@agent-native/core 0.79.17 → 0.79.19

package/corpus/README.md

@@ -27,5 +27,5 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- core files: 2030
-- template files: 4399
+- core files: 2031
+- template files: 4416

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @agent-native/core
 
+## 0.79.19
+
+### Patch Changes
+
+- 92876ad: Use a compact popover for the shared language picker so icon-only chrome can style it reliably.
+
+## 0.79.18
+
+### Patch Changes
+
+- a6492db: Quiet app-shell divider lines, taller center headers, and soften raised drawer/card surfaces in dark mode.
+- a6492db: Save legacy key setup requests to scoped DB secrets instead of writing deployment env vars, and let file upload providers resolve request-scoped credentials.
+- a6492db: Add a reusable settings tab shell and let team settings hide their duplicate panel title.
+
 ## 0.79.17
 
 ### Patch Changes

package/corpus/core/docs/content/file-uploads.md

@@ -54,22 +54,28 @@ Register a custom provider in a server plugin to use any storage backend (S3, Cl
 ```ts
 // server/plugins/file-upload.ts
 import { registerFileUploadProvider } from "@agent-native/core/file-upload";
+import { resolveSecret } from "@agent-native/core/server";
 
 export default defineNitroPlugin(() => {
+  const readBucket = () => resolveSecret("S3_BUCKET");
+
   registerFileUploadProvider({
     id: "s3",
     name: "Amazon S3",
-    isConfigured: () => !!process.env.S3_BUCKET,
+    isConfigured: () => false,
+    isConfiguredForRequest: async () => !!(await readBucket()),
     upload: async ({ data, filename, mimeType }) => {
+      const bucket = await readBucket();
+      if (!bucket) throw new Error("S3 storage is not configured");
       const key = `uploads/${Date.now()}-${filename}`;
       await s3Client.putObject({
-        Bucket: process.env.S3_BUCKET!,
+        Bucket: bucket,
         Key: key,
         Body: data,
         ContentType: mimeType,
       });
       return {
-        url: `https://${process.env.S3_BUCKET}.s3.amazonaws.com/${key}`,
+        url: `https://${bucket}.s3.amazonaws.com/${key}`,
         provider: "s3",
       };
     },
@@ -85,7 +91,8 @@ The `FileUploadProvider` interface:
 interface FileUploadProvider {
   id: string; // Unique id, e.g. "s3"
   name: string; // Human-readable name
-  isConfigured: () => boolean; // True when ready (env vars set, etc.)
+  isConfigured: () => boolean; // True when ready from sync runtime state
+  isConfiguredForRequest?: () => Promise<boolean>; // True from scoped DB secrets
   upload: (input: FileUploadInput) => Promise<FileUploadResult>;
 }
 

package/corpus/core/docs/content/locales/ar-SA/multi-app-workspace.md

@@ -168,7 +168,7 @@ pnpm dev
 
 ## متغيرات البيئة المشتركة {#shared-env}
 
-يتم تحميل جذر مساحة العمل `.env` في كل تطبيق تلقائيًا. ضع المفاتيح المشتركة مرة واحدة في الجذر — `ANTHROPIC_API_KEY`، `A2A_SECRET`، `BETTER_AUTH_SECRET`، `DATABASE_URL`، `BUILDER_PRIVATE_KEY`، وما إلى ذلك — وسيلتقطها كل تطبيق. يتم إجراء التجاوزات لكل تطبيق في `apps/<name>/.env` والفوز في الصراع.
+The workspace root `.env` is loaded into every app automatically for deployment-level configuration such as `A2A_SECRET`, `BETTER_AUTH_SECRET`, and `DATABASE_URL`. User, org, and workspace API keys should be saved as scoped DB secrets instead of being written into `.env`. Per-app deploy-time overrides can still go in `apps/<name>/.env` and win on conflict.
 
 بالنسبة لبيانات اعتماد تطبيق وقت التشغيل، تفضل Dispatch vault على تحرير ملفات `.env` يدويًا. يتم تعيين الوصول الافتراضي للمخزن إلى جميع التطبيقات، لذلك يكون كل مفتاح مخزن محفوظ متاحًا لكل تطبيق مساحة عمل ويمكن دفعه باستخدام `sync-vault-to-app`. قم بتبديل المخزن إلى الوضع اليدوي فقط عندما تحتاج التطبيقات إلى منح صريحة لكل مفتاح.
 
@@ -182,8 +182,8 @@ my-company-platform/
 
 هناك عدد قليل من عمليات الإعداد التي تكون جاهزة للاستخدام في مساحة العمل:
 
-- **Builder `/cli-auth`**: يؤدي النقر على "Connect Builder" من أي تطبيق إلى كتابة `BUILDER_PRIVATE_KEY` والأصدقاء إلى **جذر مساحة العمل** `.env`، بحيث يتمكن كل تطبيق من الوصول إلى المتصفح مرة واحدة.
-- **مسار إعدادات Env-vars** (`POST /_agent-native/env-vars`): عندما تكون داخل مساحة عمل، يتم كتابة جذر مساحة العمل بشكل افتراضي `.env`. قم بتمرير `scope: "app"` في النص لتجاوز تطبيق واحد.
+- **Builder `/cli-auth`**: clicking "Connect Builder" from any app writes `BUILDER_PRIVATE_KEY` and related metadata to scoped DB secrets, so every app can resolve the connection without sharing a deploy-global key.
+- **Compatibility key route** (`POST /_agent-native/env-vars`): older onboarding forms still call this route name, but it now saves values as scoped DB secrets. Pass `scope: "workspace"` to share with the active org, or omit it for a per-user key.
 
 ## بيانات الاعتماد المشتركة {#shared-credentials}
 

package/corpus/core/docs/content/locales/de-DE/multi-app-workspace.md

@@ -168,7 +168,7 @@ Informationen zum Konfigurationsschema, zu den Prioritätsregeln und zur Hub-Ein
 
 ## Gemeinsame Umgebungsvariablen {#shared-env}
 
-Das Arbeitsbereichsstammverzeichnis `.env` wird automatisch in jede App geladen. Legen Sie gemeinsam genutzte Schlüssel einmal im Stammverzeichnis ab – `ANTHROPIC_API_KEY`, `A2A_SECRET`, `BETTER_AUTH_SECRET`, `DATABASE_URL`, `BUILDER_PRIVATE_KEY` usw. – und jede App übernimmt sie. Überschreibungen pro App erfolgen in `apps/<name>/.env` und gewinnen bei Konflikten.
+The workspace root `.env` is loaded into every app automatically for deployment-level configuration such as `A2A_SECRET`, `BETTER_AUTH_SECRET`, and `DATABASE_URL`. User, org, and workspace API keys should be saved as scoped DB secrets instead of being written into `.env`. Per-app deploy-time overrides can still go in `apps/<name>/.env` and win on conflict.
 
 Für Laufzeit-App-Anmeldeinformationen bevorzugen Sie den Dispatch-Tresor gegenüber der manuellen Bearbeitung von `.env`-Dateien. Der Tresor ist standardmäßig auf den Zugriff aller Apps eingestellt, sodass jeder gespeicherte Tresorschlüssel für jede Workspace-App verfügbar ist und mit `sync-vault-to-app` übertragen werden kann. Schalten Sie den Tresor nur dann in den manuellen Modus, wenn Apps explizite Gewährung pro Schlüssel benötigen.
 
@@ -182,8 +182,8 @@ my-company-platform/
 
 Einige Onboarding-Abläufe sind standardmäßig arbeitsbereichsorientiert:
 
-- **Builder `/cli-auth`**: Wenn Sie in einer beliebigen App auf „Builder verbinden“ klicken, werden `BUILDER_PRIVATE_KEY` und Freunde in das **Arbeitsbereichsstammverzeichnis** `.env` geschrieben, sodass jede App sofort Browserzugriff erhält.
-- **Env-vars-Einstellungsroute** (`POST /_agent-native/env-vars`): Wenn innerhalb eines Arbeitsbereichs, wird standardmäßig das Arbeitsbereichsstammverzeichnis `.env` geschrieben. Übergeben Sie `scope: "app"` im Textkörper, um eine App zu überschreiben.
+- **Builder `/cli-auth`**: clicking "Connect Builder" from any app writes `BUILDER_PRIVATE_KEY` and related metadata to scoped DB secrets, so every app can resolve the connection without sharing a deploy-global key.
+- **Compatibility key route** (`POST /_agent-native/env-vars`): older onboarding forms still call this route name, but it now saves values as scoped DB secrets. Pass `scope: "workspace"` to share with the active org, or omit it for a per-user key.
 
 ## Gemeinsame Anmeldeinformationen {#shared-credentials}
 

package/corpus/core/docs/content/locales/es-ES/multi-app-workspace.md

@@ -168,7 +168,7 @@ Consulte [MCP Clients](/docs/mcp-clients) para conocer el esquema de configuraci
 
 ## Variables de entorno compartidas {#shared-env}
 
-La raíz del espacio de trabajo `.env` se carga automáticamente en cada aplicación. Coloque las claves compartidas una vez en la raíz (`ANTHROPIC_API_KEY`, `A2A_SECRET`, `BETTER_AUTH_SECRET`, `DATABASE_URL`, `BUILDER_PRIVATE_KEY`, etc.) y cada aplicación las recogerá. Las anulaciones por aplicación van en `apps/<name>/.env` y ganan en caso de conflicto.
+The workspace root `.env` is loaded into every app automatically for deployment-level configuration such as `A2A_SECRET`, `BETTER_AUTH_SECRET`, and `DATABASE_URL`. User, org, and workspace API keys should be saved as scoped DB secrets instead of being written into `.env`. Per-app deploy-time overrides can still go in `apps/<name>/.env` and win on conflict.
 
 Para las credenciales de la aplicación en tiempo de ejecución, prefiera la bóveda de Dispatch a la edición manual de archivos `.env`. La bóveda tiene de forma predeterminada acceso a todas las aplicaciones, por lo que cada clave de bóveda guardada está disponible para todas las aplicaciones del espacio de trabajo y se puede enviar con `sync-vault-to-app`. Cambie la bóveda al modo manual solo cuando las aplicaciones necesiten concesiones explícitas por clave.
 
@@ -182,8 +182,8 @@ my-company-platform/
 
 Algunos flujos de incorporación tienen en cuenta el espacio de trabajo desde el primer momento:
 
-- **Builder `/cli-auth`**: al hacer clic en "Conectar Builder" desde cualquier aplicación, `BUILDER_PRIVATE_KEY` y sus amigos se escriben en la **raíz del espacio de trabajo** `.env`, por lo que todas las aplicaciones obtienen acceso al navegador a la vez.
-- **Ruta de configuración de Env-vars** (`POST /_agent-native/env-vars`): cuando está dentro de un espacio de trabajo, de forma predeterminada se escribe la raíz del espacio de trabajo `.env`. Pase `scope: "app"` en el cuerpo para anular una aplicación.
+- **Builder `/cli-auth`**: clicking "Connect Builder" from any app writes `BUILDER_PRIVATE_KEY` and related metadata to scoped DB secrets, so every app can resolve the connection without sharing a deploy-global key.
+- **Compatibility key route** (`POST /_agent-native/env-vars`): older onboarding forms still call this route name, but it now saves values as scoped DB secrets. Pass `scope: "workspace"` to share with the active org, or omit it for a per-user key.
 
 ## Credenciales compartidas {#shared-credentials}
 

package/corpus/core/docs/content/locales/fr-FR/multi-app-workspace.md

@@ -168,7 +168,7 @@ Voir [MCP Clients](/docs/mcp-clients) pour le schéma de configuration, les règ
 
 ## Variables d'environnement partagées {#shared-env}
 
-La racine de l'espace de travail `.env` est chargée automatiquement dans chaque application. Placez les clés partagées une fois à la racine – `ANTHROPIC_API_KEY`, `A2A_SECRET`, `BETTER_AUTH_SECRET`, `DATABASE_URL`, `BUILDER_PRIVATE_KEY`, etc. – et chaque application les récupère. Les remplacements par application vont dans `apps/<name>/.env` et gagnent en cas de conflit.
+The workspace root `.env` is loaded into every app automatically for deployment-level configuration such as `A2A_SECRET`, `BETTER_AUTH_SECRET`, and `DATABASE_URL`. User, org, and workspace API keys should be saved as scoped DB secrets instead of being written into `.env`. Per-app deploy-time overrides can still go in `apps/<name>/.env` and win on conflict.
 
 Pour les informations d'identification de l'application d'exécution, préférez le coffre-fort Dispatch à la modification manuelle des fichiers `.env`. Le coffre-fort est par défaut un accès à toutes les applications, de sorte que chaque clé du coffre-fort enregistrée est disponible pour chaque application de l'espace de travail et peut être poussée avec `sync-vault-to-app`. Basculez le coffre-fort en mode manuel uniquement lorsque les applications ont besoin d'autorisations explicites par clé.
 
@@ -182,8 +182,8 @@ my-company-platform/
 
 Quelques flux d'intégration sont prêts à l'emploi et adaptés à l'espace de travail :
 
-- **Builder `/cli-auth`** : en cliquant sur "Connecter Builder" depuis n'importe quelle application, `BUILDER_PRIVATE_KEY` et ses amis sont écrits dans la **racine de l'espace de travail** `.env`, afin que chaque application puisse accéder au navigateur en même temps.
-- **Route des paramètres Env-vars** (`POST /_agent-native/env-vars`) : à l'intérieur d'un espace de travail, la racine de l'espace de travail est écrite par défaut `.env`. Transmettez `scope: "app"` dans le corps pour remplacer une application.
+- **Builder `/cli-auth`**: clicking "Connect Builder" from any app writes `BUILDER_PRIVATE_KEY` and related metadata to scoped DB secrets, so every app can resolve the connection without sharing a deploy-global key.
+- **Compatibility key route** (`POST /_agent-native/env-vars`): older onboarding forms still call this route name, but it now saves values as scoped DB secrets. Pass `scope: "workspace"` to share with the active org, or omit it for a per-user key.
 
 ## Identifiants partagés {#shared-credentials}
 

package/corpus/core/docs/content/locales/hi-IN/multi-app-workspace.md

@@ -168,7 +168,7 @@ pnpm dev
 
 ## साझा पर्यावरण चर {#shared-env}
 
-वर्कस्पेस रूट `.env` स्वचालित रूप से प्रत्येक ऐप में लोड होता है। साझा कुंजियों को एक बार रूट पर रखें - `ANTHROPIC_API_KEY`, `A2A_SECRET`, `BETTER_AUTH_SECRET`, `DATABASE_URL`, `BUILDER_PRIVATE_KEY`, आदि - और हर ऐप उन्हें चुन लेता है। प्रति-ऐप ओवरराइड `apps/<name>/.env` में जाते हैं और संघर्ष पर जीत हासिल करते हैं।
+The workspace root `.env` is loaded into every app automatically for deployment-level configuration such as `A2A_SECRET`, `BETTER_AUTH_SECRET`, and `DATABASE_URL`. User, org, and workspace API keys should be saved as scoped DB secrets instead of being written into `.env`. Per-app deploy-time overrides can still go in `apps/<name>/.env` and win on conflict.
 
 रनटाइम ऐप क्रेडेंशियल के लिए, `.env` फ़ाइलों को हाथ से संपादित करने के बजाय डिस्पैच वॉल्ट को प्राथमिकता दें। वॉल्ट डिफ़ॉल्ट रूप से सभी ऐप्स तक पहुंच प्रदान करता है, इसलिए प्रत्येक सहेजी गई वॉल्ट कुंजी प्रत्येक कार्यस्थान ऐप के लिए उपलब्ध है और इसे `sync-vault-to-app` के साथ पुश किया जा सकता है। वॉल्ट को मैन्युअल मोड में तभी स्विच करें जब ऐप्स को स्पष्ट प्रति-कुंजी अनुदान की आवश्यकता हो।
 
@@ -182,8 +182,8 @@ my-company-platform/
 
 कुछ ऑनबोर्डिंग प्रवाह बॉक्स से बाहर कार्यक्षेत्र-जागरूक हैं:
 
-- **Builder `/cli-auth`**: किसी भी ऐप से "कनेक्ट Builder" पर क्लिक करने से `BUILDER_PRIVATE_KEY` और मित्र **वर्कस्पेस रूट** `.env` पर लिखते हैं, इसलिए प्रत्येक ऐप एक ही बार में ब्राउज़र एक्सेस प्राप्त कर लेता है।
-- **Env-vars सेटिंग्स रूट** (`POST /_agent-native/env-vars`): जब किसी कार्यक्षेत्र के अंदर, डिफ़ॉल्ट रूप से कार्यक्षेत्र रूट `.env` लिखा जाता है। एक ऐप को ओवरराइड करने के लिए बॉडी में `scope: "app"` पास करें।
+- **Builder `/cli-auth`**: clicking "Connect Builder" from any app writes `BUILDER_PRIVATE_KEY` and related metadata to scoped DB secrets, so every app can resolve the connection without sharing a deploy-global key.
+- **Compatibility key route** (`POST /_agent-native/env-vars`): older onboarding forms still call this route name, but it now saves values as scoped DB secrets. Pass `scope: "workspace"` to share with the active org, or omit it for a per-user key.
 
 ## साझा क्रेडेंशियल {#shared-credentials}
 

package/corpus/core/docs/content/locales/ja-JP/multi-app-workspace.md

@@ -168,7 +168,7 @@ pnpm dev
 
 ## 共有環境変数 {#shared-env}
 
-ワークスペース ルート `.env` はすべてのアプリに自動的にロードされます。共有キーをルート (`ANTHROPIC_API_KEY`、`A2A_SECRET`、`BETTER_AUTH_SECRET`、`DATABASE_URL`、`BUILDER_PRIVATE_KEY` など) に一度置くと、すべてのアプリがそれらを取得します。アプリごとのオーバーライドは `apps/<name>/.env` で行われ、競合が発生した場合に優先されます。
+The workspace root `.env` is loaded into every app automatically for deployment-level configuration such as `A2A_SECRET`, `BETTER_AUTH_SECRET`, and `DATABASE_URL`. User, org, and workspace API keys should be saved as scoped DB secrets instead of being written into `.env`. Per-app deploy-time overrides can still go in `apps/<name>/.env` and win on conflict.
 
 ランタイム アプリの資格情報については、`.env` ファイルを手動で編集するよりも、Dispatch ボールトを使用することをお勧めします。ボールトはデフォルトですべてのアプリにアクセスするため、保存されたすべてのボールト キーはすべてのワークスペース アプリで使用でき、`sync-vault-to-app` でプッシュできます。アプリがキーごとの明示的な許可を必要とする場合にのみ、ボールトを手動モードに切り替えます。
 
@@ -182,8 +182,8 @@ my-company-platform/
 
 いくつかのオンボーディング フローは、すぐに使えるワークスペース対応です。
 
-- **Builder `/cli-auth`**: 任意のアプリから [Builder に接続] をクリックすると、`BUILDER_PRIVATE_KEY` とその友人が **ワークスペース ルート** `.env` に書き込まれるため、すべてのアプリが一度にブラウザー アクセスを取得します。
-- **Env-vars 設定ルート** (`POST /_agent-native/env-vars`): ワークスペース内では、デフォルトでワークスペース ルート `.env` が書き込まれます。 1 つのアプリをオーバーライドするには、本文で `scope: "app"` を渡します。
+- **Builder `/cli-auth`**: clicking "Connect Builder" from any app writes `BUILDER_PRIVATE_KEY` and related metadata to scoped DB secrets, so every app can resolve the connection without sharing a deploy-global key.
+- **Compatibility key route** (`POST /_agent-native/env-vars`): older onboarding forms still call this route name, but it now saves values as scoped DB secrets. Pass `scope: "workspace"` to share with the active org, or omit it for a per-user key.
 
 ## 共有認証情報 {#shared-credentials}
 

package/corpus/core/docs/content/locales/ko-KR/multi-app-workspace.md

@@ -168,7 +168,7 @@ pnpm dev
 
 ## 공유 환경 변수 {#shared-env}
 
-작업공간 루트 `.env`는 모든 앱에 자동으로 로드됩니다. 공유 키(`ANTHROPIC_API_KEY`, `A2A_SECRET`, `BETTER_AUTH_SECRET`, `DATABASE_URL`, `BUILDER_PRIVATE_KEY` 등)를 루트에 한 번만 넣으면 모든 앱이 이를 선택합니다. 앱별 재정의는 `apps/<name>/.env`에 들어가 충돌 시 승리합니다.
+The workspace root `.env` is loaded into every app automatically for deployment-level configuration such as `A2A_SECRET`, `BETTER_AUTH_SECRET`, and `DATABASE_URL`. User, org, and workspace API keys should be saved as scoped DB secrets instead of being written into `.env`. Per-app deploy-time overrides can still go in `apps/<name>/.env` and win on conflict.
 
 런타임 앱 자격 증명의 경우 `.env` 파일을 직접 편집하는 것보다 Dispatch Vault를 선호합니다. 볼트는 기본적으로 모든 앱 액세스로 설정되어 있으므로 저장된 모든 볼트 키는 모든 작업 공간 앱에서 사용할 수 있으며 `sync-vault-to-app`로 푸시할 수 있습니다. 앱에 명시적인 키별 부여가 필요한 경우에만 Vault를 수동 모드로 전환하세요.
 
@@ -182,8 +182,8 @@ my-company-platform/
 
 몇 가지 온보딩 흐름은 기본적으로 작업공간을 인식합니다.
 
-- **Builder `/cli-auth`**: 모든 앱에서 "Builder 연결"을 클릭하면 `BUILDER_PRIVATE_KEY`와 친구들이 **작업 공간 루트** `.env`에 기록되므로 모든 앱이 동시에 브라우저 액세스 권한을 얻게 됩니다.
-- **Env-vars 설정 경로** (`POST /_agent-native/env-vars`): 작업 공간 내부에 있을 때 기본적으로 작업 공간 루트 `.env`를 작성합니다. 하나의 앱을 재정의하려면 본문에 `scope: "app"`를 전달하세요.
+- **Builder `/cli-auth`**: clicking "Connect Builder" from any app writes `BUILDER_PRIVATE_KEY` and related metadata to scoped DB secrets, so every app can resolve the connection without sharing a deploy-global key.
+- **Compatibility key route** (`POST /_agent-native/env-vars`): older onboarding forms still call this route name, but it now saves values as scoped DB secrets. Pass `scope: "workspace"` to share with the active org, or omit it for a per-user key.
 
 ## 공유 자격 증명 {#shared-credentials}
 

package/corpus/core/docs/content/locales/pt-BR/multi-app-workspace.md

@@ -168,7 +168,7 @@ Consulte [MCP Clients](/docs/mcp-clients) para obter o esquema de configuração
 
 ## Variáveis de ambiente compartilhadas {#shared-env}
 
-A raiz do espaço de trabalho `.env` é carregada em cada aplicativo automaticamente. Coloque as chaves compartilhadas uma vez na raiz – `ANTHROPIC_API_KEY`, `A2A_SECRET`, `BETTER_AUTH_SECRET`, `DATABASE_URL`, `BUILDER_PRIVATE_KEY`, etc. – e cada aplicativo as seleciona. As substituições por aplicativo entram em `apps/<name>/.env` e vencem em caso de conflito.
+The workspace root `.env` is loaded into every app automatically for deployment-level configuration such as `A2A_SECRET`, `BETTER_AUTH_SECRET`, and `DATABASE_URL`. User, org, and workspace API keys should be saved as scoped DB secrets instead of being written into `.env`. Per-app deploy-time overrides can still go in `apps/<name>/.env` and win on conflict.
 
 Para credenciais de aplicativos de tempo de execução, prefira o cofre do Dispatch em vez da edição manual de arquivos `.env`. O padrão do cofre é o acesso a todos os aplicativos, portanto, cada chave do cofre salva está disponível para todos os aplicativos do espaço de trabalho e pode ser enviada por push com `sync-vault-to-app`. Mude o cofre para o modo manual somente quando os apps precisarem de concessões explícitas por chave.
 
@@ -182,8 +182,8 @@ my-company-platform/
 
 Alguns fluxos de integração já reconhecem o espaço de trabalho:
 
-- **Builder `/cli-auth`**: clicar em "Conectar Builder" em qualquer aplicativo grava `BUILDER_PRIVATE_KEY` e amigos na **raiz do espaço de trabalho** `.env`, para que todos os aplicativos obtenham acesso ao navegador de uma só vez.
-- **Rota de configurações Env-vars** (`POST /_agent-native/env-vars`): quando dentro de um espaço de trabalho, o padrão é gravar a raiz do espaço de trabalho `.env`. Passe `scope: "app"` no corpo para substituir um aplicativo.
+- **Builder `/cli-auth`**: clicking "Connect Builder" from any app writes `BUILDER_PRIVATE_KEY` and related metadata to scoped DB secrets, so every app can resolve the connection without sharing a deploy-global key.
+- **Compatibility key route** (`POST /_agent-native/env-vars`): older onboarding forms still call this route name, but it now saves values as scoped DB secrets. Pass `scope: "workspace"` to share with the active org, or omit it for a per-user key.
 
 ## Credenciais compartilhadas {#shared-credentials}
 

package/corpus/core/docs/content/locales/zh-CN/multi-app-workspace.md

@@ -168,7 +168,7 @@ pnpm dev
 
 ## 共享环境变量 {#shared-env}
 
-工作区根 `.env` 会自动加载到每个应用程序中。将共享密钥放在根目录中一次（`ANTHROPIC_API_KEY`、`A2A_SECRET`、`BETTER_AUTH_SECRET`、`DATABASE_URL`、`BUILDER_PRIVATE_KEY` 等），每个应用程序都会获取它们。每个应用程序覆盖进入 `apps/<name>/.env` 并在冲突时获胜。
+The workspace root `.env` is loaded into every app automatically for deployment-level configuration such as `A2A_SECRET`, `BETTER_AUTH_SECRET`, and `DATABASE_URL`. User, org, and workspace API keys should be saved as scoped DB secrets instead of being written into `.env`. Per-app deploy-time overrides can still go in `apps/<name>/.env` and win on conflict.
 
 对于运行时应用程序凭据，与手动编辑 `.env` 文件相比，更喜欢使用 DispatchVault。保管库默认为所有应用程序访问，因此每个保存的保管库密钥可供每个工作区应用程序使用，并且可以使用 `sync-vault-to-app` 推送。仅当应用程序需要显式的每密钥授权时，才将保管库切换到手动模式。
 
@@ -182,8 +182,8 @@ my-company-platform/
 
 一些入门流程是开箱即用的工作区感知型：
 
-- **Builder `/cli-auth`**：从任何应用程序中单击“连接 Builder”会将 `BUILDER_PRIVATE_KEY` 和朋友写入 **工作区根目录** `.env`，因此每个应用程序都会立即获得浏览器访问权限。
-- **环境变量设置路由** (`POST /_agent-native/env-vars`)：在工作空间内时，默认写入工作空间根 `.env`。在正文中传递 `scope: "app"` 以覆盖一个应用程序。
+- **Builder `/cli-auth`**: clicking "Connect Builder" from any app writes `BUILDER_PRIVATE_KEY` and related metadata to scoped DB secrets, so every app can resolve the connection without sharing a deploy-global key.
+- **Compatibility key route** (`POST /_agent-native/env-vars`): older onboarding forms still call this route name, but it now saves values as scoped DB secrets. Pass `scope: "workspace"` to share with the active org, or omit it for a per-user key.
 
 ## 共享凭据 {#shared-credentials}
 

package/corpus/core/docs/content/locales/zh-TW/multi-app-workspace.md

@@ -168,7 +168,7 @@ pnpm dev
 
 ## 共用環境變數 {#shared-env}
 
-工作區根 `.env` 會自動載入到每個應用程式中。將共用金鑰放在根目錄中一次（`ANTHROPIC_API_KEY`、`A2A_SECRET`、`BETTER_AUTH_SECRET`、`DATABASE_URL`、`BUILDER_PRIVATE_KEY` 等），每個應用程式都會取得它們。每個應用程式覆蓋進入 `apps/<name>/.env` 並在衝突時獲勝。
+The workspace root `.env` is loaded into every app automatically for deployment-level configuration such as `A2A_SECRET`, `BETTER_AUTH_SECRET`, and `DATABASE_URL`. User, org, and workspace API keys should be saved as scoped DB secrets instead of being written into `.env`. Per-app deploy-time overrides can still go in `apps/<name>/.env` and win on conflict.
 
 對於執行時應用程式憑證，與手動編輯 `.env` 檔案相比，更喜歡使用 DispatchVault。保管庫預設為所有應用程式存取，因此每個儲存的保管庫金鑰可供每個工作區應用程式使用，並且可以使用 `sync-vault-to-app` 推送。僅當應用程式需要顯式的每金鑰授權時，才將保管庫切換到手動模式。
 
@@ -182,8 +182,8 @@ my-company-platform/
 
 一些入門流程是開箱即用的工作區感知型：
 
-- **Builder `/cli-auth`**：從任何應用程式中點選“連線 Builder”會將 `BUILDER_PRIVATE_KEY` 和朋友寫入 **工作區根目錄** `.env`，因此每個應用程式都會立即獲得瀏覽器存取權限。
-- **環境變數設定路由** (`POST /_agent-native/env-vars`)：在工作空間內時，預設寫入工作空間根 `.env`。在內文中傳遞 `scope: "app"` 以覆蓋一個應用程式。
+- **Builder `/cli-auth`**: clicking "Connect Builder" from any app writes `BUILDER_PRIVATE_KEY` and related metadata to scoped DB secrets, so every app can resolve the connection without sharing a deploy-global key.
+- **Compatibility key route** (`POST /_agent-native/env-vars`): older onboarding forms still call this route name, but it now saves values as scoped DB secrets. Pass `scope: "workspace"` to share with the active org, or omit it for a per-user key.
 
 ## 共用憑證 {#shared-credentials}
 

package/corpus/core/docs/content/multi-app-workspace.md

@@ -168,7 +168,7 @@ See [MCP Clients](/docs/mcp-clients) for the config schema, precedence rules, an
 
 ## Shared environment variables {#shared-env}
 
-The workspace root `.env` is loaded into every app automatically. Put shared keys once at the root — `ANTHROPIC_API_KEY`, `A2A_SECRET`, `BETTER_AUTH_SECRET`, `DATABASE_URL`, `BUILDER_PRIVATE_KEY`, etc. — and every app picks them up. Per-app overrides go in `apps/<name>/.env` and win on conflict.
+The workspace root `.env` is loaded into every app automatically for deployment-level configuration such as `A2A_SECRET`, `BETTER_AUTH_SECRET`, and `DATABASE_URL`. User, org, and workspace API keys should be saved as scoped DB secrets instead of being written into `.env`. Per-app deploy-time overrides can still go in `apps/<name>/.env` and win on conflict.
 
 For runtime app credentials, prefer the Dispatch vault over hand-editing `.env` files. The vault defaults to all-apps access, so every saved vault key is available to every workspace app and can be pushed with `sync-vault-to-app`. Switch the vault to manual mode only when apps need explicit per-key grants.
 
@@ -182,8 +182,8 @@ my-company-platform/
 
 A few onboarding flows are workspace-aware out of the box:
 
-- **Builder `/cli-auth`**: clicking "Connect Builder" from any app writes `BUILDER_PRIVATE_KEY` and friends to the **workspace root** `.env`, so every app gains browser access at once.
-- **Env-vars settings route** (`POST /_agent-native/env-vars`): when inside a workspace, defaults to writing the workspace root `.env`. Pass `scope: "app"` in the body to override one app.
+- **Builder `/cli-auth`**: clicking "Connect Builder" from any app writes `BUILDER_PRIVATE_KEY` and friends to scoped DB secrets, so every app can resolve the connection without sharing a deploy-global key.
+- **Compatibility key route** (`POST /_agent-native/env-vars`): older onboarding forms still call this route name, but it now saves values as scoped DB secrets. Pass `scope: "workspace"` to share with the active org, or omit it for a per-user key.
 
 ## Shared credentials {#shared-credentials}
 

package/corpus/core/docs/content/template-clips.md

@@ -130,6 +130,15 @@ Password-protected clips require the password once; successful responses return
 short-lived tokenized links so downstream agents do not need the plaintext
 password.
 
+When `transcript.status` is `pending`, agents should wait 15-30 seconds and
+retry the context or transcript URL a few times before falling back to frames or
+reporting that no transcript is available. Long recordings can take several
+minutes to finish. Failed transcripts include `failureReason`; if Builder
+transcription credits are exhausted, the agent should explain that the user
+needs Builder.io credits/upgrade or a Groq key for backup speech-to-text.
+Pending transcript responses also include `retryAfterSeconds` for agents that
+want a structured polling hint.
+
 Slack previews use the same sharing boundary. The `/api/slack/unfurl` webhook
 only returns a playable Slack `video` block for ready, public clips without a
 password, expiry hit, archive marker, or trash marker. Other clips still get the
@@ -146,7 +155,7 @@ normal share-page title/thumbnail metadata and require opening Clips.
     { "name": "id", "in": "query", "type": "string", "required": true, "description": "Recording id" }
   ],
   "responses": [
-    { "status": "200", "description": "Clip metadata plus transcript and frame API links" }
+    { "status": "200", "description": "Clip metadata, transcript status/failureReason/retryAfterSeconds, agent instructions, and transcript/frame API links" }
   ]
 }
 ```
@@ -160,7 +169,7 @@ normal share-page title/thumbnail metadata and require opening Clips.
     { "name": "id", "in": "query", "type": "string", "required": true, "description": "Recording id" }
   ],
   "responses": [
-    { "status": "200", "description": "Segments with startMs, endMs, readable timestamps, text, and optional source labels" }
+    { "status": "200", "description": "Transcript status, failureReason, retryAfterSeconds, full text, and segments with startMs, endMs, readable timestamps, text, and optional source labels" }
   ]
 }
 ```
@@ -216,7 +225,7 @@ pnpm dev
 
 Clips is a larger template with a native recorder (it ships a desktop companion for local capture). Three setup steps are needed before recordings can upload:
 
-1. **Video storage (required).** Connect a storage backend through the onboarding wizard. The easiest path is Builder.io (free during beta, one-click). For self-hosted storage, set `S3_ENDPOINT`, `S3_BUCKET`, `S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY`, and optionally `S3_REGION` and `S3_PUBLIC_BASE_URL`. Cloudflare R2 and DigitalOcean Spaces use the same env vars with the `R2_*` prefix.
+1. **Video storage (required).** Connect a storage backend through the onboarding wizard or Clips Settings. The easiest path is Builder.io (free during beta, one-click). For self-hosted storage, save `S3_ENDPOINT`, `S3_BUCKET`, `S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY`, and optionally `S3_REGION` and `S3_PUBLIC_BASE_URL` in the app; the values are stored as scoped DB secrets. Cloudflare R2 and DigitalOcean Spaces use the same key names with the `R2_*` prefix.
 2. **Google Calendar (optional).** To sync upcoming meetings, connect a Google Calendar account from Settings. The OAuth callback URL in dev is `http://localhost:8094/_agent-native/google/callback`. Set up a Google OAuth client in [Google Cloud Console](https://console.cloud.google.com/) with the Gmail and Google Calendar APIs enabled.
 3. **Screen-capture permissions.** On macOS, grant Screen Recording permission to the browser (or the desktop companion app) in System Settings → Privacy & Security → Screen Recording. Browser recordings can save redacted console and fetch/XHR diagnostics from the recorder page. Once the Chrome extension listing is available, enable `VITE_CLIPS_CHROME_EXTENSION_ENABLED=1` so users can choose the extension for active-tab browser logs or the desktop app for the smoothest native capture path.
 4. **Slack previews (optional).** Create a Slack app with `links:read`, `links:write`, and `links.embed:write`; subscribe to `link_shared`; add your Clips share domain under **App Unfurl Domains**; set the Request URL to `https://your-clips.example.com/api/slack/unfurl`; and add the OAuth redirect URL `https://your-clips.example.com/api/slack/oauth/callback`. Configure `SLACK_CLIENT_ID`, `SLACK_CLIENT_SECRET`, and `SLACK_SIGNING_SECRET`, then connect workspaces from Clips Settings.
@@ -239,8 +248,8 @@ tray app at your deployment.
 2. **Configure production state.** Set a persistent `DATABASE_URL`, the normal
    production auth/secrets variables from [Deployment](/docs/deployment), and a
    video storage provider. Builder.io Connect is the easiest storage path; for
-   self-hosted storage, use `S3_*` or `R2_*` variables for an S3-compatible
-   bucket.
+   self-hosted storage, save `S3_*` or `R2_*` keys from Clips Settings for an
+   S3-compatible bucket.
 
 3. **Deploy the web app.** For a plain Node deploy:
 

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.79.17",
+  "version": "0.79.19",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/agent/engine/builder-engine.ts

@@ -94,11 +94,16 @@ function mapReasoningEffort(budgetTokens: number): ReasoningEffort {
  * `/app/organizations/Nicholas%20kipchumba%20Space/billing` which Builder's
  * router treats as unknown and silently bounces to `/app/projects`. The
  * Builder CLI-auth callback doesn't expose the org slug/id today, so we route
- * to the org-agnostic billing page — Builder resolves the active org from
- * session there and users with multiple orgs can switch from that screen.
+ * to the org-agnostic subscription page. Agent Native attribution lets Builder
+ * skip generic onboarding for new users who land there from an upgrade CTA.
  */
 async function buildUpgradeUrl(): Promise<string> {
-  return "https://builder.io/account/billing";
+  const url = new URL("https://builder.io/account/subscription");
+  url.searchParams.set("signupSource", "agent-native");
+  url.searchParams.set("agentNativeConnectSource", "gateway_quota_upgrade");
+  url.searchParams.set("agentNativeFlow", "connect_llm");
+  url.searchParams.set("framework", "agent-native");
+  return url.toString();
 }
 
 interface GatewayErrorBody {

package/corpus/core/src/cli/mcp.ts

@@ -205,21 +205,26 @@ async function mintHostedJwt(cwd: string): Promise<string | undefined> {
     process.env.AGENT_NATIVE_OWNER_EMAIL ||
     process.env.OWNER_EMAIL ||
     "owner@localhost";
+  let fileA2ASecret: string | undefined;
   if (!process.env.A2A_SECRET) {
     const baseDir = envBaseDir(cwd);
     const content =
       readEnvFile(path.join(baseDir, ".env.local")) +
       "\n" +
       readEnvFile(path.join(baseDir, ".env"));
-    const secret = getEnvValue(content, "A2A_SECRET");
-    if (secret) process.env.A2A_SECRET = secret;
+    fileA2ASecret = getEnvValue(content, "A2A_SECRET");
   }
   try {
     const { signA2AToken } = await import("../a2a/client.js");
-    return await signA2AToken(owner, undefined, undefined, {
-      preferGlobalSecret: true,
-      expiresIn: "30d",
-    });
+    return await signA2AToken(
+      owner,
+      undefined,
+      process.env.A2A_SECRET || fileA2ASecret,
+      {
+        preferGlobalSecret: true,
+        expiresIn: "30d",
+      },
+    );
   } catch (err: any) {
     logErr(
       `  Could not mint a hosted JWT (${err?.message ?? err}). ` +

package/corpus/core/src/client/AssistantChat.tsx

@@ -1137,8 +1137,8 @@ const AssistantChatInner = forwardRef<
   const isComposerDisabled = missingApiKey || composerDisabled;
   const missingApiKeySetupAboveComposer =
     missingApiKeySetupLayout === "sidebar";
-  // Increments each time the user clicks the (disabled) composer while no LLM
-  // is connected — `BuilderSetupCard` watches this to replay a one-shot bounce.
+  // Increments each time the user tries to chat while no LLM is connected.
+  // `BuilderSetupCard` watches this to replay a one-shot bounce.
   const [missingKeyBouncePulse, setMissingKeyBouncePulse] = useState(0);
   const [authError, setAuthError] = useState<{
     sessionExpired?: boolean;
@@ -3152,6 +3152,10 @@ const AssistantChatInner = forwardRef<
                             <button
                               key={suggestion}
                               onClick={() => {
+                                if (missingApiKey) {
+                                  setMissingKeyBouncePulse((p) => p + 1);
+                                  return;
+                                }
                                 threadRuntime.append({
                                   role: "user",
                                   content: [{ type: "text", text: suggestion }],

package/corpus/core/src/client/chat/markdown-renderer.tsx

@@ -179,6 +179,7 @@ function isBuilderErrorCtaHref(href: string | undefined): boolean {
     return (
       url.href === BUILDER_SPACE_SETTINGS_URL ||
       url.pathname === "/account/billing" ||
+      url.pathname === "/account/subscription" ||
       /^\/app\/organizations\/[^/]+\/billing$/.test(url.pathname)
     );
   } catch {