@agent-native/core 0.72.3 → 0.73.0

package/corpus/core/src/server/onboarding-html.ts

@@ -55,6 +55,36 @@ function withAppBasePath(path: string): string {
   return `${basePath}${cleanPath}`;
 }
 
+const AGENT_NATIVE_TERMS_URL = "https://www.agent-native.com/terms";
+const AGENT_NATIVE_PRIVACY_URL = "https://www.agent-native.com/privacy";
+
+export interface SignupLegalNoticeOptions {
+  termsUrl: string;
+  privacyUrl: string;
+  termsLabel?: string;
+  privacyLabel?: string;
+  prefix?: string;
+  connector?: string;
+  suffix?: string;
+}
+
+function normalizeRequestHostname(host: string | undefined): string {
+  const firstHost = host?.split(",")[0]?.trim().toLowerCase() ?? "";
+  if (!firstHost) return "";
+  if (firstHost.startsWith("[")) {
+    const close = firstHost.indexOf("]");
+    return close > 0 ? firstHost.slice(1, close) : firstHost;
+  }
+  return firstHost.replace(/:\d+$/, "");
+}
+
+function isAgentNativeHostedHost(host: string | undefined): boolean {
+  const hostname = normalizeRequestHostname(host);
+  return (
+    hostname === "agent-native.com" || hostname.endsWith(".agent-native.com")
+  );
+}
+
 export interface OnboardingHtmlOptions {
   /**
    * Hide email/password forms and show ONLY the Google sign-in button.
@@ -93,6 +123,12 @@ export interface OnboardingHtmlOptions {
     continueLabel?: string;
     cancelLabel?: string;
   };
+  /**
+   * Optional email signup legal copy. Builder-hosted `*.agent-native.com`
+   * deployments get the Agent Native links automatically; self-hosted and
+   * custom-domain apps must opt in with their own URLs.
+   */
+  signupLegalNotice?: SignupLegalNoticeOptions | false;
   /**
    * Google sign-in flow: `'popup'`, `'redirect'`, or `'auto'` (default).
    * Falls back to `GOOGLE_AUTH_MODE` env var, then `'auto'`. Builder web
@@ -139,6 +175,21 @@ export function getOnboardingHtml(opts: OnboardingHtmlOptions = {}): string {
       .replace(/</g, "&lt;")
       .replace(/>/g, "&gt;")
       .replace(/"/g, "&quot;");
+  const hostedSignupLegalNotice: SignupLegalNoticeOptions | undefined =
+    opts.signupLegalNotice === undefined &&
+    isAgentNativeHostedHost(opts.requestHost)
+      ? {
+          termsUrl: AGENT_NATIVE_TERMS_URL,
+          privacyUrl: AGENT_NATIVE_PRIVACY_URL,
+        }
+      : undefined;
+  const signupLegalNotice =
+    opts.signupLegalNotice === false
+      ? undefined
+      : (opts.signupLegalNotice ?? hostedSignupLegalNotice);
+  const signupLegalNoteHtml = signupLegalNotice
+    ? `      <p class="legal-note">${esc(signupLegalNotice.prefix ?? "By signing up, you accept our")} <a href="${esc(signupLegalNotice.termsUrl)}" target="_blank" rel="noreferrer">${esc(signupLegalNotice.termsLabel ?? "Terms")}</a> ${esc(signupLegalNotice.connector ?? "and")} <a href="${esc(signupLegalNotice.privacyUrl)}" target="_blank" rel="noreferrer">${esc(signupLegalNotice.privacyLabel ?? "Privacy Policy")}</a>${esc(signupLegalNotice.suffix ?? ".")}</p>`
+    : "";
   const googleSignInNotice = opts.googleSignInNotice;
   const googleNoticeBodyParts = googleSignInNotice
     ? (Array.isArray(googleSignInNotice.body)
@@ -177,11 +228,16 @@ export function getOnboardingHtml(opts: OnboardingHtmlOptions = {}): string {
     aria-describedby="google-preflight-copy"
     tabindex="-1"
   >
-    <div class="google-preflight-heading">
-      <p class="google-preflight-title" id="google-preflight-title">${esc(googleSignInNotice.title)}</p>
-      <button type="button" class="google-preflight-close" aria-label="Close Google sign-in choices" onclick="__anHideGoogleNotice()">&times;</button>
-    </div>
+    <button type="button" class="google-preflight-close" aria-label="Close Google sign-in choices" onclick="__anHideGoogleNotice()">&times;</button>
+    <div class="google-preflight-main">
+      <span class="google-preflight-icon" aria-hidden="true">
+        <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M10.24 3.957l-8.422 14.06a1.989 1.989 0 0 0 1.7 2.983h16.845a1.989 1.989 0 0 0 1.7 -2.983l-8.423 -14.06a1.989 1.989 0 0 0 -3.4 0z"/><path d="M12 9v4"/><path d="M12 16h.01"/></svg>
+      </span>
+      <div class="google-preflight-text">
+        <p class="google-preflight-title" id="google-preflight-title">${esc(googleSignInNotice.title)}</p>
 ${googleNoticeBodyHtml}
+      </div>
+    </div>
     <div class="google-preflight-actions">
       <button type="button" class="btn-primary" id="google-preflight-continue" onclick="__anAcceptGoogleNotice()">${esc(googleSignInNotice.continueLabel ?? "Continue")}</button>
 ${googleNoticeRunLocalHtml}
@@ -707,6 +763,19 @@ ${
     cursor: pointer;
   }
   .btn-secondary:hover { color: #bbb; border-color: rgba(255,255,255,0.2); }
+  .legal-note {
+    margin-top: 0.625rem;
+    color: #666;
+    font-size: 0.6875rem;
+    line-height: 1.45;
+    text-align: center;
+  }
+  .legal-note a {
+    color: #777;
+    text-decoration: underline;
+    text-underline-offset: 2px;
+  }
+  .legal-note a:hover { color: #aaa; }
   .msg { margin-top: 0.75rem; font-size: 0.8125rem; display: none; }
   .msg.error { color: #f87171; }
   .msg.success { color: #33C4FF; }
@@ -898,25 +967,40 @@ ${
     border-left: 1px solid rgba(255,255,255,0.12);
     border-top: 1px solid rgba(255,255,255,0.12);
   }
-  .google-preflight-heading {
+  .google-preflight-main {
     display: flex;
     align-items: flex-start;
-    justify-content: space-between;
-    gap: 0.75rem;
-    margin-bottom: 0.375rem;
+    gap: 0.625rem;
+    padding-right: 1.25rem;
   }
+  .google-preflight-icon {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    flex: none;
+    width: 1.75rem;
+    height: 1.75rem;
+    border-radius: 7px;
+    background: rgba(245,158,11,0.15);
+    color: #fcd34d;
+  }
+  .google-preflight-icon svg { width: 1rem; height: 1rem; }
+  .google-preflight-text { min-width: 0; }
   .google-preflight-title {
     color: #fff;
     font-size: 0.8125rem;
     font-weight: 600;
+    margin-bottom: 0.25rem;
   }
   .google-preflight-close {
+    position: absolute;
+    top: 0.5rem;
+    right: 0.5rem;
     display: inline-flex;
     align-items: center;
     justify-content: center;
     width: 1.5rem;
     height: 1.5rem;
-    margin: -0.25rem -0.25rem 0 0;
     background: transparent;
     border: none;
     border-radius: 999px;
@@ -942,6 +1026,7 @@ ${
     flex: 1;
     width: auto;
     margin-top: 0;
+    white-space: nowrap;
   }
   .google-preflight-command {
     margin-top: 0.75rem;
@@ -1039,6 +1124,7 @@ ${
     <label for="s-pass2">Confirm password</label>
     <input id="s-pass2" type="password" autocomplete="new-password" placeholder="Confirm password" required minlength="8" />
       <button type="submit">Create account</button>
+${signupLegalNoteHtml}
       <p class="msg" id="s-msg"></p>
     </form>
 

package/corpus/core/src/shared/mcp-embed-headers.ts

@@ -1,10 +1,16 @@
 export const MCP_EMBED_CORS_ALLOW_HEADERS =
-  "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
+  "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
 export const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 
 const CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\.claudemcpcontent\.com$/i;
 const CHATGPT_MCP_SANDBOX_HOST_RE =
   /^(?:[^.]+\.)?web-sandbox\.oaiusercontent\.com$/i;
+const AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX = ".agent-native.com";
+const MCP_PRODUCT_HOST_ORIGINS = new Set([
+  "https://chat.openai.com",
+  "https://chatgpt.com",
+  "https://claude.ai",
+]);
 
 export function isLocalMcpEmbedOrigin(
   origin: string | null | undefined,
@@ -50,6 +56,37 @@ export function isChatGptMcpSandboxOrigin(
   }
 }
 
+export function isMcpProductHostOrigin(
+  origin: string | null | undefined,
+): boolean {
+  if (!origin) return false;
+  try {
+    return MCP_PRODUCT_HOST_ORIGINS.has(new URL(origin).origin);
+  } catch {
+    return false;
+  }
+}
+
+export function isAgentNativeFirstPartyAppOrigin(
+  origin: string | null | undefined,
+): boolean {
+  if (!origin) return false;
+  try {
+    const url = new URL(origin);
+    const hostname = url.hostname.toLowerCase();
+    return (
+      url.protocol === "https:" &&
+      !url.username &&
+      !url.password &&
+      !url.port &&
+      hostname.endsWith(AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX) &&
+      hostname.length > AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX.length
+    );
+  } catch {
+    return false;
+  }
+}
+
 export function isMcpEmbedCorsOrigin(
   origin: string | null | undefined,
 ): boolean {
@@ -57,7 +94,9 @@ export function isMcpEmbedCorsOrigin(
     origin === "null" ||
     isLocalMcpEmbedOrigin(origin) ||
     isClaudeMcpContentOrigin(origin) ||
-    isChatGptMcpSandboxOrigin(origin)
+    isChatGptMcpSandboxOrigin(origin) ||
+    isMcpProductHostOrigin(origin) ||
+    isAgentNativeFirstPartyAppOrigin(origin)
   );
 }
 
@@ -67,7 +106,9 @@ export function shouldAllowMcpEmbedCredentials(
   return (
     origin !== "null" &&
     !isClaudeMcpContentOrigin(origin) &&
-    !isChatGptMcpSandboxOrigin(origin)
+    !isChatGptMcpSandboxOrigin(origin) &&
+    !isMcpProductHostOrigin(origin) &&
+    !isAgentNativeFirstPartyAppOrigin(origin)
   );
 }
 

package/corpus/core/src/templates/default/AGENTS.md

@@ -38,6 +38,10 @@ Read these local package docs before implementing advanced Agent Native
 features. Prefer this app's own `AGENTS.md` and `.agents/skills/` for
 app-specific rules, then use the corpus for reusable framework/template
 patterns.
+After updating `@agent-native/core`, run `pnpm skills:update` or
+`npx @agent-native/core@latest skills update scaffold --project` from the app
+root to refresh framework-provided `.agents/skills` and repair `CLAUDE.md` /
+`.claude/skills` compatibility links.
 
 ### Database Code
 

package/corpus/core/src/templates/default/package.json

@@ -8,7 +8,8 @@
     "start": "agent-native start",
     "typecheck": "agent-native typecheck",
     "action": "agent-native action",
-    "script": "agent-native script"
+    "script": "agent-native script",
+    "skills:update": "agent-native skills update scaffold --project"
   },
   "dependencies": {
     "@agent-native/core": "latest",

package/corpus/core/src/templates/headless/AGENTS.md

@@ -38,6 +38,10 @@ first-party template patterns ships in `node_modules/@agent-native/core/corpus`.
 Read these local package docs before implementing advanced Agent Native
 features. Prefer this app's own `AGENTS.md` for app-specific rules, then use
 the corpus for reusable framework/template patterns.
+After updating `@agent-native/core`, run `pnpm skills:update` or
+`npx @agent-native/core@latest skills update scaffold --project` from the app
+root to refresh framework-provided `.agents/skills` and repair `CLAUDE.md` /
+`.claude/skills` compatibility links.
 
 ## Actions
 

package/corpus/core/src/templates/headless/package.json

@@ -6,6 +6,7 @@
     "action": "agent-native action",
     "agent": "agent-native agent",
     "script": "agent-native script",
+    "skills:update": "agent-native skills update scaffold --project",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {

package/corpus/core/src/templates/workspace-root/AGENTS.md

@@ -27,6 +27,10 @@ first-party template patterns ships in `node_modules/@agent-native/core/corpus`.
 Use package docs for framework APIs, the package corpus for reusable
 framework/template patterns, and `packages/shared/AGENTS.md` plus
 `packages/shared/.agents/skills/` for workspace-specific conventions.
+After updating `@agent-native/core`, run `pnpm skills:update` or
+`npx @agent-native/core@latest skills update scaffold --project` from the
+workspace root to refresh framework-provided shared skills and repair
+`CLAUDE.md` / `.claude/skills` compatibility links.
 
 ## Core Agent Rule
 

package/corpus/core/src/templates/workspace-root/README.md

@@ -35,6 +35,10 @@ the shared package (`@{{APP_NAME}}/shared`).
 
 The workspace root also links `.agents/skills` to the shared package so coding
 agents launched from the root can discover the same workspace-wide skills.
+Run `pnpm skills:update` (or
+`npx @agent-native/core@latest skills update scaffold --project`) after updating
+`@agent-native/core` to refresh framework-provided shared skills and repair
+Claude compatibility links.
 
 Runtime-editable global resources live in Dispatch, not in `packages/shared`.
 Use Dispatch **Resources** for company context and guardrails that admins should

package/corpus/core/src/templates/workspace-root/package.json

@@ -7,6 +7,7 @@
     "build": "pnpm -r build",
     "typecheck": "pnpm -r typecheck",
     "repair:workspace-org": "tsx scripts/repair-workspace-org.ts",
+    "skills:update": "agent-native skills update scaffold --project",
     "fmt:check": "prettier --check .",
     "lint": "pnpm fmt:check"
   },

package/corpus/core/src/vite/client.ts

@@ -954,6 +954,52 @@ const VITE_RUNTIME_PATH_PREFIXES = [
   "/src/",
 ];
 
+const EMBED_DEV_STATIC_ASSET_PATH_PREFIXES = [
+  ...VITE_RUNTIME_PATH_PREFIXES,
+  "/assets/",
+  "/library-presets/",
+];
+
+const EMBED_DEV_STATIC_ASSET_PATHS = new Set([
+  "/favicon.ico",
+  "/favicon.svg",
+  "/manifest.json",
+]);
+
+function mountedPathCandidates(
+  reqUrl: string | undefined,
+  base: string | undefined,
+): string[] {
+  if (!reqUrl) return [];
+  let pathname: string;
+  try {
+    pathname = new URL(reqUrl, "http://agent-native.local").pathname;
+  } catch {
+    return [];
+  }
+  if (base && base !== "/") {
+    const normalizedBase = base.endsWith("/") ? base : `${base}/`;
+    if (pathname.startsWith(normalizedBase)) {
+      return [pathname.slice(normalizedBase.length - 1) || "/"];
+    }
+  }
+  return [pathname];
+}
+
+function isEmbedDevStaticAssetRequest(
+  reqUrl: string | undefined,
+  base: string | undefined,
+): boolean {
+  return mountedPathCandidates(reqUrl, base).some((pathname) => {
+    if (EMBED_DEV_STATIC_ASSET_PATHS.has(pathname)) return true;
+    if (/^\/icon-[^/]+\.svg$/i.test(pathname)) return true;
+    if (/^\/agent-native-[^/]+\.svg$/i.test(pathname)) return true;
+    return EMBED_DEV_STATIC_ASSET_PATH_PREFIXES.some((prefix) =>
+      pathname.startsWith(prefix),
+    );
+  });
+}
+
 function cookieValue(req: IncomingMessage, name: string): string | undefined {
   const header = req.headers.cookie;
   if (typeof header !== "string" || !header) return undefined;
@@ -1166,6 +1212,13 @@ function embedDevFrameHeaders(): Plugin {
     configureServer(server) {
       server.middlewares.use((req, res, next) => {
         const origin = String(req.headers.origin ?? "");
+        if (isEmbedDevStaticAssetRequest(req.url, server.config?.base)) {
+          for (const [name, value] of Object.entries(
+            MCP_EMBED_STATIC_ASSET_HEADERS,
+          )) {
+            res.setHeader(name, value);
+          }
+        }
         if (isMcpEmbedCorsOrigin(origin)) {
           res.setHeader("Access-Control-Allow-Origin", origin);
           res.setHeader("Vary", "Origin");

package/corpus/templates/analytics/actions/update-dashboard.ts

@@ -265,9 +265,8 @@ function validateDashboardConfig(
     if (!p || typeof p !== "object") {
       return `panel[${i}] must be an object`;
     }
-    // Section panels are pure layout dividers — they have no query, so source
-    // and sql are optional. They still need id/title/chartType/width so the
-    // grid renders them.
+    // Section panels are pure layout dividers, so source and sql are optional.
+    // Width stays required for backward-compatible dashboard payloads.
     const isSection = p.chartType === "section";
     const required = isSection
       ? (["id", "title", "chartType", "width"] as const)
@@ -276,7 +275,7 @@ function validateDashboardConfig(
       const v = p[field];
       if (field === "width") {
         if (!isValidColumnCount(v)) {
-          return `panel[${i}].width must be an integer between 1 and 6 (number of grid columns to span)`;
+          return `panel[${i}].width must be an integer between 1 and 6 (legacy layout field)`;
         }
         continue;
       }