@agent-native/core 0.79.17 → 0.79.19

package/corpus/templates/calendar/server/handlers/google-auth.ts

@@ -9,6 +9,7 @@ import {
   encodeOAuthState,
   decodeOAuthState,
   resolveOAuthOwner,
+  resolveSecret,
   createOAuthSession,
   oauthCallbackResponse,
   oauthDesktopExchangePage,
@@ -16,6 +17,7 @@ import {
   setDesktopExchange,
   setDesktopExchangeError,
   safeReturnPath,
+  runWithRequestContext,
 } from "@agent-native/core/server";
 import {
   defineEventHandler,
@@ -41,9 +43,15 @@ const GOOGLE_IDENTITY_SCOPES = [
   "https://www.googleapis.com/auth/userinfo.profile",
 ];
 
-function resolveCalendarOAuthCredentials() {
-  const clientId = process.env.GOOGLE_CLIENT_ID;
-  const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
+async function resolveCalendarOAuthCredentials(event: H3Event) {
+  const session = await getSession(event).catch(() => null);
+  const { clientId, clientSecret } = await runWithRequestContext(
+    { userEmail: session?.email, orgId: session?.orgId },
+    async () => ({
+      clientId: await resolveSecret("GOOGLE_CLIENT_ID"),
+      clientSecret: await resolveSecret("GOOGLE_CLIENT_SECRET"),
+    }),
+  );
   if (!clientId || !clientSecret) return null;
   return { clientId, clientSecret };
 }
@@ -192,7 +200,7 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
     const flowId = desktop ? (q.flow_id as string) || undefined : undefined;
     const calendarConnect = isCalendarConnectRequest(q, owner);
     const credentials = calendarConnect
-      ? resolveCalendarOAuthCredentials()
+      ? await resolveCalendarOAuthCredentials(event)
       : resolveGoogleSignInCredentials();
 
     if (!credentials) {
@@ -200,7 +208,7 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
       return {
         error: "missing_credentials",
         message: calendarConnect
-          ? "Google Calendar OAuth credentials are not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET."
+          ? "Google Calendar OAuth credentials are not configured. Save GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in settings."
           : "Google sign-in credentials are not configured. Set GOOGLE_SIGN_IN_CLIENT_ID and GOOGLE_SIGN_IN_CLIENT_SECRET.",
       };
     }
@@ -229,7 +237,7 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
     });
 
     const url = calendarConnect
-      ? getAuthUrl(undefined, redirectUri, state)
+      ? await getAuthUrl(undefined, redirectUri, state, owner)
       : `${GOOGLE_AUTH_URL}?${new URLSearchParams({
           client_id: credentials.clientId,
           redirect_uri: redirectUri,
@@ -364,12 +372,12 @@ export const getGoogleAddAccountUrl = defineEventHandler(
       setResponseStatus(event, 401);
       return { error: "Must be logged in to add an account" };
     }
-    if (!process.env.GOOGLE_CLIENT_ID || !process.env.GOOGLE_CLIENT_SECRET) {
+    if (!(await resolveCalendarOAuthCredentials(event))) {
       setResponseStatus(event, 422);
       return {
         error: "missing_credentials",
         message:
-          "Google OAuth credentials are not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.",
+          "Google OAuth credentials are not configured. Save GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET in settings.",
       };
     }
     try {
@@ -393,7 +401,12 @@ export const getGoogleAddAccountUrl = defineEventHandler(
         app: OAUTH_STATE_APP_ID,
         flowId,
       });
-      const url = getAuthUrl(undefined, redirectUri, state);
+      const url = await getAuthUrl(
+        undefined,
+        redirectUri,
+        state,
+        session.email,
+      );
       if (q.redirect === "1") {
         return oauthRedirectResponse(url);
       }

package/corpus/templates/calendar/server/lib/booking-emails.ts

@@ -49,7 +49,7 @@ async function sendBestEffort(
   label: string,
   args: Parameters<typeof sendEmail>[0],
 ) {
-  if (!isEmailConfigured()) return;
+  if (!(await isEmailConfigured())) return;
   try {
     await sendEmail(args);
   } catch (error) {

package/corpus/templates/calendar/server/lib/event-guest-notifications.ts

@@ -129,7 +129,7 @@ export async function sendEventGuestNotificationNote({
     };
   }
 
-  if (!isEmailConfigured()) {
+  if (!(await isEmailConfigured())) {
     return {
       requested: true,
       recipientCount: recipients.length,

package/corpus/templates/calendar/server/lib/google-calendar.ts

@@ -4,7 +4,12 @@ import {
   deleteOAuthTokens,
   listOAuthAccountsByOwner,
 } from "@agent-native/core/oauth-tokens";
-import { isOAuthConnected, getOAuthAccounts } from "@agent-native/core/server";
+import {
+  isOAuthConnected,
+  getOAuthAccounts,
+  resolveSecret,
+  runWithRequestContext,
+} from "@agent-native/core/server";
 
 import type {
   CalendarEvent,
@@ -56,48 +61,59 @@ function optionalString(value: unknown): string | undefined {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
 
-function getOAuth2Credentials() {
-  const credentials = resolveGoogleProviderCredentialCandidates()[0];
+async function getOAuth2Credentials(owner?: string) {
+  const credentials = (
+    await resolveGoogleProviderCredentialCandidates(owner)
+  )[0];
   if (!credentials) {
     throw new Error(
-      "GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET must be set in environment",
+      "GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET must be saved in settings",
     );
   }
   return credentials;
 }
 
-function getOAuth2RefreshCredentials() {
-  const candidates = resolveGoogleProviderCredentialCandidates();
+async function getOAuth2RefreshCredentials(owner?: string) {
+  const candidates = await resolveGoogleProviderCredentialCandidates(owner);
   if (!candidates.length) {
     throw new Error(
-      "GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET must be set in environment",
+      "GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET must be saved in settings",
     );
   }
   return candidates;
 }
 
-function readCredentialPair(
+async function readCredentialPair(
   clientIdKey: string,
   clientSecretKey: string,
-): GoogleOAuthCredentials | null {
-  const clientId = process.env[clientIdKey];
-  const clientSecret = process.env[clientSecretKey];
+): Promise<GoogleOAuthCredentials | null> {
+  const [clientId, clientSecret] = await Promise.all([
+    resolveSecret(clientIdKey),
+    resolveSecret(clientSecretKey),
+  ]);
   if (!clientId || !clientSecret) return null;
   return { clientId, clientSecret };
 }
 
-function resolveGoogleProviderCredentialCandidates(): GoogleOAuthCredentials[] {
-  const primary = readCredentialPair(
-    "GOOGLE_CLIENT_ID",
-    "GOOGLE_CLIENT_SECRET",
-  );
-  const legacy = readCredentialPair(
-    "GOOGLE_LEGACY_CLIENT_ID",
-    "GOOGLE_LEGACY_CLIENT_SECRET",
-  );
-  if (!primary) return legacy ? [legacy] : [];
-  if (!legacy || legacy.clientId === primary.clientId) return [primary];
-  return [primary, legacy];
+async function resolveGoogleProviderCredentialCandidates(
+  owner?: string,
+): Promise<GoogleOAuthCredentials[]> {
+  const resolve = async () => {
+    const primary = await readCredentialPair(
+      "GOOGLE_CLIENT_ID",
+      "GOOGLE_CLIENT_SECRET",
+    );
+    const legacy = await readCredentialPair(
+      "GOOGLE_LEGACY_CLIENT_ID",
+      "GOOGLE_LEGACY_CLIENT_SECRET",
+    );
+    if (!primary) return legacy ? [legacy] : [];
+    if (!legacy || legacy.clientId === primary.clientId) return [primary];
+    return [primary, legacy];
+  };
+  return owner
+    ? runWithRequestContext({ userEmail: owner }, resolve)
+    : await resolve();
 }
 
 /**
@@ -356,7 +372,10 @@ async function getValidAccessToken(
     }
     try {
       let lastRefreshError: any;
-      for (const { clientId, clientSecret } of getOAuth2RefreshCredentials()) {
+      for (const {
+        clientId,
+        clientSecret,
+      } of await getOAuth2RefreshCredentials(owner)) {
         try {
           const oauth2 = createOAuth2Client(clientId, clientSecret, "");
           const newTokens = await oauth2.refreshToken(tokens.refresh_token);
@@ -396,12 +415,13 @@ async function getValidAccessToken(
   return tokens.access_token;
 }
 
-export function getAuthUrl(
+export async function getAuthUrl(
   origin?: string,
   redirectUri?: string,
   state?: string,
-): string {
-  const { clientId, clientSecret } = getOAuth2Credentials();
+  owner?: string,
+): Promise<string> {
+  const { clientId, clientSecret } = await getOAuth2Credentials(owner);
   const uri =
     redirectUri ||
     (origin ? `${origin}/_agent-native/google/callback` : undefined);
@@ -420,7 +440,7 @@ export async function exchangeCode(
   redirectUri?: string,
   owner?: string,
 ): Promise<string> {
-  const { clientId, clientSecret } = getOAuth2Credentials();
+  const { clientId, clientSecret } = await getOAuth2Credentials(owner);
   const uri =
     redirectUri ||
     (origin ? `${origin}/_agent-native/google/callback` : undefined);

package/corpus/templates/chat/app/components/layout/Header.tsx

@@ -10,7 +10,6 @@ const pageTitleKeys: Record<string, string> = {
   "/": "navigation.chat",
   "/observability": "navigation.observability",
   "/settings": "navigation.settings",
-  "/team": "navigation.team",
 };
 
 function resolveTitle(pathname: string, t: (key: string) => string): string {

package/corpus/templates/chat/app/hooks/use-navigation-state.ts

@@ -60,7 +60,7 @@ function viewForPath(pathname: string): string {
   if (pathname.startsWith("/database")) return "database";
   if (pathname.startsWith("/extensions")) return "extensions";
   if (pathname.startsWith("/observability")) return "observability";
-  if (pathname.startsWith("/team")) return "team";
+  if (pathname.startsWith("/team")) return "settings";
   return "chat";
 }
 
@@ -76,8 +76,10 @@ function pathForView(view?: string): string {
       return "/extensions";
     case "observability":
       return "/observability";
+    case "settings":
+      return "/settings";
     case "team":
-      return "/team";
+      return "/settings#team";
     default:
       return "/";
   }

package/corpus/templates/chat/app/routes/settings.tsx

@@ -1,10 +1,11 @@
 import {
   ChangelogSettingsCard,
   LanguagePicker,
+  SettingsTabsPage,
   openAgentSettings,
   useT,
 } from "@agent-native/core/client";
-import { Link } from "react-router";
+import { TeamPage } from "@agent-native/core/client/org";
 
 import { useSetPageTitle } from "@/components/layout/HeaderActions";
 import { Button } from "@/components/ui/button";
@@ -29,60 +30,59 @@ export default function SettingsRoute() {
   useSetPageTitle(t("settings.title"));
 
   return (
-    <main className="mx-auto w-full max-w-3xl space-y-6 px-4 py-6 sm:px-6 sm:py-10">
-      <div className="space-y-1">
-        <h1 className="text-2xl font-semibold tracking-tight">
-          {t("settings.title")}
-        </h1>
-        <p className="text-sm leading-6 text-muted-foreground">
-          {t("settings.description")}
-        </p>
-      </div>
+    <SettingsTabsPage
+      teamLabel={t("navigation.team")}
+      general={
+        <div className="mx-auto w-full max-w-3xl space-y-6">
+          <p className="text-sm leading-6 text-muted-foreground">
+            {t("settings.description")}
+          </p>
 
-      <Card>
-        <CardHeader>
-          <CardTitle className="text-base">
-            {t("settings.languageTitle")}
-          </CardTitle>
-          <CardDescription>{t("settings.languageDescription")}</CardDescription>
-        </CardHeader>
-        <CardContent className="max-w-xs space-y-1.5">
-          <Label>{t("settings.languageLabel")}</Label>
-          <LanguagePicker label={t("settings.languageLabel")} />
-        </CardContent>
-      </Card>
+          <Card>
+            <CardHeader>
+              <CardTitle className="text-base">
+                {t("settings.languageTitle")}
+              </CardTitle>
+              <CardDescription>
+                {t("settings.languageDescription")}
+              </CardDescription>
+            </CardHeader>
+            <CardContent className="max-w-xs space-y-1.5">
+              <Label>{t("settings.languageLabel")}</Label>
+              <LanguagePicker label={t("settings.languageLabel")} />
+            </CardContent>
+          </Card>
 
-      <Card>
-        <CardHeader>
-          <CardTitle className="text-base">
-            {t("settings.workspaceTitle")}
-          </CardTitle>
-          <CardDescription>
-            {t("settings.workspaceDescription")}
-          </CardDescription>
-        </CardHeader>
-        <CardContent>
-          <Button variant="outline" asChild>
-            <Link to="/team">{t("settings.openTeamSettings")}</Link>
-          </Button>
-        </CardContent>
-      </Card>
-
-      <Card>
-        <CardHeader>
-          <CardTitle className="text-base">
-            {t("settings.agentTitle")}
-          </CardTitle>
-          <CardDescription>{t("settings.agentDescription")}</CardDescription>
-        </CardHeader>
-        <CardContent>
-          <Button variant="outline" onClick={() => openAgentSettings()}>
-            {t("settings.openAgentSettings")}
-          </Button>
-        </CardContent>
-      </Card>
-
-      <ChangelogSettingsCard markdown={changelog} />
-    </main>
+          <Card>
+            <CardHeader>
+              <CardTitle className="text-base">
+                {t("settings.agentTitle")}
+              </CardTitle>
+              <CardDescription>
+                {t("settings.agentDescription")}
+              </CardDescription>
+            </CardHeader>
+            <CardContent>
+              <Button variant="outline" onClick={() => openAgentSettings()}>
+                {t("settings.openAgentSettings")}
+              </Button>
+            </CardContent>
+          </Card>
+        </div>
+      }
+      team={
+        <div className="mx-auto w-full max-w-3xl">
+          <TeamPage
+            showTitle={false}
+            createOrgDescription={t("pages.teamCreateOrgDescription")}
+          />
+        </div>
+      }
+      whatsNew={
+        <div className="mx-auto w-full max-w-3xl">
+          <ChangelogSettingsCard markdown={changelog} />
+        </div>
+      }
+    />
   );
 }

package/corpus/templates/chat/app/routes/team.tsx

@@ -1,7 +1,5 @@
-import { useT } from "@agent-native/core/client";
-import { TeamPage } from "@agent-native/core/client/org";
+import { Navigate } from "react-router";
 
-import { useSetPageTitle } from "@/components/layout/HeaderActions";
 import { APP_TITLE } from "@/lib/app-config";
 
 export function meta() {
@@ -9,11 +7,5 @@ export function meta() {
 }
 
 export default function TeamRoute() {
-  const t = useT();
-  useSetPageTitle(t("pages.teamTitle"));
-  return (
-    <main className="mx-auto w-full max-w-3xl px-4 py-6 sm:px-6 sm:py-10">
-      <TeamPage createOrgDescription={t("pages.teamCreateOrgDescription")} />
-    </main>
-  );
+  return <Navigate to="/settings#team" replace />;
 }

package/corpus/templates/clips/.agents/skills/ai-video-tools/SKILL.md

@@ -11,7 +11,7 @@ description: >-
 
 ## Rule
 
-Every AI feature in Clips goes through the agent chat unless it is the narrow media-pipeline exception below. The UI and server should not add broad shadow agents or inline chat workflows. **Exception:** transcription. Transcription takes audio, not prompts — the `request-transcript` action calls the transcription API directly. Provider priority for transcription: **native** first (browser Web Speech API / desktop macOS SFSpeech, saved via `save-browser-transcript`, no key required) → **cloud fallback** when native text is missing: **Builder.io managed** Gemini (via `BUILDER_PRIVATE_KEY` or a connected Builder account, no extra key needed) → **Groq** `whisper-large-v3-turbo` via `GROQ_API_KEY` (fast, ~$0.04/hr). Clips never routes recording/meeting audio to OpenAI for transcription.
+Every AI feature in Clips goes through the agent chat unless it is the narrow media-pipeline exception below. The UI and server should not add broad shadow agents or inline chat workflows. **Exception:** transcription. Transcription takes audio, not prompts — the `request-transcript` action calls the transcription API directly. Provider priority for transcription: **native** first (browser Web Speech API, desktop local Whisper/macOS SFSpeech when available, and desktop Web Speech fallback on non-mac, saved via `save-browser-transcript`, no key required) → **cloud fallback** when native text is missing: **Builder.io managed** Gemini (via `BUILDER_PRIVATE_KEY` or a connected Builder account, no extra key needed) → **Groq** `whisper-large-v3-turbo` via `GROQ_API_KEY` (fast, ~$0.04/hr). Clips never routes recording/meeting audio to OpenAI for transcription.
 
 Builder.io is the primary setup path: it brings managed AI credits, object
 storage, uploads, and transcription together. Bring-your-own-key setup belongs
@@ -99,7 +99,7 @@ Transcription takes an audio file and returns text + segments. That's not a prom
 
 **Provider priority:**
 
-1. **Native (highest priority).** The browser's Web Speech API and desktop macOS SFSpeech capture run during recording and save results via `save-browser-transcript`. This gives an instant transcript with no API key. When `request-transcript` runs afterward, it preserves the ready native transcript and only falls back to a cloud provider if native text is missing.
+1. **Native (highest priority).** The browser's Web Speech API, desktop local Whisper/macOS SFSpeech when available, and desktop Web Speech fallback on non-mac run during recording and save results via `save-browser-transcript`. This gives an instant transcript with no API key when the local/browser recognizer is available. When `request-transcript` runs afterward, it preserves the ready native transcript and only falls back to a cloud provider if native text is missing.
 2. **Cloud fallback — Builder.io managed (Gemini).** When a Builder account is connected (`BUILDER_PRIVATE_KEY` or per-user OAuth, no separate API key needed), `request-transcript` calls `transcribeWithBuilder()`, which routes audio to Builder.io's managed Gemini transcription. Returns text plus timestamped segments.
 3. **Cloud fallback — Groq Whisper.** `GROQ_API_KEY` → `https://api.groq.com/openai/v1/audio/transcriptions`, model `whisper-large-v3-turbo`. Fast (~$0.04/hour of audio) Whisper-compatible speech-to-text used when Builder is unavailable.
 
@@ -107,6 +107,11 @@ Clips never routes recording/meeting audio to OpenAI for transcription. (Groq's
 
 If no native transcript exists and no cloud fallback is available (no Builder connection and no Groq key), the action writes `status="failed"` so the UI can show a friendly prompt.
 
+If Builder transcription fails because credits are exhausted, explain that
+Builder.io credits/upgrade or a Groq key are the supported speech-to-text
+fallbacks. Generic OpenAI or Anthropic chat keys power chat, but they do not
+transcribe Clips recordings.
+
 ### Secret registration
 
 Builder transcription needs no app-specific key (the connected Builder.io account or `BUILDER_PRIVATE_KEY` carries the grant). The only transcription API key declared in `server/register-secrets.ts` is the optional Groq key, so it appears in the agent sidebar settings UI:

package/corpus/templates/clips/.agents/skills/recording/SKILL.md

@@ -30,7 +30,7 @@ Some recordings are linked to a meeting — when `meeting_id` is non-null on the
 3. **Create row.** As soon as the stream is granted, call `create-recording` to insert the row with `status: "uploading"` and a pre-generated id. That id is used for every subsequent chunk upload.
 4. **Record.** Start a `MediaRecorder` with `mimeType: "video/webm;codecs=vp9,opus"` (fallback to vp8, then browser default). Use `timeslice: 2000` so chunks arrive every 2s.
 5. **Upload each chunk.** `ondataavailable` POSTs the chunk bytes to `/api/uploads/chunk` with headers `X-Recording-Id` and `X-Chunk-Index`. Don't retry inline — buffer failed chunks in `IndexedDB` and let a background worker re-send.
-6. **Live transcription.** Alongside the MediaRecorder, `useLiveTranscription` runs the Web Speech API to accumulate transcript text in real time. On stop, the client calls `save-browser-transcript` to persist the result immediately — no API key needed.
+6. **Live transcription.** Alongside the MediaRecorder, `useLiveTranscription` runs the Web Speech API to accumulate transcript text in real time. On stop, the client calls `save-browser-transcript` to persist the result immediately — no API key needed. Desktop recordings use local Whisper/macOS speech first when available, and fall back to Web Speech in the webview on non-mac before relying on upload transcription.
 7. **Finalize.** On stop, send the final chunk to `/api/uploads/:id/chunk?isFinal=1`. The route calls `finalize-recording`, which stitches chunks, uploads the finished media when storage is configured, transitions `status` to `ready`, then kicks off `request-transcript` for higher-quality output (see `ai-video-tools`).
 8. **Navigate.** Once the row is `ready` the UI navigates to `/r/:id`.
 

package/corpus/templates/clips/.agents/skills/video-sharing/SKILL.md

@@ -173,6 +173,13 @@ These endpoints follow the same access model as `/api/public-recording`:
 - Password-protected clips require `password=<pw>` once; successful JSON
   responses include short-lived tokenized links so the plaintext password is not
   copied into downstream agent prompts, browser history, or logs.
+- If the context or transcript response reports `transcript.status` as
+  `"pending"`, wait 15-30 seconds and retry the context/transcript URL a few
+  times before falling back to frames or telling the user no transcript exists.
+- If transcription failed because Builder transcription credits are exhausted,
+  tell the user to upgrade or connect Builder.io credits, or configure a Groq
+  key for backup speech-to-text. Generic OpenAI or Anthropic chat keys do not
+  transcribe Clips recordings.
 - Frame extraction must use the checked recording media path and must not expose
   raw provider URLs.
 

package/corpus/templates/clips/AGENTS.md

@@ -52,6 +52,14 @@ Detailed media, meeting, dictation, editing, and sharing rules live in
   segments; `/api/agent-frame.jpg?id=<recordingId>&atMs=<ms>` for a screen
   frame at a timestamp. Password-protected clips require the password once to
   mint a short-lived token returned inside agent-context links.
+- If public agent context or transcript APIs report `transcript.status` as
+  `"pending"`, wait 15-30 seconds and retry the context/transcript URL a few
+  times, especially for long recordings. Do not pivot straight to frames or tell
+  the user there is no transcript until the retry budget is exhausted.
+- If transcription failed because Builder transcription credits are exhausted,
+  tell the user that clearly and point them to Builder.io credits/upgrade or a
+  Groq key for backup speech-to-text. Generic OpenAI or Anthropic chat keys do
+  not transcribe Clips recordings.
 - Slack unfurls use `/api/slack/unfurl` for `link_shared` events and only
   return playable `chat.unfurl` video blocks for ready public clips with no
   password, no expiry hit, and no archive/trash marker. Private, org-only,

package/corpus/templates/clips/actions/invite-member.ts

@@ -167,7 +167,7 @@ export default defineAction({
       status: "pending" as const,
       token,
       inviteUrl,
-      emailConfigured: isEmailConfigured(),
+      emailConfigured: await isEmailConfigured(),
     };
   },
 });

package/corpus/templates/clips/actions/request-transcript.ts

@@ -1008,7 +1008,7 @@ export default defineAction({
       } catch (err) {
         const reason = (err as Error).message;
         const details = serializeError(err);
-        if (reason.includes("credits exhausted")) {
+        if (reason.toLowerCase().includes("credits exhausted")) {
           const preserved = await preserveReadyTranscriptIfAvailable({
             db,
             recordingId: args.recordingId,