@agent-native/core 0.68.1 → 0.68.3

package/corpus/templates/clips/app/routes/share.$shareId.tsx

@@ -41,6 +41,7 @@ import { DeleteRecordingMenu } from "@/components/player/delete-recording-menu";
 import { usePlayerShortcuts } from "@/hooks/use-player-shortcuts";
 import { useViewTracking } from "@/hooks/use-view-tracking";
 import { Button } from "@/components/ui/button";
+import { CaptureInstallButton } from "@/components/capture-install-options";
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -1004,12 +1005,10 @@ function PublicAgentEmptyState() {
         Loom alternative
       </p>
       <div className="mt-7 flex w-full max-w-[220px] flex-col gap-2">
-        <Button asChild className="w-full gap-2">
-          <a href={appPath("/download")}>
-            <IconDownload className="h-4 w-4" />
-            {downloadLabel}
-          </a>
-        </Button>
+        <CaptureInstallButton className="w-full gap-2" align="center">
+          <IconDownload className="h-4 w-4" />
+          {downloadLabel}
+        </CaptureInstallButton>
         <Button asChild variant="outline" className="w-full">
           <a href={appPath("/signup")}>Sign up</a>
         </Button>

package/corpus/templates/clips/chrome-extension/STORE_DRAFT.md

@@ -6,6 +6,8 @@ Name: Agent-Native Clips
 
 Chrome Web Store item ID: `baoipacpchggcdigagnajakiidcgcffn`
 
+Chrome Web Store URL: `https://chromewebstore.google.com/detail/baoipacpchggcdigagnajakiidcgcffn`
+
 Summary: Start Clips recordings from Chrome with optional redacted console and network diagnostics.
 
 Category: Productivity
@@ -39,3 +41,30 @@ Diagnostics are bounded and redacted before they are saved. Clips does not colle
 ## Review Notes
 
 The extension opens `https://clips.agent-native.com/record` by default. Local development can point the settings page to a localhost Clips instance.
+
+## Submission Artifact
+
+Build the latest Chrome Web Store ZIP from the repo root:
+
+```bash
+pnpm --filter clips-chrome-extension package
+```
+
+Upload the generated artifact:
+
+```txt
+templates/clips/chrome-extension/releases/clips-chrome-extension-0.1.0.zip
+```
+
+## Web App Rollout Gate
+
+Keep the web app's Chrome extension UI hidden until the Web Store listing is
+approved and there is a stable public URL.
+
+- `VITE_CLIPS_CHROME_EXTENSION_ENABLED=1` reveals the Chrome option beside
+  Clips desktop prompts.
+- `VITE_CLIPS_CHROME_EXTENSION_URL` overrides the default install URL
+  (`https://chromewebstore.google.com/detail/baoipacpchggcdigagnajakiidcgcffn`)
+  if a deployment uses a different listing.
+- Leave both unset while submitting the draft so production continues to send
+  users directly to the desktop app.

package/corpus/templates/clips/server/lib/calendar-event-meetings.ts

@@ -12,7 +12,8 @@ import {
   detectPlatform,
   getEvent,
   pickJoinUrl,
-  refreshAccessToken,
+  resolveGoogleOAuthCredentialCandidates,
+  refreshAccessTokenWithFallback,
   type CalendarEvent,
 } from "./google-calendar-client.js";
 
@@ -77,9 +78,8 @@ export function shouldMarkNeedsReauth(message: string): boolean {
 export async function resolveCalendarAccessToken(
   account: CalendarAccountForEvents,
 ): Promise<string | null> {
-  const clientId = process.env.GOOGLE_CLIENT_ID;
-  const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
-  if (!clientId || !clientSecret || !account.ownerEmail) return null;
+  const credentialCandidates = resolveGoogleOAuthCredentialCandidates();
+  if (!credentialCandidates.length || !account.ownerEmail) return null;
 
   let bundle: AccessTokenBundle | null = null;
   if (account.accessTokenSecretRef) {
@@ -112,10 +112,9 @@ export async function resolveCalendarAccessToken(
 
   let refreshed;
   try {
-    refreshed = await refreshAccessToken({
+    refreshed = await refreshAccessTokenWithFallback({
       refreshToken: refreshSecret.value,
-      clientId,
-      clientSecret,
+      credentials: credentialCandidates,
     });
   } catch {
     // TODO(needs-reauth classification): a transient refresh failure (network

package/corpus/templates/clips/server/lib/google-calendar-client.ts

@@ -82,6 +82,35 @@ export interface ExchangeCodeArgs {
   redirectUri: string;
 }
 
+export interface GoogleOAuthClientCredentials {
+  clientId: string;
+  clientSecret: string;
+}
+
+function readCredentialPair(
+  clientIdKey: string,
+  clientSecretKey: string,
+): GoogleOAuthClientCredentials | null {
+  const clientId = process.env[clientIdKey];
+  const clientSecret = process.env[clientSecretKey];
+  if (!clientId || !clientSecret) return null;
+  return { clientId, clientSecret };
+}
+
+export function resolveGoogleOAuthCredentialCandidates(): GoogleOAuthClientCredentials[] {
+  const primary = readCredentialPair(
+    "GOOGLE_CLIENT_ID",
+    "GOOGLE_CLIENT_SECRET",
+  );
+  const legacy = readCredentialPair(
+    "GOOGLE_LEGACY_CLIENT_ID",
+    "GOOGLE_LEGACY_CLIENT_SECRET",
+  );
+  if (!primary) return legacy ? [legacy] : [];
+  if (!legacy || legacy.clientId === primary.clientId) return [primary];
+  return [primary, legacy];
+}
+
 /** Exchange an authorization code for tokens. Throws on non-2xx. */
 export async function exchangeCode(
   args: ExchangeCodeArgs,
@@ -129,6 +158,38 @@ export async function refreshAccessToken(args: {
   return (await res.json()) as GoogleTokenResponse;
 }
 
+function isPermanentRefreshFailure(error: unknown): boolean {
+  const message = error instanceof Error ? error.message : String(error || "");
+  const lower = message.toLowerCase();
+  return (
+    lower.includes("invalid_grant") ||
+    lower.includes("unauthorized_client") ||
+    lower.includes("invalid_client")
+  );
+}
+
+export async function refreshAccessTokenWithFallback(args: {
+  refreshToken: string;
+  credentials: GoogleOAuthClientCredentials[];
+}): Promise<GoogleTokenResponse> {
+  let lastError: unknown;
+  for (const credentials of args.credentials) {
+    try {
+      return await refreshAccessToken({
+        refreshToken: args.refreshToken,
+        clientId: credentials.clientId,
+        clientSecret: credentials.clientSecret,
+      });
+    } catch (error) {
+      lastError = error;
+      if (!isPermanentRefreshFailure(error)) throw error;
+    }
+  }
+  throw lastError instanceof Error
+    ? lastError
+    : new Error("Google token refresh failed.");
+}
+
 /** Best-effort revoke. Returns true if Google returned 2xx, false otherwise. */
 export async function revokeToken(token: string): Promise<boolean> {
   try {

package/corpus/templates/clips/server/routes/_agent-native/google/auth-url.get.ts

@@ -8,6 +8,7 @@ import {
   encodeOAuthState,
   getSession,
   isElectron,
+  resolveGoogleSignInCredentials,
   resolveOAuthRedirectUri,
   safeReturnPath,
 } from "@agent-native/core/server";
@@ -34,17 +35,6 @@ function oauthRedirectResponse(url: string) {
 }
 
 export default defineEventHandler(async (event: H3Event) => {
-  const clientId = process.env.GOOGLE_CLIENT_ID;
-  const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
-  if (!clientId || !clientSecret) {
-    setResponseStatus(event, 422);
-    return {
-      error: "missing_credentials",
-      message:
-        "Google OAuth credentials are not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.",
-    };
-  }
-
   try {
     const q = getQuery(event);
     const redirectUri = resolveOAuthRedirectUri(event);
@@ -67,6 +57,23 @@ export default defineEventHandler(async (event: H3Event) => {
     const returnUrl = requestedReturn !== "/" ? requestedReturn : undefined;
     const calendarConnect =
       q.calendar === "1" || q.calendar === "true" || q.product === "calendar";
+    const credentials = calendarConnect
+      ? process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET
+        ? {
+            clientId: process.env.GOOGLE_CLIENT_ID,
+            clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+          }
+        : null
+      : resolveGoogleSignInCredentials();
+    if (!credentials) {
+      setResponseStatus(event, 422);
+      return {
+        error: "missing_credentials",
+        message: calendarConnect
+          ? "Google Calendar OAuth credentials are not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET."
+          : "Google sign-in credentials are not configured. Set GOOGLE_SIGN_IN_CLIENT_ID and GOOGLE_SIGN_IN_CLIENT_SECRET.",
+      };
+    }
 
     if (calendarConnect && !owner) {
       setResponseStatus(event, 401);
@@ -87,7 +94,7 @@ export default defineEventHandler(async (event: H3Event) => {
     });
 
     const params = new URLSearchParams({
-      client_id: clientId,
+      client_id: credentials.clientId,
       redirect_uri: redirectUri,
       response_type: "code",
       state,

package/corpus/templates/clips/server/routes/_agent-native/google/callback.get.ts

@@ -10,6 +10,7 @@ import {
   getAppUrl,
   oauthCallbackResponse,
   oauthErrorPage,
+  resolveGoogleSignInCredentials,
   resolveOAuthOwner,
   setDesktopExchange,
   type OAuthStatePayload,
@@ -51,11 +52,10 @@ async function handleGoogleSignInCallback(
       return { error: "Missing authorization code" };
     }
 
-    const clientId = process.env.GOOGLE_CLIENT_ID;
-    const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
-    if (!clientId || !clientSecret) {
+    const credentials = resolveGoogleSignInCredentials();
+    if (!credentials) {
       return oauthErrorPage(
-        "Google OAuth is not configured (missing client id/secret).",
+        "Google sign-in is not configured (missing client id/secret).",
       );
     }
 
@@ -66,8 +66,8 @@ async function handleGoogleSignInCallback(
       },
       body: new URLSearchParams({
         code,
-        client_id: clientId,
-        client_secret: clientSecret,
+        client_id: credentials.clientId,
+        client_secret: credentials.clientSecret,
         redirect_uri: state.redirectUri,
         grant_type: "authorization_code",
       }),

package/corpus/templates/content/vite.config.ts

@@ -346,6 +346,42 @@ const dynamicLocalComponentDirs = (() => {
   }
 })();
 
+const cloudflareSsrStubs =
+  process.env.NITRO_PRESET === "cloudflare_pages"
+    ? [
+        "@assistant-ui/react",
+        "@tiptap/core",
+        "@tiptap/extension-blockquote",
+        "@tiptap/extension-code-block-lowlight",
+        "@tiptap/extension-collaboration",
+        "@tiptap/extension-collaboration-caret",
+        "@tiptap/extension-image",
+        "@tiptap/extension-link",
+        "@tiptap/extension-placeholder",
+        "@tiptap/extension-table",
+        "@tiptap/extension-table-cell",
+        "@tiptap/extension-table-header",
+        "@tiptap/extension-table-row",
+        "@tiptap/extension-task-item",
+        "@tiptap/extension-task-list",
+        "@tiptap/pm",
+        "@tiptap/react",
+        "@tiptap/starter-kit",
+        "@xterm/addon-fit",
+        "@xterm/addon-web-links",
+        "@xterm/xterm",
+        "katex",
+        "lowlight",
+        "prettier",
+        "react-markdown",
+        "remark-gfm",
+        "remark-mdx",
+        "tiptap-markdown",
+        "yjs",
+        "y-protocols",
+      ]
+    : [];
+
 export default defineConfig({
   plugins: [contentLocalComponentsPlugin(), reactRouter()],
   fsAllow: [
@@ -354,7 +390,7 @@ export default defineConfig({
   ],
   // shiki only runs in AssistantChat's useEffect — keep it out of the
   // CF Pages Functions bundle (25 MiB limit).
-  ssrStubs: ["shiki"],
+  ssrStubs: ["shiki", ...cloudflareSsrStubs],
   optimizeDeps: {
     include: [
       "yjs",

package/corpus/templates/design/app/pages/NotFound.tsx

@@ -4,7 +4,7 @@ import { Button } from "@/components/ui/button";
 
 export default function NotFound() {
   return (
-    <div className="min-h-screen bg-background flex flex-col items-center justify-center">
+    <div className="flex min-h-full w-full flex-col items-center justify-center bg-background px-4 py-12">
       <h1 className="text-6xl font-bold text-muted-foreground/60 mb-4">404</h1>
       <p className="text-sm text-muted-foreground mb-6">
         The page you are looking for does not exist.

package/corpus/templates/design/app/routes/$.tsx

@@ -0,0 +1,9 @@
+import NotFound from "@/pages/NotFound";
+
+export function meta() {
+  return [{ title: "Not Found - Design" }];
+}
+
+export default function CatchAllRoute() {
+  return <NotFound />;
+}

package/corpus/templates/mail/app/pages/NotFound.tsx

@@ -4,7 +4,7 @@ import { Button } from "@/components/ui/button";
 
 export function NotFound() {
   return (
-    <div className="flex h-screen items-center justify-center bg-background">
+    <div className="flex min-h-full w-full items-center justify-center bg-background px-4 py-12">
       <div className="text-center">
         <IconMail className="h-12 w-12 text-muted-foreground/40 mx-auto mb-4" />
         <h1 className="text-2xl font-semibold text-foreground">404</h1>

package/corpus/templates/mail/app/routes/$.tsx

@@ -0,0 +1,9 @@
+import { NotFound } from "@/pages/NotFound";
+
+export function meta() {
+  return [{ title: "Not Found - Mail" }];
+}
+
+export default function CatchAllRoute() {
+  return <NotFound />;
+}

package/corpus/templates/plan/app/global.css

@@ -380,9 +380,9 @@
   --rail-gap: 2rem;
 }
 
-@media (min-width: 1024px) {
+@container plan-doc (min-width: 64rem) {
   .plan-content-surface[data-plan-layout="wide"] .plan-document-shell {
-    --plan-wide-component-width: min(1560px, calc(100vw - 5rem));
+    --plan-wide-component-width: min(1560px, calc(100cqw - 5rem));
   }
 
   .plan-content-surface[data-plan-layout="wide"] .plan-document-flow-stack {

package/corpus/templates/slides/app/pages/NotFound.tsx

@@ -10,7 +10,7 @@ export default function NotFound() {
   }, [location.pathname]);
 
   return (
-    <div className="min-h-screen flex items-center justify-center bg-background">
+    <div className="flex min-h-0 w-full flex-1 items-center justify-center bg-background px-4 py-12">
       <div className="text-center">
         <h1 className="text-6xl font-bold text-muted-foreground/40 mb-2">
           404

package/corpus/templates/slides/app/routes/$.tsx

@@ -0,0 +1,9 @@
+import NotFound from "@/pages/NotFound";
+
+export function meta() {
+  return [{ title: "Not Found - Slides" }];
+}
+
+export default function CatchAllRoute() {
+  return <NotFound />;
+}

package/corpus/templates/slides/server/lib/google-docs-oauth.ts

@@ -30,19 +30,55 @@ interface GoogleUserInfo {
   verified_email?: boolean;
 }
 
+interface GoogleOAuthCredentials {
+  clientId: string;
+  clientSecret: string;
+}
+
+function readCredentialPair(
+  clientIdKey: string,
+  clientSecretKey: string,
+): GoogleOAuthCredentials | null {
+  const clientId = process.env[clientIdKey];
+  const clientSecret = process.env[clientSecretKey];
+  if (!clientId || !clientSecret) return null;
+  return { clientId, clientSecret };
+}
+
+function resolveGoogleProviderCredentialCandidates(): GoogleOAuthCredentials[] {
+  const primary = readCredentialPair(
+    "GOOGLE_CLIENT_ID",
+    "GOOGLE_CLIENT_SECRET",
+  );
+  const legacy = readCredentialPair(
+    "GOOGLE_LEGACY_CLIENT_ID",
+    "GOOGLE_LEGACY_CLIENT_SECRET",
+  );
+  if (!primary) return legacy ? [legacy] : [];
+  if (!legacy || legacy.clientId === primary.clientId) return [primary];
+  return [primary, legacy];
+}
+
 function getOAuthCredentials(): { clientId: string; clientSecret: string } {
-  const clientId = process.env.GOOGLE_CLIENT_ID;
-  const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
-  if (!clientId || !clientSecret) {
+  const credentials = resolveGoogleProviderCredentialCandidates()[0];
+  if (!credentials) {
     throw new Error(
       "Google OAuth is not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.",
     );
   }
-  return { clientId, clientSecret };
+  return credentials;
 }
 
 export function isGoogleDocsOAuthConfigured(): boolean {
-  return !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
+  return resolveGoogleProviderCredentialCandidates().length > 0;
+}
+
+function isPermanentGoogleRefreshError(error: string | undefined): boolean {
+  return (
+    error === "invalid_grant" ||
+    error === "unauthorized_client" ||
+    error === "invalid_client"
+  );
 }
 
 export function getGooglePickerConfig(): {
@@ -98,35 +134,55 @@ async function refreshGoogleDocsToken(
     throw new Error("Google Docs connection expired. Please reconnect.");
   }
 
-  const { clientId, clientSecret } = getOAuthCredentials();
-  const response = await fetch(TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      refresh_token: tokens.refresh_token,
-      client_id: clientId,
-      client_secret: clientSecret,
-      grant_type: "refresh_token",
-    }),
-  });
-  const data = (await response.json()) as {
+  const credentialCandidates = resolveGoogleProviderCredentialCandidates();
+  let data: {
     access_token?: string;
     expires_in?: number;
     token_type?: string;
     scope?: string;
     error?: string;
     error_description?: string;
-  };
-  if (!response.ok || !data.access_token) {
-    if (
-      data.error === "invalid_grant" ||
-      data.error === "unauthorized_client" ||
-      data.error === "invalid_client"
-    ) {
+  } | null = null;
+  let lastStatusText = "Could not refresh Google token.";
+  for (const credentials of credentialCandidates) {
+    const response = await fetch(TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        refresh_token: tokens.refresh_token,
+        client_id: credentials.clientId,
+        client_secret: credentials.clientSecret,
+        grant_type: "refresh_token",
+      }),
+    });
+    lastStatusText = response.statusText;
+    data = (await response.json()) as {
+      access_token?: string;
+      expires_in?: number;
+      token_type?: string;
+      scope?: string;
+      error?: string;
+      error_description?: string;
+    };
+    if (response.ok && data.access_token) break;
+    if (!isPermanentGoogleRefreshError(data.error)) {
+      throw new Error(
+        data.error_description ||
+          data.error ||
+          "Could not refresh Google token.",
+      );
+    }
+  }
+
+  if (!data?.access_token) {
+    if (isPermanentGoogleRefreshError(data?.error)) {
       await deleteOAuthTokens(GOOGLE_DOCS_PROVIDER, accountId);
     }
     throw new Error(
-      data.error_description || data.error || "Could not refresh Google token.",
+      data?.error_description ||
+        data?.error ||
+        lastStatusText ||
+        "Could not refresh Google token.",
     );
   }
 

package/corpus/templates/videos/app/pages/NotFound.tsx

@@ -12,7 +12,7 @@ const NotFound = () => {
   }, [location.pathname]);
 
   return (
-    <div className="min-h-screen flex items-center justify-center bg-background">
+    <div className="flex min-h-full w-full items-center justify-center bg-background px-4 py-12">
       <div className="text-center">
         <h1 className="text-5xl font-bold text-muted-foreground/30 mb-3">
           404