet, appStateCompareAndSetMany, appStateList, appStateDeleteByPrefix, type AppStateCompareAndSetOperation, } from "./store.js";
+export { appStateGet, appStateGetMany, appStateGetManyEntries, appStatePut, appStateDelete, appStateCompareAndSet, appStateCompareAndSetMany, appStateList, appStateListUpdatedAt, appStateDeleteByPrefix, type AppStateCompareAndSetOperation, } from "./store.js";
+export { browserTabUsedKey, findLastUsedBrowserTab, LAST_USED_BROWSER_TAB_MAX_AGE_MS, } from "./last-used-tab.js";
 export { getAppStateEmitter, emitAppStateChange, emitAppStateDelete, type AppStateEvent, } from "./emitter.js";
 export { getState, getStateMany, MAX_APP_STATE_BATCH_KEYS, MAX_APP_STATE_BATCH_WRITES, putState, putStateMany, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, } from "./handlers.js";
-export { readAppState, writeAppState, deleteAppState, compareAndSetAppState, compareAndSetManyAppState, listAppState, deleteAppStateByPrefix, readAppStateForCurrentTab, writeAppStateForCurrentTab, appStateKeyForBrowserTab, getCurrentRequestBrowserTabId, } from "./script-helpers.js";
+export { readAppState, writeAppState, deleteAppState, compareAndSetAppState, compareAndSetManyAppState, listAppState, deleteAppStateByPrefix, readAppStateForCurrentTab, writeAppStateForCurrentTab, appStateKeyForBrowserTab, getCurrentRequestBrowserTabId, resolveCurrentRequestStateTab, } from "./script-helpers.js";

package/dist/application-state/index.js

@@ -1,4 +1,5 @@
-export { appStateGet, appStateGetMany, appStateGetManyEntries, appStatePut, appStateDelete, appStateCompareAndSet, appStateCompareAndSetMany, appStateList, appStateDeleteByPrefix, } from "./store.js";
+export { appStateGet, appStateGetMany, appStateGetManyEntries, appStatePut, appStateDelete, appStateCompareAndSet, appStateCompareAndSetMany, appStateList, appStateListUpdatedAt, appStateDeleteByPrefix, } from "./store.js";
+export { browserTabUsedKey, findLastUsedBrowserTab, LAST_USED_BROWSER_TAB_MAX_AGE_MS, } from "./last-used-tab.js";
 export { getAppStateEmitter, emitAppStateChange, emitAppStateDelete, } from "./emitter.js";
 export { getState, getStateMany, MAX_APP_STATE_BATCH_KEYS, MAX_APP_STATE_BATCH_WRITES, putState, putStateMany, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, } from "./handlers.js";
-export { readAppState, writeAppState, deleteAppState, compareAndSetAppState, compareAndSetManyAppState, listAppState, deleteAppStateByPrefix, readAppStateForCurrentTab, writeAppStateForCurrentTab, appStateKeyForBrowserTab, getCurrentRequestBrowserTabId, } from "./script-helpers.js";
+export { readAppState, writeAppState, deleteAppState, compareAndSetAppState, compareAndSetManyAppState, listAppState, deleteAppStateByPrefix, readAppStateForCurrentTab, writeAppStateForCurrentTab, appStateKeyForBrowserTab, getCurrentRequestBrowserTabId, resolveCurrentRequestStateTab, } from "./script-helpers.js";

package/dist/application-state/last-used-tab.d.ts

@@ -0,0 +1,11 @@
+import type { BrowserTabTarget } from "../server/request-context.js";
+/** How long after its last use a tab still counts as the one to act on. */
+export declare const LAST_USED_BROWSER_TAB_MAX_AGE_MS: number;
+/** The row that records a tab's last use: one per app and tab. */
+export declare function browserTabUsedKey(browserTabId: string): string;
+/**
+ * The tab of this app the user used last, if one was used within
+ * LAST_USED_BROWSER_TAB_MAX_AGE_MS. Tabs are ordered by when the server
+ * stored their use, so browser clocks don't matter.
+ */
+export declare function findLastUsedBrowserTab(sessionId: string, now?: number): Promise<BrowserTabTarget>;

package/dist/application-state/last-used-tab.js

@@ -0,0 +1,43 @@
+import { getAppConfig } from "../app-config/index.js";
+import { BROWSER_TAB_USED_APP_STATE_KEY } from "../shared/app-state-routes.js";
+import { appStateListUpdatedAt } from "./store.js";
+/** How long after its last use a tab still counts as the one to act on. */
+export const LAST_USED_BROWSER_TAB_MAX_AGE_MS = 12 * 60 * 60 * 1000;
+const SAFE_TAB_ID_RE = /^[A-Za-z0-9_-]{1,96}$/;
+// Several apps can share one database (Design and Slides do), so each app
+// keeps its tabs' records under its own name. The browser's write and the
+// MCP lookup both run in this app's server, so they name it the same way.
+// Encoding keeps distinct names distinct and keeps ":" out of the name.
+function appScope() {
+    const app = getAppConfig().app;
+    const name = app.workspaceId ?? app.id ?? app.slug ?? app.packageName ?? app.name;
+    return name ? encodeURIComponent(name) : "app";
+}
+function browserTabUsedKeyPrefix() {
+    return `${BROWSER_TAB_USED_APP_STATE_KEY}:${appScope()}:`;
+}
+/** The row that records a tab's last use: one per app and tab. */
+export function browserTabUsedKey(browserTabId) {
+    return `${browserTabUsedKeyPrefix()}${browserTabId}`;
+}
+/**
+ * The tab of this app the user used last, if one was used within
+ * LAST_USED_BROWSER_TAB_MAX_AGE_MS. Tabs are ordered by when the server
+ * stored their use, so browser clocks don't matter.
+ */
+export async function findLastUsedBrowserTab(sessionId, now = Date.now()) {
+    const prefix = browserTabUsedKeyPrefix();
+    let best;
+    for (const { key, updatedAt } of await appStateListUpdatedAt(sessionId, prefix, now - LAST_USED_BROWSER_TAB_MAX_AGE_MS)) {
+        const tabId = key.slice(prefix.length);
+        if (!SAFE_TAB_ID_RE.test(tabId))
+            continue;
+        if (!Number.isFinite(updatedAt))
+            continue;
+        if (now - updatedAt > LAST_USED_BROWSER_TAB_MAX_AGE_MS)
+            continue;
+        if (!best || updatedAt > best.usedAt)
+            best = { tabId, usedAt: updatedAt };
+    }
+    return best ? { kind: "last-used", ...best } : { kind: "unavailable" };
+}

package/dist/application-state/script-helpers.d.ts

@@ -10,9 +10,35 @@ export declare function listAppState(prefix: string): Promise<Array<{
 }>>;
 export declare function deleteAppStateByPrefix(prefix: string): Promise<number>;
 export declare function normalizeBrowserTabId(value: unknown): string | null;
+/** The browser tab the current request came from, if any. */
 export declare function getCurrentRequestBrowserTabId(): string | null;
+/**
+ * The tab whose tab-scoped app state the current request reads and writes:
+ * the tab it came from or, for an MCP call from no tab, the tab of this app
+ * the user used last. `unavailable` when the call looked for a tab and none
+ * was used recently. Requests that have neither (scripts, jobs, the CLI) get
+ * no tab and keep the account-wide rows.
+ */
+export declare function resolveCurrentRequestStateTab(): Promise<{
+    tabId: string | null;
+    unavailable: boolean;
+}>;
 export declare function appStateKeyForBrowserTab(key: string, browserTabId: unknown): string;
+/**
+ * Reads `key` for the current request's tab (see
+ * resolveCurrentRequestStateTab), falling back to the account-wide row only
+ * when `fallbackToGlobal` is true. A request with no tab at all reads the
+ * account-wide row. An MCP call that found no recently used tab reads it
+ * only when it opted in, and never for the ambient keys: no tab keeps those
+ * rows current.
+ */
 export declare function readAppStateForCurrentTab(key: string, options?: {
     fallbackToGlobal?: boolean;
 }): Promise<Record<string, unknown> | null>;
+/**
+ * Writes `key` for the current request's tab (see
+ * resolveCurrentRequestStateTab). With no tab, it writes the account-wide
+ * row, as it always has: an MCP caller learns from the call's result that no
+ * tab was found.
+ */
 export declare function writeAppStateForCurrentTab(key: string, value: Record<string, unknown>): Promise<void>;

package/dist/application-state/script-helpers.js

@@ -19,30 +19,43 @@ async function resolveSessionId() {
     throw new Error("Application state access requires an authenticated request context or AGENT_USER_EMAIL env var");
 }
 export async function readAppState(key) {
-    return readUnscopedAppState(requestScopedAppStateKey(key));
+    const scoped = await requestScopedAppStateKey(key);
+    // No tab to read from: a call that asked for one gets nothing rather than
+    // the account-wide row, which no tab keeps current.
+    if (scoped.unavailable)
+        return null;
+    return readUnscopedAppState(scoped.key);
 }
 export async function writeAppState(key, value) {
     const sessionId = await resolveSessionId();
-    return appStatePut(sessionId, requestScopedAppStateKey(key), value, {
+    const { key: scopedKey } = await requestScopedAppStateKey(key);
+    return appStatePut(sessionId, scopedKey, value, {
         requestSource: "agent",
     });
 }
 export async function deleteAppState(key) {
     const sessionId = await resolveSessionId();
-    return appStateDelete(sessionId, requestScopedAppStateKey(key), {
+    const { key: scopedKey } = await requestScopedAppStateKey(key);
+    return appStateDelete(sessionId, scopedKey, {
         requestSource: "agent",
     });
 }
 export async function compareAndSetAppState(key, expectedValue, nextValue) {
     const sessionId = await resolveSessionId();
-    return appStateCompareAndSet(sessionId, requestScopedAppStateKey(key), expectedValue, nextValue, { requestSource: "agent" });
+    const { key: scopedKey } = await requestScopedAppStateKey(key);
+    return appStateCompareAndSet(sessionId, scopedKey, expectedValue, nextValue, {
+        requestSource: "agent",
+    });
 }
 export async function compareAndSetManyAppState(operations) {
     const sessionId = await resolveSessionId();
-    return appStateCompareAndSetMany(sessionId, operations.map((operation) => ({
+    const scopedOperations = await Promise.all(operations.map(async (operation) => ({
         ...operation,
-        key: requestScopedAppStateKey(operation.key),
-    })), { requestSource: "agent" });
+        key: (await requestScopedAppStateKey(operation.key)).key,
+    })));
+    return appStateCompareAndSetMany(sessionId, scopedOperations, {
+        requestSource: "agent",
+    });
 }
 export async function listAppState(prefix) {
     const sessionId = await resolveSessionId();
@@ -69,6 +82,7 @@ export function normalizeBrowserTabId(value) {
     const trimmed = value.trim();
     return SAFE_TAB_ID_RE.test(trimmed) ? trimmed : null;
 }
+/** The browser tab the current request came from, if any. */
 export function getCurrentRequestBrowserTabId() {
     try {
         return normalizeBrowserTabId(getRequestRunContext()?.browserTabId);
@@ -77,32 +91,86 @@ export function getCurrentRequestBrowserTabId() {
         return null;
     }
 }
+/**
+ * The tab whose tab-scoped app state the current request reads and writes:
+ * the tab it came from or, for an MCP call from no tab, the tab of this app
+ * the user used last. `unavailable` when the call looked for a tab and none
+ * was used recently. Requests that have neither (scripts, jobs, the CLI) get
+ * no tab and keep the account-wide rows.
+ */
+export async function resolveCurrentRequestStateTab() {
+    const browserTabId = getCurrentRequestBrowserTabId();
+    if (browserTabId)
+        return { tabId: browserTabId, unavailable: false };
+    let slot;
+    try {
+        slot = getRequestRunContext()?.browserTabTarget;
+    }
+    catch {
+        slot = undefined;
+    }
+    if (!slot)
+        return { tabId: null, unavailable: false };
+    const target = await slot.resolve();
+    if (target.kind === "last-used") {
+        const tabId = normalizeBrowserTabId(target.tabId);
+        if (tabId)
+            return { tabId, unavailable: false };
+    }
+    return { tabId: null, unavailable: true };
+}
 export function appStateKeyForBrowserTab(key, browserTabId) {
     const normalized = normalizeBrowserTabId(browserTabId);
     return normalized ? `${key}:${normalized}` : key;
 }
-function requestScopedAppStateKey(key) {
+async function requestScopedAppStateKey(key) {
     if (!TAB_SCOPED_AMBIENT_KEYS.has(key))
-        return key;
-    return appStateKeyForBrowserTab(key, getCurrentRequestBrowserTabId());
+        return { key, unavailable: false };
+    const tab = await resolveCurrentRequestStateTab();
+    return {
+        key: appStateKeyForBrowserTab(key, tab.tabId),
+        unavailable: tab.unavailable,
+    };
 }
 async function readUnscopedAppState(key) {
     const sessionId = await resolveSessionId();
     return appStateGet(sessionId, key);
 }
+/**
+ * Reads `key` for the current request's tab (see
+ * resolveCurrentRequestStateTab), falling back to the account-wide row only
+ * when `fallbackToGlobal` is true. A request with no tab at all reads the
+ * account-wide row. An MCP call that found no recently used tab reads it
+ * only when it opted in, and never for the ambient keys: no tab keeps those
+ * rows current.
+ */
 export async function readAppStateForCurrentTab(key, options) {
-    const browserTabId = getCurrentRequestBrowserTabId();
-    const tabKey = appStateKeyForBrowserTab(key, browserTabId);
+    const tab = await resolveCurrentRequestStateTab();
+    const tabKey = appStateKeyForBrowserTab(key, tab.tabId);
+    const fallbackToGlobal = options?.fallbackToGlobal === true;
     if (tabKey !== key) {
         const scoped = await readAppState(tabKey);
         if (scoped)
             return scoped;
-        if (options?.fallbackToGlobal !== true)
+        if (!fallbackToGlobal)
             return null;
     }
+    if (tab.unavailable &&
+        (!fallbackToGlobal || TAB_SCOPED_AMBIENT_KEYS.has(key)))
+        return null;
     return readUnscopedAppState(key);
 }
+/**
+ * Writes `key` for the current request's tab (see
+ * resolveCurrentRequestStateTab). With no tab, it writes the account-wide
+ * row, as it always has: an MCP caller learns from the call's result that no
+ * tab was found.
+ */
 export async function writeAppStateForCurrentTab(key, value) {
-    const tabKey = appStateKeyForBrowserTab(key, getCurrentRequestBrowserTabId());
-    return writeAppState(tabKey, value);
+    const tab = await resolveCurrentRequestStateTab();
+    const tabKey = appStateKeyForBrowserTab(key, tab.tabId);
+    if (tabKey !== key)
+        return writeAppState(tabKey, value);
+    const sessionId = await resolveSessionId();
+    return appStatePut(sessionId, key, value, { requestSource: "agent" });
 }

package/dist/application-state/store.d.ts

@@ -46,6 +46,14 @@ export declare function appStateList(sessionId: string, keyPrefix: string): Prom
     key: string;
     value: Record<string, unknown>;
 }>>;
+/**
+ * Lists the keys under `keyPrefix` with when the server last wrote each,
+ * leaving out any written before `writtenSince`.
+ */
+export declare function appStateListUpdatedAt(sessionId: string, keyPrefix: string, writtenSince?: number): Promise<Array<{
+    key: string;
+    updatedAt: number;
+}>>;
 export declare function appStateListByKeyPrefix(keyPrefix: string, limit?: number): Promise<Array<{
     sessionId: string;
     key: string;

package/dist/application-state/store.js

@@ -253,6 +253,22 @@ export async function appStateList(sessionId, keyPrefix) {
         value: JSON.parse(row.value),
     }));
 }
+/**
+ * Lists the keys under `keyPrefix` with when the server last wrote each,
+ * leaving out any written before `writtenSince`.
+ */
+export async function appStateListUpdatedAt(sessionId, keyPrefix, writtenSince = 0) {
+    await ensureTable();
+    const client = getDbExec();
+    const { rows } = await client.execute({
+        sql: `SELECT key, updated_at FROM application_state WHERE session_id = ? AND key LIKE ? ESCAPE '!' AND updated_at >= ?`,
+        args: [sessionId, escapeLike(keyPrefix) + "%", writtenSince],
+    });
+    return rows.map((row) => ({
+        key: row.key,
+        updatedAt: Number(row.updated_at),
+    }));
+}
 export async function appStateListByKeyPrefix(keyPrefix, limit = 100) {
     await ensureTable();
     const client = getDbExec();

package/dist/cli/agent.js

@@ -8,7 +8,7 @@ import { runAgentLoopDirectWithSoftTimeout } from "../agent/run-loop-with-resume
 import { getAppConfig } from "../app-config/index.js";
 import { createGitHubRepoToolEntries } from "../provider-api/github-repo.js";
 import { loadCliBootstrap } from "../scripts/cli-bootstrap.js";
-import { resolveDevUserEmail } from "../scripts/dev-session.js";
+import { devOrgChoiceFromEnv, resolveDevOrgScope, resolveDevUserEmail, } from "../scripts/dev-session.js";
 import { loadEnv, serializeCliArgs } from "../scripts/utils.js";
 import { autoDiscoverActions } from "../server/action-discovery.js";
 import { captureCliOutput } from "../server/cli-capture.js";
@@ -134,9 +134,13 @@ export async function runAgent(args, io = {}) {
         return 1;
     }
     const ownerEmail = parsed.userEmail ?? env.AGENT_USER_EMAIL ?? (await resolveDevUserEmail());
-    const orgId = parsed.orgId ?? env.AGENT_ORG_ID ?? undefined;
+    const envChoice = devOrgChoiceFromEnv(env);
+    const orgScope = await resolveDevOrgScope(ownerEmail, {
+        orgId: parsed.orgId ?? envChoice.orgId,
+        personal: envChoice.personal,
+    });
     try {
-        const result = await runWithRequestContext({ userEmail: ownerEmail, orgId }, () => runLocalAgentLoop(parsed));
+        const result = await runWithRequestContext({ ...(ownerEmail ? { userEmail: ownerEmail } : {}), ...orgScope }, () => runLocalAgentLoop(parsed));
         if (parsed.json) {
             stdout(JSON.stringify(result, null, 2));
             return result.failure ? 1 : 0;

package/dist/cli/code-agent-executor.d.ts

@@ -21,6 +21,7 @@ interface CodeAgentApprovalExecutionOptions {
     streamToolOutputToStdout?: boolean;
     signal?: AbortSignal;
 }
+export declare const RECAP_SOURCE_TOOL_PROFILE = "recap-source";
 export declare function executeCodeAgentRun(options: ExecuteCodeAgentRunOptions): Promise<CodeAgentRunRecord | null>;
 export declare function codeAgentMcpInvocationPolicy(permissionMode: CodeAgentPermissionMode): McpToolInvocationPolicy;
 export declare function executeExistingCodeAgentRun(runId: string, options?: Omit<ExecuteCodeAgentRunOptions, "runId">): Promise<CodeAgentRunRecord | null>;

package/dist/cli/code-agent-executor.js

@@ -31,8 +31,18 @@ const MCP_CONFIG_REMOVE_ATTEMPTS = 3;
 const PI_CLI_ENGINE_NAME = "pi-cli";
 const OPENCODE_CLI_ENGINE_NAME = "opencode-cli";
 const CLAUDE_CLI_DEFAULT_MODEL = "claude-sonnet-5-5";
-const RECAP_SOURCE_TOOL_PROFILE = "recap-source";
+export const RECAP_SOURCE_TOOL_PROFILE = "recap-source";
 const RECAP_SOURCE_OUTPUT_FILE = "recap-source.json";
+const RECAP_SOURCE_INPUT_FILES = new Set([
+    "recap.diff",
+    "recap.stat",
+    "recap-blocks.md",
+    "recap-prompt.md",
+    "recap-source.initial.json",
+    "recap-source.json",
+    "recap-url-reason.txt",
+    "recap-repair-prompt.md",
+]);
 const STRUCTURED_HISTORY_RECENT_EVENTS = 40;
 const STRUCTURED_HISTORY_RESULT_CAP = MAX_TOOL_OUTPUT_CHARS;
 export async function executeCodeAgentRun(options) {
@@ -2268,8 +2278,28 @@ function createLocalCodeAgentActions(cwd, permissionMode, runId, onToolMetadata,
     if (toolProfile === RECAP_SOURCE_TOOL_PROFILE) {
         const allowedOutput = path.resolve(cwd, RECAP_SOURCE_OUTPUT_FILE);
         const writeAction = actions.write;
+        const readAction = actions.read;
         return {
-            read: actions.read,
+            read: {
+                ...readAction,
+                run: async (args, context) => {
+                    const requestedPath = args && typeof args.path === "string" ? args.path : "";
+                    try {
+                        const resolved = path.resolve(cwd, requestedPath);
+                        const name = path.basename(resolved);
+                        if (!RECAP_SOURCE_INPUT_FILES.has(name) ||
+                            resolved !== path.join(cwd, name) ||
+                            fs.lstatSync(resolved).isSymbolicLink() ||
+                            path.dirname(fs.realpathSync(resolved)) !== fs.realpathSync(cwd)) {
+                            return "Error: recap source reads are limited to generated recap inputs.";
+                        }
+                    }
+                    catch {
+                        return "Error: recap source reads are limited to generated recap inputs.";
+                    }
+                    return readAction.run(args, context);
+                },
+            },
             write: {
                 ...writeAction,
                 run: async (args, context) => {
@@ -2277,6 +2307,11 @@ function createLocalCodeAgentActions(cwd, permissionMode, runId, onToolMetadata,
                     if (path.resolve(cwd, requestedPath) !== allowedOutput) {
                         return `Error: only ${RECAP_SOURCE_OUTPUT_FILE} may be written in the recap-source tool profile.`;
                     }
+                    if (fs
+                        .lstatSync(allowedOutput, { throwIfNoEntry: false })
+                        ?.isSymbolicLink()) {
+                        return `Error: ${RECAP_SOURCE_OUTPUT_FILE} cannot be a symbolic link.`;
+                    }
                     return writeAction.run(args, context);
                 },
             },

package/dist/cli/code.js

@@ -4,7 +4,7 @@ import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { runAuditAgentWeb } from "./audit-agent-web.js";
 import { findProjectSlashCommand, listProjectSlashCommands, renderProjectSlashCommandPrompt, } from "./code-agent-commands.js";
-import { executeApproveAlwaysCodeAgentApproval, executeCodeAgentRun, executeDenyCodeAgentApproval, executeExistingCodeAgentRun, executePendingCodeAgentApproval, } from "./code-agent-executor.js";
+import { RECAP_SOURCE_TOOL_PROFILE, executeApproveAlwaysCodeAgentApproval, executeCodeAgentRun, executeDenyCodeAgentApproval, executeExistingCodeAgentRun, executePendingCodeAgentApproval, } from "./code-agent-executor.js";
 import { CODE_AGENT_PERMISSION_MODES, appendCodeAgentTranscriptEvent, createCodeAgentRunRecord, getCodeAgentRunRecord, getLastCodeAgentRunRecord, isActiveCodeAgentRun, listCodeAgentRunRecords, listCodeAgentTranscriptEvents, normalizeCodeAgentPermissionMode, queueCodeAgentFollowUp, updateCodeAgentRunRecord, } from "./code-agent-runs.js";
 import { runMigrate } from "./migrate.js";
 export const CODE_AGENT_CLI_GOALS = [
@@ -325,6 +325,8 @@ Usage:
   agent-native code run <runId>
   agent-native code goals
 
+Restricted tool profile: ${RECAP_SOURCE_TOOL_PROFILE}
+
 Interactive shell:
   /help        Show shell commands
   /goals       List available coding-agent goals

package/dist/client/agent-sidebar-state.d.ts

@@ -13,6 +13,8 @@ export interface AgentSidebarStateChangeDetail {
     open: boolean;
     source: AgentSidebarStateSource;
     mode: AgentSidebarStateMode;
+    /** The panel draws inside the app's `panelHost`, not beside the page. */
+    hosted?: boolean;
 }
 export declare function snapAgentSidebarWidth(width: number): number;
 export declare function getAgentSidebarWideWidth(viewportWidth?: number): number;

package/dist/client/browser-tab-use.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Records when someone uses this browser tab (it gains focus, or its route
+ * changes while focused) and forgets the tab when the page goes away. An MCP
+ * tool call comes from no tab, so the server points its tab-scoped app
+ * state (navigation, navigate commands, selection) at the tab of this app
+ * used last. `useAgentRouteState` calls it; an app with its own navigation
+ * sync calls it once with its current route.
+ */
+export declare function useBrowserTabUse(route: string, enabled?: boolean): void;