@agent-native/core 0.79.17 → 0.79.19

package/corpus/core/src/styles/agent-native.css

@@ -55,6 +55,8 @@
   --agent-native-lower-surface: hsl(
     var(--sidebar-background, var(--background))
   );
+  --agent-native-raised-surface: hsl(var(--background));
+  --agent-native-card-surface: hsl(var(--card));
   --agent-native-raised-border: hsl(var(--border));
   --agent-native-raised-radius: 8px;
   --agent-native-raised-shadow-left: -1px 0 3px rgb(0 0 0 / 0.018);
@@ -86,6 +88,16 @@
       hsl(var(--sidebar-background, var(--background))) 94%,
       black
     );
+    --agent-native-raised-surface: color-mix(
+      in srgb,
+      hsl(var(--background)) 78%,
+      hsl(var(--muted)) 22%
+    );
+    --agent-native-card-surface: color-mix(
+      in srgb,
+      var(--agent-native-raised-surface) 88%,
+      hsl(var(--muted)) 12%
+    );
   }
 }
 
@@ -126,7 +138,7 @@
 .agent-sidebar-main-surface {
   position: relative;
   z-index: 1;
-  background: hsl(var(--background));
+  background: var(--agent-native-raised-surface);
   transition:
     border-radius 260ms cubic-bezier(0.32, 0.72, 0, 1),
     border-color 260ms cubic-bezier(0.32, 0.72, 0, 1),
@@ -136,17 +148,49 @@
 .agent-layout-shell
   :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
   > :first-child
-  > :where(header, div).border-b:first-child,
+  > :where(header, div).border-b,
 .agent-layout-shell
   :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
-  > :where(header, div).border-b:first-child,
+  > :where(header, div).border-b,
 .agent-layout-shell
   .agent-layout-left-drawer
   > :where(header, div).border-b:first-child,
+.agent-layout-shell
+  .agent-layout-left-drawer
+  > :first-child
+  > :where(header, div).border-b,
 .agent-layout-shell .agent-native-shell-topbar {
   border-bottom-color: transparent !important;
 }
 
+.agent-layout-shell
+  :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
+  > :first-child
+  > :where(header, div).border-b,
+.agent-layout-shell
+  :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
+  > :where(header, div).border-b {
+  background-color: var(--agent-native-raised-surface) !important;
+}
+
+.agent-layout-shell
+  :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
+  > :first-child
+  > :where(header, div).border-b.h-12,
+.agent-layout-shell
+  :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
+  > :where(header, div).border-b.h-12 {
+  min-height: 4rem;
+  height: 4rem;
+}
+
+.dark
+  .agent-layout-shell
+  :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
+  :where(.bg-card) {
+  background-color: var(--agent-native-card-surface) !important;
+}
+
 @media (min-width: 768px) {
   .agent-layout-main-surface,
   .agent-layout-shell > .agent-sidebar-shell > .agent-sidebar-main-surface {

package/corpus/core/src/templates/workspace-root/AGENTS.md

@@ -170,7 +170,8 @@ Use the workspace root `.env` for shared identity and cross-app trust settings:
 - `WORKSPACE_OWNER_EMAIL` — initial owner/admin email for repairs and
   integration defaults.
 - `A2A_SECRET` — shared secret for cross-app A2A signing. Generate with
-  `openssl rand -hex 32` or `pnpm repair:workspace-org -- --name ...`.
+  `openssl rand -hex 32` and configure through your deployment/scoped secret
+  manager.
 
 `DISPATCH_DEFAULT_OWNER_EMAIL` is optional. Set it only for trusted,
 single-workspace deployments where unlinked integration requests should run as
@@ -183,7 +184,7 @@ When asked to repair workspace org or A2A configuration:
 1. Read `.env` first. Do not infer the organization, domain, owner email, or
    secret from old examples.
 2. Run `pnpm repair:workspace-org -- --name "<org>" --domain example.com --owner-email owner@example.com`
-   to create or update generic workspace identity values.
+   to validate generic workspace identity values without writing `.env`.
 3. Prefer the app's organization settings UI or authenticated org routes for
    changing `allowed_domain` and `a2a_secret`.
 4. If direct SQL is unavoidable, inspect the live schema first and use only

package/corpus/core/src/templates/workspace-root/README.md

@@ -97,7 +97,7 @@ cross-app trust:
 - `A2A_SECRET` — shared signing secret for cross-app A2A calls.
 
 Run `pnpm repair:workspace-org -- --name "<org>" --domain example.com --owner-email owner@example.com`
-to fill or validate those values without committing secrets. Existing
+to validate those values without writing env files. Existing
 organization rows should still be repaired through the app's org settings UI or
 authenticated org routes whenever possible.
 

package/corpus/core/src/templates/workspace-root/scripts/repair-workspace-org.ts

@@ -1,6 +1,5 @@
 #!/usr/bin/env tsx
 
-import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 
@@ -10,8 +9,6 @@ interface Options {
   ownerEmail?: string;
   a2aSecret?: string;
   envPath: string;
-  force: boolean;
-  dryRun: boolean;
   setDispatchDefaultOwner: boolean;
 }
 
@@ -22,10 +19,10 @@ Options:
   --name <value>                 Sets WORKSPACE_ORG_NAME
   --domain <value>               Sets WORKSPACE_ORG_DOMAIN
   --owner-email <value>          Sets WORKSPACE_OWNER_EMAIL
-  --a2a-secret <value>           Sets A2A_SECRET (generated when omitted)
-  --env <path>                   Env file to update (default: .env)
-  --force                        Overwrite existing non-empty values
-  --dry-run                      Print the changes without writing
+  --a2a-secret <value>           Reads A2A_SECRET for validation
+  --env <path>                   Env file to read for fallback values (default: .env)
+  --force                        Accepted for compatibility; no file is written
+  --dry-run                      Accepted for compatibility; no file is written
   --set-dispatch-default-owner   Also set DISPATCH_DEFAULT_OWNER_EMAIL
 `;
 
@@ -41,8 +38,6 @@ type RequiredKey = (typeof REQUIRED_KEYS)[number];
 function parseArgs(argv: string[]): Options {
   const opts: Options = {
     envPath: ".env",
-    force: false,
-    dryRun: false,
     setDispatchDefaultOwner: false,
   };
 
@@ -78,10 +73,8 @@ function parseArgs(argv: string[]): Options {
         opts.envPath = value();
         break;
       case "--force":
-        opts.force = true;
         break;
       case "--dry-run":
-        opts.dryRun = true;
         break;
       case "--set-dispatch-default-owner":
         opts.setDispatchDefaultOwner = true;
@@ -147,47 +140,6 @@ function validateEmail(email: string): void {
   }
 }
 
-function formatEnvValue(value: string): string {
-  if (/^[A-Za-z0-9_@./:+-]+$/.test(value)) return value;
-  return JSON.stringify(value);
-}
-
-function upsertEnvValue(
-  content: string,
-  key: string,
-  value: string,
-  force: boolean,
-): { content: string; changed: boolean; skipped: boolean } {
-  const lines = content.length > 0 ? content.split(/\r?\n/) : [];
-  let found = false;
-  let changed = false;
-  let skipped = false;
-
-  const next = lines.map((line) => {
-    const match = line.match(/^(\s*)([A-Z0-9_]+)(\s*=\s*)(.*)$/);
-    if (!match || match[2] !== key) return line;
-
-    found = true;
-    const existing = unquote(match[4]);
-    if (existing && !force) {
-      skipped = true;
-      return line;
-    }
-
-    const replacement = `${match[1]}${key}${match[3]}${formatEnvValue(value)}`;
-    if (replacement !== line) changed = true;
-    return replacement;
-  });
-
-  if (!found) {
-    if (next.length > 0 && next[next.length - 1] !== "") next.push("");
-    next.push(`${key}=${formatEnvValue(value)}`);
-    changed = true;
-  }
-
-  return { content: next.join("\n"), changed, skipped };
-}
-
 function firstValue(...values: Array<string | undefined>): string | undefined {
   return values.map((v) => v?.trim()).find(Boolean);
 }
@@ -213,13 +165,21 @@ function main(): void {
     process.env.WORKSPACE_OWNER_EMAIL,
     current.WORKSPACE_OWNER_EMAIL,
   )?.toLowerCase();
-  const a2aSecret =
-    firstValue(opts.a2aSecret, process.env.A2A_SECRET, current.A2A_SECRET) ??
-    crypto.randomBytes(32).toString("hex");
+  const a2aSecret = firstValue(
+    opts.a2aSecret,
+    process.env.A2A_SECRET,
+    current.A2A_SECRET,
+  );
 
   if (!name) fail("--name or WORKSPACE_ORG_NAME is required.");
   if (!rawDomain) fail("--domain or WORKSPACE_ORG_DOMAIN is required.");
   if (!ownerEmail) fail("--owner-email or WORKSPACE_OWNER_EMAIL is required.");
+  if (!a2aSecret) {
+    fail(
+      "--a2a-secret or A2A_SECRET is required. This script reads existing " +
+        "configuration but does not write env files.",
+    );
+  }
 
   const domain = normalizeDomain(rawDomain);
   validateDomain(domain);
@@ -232,52 +192,31 @@ function main(): void {
     A2A_SECRET: a2aSecret,
   };
 
-  let next = original.trimEnd();
-  const changed: string[] = [];
-  const skipped: string[] = [];
-
-  for (const key of REQUIRED_KEYS) {
-    const result = upsertEnvValue(next, key, desired[key], opts.force);
-    next = result.content;
-    if (result.changed) changed.push(key);
-    if (result.skipped) skipped.push(key);
-  }
-
+  const displayEntries: Array<[string, string]> = REQUIRED_KEYS.map((key) => [
+    key,
+    key === "A2A_SECRET" ? "[configured]" : desired[key],
+  ]);
   if (opts.setDispatchDefaultOwner) {
-    const result = upsertEnvValue(
-      next,
-      "DISPATCH_DEFAULT_OWNER_EMAIL",
-      ownerEmail,
-      opts.force,
-    );
-    next = result.content;
-    if (result.changed) changed.push("DISPATCH_DEFAULT_OWNER_EMAIL");
-    if (result.skipped) skipped.push("DISPATCH_DEFAULT_OWNER_EMAIL");
-  }
-
-  next = next.trimEnd() + "\n";
-
-  if (opts.dryRun) {
-    console.log(next);
-  } else {
-    fs.writeFileSync(envPath, next);
+    displayEntries.push(["DISPATCH_DEFAULT_OWNER_EMAIL", ownerEmail]);
   }
 
   console.log(
-    `${opts.dryRun ? "Validated" : "Updated"} ${path.relative(process.cwd(), envPath) || envPath}.`,
+    `Validated workspace org settings from ${path.relative(process.cwd(), envPath) || envPath}.`,
   );
-  if (changed.length > 0) console.log(`Changed: ${changed.join(", ")}`);
-  if (skipped.length > 0) {
-    console.log(
-      `Kept existing values: ${skipped.join(", ")} (use --force to overwrite)`,
-    );
+  console.log("No env files were written.");
+  console.log("");
+  console.log("Resolved configuration:");
+  for (const [key, value] of displayEntries) {
+    console.log(`- ${key}: ${value}`);
   }
   console.log("");
   console.log("Next steps:");
   console.log("1. Sign in as WORKSPACE_OWNER_EMAIL.");
   console.log("2. Create or select the org named by WORKSPACE_ORG_NAME.");
   console.log("3. Set the org allowed domain to WORKSPACE_ORG_DOMAIN.");
-  console.log("4. Set or sync the org A2A secret from A2A_SECRET across apps.");
+  console.log(
+    "4. Configure A2A_SECRET through the scoped secret/deployment secret manager for apps that need cross-app A2A.",
+  );
 }
 
 main();

package/corpus/core/src/terminal/pty-server.ts

@@ -30,14 +30,6 @@ async function getChildProcess(): Promise<typeof import("child_process")> {
   return _cp;
 }
 
-let _fs: typeof import("fs") | undefined;
-async function getFs(): Promise<typeof import("fs")> {
-  if (!_fs) {
-    _fs = await import("node:fs");
-  }
-  return _fs;
-}
-
 /**
  * Kill a process and all its descendants.
  * node-pty's kill() only sends a signal to the shell, but child processes
@@ -314,10 +306,10 @@ export async function createPtyWebSocketServer(
           msg.type === "agentNative.setEnvVars" &&
           Array.isArray(msg.data?.vars)
         ) {
-          const envPath = path.join(resolvedAppDir, ".env");
           const vars: Array<{ key: string; value: string }> = msg.data.vars;
 
-          // Validate env var names and sanitize values
+          // Legacy bridge message. Keep validating the keys, but do not persist
+          // them to .env or process.env; key storage is DB-scoped.
           const validKeyPattern = /^[A-Za-z_][A-Za-z0-9_]*$/;
           const sanitizedVars = vars.filter(({ key }) => {
             if (!validKeyPattern.test(key)) {
@@ -327,39 +319,12 @@ export async function createPtyWebSocketServer(
             return true;
           });
 
-          const fs = await getFs();
-          let lines: string[] = [];
-          try {
-            lines = fs.readFileSync(envPath, "utf-8").split("\n");
-          } catch {}
-
-          for (const { key, value } of sanitizedVars) {
-            // Strip newlines/null bytes to prevent line injection
-            const safeValue = value.replace(/[\r\n\0]/g, "");
-            // Quote values containing #, spaces, or quotes so dotenv parses correctly
-            const needsQuoting = /[# "']/.test(safeValue);
-            const quotedValue = needsQuoting
-              ? `"${safeValue.replace(/"/g, '\\"')}"`
-              : safeValue;
-            const idx = lines.findIndex((l) => l.startsWith(`${key}=`));
-            const entry = `${key}=${quotedValue}`;
-            if (idx !== -1) {
-              lines[idx] = entry;
-            } else {
-              lines.push(entry);
-            }
-          }
-
-          while (lines.length > 0 && lines[lines.length - 1] === "") {
-            lines.pop();
-          }
-          fs.writeFileSync(envPath, lines.join("\n") + "\n", "utf-8");
-
           if (ws.readyState === WebSocket.OPEN) {
             ws.send(
               JSON.stringify({
                 type: "env-vars-saved",
                 keys: sanitizedVars.map((v) => v.key),
+                storage: "scoped-secrets",
               }),
             );
           }

package/corpus/core/src/triggers/dispatcher.ts

@@ -257,8 +257,7 @@ async function handleEvent(
       // Resolve API key for condition evaluation
       const owner = meta.createdBy || resource.owner;
       const userApiKey = await getOwnerActiveApiKey(owner);
-      const apiKey =
-        userApiKey || _deps.apiKey || process.env.ANTHROPIC_API_KEY;
+      const apiKey = userApiKey || _deps.apiKey;
       if (!apiKey) {
         console.warn(
           `[triggers] No API key for trigger "${resource.path}" — skipping`,

package/corpus/templates/.retired/issues/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "issues",
+  "private": true,
+  "scripts": {
+    "build": "node ../../../scripts/build-retired-netlify-site.ts issues"
+  }
+}

package/corpus/templates/.retired/meeting-notes/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "meeting-notes",
+  "private": true,
+  "scripts": {
+    "build": "node ../../../scripts/build-retired-netlify-site.ts meeting-notes"
+  }
+}

package/corpus/templates/.retired/recruiting/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "recruiting",
+  "private": true,
+  "scripts": {
+    "build": "node ../../../scripts/build-retired-netlify-site.ts recruiting"
+  }
+}

package/corpus/templates/.retired/scheduling/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "scheduling",
+  "private": true,
+  "scripts": {
+    "build": "node ../../../scripts/build-retired-netlify-site.ts scheduling"
+  }
+}

package/corpus/templates/.retired/voice/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "voice",
+  "private": true,
+  "scripts": {
+    "build": "node ../../../scripts/build-retired-netlify-site.ts voice"
+  }
+}

package/corpus/templates/analytics/app/components/layout/Header.tsx

@@ -21,7 +21,6 @@ const pageTitleKeys: Record<string, string> = {
   "/analyses": "navigation.analyses",
   "/sessions": "navigation.sessions",
   "/dashboards/explorer": "navigation.explorer",
-  "/team": "navigation.team",
   "/settings": "navigation.settings",
 };
 

package/corpus/templates/analytics/app/components/layout/Sidebar.tsx

@@ -10,11 +10,9 @@ import {
   IconGripVertical,
   IconBook2,
   IconDatabase,
-  IconUsers,
   IconReportAnalytics,
   IconSearch,
   IconArchive,
-  IconTemplate,
   IconBuilding,
   IconLock,
   IconLink,
@@ -144,7 +142,6 @@ import {
 import { CSS } from "@dnd-kit/utilities";
 
 const bottomItems = [
-  { icon: IconUsers, labelKey: "navigation.team", href: "/team" },
   { icon: IconSettings, labelKey: "navigation.settings", href: "/settings" },
 ];
 
@@ -1962,20 +1959,6 @@ export function Sidebar({ mobile }: { mobile?: boolean } = {}) {
             {t("navigation.dataDictionary")}
           </Link>
 
-          {/* Catalog link */}
-          <Link
-            to="/catalog"
-            className={cn(
-              "flex items-center gap-3 rounded-lg px-3 py-2 transition-all hover:text-primary",
-              location.pathname === "/catalog"
-                ? "bg-sidebar-accent text-sidebar-accent-foreground"
-                : "text-muted-foreground hover:bg-sidebar-accent/50",
-            )}
-          >
-            <IconTemplate className="h-4 w-4" />
-            {t("navigation.templateCatalog")}
-          </Link>
-
           {/* Dashboards section */}
           <div className="group/section min-w-0 space-y-1">
             <div
@@ -2280,7 +2263,7 @@ export function Sidebar({ mobile }: { mobile?: boolean } = {}) {
                   <LanguagePicker
                     variant="icon"
                     label={t("settings.languageLabel")}
-                    className="[&_[role=combobox]]:rounded-lg [&_[role=combobox]]:border-0 [&_[role=combobox]]:bg-transparent [&_[role=combobox]]:text-muted-foreground [&_[role=combobox]]:hover:bg-sidebar-accent/50 [&_[role=combobox]]:hover:text-primary"
+                    className="[&_[data-language-picker-trigger]]:rounded-lg [&_[data-language-picker-trigger]]:border-0 [&_[data-language-picker-trigger]]:bg-transparent [&_[data-language-picker-trigger]]:text-muted-foreground [&_[data-language-picker-trigger]]:hover:bg-sidebar-accent/50 [&_[data-language-picker-trigger]]:hover:text-primary"
                   />
                 </div>
               </div>

package/corpus/templates/analytics/app/global.css

@@ -146,6 +146,19 @@
   display: none;
 }
 
+.dark .analytics-ask-page {
+  background: hsl(var(--secondary) / 0.38);
+}
+
+.dark .analytics-ask-page .analytics-chat-panel {
+  background: transparent;
+}
+
+.dark .agent-sidebar-panel[data-agent-sidebar-layout="desktop"],
+.dark .agent-sidebar-panel[data-agent-sidebar-layout="mobile"] {
+  background: #000 !important;
+}
+
 .analytics-chat-panel
   [data-agent-empty-state="centered"]
   .analytics-chat-intro {
@@ -236,9 +249,11 @@
 }
 
 .dark
+  .analytics-ask-page
   .analytics-chat-panel
   [data-agent-empty-state="centered"]
   .agent-composer-root {
+  background: hsl(var(--secondary) / 0.72);
   box-shadow: none;
 }
 

package/corpus/templates/analytics/app/i18n/zh-TW.ts

@@ -1,4 +1,7 @@
 const messages = {
+  root: {
+    whatsNew: "最新消息",
+  },
   navigation: {
     brand: "Analytics",
     ask: "提問",
@@ -102,6 +105,9 @@ const messages = {
     credentials: "資料來源憑證",
     credentialsDescription: "API 金鑰和憑證在資料來源頁面管理。",
     manageDataSources: "管理資料來源",
+    dashboardTemplates: "儀表板範本",
+    dashboardTemplatesDescription: "需要起點時，可安裝來源程式碼控制的儀表板。",
+    openDashboardTemplates: "開啟目錄",
     languageTitle: "語言",
     languageLabel: "介面語言",
     about: "關於",
@@ -795,7 +801,7 @@ const messages = {
     time: "時間",
   },
   catalog: {
-    description: "來源程式碼控制的儀表板可隨時安裝到您的工作空間中。",
+    description: "需要起點時，可安裝儀表板範本。",
     noTemplatesFound: "沒有找到範本",
     tryDifferentCategory: "嘗試不同的目錄類別。",
     templatesCount: "{{count}} 個範本",