@agent-native/core 0.228.2-nightly-20261113152307 → 0.228.2

package/dist/cli/skills-content/an-skill.d.ts

@@ -1,2 +1,2 @@
-export declare const AN_SKILL_MD = "---\nname: an\ndescription: >-\n  Open and operate Agent-Native workspace apps through Dispatch MCP, with\n  inline app surfaces, browser-session authentication, and current screen state.\nmetadata:\n  visibility: exported\n---\n\n# Agent-Native Apps\n\nUse `/an <app>` to open an Agent-Native app beside the conversation and keep\nthe app's live UI and the agent's actions in the same workflow. The first\nargument is the Dispatch app id. For example, `/an slides` opens the Slides\neditor. After it opens, the user can sign in in that browser surface and ask\nfor new decks or focused edits in ordinary language.\n\n## Open the app\n\nFor a known app, call Dispatch's `open_app` with an inline surface:\n\n```json\n{\n  \"app\": \"slides\",\n  \"path\": \"/\",\n  \"embed\": true,\n  \"chrome\": \"full\"\n}\n```\n\nThe MCP App response is the preferred handoff for Claude, Claude Desktop,\nClaude Cowork, ChatGPT, ChatGPT desktop, Codex, and other compatible hosts. Keep\nthe returned open link as the fallback for a host that cannot render MCP Apps\ninline. Do not claim that a browser opened unless the host rendered the inline\nsurface or its browser tool confirmed the returned URL.\n\nIf the app name is missing or uncertain, call `list_apps` first and use the\nexact granted app id. If the requested app is not listed, explain that it must\nbe granted in Dispatch's Agents access settings. Do not invent a URL, use a\nlocalhost URL, or route around the Dispatch grant.\n\n## Work in the opened app\n\nPrefer direct app tools when the host exposes them. After opening an app, call\n`list-host-webmcp-tools` when available, then use `run-host-webmcp-tool`\nwith the exact listed name and origin. Page-local tools reflect current app\nstate and selection, so use `view-screen` before selection-dependent edits\nand read back writes.\n\nYou are the model doing the work: when the user asks for new content \u2014 a\ndesign, a deck, a form, a document \u2014 author it yourself and save it with the\napp's create/update tools. Never hand off authoring to the app's own agent\nwhen those tools exist, and never wait on an in-app question form; it answers\nback through that app's own chat, not to you.\n\nUse `ask_app` only when the host has no direct page tools, the requested\ncapability is not exposed, the task needs the app agent's interpretation or\nmulti-step specialist reasoning, or a direct call fails and needs recovery.\nDispatch's unified `/mcp` endpoint still exposes generic cross-app verbs; a\ndirect app MCP connection or page WebMCP surface is where named app actions\nappear.\n\nThe app's MCP `instructions` name its key tools (generated from the app's own\nlist); follow those names verbatim and use `tool-search` for anything else \u2014\nnever guess a tool name.\n\n1. Call `view-screen` before any selection-dependent edit and use the ids it\n   returns; never guess an id from a title, index, or stale context.\n2. If `view-screen` returns a `selection` and `nextRequiredAction`, make\n   that call directly with the smallest atomic change; do not regenerate a\n   whole artifact for a focused edit.\n3. Read the result back with the app's matching read action and report what\n   changed. A queued `ask_app_status` task is not proof an edit completed.\n\n## Authentication and host behavior\n\nThe Dispatch MCP connector identifies the calling agent, while the embedded app\nuses the user's browser session. Let the user complete sign-in in the rendered\nAgent-Native browser surface. Never request, copy, or store passwords, OAuth\ncodes, cookies, or access tokens.\n\nThe generic Agent-Native plugin registers Dispatch at\n`https://dispatch.agent-native.com/mcp` for hosts that support plugin MCP\nconfiguration. ChatGPT custom connectors use the same URL with OAuth. After\ninstalling or changing a connector, reload Claude/Cowork/ChatGPT or reconnect\nand rescan the MCP server if the new tools or inline surface are not visible.\n\n## Failure handling\n\n- If `open_app` succeeds but no inline surface appears, show its returned\n  link and say that this host does not expose an embedded browser here.\n- After an app loads, check for `list-host-webmcp-tools` before delegating. If\n  it is available, use the exact returned tool name and origin for direct work.\n- If `ask_app` cannot reach Slides, check that Slides is granted in\n  Dispatch and that the connector is authenticated, then retry once with the\n  exact app id `slides`.\n- If screen state has no deck or selection, describe that state instead of\n  fabricating context. Ask the user to open a deck or select an element when\n  the requested edit depends on it.\n- Treat a successful open link, a queued task, or a tool acknowledgment as\n  navigation/task setup only. Confirm a write with the app's readback action.\n";
+export declare const AN_SKILL_MD = "---\nname: an\ndescription: >-\n  Open and operate Agent-Native workspace apps through Dispatch MCP, with\n  inline app surfaces, browser-session authentication, and current screen state.\nmetadata:\n  visibility: exported\n---\n\n# Agent-Native Apps\n\nUse `/an <app>` to open an Agent-Native app beside the conversation and keep\nthe app's live UI and the agent's actions in the same workflow. The first\nargument is the Dispatch app id. For example, `/an slides` opens the Slides\neditor. After it opens, the user can sign in in that browser surface and ask\nfor new decks or focused edits in ordinary language.\n\n## Open the app\n\nFor a known app, call Dispatch's `open_app` with an inline surface:\n\n```json\n{\n  \"app\": \"slides\",\n  \"path\": \"/\",\n  \"embed\": true,\n  \"chrome\": \"full\"\n}\n```\n\nThe MCP App response is the preferred handoff for Claude, Claude Desktop,\nClaude Cowork, ChatGPT, ChatGPT desktop, Codex, and other compatible hosts. Keep\nthe returned open link as the fallback for a host that cannot render MCP Apps\ninline. Do not claim that a browser opened unless the host rendered the inline\nsurface or its browser tool confirmed the returned URL.\n\nIf the app name is missing or uncertain, call `list_apps` first and use the\nexact granted app id. If the requested app is not listed, explain that it must\nbe granted in Dispatch's Agents access settings. Do not invent a URL, use a\nlocalhost URL, or route around the Dispatch grant.\n\n## Work in the opened app\n\nPrefer direct app tools when the host exposes them. After opening an app, call\n`list-host-webmcp-tools` when available, then use `run-host-webmcp-tool`\nwith the exact listed name and origin. Page-local tools reflect current app\nstate and selection, so use `view-screen` before selection-dependent edits\nand read back writes.\n\nYou are the model doing the work: when the user asks for new content \u2014 a\ndesign, a deck, a form, a document \u2014 author it yourself and save it with the\napp's create/update tools. Never hand off authoring to the app's own agent\nwhen those tools exist, and never wait on an in-app question form; it answers\nback through that app's own chat, not to you.\n\nUse `ask_app` only when the host has no direct page tools, the requested\ncapability is not exposed, the task needs the app agent's interpretation or\nmulti-step specialist reasoning, or a direct call fails and needs recovery.\nDispatch's unified `/mcp` endpoint still exposes generic cross-app verbs; a\ndirect app MCP connection or page WebMCP surface is where named app actions\nappear.\n\nThe app's MCP `instructions` name its key tools (generated from the app's own\nlist); follow those names verbatim and use `tool-search` for anything else \u2014\nnever guess a tool name.\n\n1. Call `view-screen` before any selection-dependent edit and use the ids it\n   returns; never guess an id from a title, index, or stale context.\n2. If `view-screen` returns a `selection` and `nextRequiredAction`, make\n   that call directly with the smallest atomic change; do not regenerate a\n   whole artifact for a focused edit.\n3. Read the result back with the app's matching read action and report what\n   changed. A queued `ask_app_status` task is not proof an edit completed.\n\n## Keep the open app in step with the chat\n\nClaude opens an embedded app in its side panel. The panel is one live app: an\nedit made through a tool shows there, and an edit the user makes by hand is in\nthe app's data the next time you read it.\n\n- To change what the open panel shows (filter a list, open a record, switch a\n  week), call the view tools `read_view` and `navigate_view` on the open app\n  instead of calling `open_app` again. Each new `open_app` call opens a new\n  view and replaces the panel.\n- Before acting on \"this\", \"it\" or \"the one I opened\", call `read_view`;\n  the user may have clicked or typed in the panel since your last turn.\n- Draft and edit with the app's own actions (create or update a draft, an\n  event, a task), then read it back. Send, delete or move only when the user\n  asks.\n\n## Authentication and host behavior\n\nThe Dispatch MCP connector identifies the calling agent, while the embedded app\nuses the user's browser session. Let the user complete sign-in in the rendered\nAgent-Native browser surface. Never request, copy, or store passwords, OAuth\ncodes, cookies, or access tokens.\n\nThe generic Agent-Native plugin registers Dispatch at\n`https://dispatch.agent-native.com/mcp` for hosts that support plugin MCP\nconfiguration. ChatGPT custom connectors use the same URL with OAuth. After\ninstalling or changing a connector, reload Claude/Cowork/ChatGPT or reconnect\nand rescan the MCP server if the new tools or inline surface are not visible.\n\n## Failure handling\n\n- If `open_app` succeeds but no inline surface appears, show its returned\n  link and say that this host does not expose an embedded browser here.\n- After an app loads, check for `list-host-webmcp-tools` before delegating. If\n  it is available, use the exact returned tool name and origin for direct work.\n- If `ask_app` cannot reach Slides, check that Slides is granted in\n  Dispatch and that the connector is authenticated, then retry once with the\n  exact app id `slides`.\n- If screen state has no deck or selection, describe that state instead of\n  fabricating context. Ask the user to open a deck or select an element when\n  the requested edit depends on it.\n- Treat a successful open link, a queued task, or a tool acknowledgment as\n  navigation/task setup only. Confirm a write with the app's readback action.\n";
 export declare const AN_COMMAND_MD = "---\ndescription: Open and operate a granted Agent-Native app through Dispatch MCP.\nargument-hint: <app> [request]\n---\n\nUse the an skill. Treat the first argument as the Agent-Native Dispatch app id.\nFor `/an slides`, call `open_app` with app `slides`, path \"/\", embed\ntrue, and chrome `full`. Keep the returned link if the host cannot render\nthe inline MCP App. Any remaining arguments are the user's request after the\napp opens:\n\n$ARGUMENTS\n";

package/dist/cli/skills-content/an-skill.js

@@ -73,6 +73,22 @@ never guess a tool name.
 3. Read the result back with the app's matching read action and report what
    changed. A queued \`ask_app_status\` task is not proof an edit completed.
 
+## Keep the open app in step with the chat
+
+Claude opens an embedded app in its side panel. The panel is one live app: an
+edit made through a tool shows there, and an edit the user makes by hand is in
+the app's data the next time you read it.
+
+- To change what the open panel shows (filter a list, open a record, switch a
+  week), call the view tools \`read_view\` and \`navigate_view\` on the open app
+  instead of calling \`open_app\` again. Each new \`open_app\` call opens a new
+  view and replaces the panel.
+- Before acting on "this", "it" or "the one I opened", call \`read_view\`;
+  the user may have clicked or typed in the panel since your last turn.
+- Draft and edit with the app's own actions (create or update a draft, an
+  event, a task), then read it back. Send, delete or move only when the user
+  asks.
+
 ## Authentication and host behavior
 
 The Dispatch MCP connector identifies the calling agent, while the embedded app

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import
     ok: boolean;
 }>>;
 export declare const postCollabText: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     text?: undefined;
+    ok?: undefined;
     error: string;
 } | {
     error?: undefined;

package/dist/collab/struct-routes.d.ts

@@ -13,9 +13,9 @@ export declare const postCollabPatch: import("h3").EventHandlerWithFetch<import(
     ok: boolean;
 }>>;
 export declare const getCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    data?: undefined;
     error: string;
     docId?: undefined;
+    data?: undefined;
 } | {
     error?: undefined;
     docId: string;

package/dist/db/schema-snapshot.generated.js

@@ -68,7 +68,7 @@ export const SCHEMA_SNAPSHOT = {
         'CREATE TABLE "app_permission_overrides" (\n  "org_id" text NOT NULL,\n  "app_id" text NOT NULL,\n  "permission" text NOT NULL,\n  "roles_json" text NOT NULL,\n  "updated_by" text NOT NULL,\n  "updated_at" bigint NOT NULL\n);',
         'CREATE TABLE "app_resource_change_consumers" (\n  "app" text NOT NULL,\n  "resource_type" text NOT NULL,\n  "consumer" text NOT NULL,\n  "registered_at" timestamp with time zone DEFAULT now() NOT NULL\n);',
         'CREATE TABLE "app_resource_changes" (\n  "consumer" text NOT NULL,\n  "app" text NOT NULL,\n  "resource_type" text NOT NULL,\n  "resource_id" text NOT NULL,\n  "reason" text NOT NULL,\n  "seq" bigint NOT NULL,\n  "changed_at" timestamp with time zone DEFAULT clock_timestamp() NOT NULL,\n  "available_at" timestamp with time zone DEFAULT clock_timestamp() NOT NULL,\n  "attempts" integer DEFAULT 0 NOT NULL,\n  "failed_at" timestamp with time zone\n);',
-        'CREATE TABLE "app_secrets" (\n  "id" text NOT NULL,\n  "scope" text NOT NULL,\n  "scope_id" text NOT NULL,\n  "key" text NOT NULL,\n  "encrypted_value" text NOT NULL,\n  "shared_encrypted_value" text,\n  "description" text,\n  "url_allowlist" text,\n  "created_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL\n);',
+        'CREATE TABLE "app_secrets" (\n  "id" text NOT NULL,\n  "scope" text NOT NULL,\n  "scope_id" text NOT NULL,\n  "key" text NOT NULL,\n  "encrypted_value" text NOT NULL,\n  "shared_encrypted_value" text,\n  "description" text,\n  "url_allowlist" text,\n  "created_at" bigint NOT NULL,\n  "updated_at" bigint NOT NULL,\n  "label" text,\n  "provider" text,\n  "created_by" text\n);',
         'CREATE TABLE "application_state" (\n  "session_id" text NOT NULL,\n  "key" text NOT NULL,\n  "value" text NOT NULL,\n  "updated_at" bigint NOT NULL,\n  "writer" text,\n  "writer_seq" bigint\n);',
         'CREATE TABLE "automation_runs" (\n  "id" text NOT NULL,\n  "owner" text NOT NULL,\n  "automation" text NOT NULL,\n  "path" text NOT NULL,\n  "scope" text,\n  "org_id" text,\n  "app_id" text,\n  "run_id" text,\n  "thread_id" text,\n  "status" text DEFAULT \'running\'::text NOT NULL,\n  "started_at" bigint NOT NULL,\n  "finished_at" bigint,\n  "error" text,\n  "error_code" text,\n  "notification_email" text,\n  "failure_alerted" bigint DEFAULT 0 NOT NULL,\n  "failure_alert_state" text,\n  "failure_alert_attempts" bigint DEFAULT 0 NOT NULL,\n  "failure_alert_next_attempt_at" bigint,\n  "failure_alert_claimed_at" bigint,\n  "failure_alert_provider" text,\n  "failure_alert_first_attempt_at" bigint,\n  "failure_alert_unsubscribe_token" text,\n  "claimed_at" bigint,\n  "dispatch_pending" bigint DEFAULT 0 NOT NULL\n);',
         'CREATE TABLE "automation_scheduler_health" (\n  "id" text NOT NULL,\n  "app_id" text DEFAULT \'default\'::text NOT NULL,\n  "org_id" text,\n  "last_checked_at" bigint,\n  "last_dispatched_at" bigint,\n  "last_error" text,\n  "runtime" text,\n  "updated_at" bigint NOT NULL,\n  "lease_owner" text,\n  "lease_expires_at" bigint\n);',
@@ -953,6 +953,7 @@ export const SCHEMA_SNAPSHOT = {
         ["agent_tool_approvals", "tool-revision", null],
         ["app_resource_changes", "baseline", null],
         ["app_secrets", "baseline", null],
+        ["app_secrets", "vault-metadata-columns", null],
         ["application_state", "baseline", null],
         ["application_state", "indexes", null],
         ["application_state", "widen-bigint", null],

package/dist/framework-package-versions.json

@@ -1,17 +1,17 @@
 {
-  "@agent-native/agentkit": "0.228.2-nightly-20261113152307",
+  "@agent-native/agentkit": "0.228.2",
   "@agent-native/code-agents-ui": "0.1.75",
-  "@agent-native/core": "0.228.2-nightly-20261113152307",
-  "@agent-native/core-corpus": "0.228.2-nightly-20261113152307",
-  "@agent-native/creative-context": "0.8.71",
-  "@agent-native/dispatch": "0.42.7-nightly-20261113152307",
+  "@agent-native/core": "0.228.2",
+  "@agent-native/core-corpus": "0.228.2",
+  "@agent-native/creative-context": "0.8.72",
+  "@agent-native/dispatch": "0.42.7",
   "@agent-native/embedding": "0.2.0",
   "@agent-native/migrate": "0.0.7",
-  "@agent-native/otel": "0.1.38",
-  "@agent-native/pinpoint": "0.1.114",
-  "@agent-native/recap-cli": "0.5.102",
-  "@agent-native/scheduling": "0.2.58",
+  "@agent-native/otel": "0.1.39",
+  "@agent-native/pinpoint": "0.1.115",
+  "@agent-native/recap-cli": "0.5.103",
+  "@agent-native/scheduling": "0.2.59",
   "@agent-native/shared-app-config": "0.1.2",
-  "@agent-native/skills": "0.4.7-nightly-20261113152307",
-  "@agent-native/toolkit": "0.228.2-nightly-20261113152307"
+  "@agent-native/skills": "0.4.7",
+  "@agent-native/toolkit": "0.228.2"
 }

package/dist/identity/rekey.js

@@ -239,6 +239,8 @@ export const IDENTITY_REKEY_IGNORED_COLUMNS = new Set([
     "tool_history.actor_email",
     "tool_history.owner_email",
     "agent_resource_versions.created_by",
+    // Creator attribution on a Vault key, kept as written; the key is owned by its scope.
+    "app_secrets.created_by",
     "agent_review_comments.created_by",
     "agent_human_review_summaries.created_by",
     "organizations.created_by",

package/dist/mcp/embed-app.js

@@ -31,6 +31,9 @@ export function embedApp(options = {}) {
     return {
         title,
         requiresEmbedSession: true,
+        // Claude reads this from the resources/read content item and moves the
+        // view to its side panel; hosts that do not know the field ignore it.
+        _meta: { ui: { preferredDisplayMode: "fullscreen" } },
         ...(options.description ? { description: options.description } : {}),
         html: (ctx) => {
             const remoteBridgeFallbackEnabled = ctx.catalogMode !== "directory";
@@ -1363,6 +1366,7 @@ export function embedApp(options = {}) {
         window.history.replaceState(window.history.state, "", localPathFromUrl(appUrl, false));
       } catch {}
       await mountTransplantedHtml(html, appUrl);
+      watchPageTools();
       embedSessionRefreshAttempts = 0;
       notifyHostHeightRepeatedly();
     }
@@ -1756,6 +1760,7 @@ export function embedApp(options = {}) {
       ${ctx.catalogMode === "directory" ? "" : 'frame.allow = "clipboard-read; clipboard-write";'}
       appFrame = frame;
       appFrameReady = false;
+      notifyViewToolsChanged();
       lastFrameSrc = src;
       appFrameDocumentState.loadGeneration += 1;
       frame.addEventListener("load", () => {
@@ -2642,6 +2647,226 @@ export function embedApp(options = {}) {
       if (bridge && (!appFrame || openAiBridge)) syncOpenAiBridge(bridge);
     }, { passive: true });
 
+    // App tools: the host calls these on this open view, so a "filter it" or
+    // "open that one" turn changes the panel in place instead of opening a new view.
+    const readViewToolName = "read_view";
+    const navigateViewToolName = "navigate_view";
+    const maxViewTextChars = 6000;
+    const maxPageTools = 60;
+    const pageToolWaitMs = 40000;
+    const pageToolOrigins = new Map();
+    let pageToolWatchStarted = false;
+
+    function appPageToolHelper() {
+      if (appFrame) return null;
+      const helper = window.__agentNativeWebMcp;
+      return helper && typeof helper.tools === "function" && typeof helper.call === "function"
+        ? helper
+        : null;
+    }
+
+    function currentViewUrl() {
+      if (appFrame) {
+        try {
+          return new URL(appFrame.src, window.location.href);
+          // coercion-ok: null means "no readable view URL"; read_view and navigate_view report it as an error
+        } catch {
+          return null;
+        }
+      }
+      return lastFrameSrc ? new URL(window.location.href) : null;
+    }
+
+    function readViewState() {
+      // A nested app frame is cross-origin and moves on its own, so its src is
+      // only the launch URL; reporting it would describe the wrong page.
+      if (appFrame) throw new Error("This host shows the app in a nested frame, so its current page can't be read.");
+      const url = currentViewUrl();
+      if (!url) throw new Error("No app page has loaded in this view yet.");
+      const state = {
+        path: localPathFromUrl(url, false),
+        title: document.title
+      };
+      {
+        const selection = typeof window.getSelection === "function"
+          ? String(window.getSelection() || "").trim()
+          : "";
+        if (selection) state.selectedText = selection.slice(0, maxViewTextChars);
+        const root = document.querySelector("main") || document.body;
+        state.visibleText = root
+          ? String(root.innerText || "").replace(/\\s+/g, " ").trim().slice(0, maxViewTextChars)
+          : "";
+      }
+      return state;
+    }
+
+    function navigateView(rawPath) {
+      const path = typeof rawPath === "string" ? rawPath.trim() : "";
+      if (!path.startsWith("/") || path.startsWith("//")) {
+        throw new Error("path must start with / and stay inside the open app, e.g. the path read_view returns.");
+      }
+      // The nested frame was launched on a session scoped to its start URL;
+      // pointing it at a bare app route would drop that session.
+      if (appFrame) {
+        throw new Error("This host shows the app in a nested frame, so it can't be moved from here.");
+      }
+      const base = currentViewUrl();
+      if (!base) throw new Error("No app page has loaded in this view yet.");
+      const target = new URL(path, base);
+      if (target.origin !== base.origin) throw new Error("path must stay inside the open app.");
+      const nextPath = localPathFromUrl(target, false);
+      // React Router reads the location on popstate, so a pushed entry plus a
+      // popstate event moves the transplanted app without reloading it.
+      const current = window.history.state;
+      const idx = current && typeof current.idx === "number" ? current.idx + 1 : 0;
+      window.history.pushState(
+        { usr: null, key: Math.random().toString(36).slice(2, 10), idx },
+        "",
+        nextPath
+      );
+      window.dispatchEvent(new PopStateEvent("popstate", { state: window.history.state }));
+      return { path: nextPath };
+    }
+
+    async function listViewTools() {
+      // A nested cross-origin frame can be neither read nor moved from here.
+      if (appFrame) return [];
+      const tools = [
+        {
+          name: readViewToolName,
+          title: "Read open app view",
+          description: "Read the app page open beside the chat: its path, title, selected text and visible text. Call it before acting on what the user is looking at.",
+          inputSchema: { type: "object", properties: {} },
+          annotations: { readOnlyHint: true }
+        },
+        {
+          name: navigateViewToolName,
+          title: "Navigate open app view",
+          description: "Show another page of the open app in place, such as a filtered list or one record. Pass a path in the form read_view returns.",
+          inputSchema: {
+            type: "object",
+            properties: {
+              path: {
+                type: "string",
+                description: "App path starting with /, in the form read_view returns, e.g. a list with a search query."
+              }
+            },
+            required: ["path"]
+          }
+        }
+      ];
+      const helper = appPageToolHelper();
+      if (!helper) return tools;
+      pageToolOrigins.clear();
+      try {
+        const summaries = await helper.tools();
+        for (const summary of (Array.isArray(summaries) ? summaries : []).slice(0, maxPageTools)) {
+          if (!summary || typeof summary.name !== "string") continue;
+          if (tools.some((tool) => tool.name === summary.name)) continue;
+          const full = typeof helper.describe === "function"
+            ? await helper.describe(summary.name, summary.origin)
+            : null;
+          const schema = full && full.inputSchema && full.inputSchema.type === "object"
+            ? full.inputSchema
+            : { type: "object", properties: {} };
+          tools.push({
+            name: summary.name,
+            ...(summary.title ? { title: summary.title } : {}),
+            description: String((full && full.description) || summary.description || summary.name),
+            inputSchema: schema,
+            ...(summary.readOnly ? { annotations: { readOnlyHint: true } } : {})
+          });
+          pageToolOrigins.set(summary.name, summary.origin);
+        }
+      } catch (err) {
+        console.warn("[agent-native] page tools unavailable to the MCP host", err);
+      }
+      return tools;
+    }
+
+    async function callViewTool(params) {
+      const record = objectValue(params);
+      const name = typeof record.name === "string" ? record.name : "";
+      const args = objectValue(record.arguments);
+      try {
+        let result;
+        if (name === readViewToolName) {
+          result = readViewState();
+        } else if (name === navigateViewToolName) {
+          result = navigateView(args.path);
+        } else {
+          const helper = appPageToolHelper();
+          if (!helper) throw new Error("Unknown view tool: " + name);
+          const origin = pageToolOrigins.get(name);
+          const outcome = await helper.call(name, args, {
+            waitMs: pageToolWaitMs,
+            ...(origin ? { origin } : {})
+          });
+          if (!outcome || outcome.state !== "done") {
+            throw new Error("Page tool " + name + " did not finish.");
+          }
+          if (!outcome.ok) throw new Error(outcome.error || "Page tool " + name + " failed.");
+          result = outcome.result;
+        }
+        const structured = result && typeof result === "object" && !Array.isArray(result)
+          ? result
+          : undefined;
+        return {
+          content: [{
+            type: "text",
+            text: typeof result === "string" ? result : JSON.stringify(result === undefined ? null : result)
+          }],
+          ...(structured ? { structuredContent: structured } : {})
+        };
+      } catch (err) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: err && err.message ? err.message : String(err) }]
+        };
+      }
+    }
+
+    function notifyViewToolsChanged() {
+      if (app && typeof app.sendToolListChanged === "function") {
+        try {
+          app.sendToolListChanged();
+        } catch (error) {
+          console.warn("[agent-native] tools/list_changed notification failed", error);
+        }
+      }
+    }
+
+    // The app registers its WebMCP tools from module scripts that keep running
+    // after the transplant mounts, so the first list_changed can arrive before
+    // they exist. Re-announce when the helper appears and on every toolchange.
+    function watchPageTools() {
+      notifyViewToolsChanged();
+      if (pageToolWatchStarted) return;
+      pageToolWatchStarted = true;
+      let timer = null;
+      const schedule = () => {
+        clearTimeout(timer);
+        timer = setTimeout(notifyViewToolsChanged, 250);
+      };
+      let watchedContext = null;
+      let helperSeen = false;
+      let ticks = 0;
+      const check = () => {
+        const context = document.modelContext;
+        if (context && context !== watchedContext && typeof context.addEventListener === "function") {
+          context.addEventListener("toolchange", schedule);
+          watchedContext = context;
+        }
+        if (!helperSeen && appPageToolHelper()) {
+          helperSeen = true;
+          schedule();
+        }
+        if ((helperSeen && watchedContext) || ++ticks >= 20) clearInterval(poll);
+      };
+      const poll = setInterval(check, 500);
+      check();
+    }
+
     function createNativeMcpAppsBridge() {
       let rpcId = 0;
       let connectPromise = null;
@@ -2745,7 +2970,10 @@ export function embedApp(options = {}) {
               "ui/initialize",
               {
                 appInfo: { name: "Agent-Native Embed", version: "1.0.0" },
-                appCapabilities: {},
+                appCapabilities: {
+                  availableDisplayModes: ["inline", "fullscreen"],
+                  tools: { listChanged: true }
+                },
                 protocolVersion: "2026-01-26"
               },
               nativeBridgeInitializeTimeoutMs
@@ -2791,17 +3019,43 @@ export function embedApp(options = {}) {
         sendSizeChanged(params) {
           rpcNotify("ui/notifications/size-changed", objectValue(params));
         },
+        sendToolListChanged() {
+          if (connectPromise) rpcNotify("notifications/tools/list_changed", {});
+        },
         async sendMessage(params) {
           await nativeApp.connect();
           return await rpcRequest("ui/message", objectValue(params));
         }
       };
 
+      async function answerHostRequest(message) {
+        let reply;
+        try {
+          if (message.method === "tools/list") {
+            reply = { result: { tools: await listViewTools() } };
+          } else if (message.method === "tools/call") {
+            reply = { result: await callViewTool(message.params) };
+          } else if (message.method === "ping" || message.method === "ui/resource-teardown") {
+            reply = { result: {} };
+          } else {
+            reply = { error: { code: -32601, message: "Method not found: " + message.method } };
+          }
+        } catch (err) {
+          reply = { error: { code: -32603, message: err && err.message ? err.message : String(err) } };
+        }
+        window.parent.postMessage({ jsonrpc: "2.0", id: message.id, ...reply }, "*");
+      }
+
       function onMessage(event) {
         if (event.source !== window.parent) return;
         const message = event.data;
         if (!message || message.jsonrpc !== "2.0") return;
-        if (typeof message.id === "number" || typeof message.id === "string") {
+        const hasId = typeof message.id === "number" || typeof message.id === "string";
+        if (hasId && typeof message.method === "string") {
+          void answerHostRequest(message);
+          return;
+        }
+        if (hasId) {
           settleRpcResponse(message);
           return;
         }
@@ -2881,9 +3135,11 @@ export function embedApp(options = {}) {
       const { App } = await import("${MCP_APP_IMPORT}");
       app = new App(
         { name: "Agent-Native Embed", version: "1.0.0" },
-        {},
+        { availableDisplayModes: ["inline", "fullscreen"], tools: { listChanged: true } },
         { autoResize: false }
       );
+      app.onlisttools = async () => ({ tools: await listViewTools() });
+      app.oncalltool = async (params) => await callViewTool(params);
       appConnectPromise = null;
       app.ontoolinput = (params) => {
         toolInput = params.arguments || {};

package/dist/mcp/oauth-route.js

@@ -310,6 +310,13 @@ function protectedResourcePathFromRequest(event) {
     pathname = pathname.replace(/\/+$/, "");
     if (!pathname || pathname === "/")
         return undefined;
+    // RFC 9728 inserts the whole resource path after the well-known segment, so
+    // a mounted app (resource /dispatch/mcp) is asked about /dispatch/mcp.
+    const issuer = getMcpOAuthIssuer(event);
+    const basePath = issuer ? new URL(issuer).pathname.replace(/\/+$/, "") : "";
+    if (basePath && pathname.startsWith(`${basePath}/`)) {
+        pathname = pathname.slice(basePath.length);
+    }
     return ([
         MCP_PUBLIC_ROUTE_PREFIX,
         MCP_LEGACY_ROUTE_PREFIX,

package/dist/notifications/routes.d.ts

@@ -1,18 +1,18 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     error?: undefined;
-    ok?: undefined;
     count: number;
     updated?: undefined;
+    ok?: undefined;
 } | {
     error?: undefined;
-    ok?: undefined;
     count?: undefined;
     updated: number;
-} | {
     ok?: undefined;
+} | {
     count?: undefined;
     updated?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     count?: undefined;

package/dist/observability/routes.d.ts

@@ -27,10 +27,10 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    summary?: undefined;
     ok?: undefined;
     error: string;
     message: string;
+    summary?: undefined;
     spans?: undefined;
 } | {
     error?: undefined;
@@ -40,30 +40,30 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     spans: import("./types.js").TraceSpan[];
 } | {
     error?: undefined;
-    summary?: undefined;
     ok?: undefined;
     message?: undefined;
+    summary?: undefined;
     spans?: undefined;
     traceMissing: true;
     id: string;
 } | {
     error?: undefined;
-    summary?: undefined;
     ok?: undefined;
     message?: undefined;
+    summary?: undefined;
     spans?: undefined;
     traceMissing?: undefined;
     id: string;
 } | {
-    summary?: undefined;
     ok?: undefined;
     message?: undefined;
+    summary?: undefined;
     spans?: undefined;
     error: any;
 } | {
     error?: undefined;
-    summary?: undefined;
     message?: undefined;
+    summary?: undefined;
     spans?: undefined;
     ok: boolean;
 }>>;

package/dist/secrets/api-keys.js

@@ -10,8 +10,9 @@ import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { canonicalSecretKey, secretKeyNames } from "./key-aliases.js";
 import { resolveSecretManagedBy } from "./managed-keys.js";
 import { getRequiredSecret, listRequiredSecrets, } from "./register.js";
-import { deleteAppSecret, listAppSecretsForScope, VAULT_SYNC_DESCRIPTION_PREFIX, } from "./storage.js";
+import { deleteAppSecret, listAppSecretsForScope, } from "./storage.js";
 import { describeSecretUsage } from "./usage.js";
+import { isVaultManagedSecret } from "./vault-managed.js";
 /**
  * The rows the resolver reads for the caller, in its precedence order:
  * personal, the pre-organization solo row, then the organization's.
@@ -63,7 +64,7 @@ function toEntry(caller, meta, owner, manages) {
     const registered = getRequiredSecret(meta.key);
     const managedBy = resolveSecretManagedBy(meta.key);
     const provider = providerForName(meta.key);
-    const vault = isVaultSynced(meta.scope, meta.description);
+    const vault = isVaultSynced(meta.scope, meta);
     const mayChange = !managedBy && !vault && (owner === "user" || manages);
     // Replace writes through the routes' own target, so it only applies when
     // that target is this row; otherwise it would add a second row instead.
@@ -155,9 +156,9 @@ export async function listApiKeys(caller) {
         canManageOrg: manages,
     };
 }
-/** Vault writes shared rows with this description; a user's own rows are never synced. */
-function isVaultSynced(scope, description) {
-    return (scope !== "user" && !!description?.startsWith(VAULT_SYNC_DESCRIPTION_PREFIX));
+/** The Vault owns the shared rows it writes; a user's own rows never belong to it. */
+function isVaultSynced(scope, meta) {
+    return scope !== "user" && isVaultManagedSecret(meta);
 }
 /**
  * Delete one saved key row. A provider key also takes its endpoint and older
@@ -181,7 +182,7 @@ export async function deleteApiKey(caller, input) {
     const row = rows.find((meta) => meta.key === input.name);
     if (!row)
         return { status: "not-found" };
-    if (isVaultSynced(storedScope, row.description))
+    if (isVaultSynced(storedScope, row))
         return { status: "vault" };
     const provider = AGENT_PROVIDER_CATALOG.find((option) => option.id === providerForName(input.name));
     const names = provider
@@ -198,7 +199,7 @@ export async function deleteApiKey(caller, input) {
             continue;
         // Vault owns its rows, and a managed name is never the user's to delete,
         // even when it sits beside the key being removed.
-        if (isVaultSynced(storedScope, meta.description))
+        if (isVaultSynced(storedScope, meta))
             continue;
         if (resolveSecretManagedBy(name))
             continue;

package/dist/secrets/index.d.ts

@@ -1,5 +1,6 @@
 export { registerRequiredSecret, listRequiredSecrets, getRequiredSecret, registerSecretUsage, getRegisteredSecretUsage, __resetSecretsRegistry, type RegisteredSecret, type SecretUsage, type SecretManagedBy, type SecretScope, type SecretKind, type SecretValidator, type ValidatorResult, } from "./register.js";
-export { writeAppSecret, readAppSecret, hasAppSecret, readAppSecretMeta, deleteAppSecret, getAppSecretMeta, listAppSecretsForScope, last4, VAULT_SYNC_DESCRIPTION_PREFIX, type SecretRef, type WriteSecretArgs, type ReadSecretResult, type SecretMeta, } from "./storage.js";
+export { writeAppSecret, readAppSecret, hasAppSecret, readAppSecretMeta, readAppSecretMetaById, deleteAppSecret, deleteAppSecretById, getAppSecretMeta, listAppSecretsForScope, listAppSecretSummaries, updateAppSecretById, AppSecretKeyConflictError, last4, type SecretRef, type WriteSecretArgs, type ReadSecretResult, type SecretMeta, type AppSecretSummary, type UpdateAppSecretPatch, } from "./storage.js";
+export { VAULT_SYNC_DESCRIPTION_PREFIX, isVaultManagedSecret, } from "./vault-managed.js";
 export { APP_SECRETS_CREATE_SQL, appSecrets } from "./schema.js";
 export { encryptSecretValue, decryptSecretValue, isEncryptedSecretValue, } from "./crypto.js";
 export { createListSecretsHandler, createWriteSecretHandler, createTestSecretHandler, createAdHocSecretHandler, type SecretStatusPayload, type AdHocSecretPayload, } from "./routes.js";

package/dist/secrets/index.js

@@ -1,5 +1,6 @@
 export { registerRequiredSecret, listRequiredSecrets, getRequiredSecret, registerSecretUsage, getRegisteredSecretUsage, __resetSecretsRegistry, } from "./register.js";
-export { writeAppSecret, readAppSecret, hasAppSecret, readAppSecretMeta, deleteAppSecret, getAppSecretMeta, listAppSecretsForScope, last4, VAULT_SYNC_DESCRIPTION_PREFIX, } from "./storage.js";
+export { writeAppSecret, readAppSecret, hasAppSecret, readAppSecretMeta, readAppSecretMetaById, deleteAppSecret, deleteAppSecretById, getAppSecretMeta, listAppSecretsForScope, listAppSecretSummaries, updateAppSecretById, AppSecretKeyConflictError, last4, } from "./storage.js";
+export { VAULT_SYNC_DESCRIPTION_PREFIX, isVaultManagedSecret, } from "./vault-managed.js";
 export { APP_SECRETS_CREATE_SQL, appSecrets } from "./schema.js";
 export { encryptSecretValue, decryptSecretValue, isEncryptedSecretValue, } from "./crypto.js";
 export { createListSecretsHandler, createWriteSecretHandler, createTestSecretHandler, createAdHocSecretHandler, } from "./routes.js";

package/dist/secrets/routes.d.ts

@@ -55,18 +55,18 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     errorCode: "secret_managed_elsewhere";
     managedBy: SecretManagedBy;
 } | {
-    errorCode?: undefined;
-    error: string;
     ok?: undefined;
+    error: string;
+    errorCode?: undefined;
     status?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     errorCode: string;
-    ok?: undefined;
     status?: undefined;
 } | {
-    errorCode?: undefined;
     error?: undefined;
+    errorCode?: undefined;
     ok: boolean;
     status: string;
 } | {