@agent-native/core 0.79.26 → 0.80.0

package/corpus/core/src/local-artifacts/index.ts

@@ -12,6 +12,7 @@ export interface AgentNativeManifestRoot {
   name?: string;
   path: string;
   kind?: string;
+  profile?: string;
   extensions?: string[];
   include?: string[];
   hide?: string[];
@@ -19,6 +20,7 @@ export interface AgentNativeManifestRoot {
 
 export interface AgentNativeManifestApp {
   mode?: AgentNativeDataMode;
+  profile?: string;
   roots?: AgentNativeManifestRoot[];
   components?: string | string[];
   extensions?: string | string[];
@@ -39,6 +41,7 @@ export interface LoadedAgentNativeManifest {
 
 export interface LocalArtifactAppDefaults {
   mode?: AgentNativeDataMode;
+  profile?: string;
   roots: AgentNativeManifestRoot[];
   hide?: string[];
   components?: string | string[];
@@ -66,6 +69,7 @@ export interface LoadedLocalArtifactRoot {
   path: string;
   absolutePath: string;
   kind?: string;
+  profile?: string;
   extensions: string[];
   hide: string[];
   include: string[];
@@ -74,6 +78,7 @@ export interface LoadedLocalArtifactRoot {
 export interface LoadedLocalArtifactApp {
   appId: string;
   mode: AgentNativeDataMode;
+  profile?: string;
   manifestPath: string | null;
   workspaceRoot: string;
   roots: LoadedLocalArtifactRoot[];
@@ -88,6 +93,7 @@ export interface LocalArtifactFileMeta {
   rootName: string;
   rootPath: string;
   kind?: string;
+  profile?: string;
   extension: string;
   contentType: string;
   sizeBytes: number;
@@ -200,6 +206,12 @@ function normalizeMode(value: unknown): AgentNativeDataMode | undefined {
   return undefined;
 }
 
+function normalizeProfile(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed || undefined;
+}
+
 function normalizeSlash(filePath: string): string {
   return filePath.replace(/\\/g, "/");
 }
@@ -259,6 +271,7 @@ function normalizeManifestRoot(value: unknown): AgentNativeManifestRoot | null {
     name: typeof value.name === "string" ? value.name : undefined,
     path: value.path,
     kind: typeof value.kind === "string" ? value.kind : undefined,
+    profile: normalizeProfile(value.profile),
     extensions: normalizeExtensions(value.extensions),
     include: asStringArray(value.include),
     hide: asStringArray(value.hide),
@@ -281,6 +294,7 @@ function normalizeManifestApp(value: unknown): AgentNativeManifestApp {
     : [];
   return {
     mode: normalizeMode(value.mode),
+    profile: normalizeProfile(value.profile),
     roots,
     components:
       typeof value.components === "string" || Array.isArray(value.components)
@@ -415,6 +429,7 @@ function mergeAppConfig(
 ): AgentNativeManifestApp {
   return {
     mode: manifestApp?.mode ?? defaults?.mode,
+    profile: manifestApp?.profile ?? defaults?.profile,
     roots:
       manifestApp?.roots && manifestApp.roots.length > 0
         ? manifestApp.roots
@@ -464,6 +479,7 @@ export async function getLocalArtifactApp(
       path: safePath,
       absolutePath,
       kind: root.kind,
+      profile: root.profile ?? app.profile,
       extensions,
       hide: [...DEFAULT_HIDE_PATTERNS, ...asStringArray(root.hide)],
       include: asStringArray(root.include),
@@ -473,6 +489,7 @@ export async function getLocalArtifactApp(
   return {
     appId: options.appId,
     mode,
+    profile: app.profile,
     manifestPath: loaded?.path ?? null,
     workspaceRoot,
     roots,
@@ -597,6 +614,7 @@ async function fileMetaForPath(
     rootName: root.name,
     rootPath: root.path,
     kind: root.kind,
+    profile: root.profile,
     extension,
     contentType: contentTypeForExtension(extension),
     sizeBytes: Buffer.byteLength(content, "utf8"),

package/corpus/core/src/localization/default-messages.ts

@@ -431,6 +431,87 @@ const messages = {
     sharedMessaging:
       "Need one shared messaging surface for your workspace? Connect Slack or Telegram to a dispatch app and let it delegate to other agents over A2A.",
   },
+  mcpIntegrations: {
+    menuLabel: "Integrations",
+    menuDescription: "Connect MCP tools to the agent",
+    title: "Connect integrations",
+    description: "Choose a default MCP integration or add a custom server.",
+    searchPlaceholder: "Search integrations",
+    addYourOwn: "Add your own",
+    noMatches: "No integrations match that search.",
+    connected: "Connected",
+    configure: "Configure",
+    connect: "Connect",
+    backToIntegrations: "Back to integrations",
+    customTitle: "Add custom MCP server",
+    configureTitle: "Configure {{name}}",
+    presetNoAuthDescription:
+      "Preset values are filled in. Test the endpoint or connect it now.",
+    presetAuthDescription:
+      "Preset values are filled in. Add any required authorization details before connecting.",
+    customDescription:
+      "Paste a Streamable HTTP or SSE MCP endpoint and optional headers.",
+    oauthNotice:
+      "This provider usually requires an OAuth setup. Follow the provider docs, or add an Authorization header if your endpoint supports token-based access.",
+    personal: "Personal",
+    organization: "Organization",
+    orgNoOrg: "Join an organization to share MCP servers",
+    orgAdminOnly: "Only owners and admins can add org-scope servers",
+    serverName: "Server name",
+    url: "URL",
+    fieldDescription: "Description",
+    headers: "Headers",
+    serverNamePlaceholder: "Server name",
+    urlPlaceholder: "https://mcp.example.com/mcp",
+    descriptionPlaceholder: "Description (optional)",
+    headersPlaceholder: "Authorization: Bearer <token>",
+    openSetupDocs: "Open setup docs",
+    test: "Test",
+    toolsAvailable_one: "{{count}} tool available",
+    toolsAvailable_other: "{{count}} tools available",
+    failed: "Failed",
+    docsLabel: "{{name}} docs",
+    catalog: {
+      context7: {
+        description: "Fetch current library docs in agent chats.",
+        useCase:
+          "Documentation, technical reference, API docs, framework guides",
+      },
+      sentry: {
+        description: "Inspect issues, events, and debugging data.",
+        useCase: "Error monitoring, debugging, performance, crash reports",
+      },
+      notion: {
+        description: "Search pages and team knowledge.",
+        useCase: "Documentation, knowledge management, notes, content creation",
+      },
+      semgrep: {
+        description: "Scan code for security findings.",
+        useCase: "Security scanning, vulnerability detection, code analysis",
+      },
+      linear: {
+        description: "Read and write Linear issues.",
+        useCase: "Project management, issue tracking, planning, bug reports",
+      },
+      supabase: {
+        description: "Manage data, auth, and backend services.",
+        useCase: "Database, authentication, storage, edge functions",
+      },
+      neon: {
+        description: "Work with serverless Postgres projects.",
+        useCase: "Database management, serverless Postgres, data storage",
+      },
+      stripe: {
+        description: "Manage payments, subscriptions, and customers.",
+        useCase: "Payments, subscriptions, invoicing, customer management",
+      },
+    },
+    auth: {
+      none: "No auth",
+      headers: "Header",
+      oauth: "OAuth",
+    },
+  },
   observability: {
     noData: "No data available",
     noConversations: "No conversations recorded yet",

package/corpus/core/src/localization/shared.ts

@@ -1,13 +1,13 @@
 export const SUPPORTED_LOCALES = [
   "en-US",
-  "zh-CN",
-  "zh-TW",
   "es-ES",
   "fr-FR",
   "de-DE",
+  "pt-BR",
+  "zh-CN",
+  "zh-TW",
   "ja-JP",
   "ko-KR",
-  "pt-BR",
   "hi-IN",
   "ar-SA",
 ] as const;

package/corpus/core/src/org/handlers.ts

@@ -203,7 +203,7 @@ export const listMembersHandler = defineEventHandler(async (event: H3Event) => {
   const args: unknown[] = [ctx.orgId];
   let sql = `SELECT email, role, joined_at AS "joinedAt" FROM org_members WHERE org_id = ?`;
   if (search) {
-    sql += ` AND LOWER(email) LIKE ? ESCAPE '\\'`;
+    sql += ` AND LOWER(email) LIKE ? ESCAPE '!'`;
     args.push(`%${escapeLike(search)}%`);
   }
   sql += ` ORDER BY LOWER(email) ASC`;
@@ -242,7 +242,7 @@ function clampInteger(
 }
 
 function escapeLike(value: string): string {
-  return value.replace(/[\\%_]/g, (match) => `\\${match}`);
+  return value.replace(/[!%_]/g, (match) => `!${match}`);
 }
 
 function normalizeInviteRole(input: unknown): "member" | "admin" {

package/corpus/core/src/resources/store.ts

@@ -32,7 +32,7 @@ export const SHARED_OWNER = "__shared__";
 export const WORKSPACE_OWNER = "__workspace__";
 
 function escapeLike(value: string): string {
-  return value.replace(/[\\%_]/g, (char) => `\\${char}`);
+  return value.replace(/[!%_]/g, (char) => `!${char}`);
 }
 
 function prefixLike(value: string): string {
@@ -635,7 +635,7 @@ async function selectGrantedWorkspaceResourceRows(input: {
     args.push(input.path);
   }
   if (input.pathPrefix) {
-    conditions.push("wr.path LIKE ? ESCAPE '\\'");
+    conditions.push("wr.path LIKE ? ESCAPE '!'");
     args.push(prefixLike(input.pathPrefix));
   }
 
@@ -1358,7 +1358,7 @@ export async function resourceList(
 
   if (pathPrefix) {
     const { rows } = await client.execute({
-      sql: `SELECT ${RESOURCE_META_SELECT} FROM resources WHERE owner = ? AND path LIKE ? ESCAPE '\\'${visibilitySql}`,
+      sql: `SELECT ${RESOURCE_META_SELECT} FROM resources WHERE owner = ? AND path LIKE ? ESCAPE '!'${visibilitySql}`,
       args: [owner, prefixLike(pathPrefix)],
     });
     const resources = rows.map(rowToMeta);
@@ -1406,11 +1406,11 @@ export async function resourceListAccessible(
 
   if (pathPrefix) {
     const { rows } = await client.execute({
-      sql: `SELECT ${RESOURCE_META_SELECT} FROM resources WHERE owner = ? AND path LIKE ? ESCAPE '\\'${visibilitySql}
+      sql: `SELECT ${RESOURCE_META_SELECT} FROM resources WHERE owner = ? AND path LIKE ? ESCAPE '!'${visibilitySql}
             UNION
-            SELECT ${RESOURCE_META_SELECT} FROM resources WHERE owner = ? AND path LIKE ? ESCAPE '\\'${visibilitySql}
+            SELECT ${RESOURCE_META_SELECT} FROM resources WHERE owner = ? AND path LIKE ? ESCAPE '!'${visibilitySql}
             UNION
-            SELECT ${RESOURCE_META_SELECT} FROM resources WHERE owner = ? AND path LIKE ? ESCAPE '\\'${visibilitySql}`,
+            SELECT ${RESOURCE_META_SELECT} FROM resources WHERE owner = ? AND path LIKE ? ESCAPE '!'${visibilitySql}`,
       args: [
         userEmail,
         prefixLike(pathPrefix),
@@ -1534,7 +1534,7 @@ export async function resourceListAllOwners(
   await ensureTable();
   const client = getDbExec();
   const { rows } = await client.execute({
-    sql: `SELECT * FROM resources WHERE path LIKE ? ESCAPE '\\'`,
+    sql: `SELECT * FROM resources WHERE path LIKE ? ESCAPE '!'`,
     args: [prefixLike(pathPrefix)],
   });
   const localResources = (

package/corpus/core/src/server/core-routes-plugin.ts

@@ -167,6 +167,39 @@ export const FRAMEWORK_ROUTE_PREFIX = "/_agent-native";
 export const FRAMEWORK_EVENTS_ROUTE = `${FRAMEWORK_ROUTE_PREFIX}/events`;
 export const LEGACY_FRAMEWORK_EVENTS_ROUTE = `${FRAMEWORK_ROUTE_PREFIX}/poll-events`;
 
+export function getFrameworkEnvKeys(): EnvKeyConfig[] {
+  return [
+    { key: "ENABLE_BUILDER", label: "Enable Builder.io features" },
+    {
+      key: "AGENT_ENGINE_PREFER_BYO_KEY",
+      label:
+        "Prefer BYO LLM key over Builder gateway (default: false — gateway wins)",
+    },
+    {
+      key: "RESEND_API_KEY",
+      label: "Resend API key",
+      helpText:
+        "Enables transactional email, including password resets, invitations, share notifications, and dashboard reports.",
+    },
+    {
+      key: "SENDGRID_API_KEY",
+      label: "SendGrid API key",
+      helpText:
+        "Enables transactional email, including password resets, invitations, share notifications, and dashboard reports.",
+    },
+    {
+      key: "EMAIL_FROM",
+      label: "Email from address",
+      helpText:
+        "Sender address for transactional email. Required when using SendGrid.",
+    },
+    ...Object.values(PROVIDER_ENV_META).map(({ envVar, label }) => ({
+      key: envVar,
+      label,
+    })),
+  ];
+}
+
 /** Result of the `/_agent-native/health` liveness + DB-warmup probe. */
 export interface DbHealthProbeResult {
   /** The serverless function is live and served the request. */
@@ -2199,18 +2232,7 @@ export function createCoreRoutesPlugin(
       );
 
       // Env key management — framework keys are always included
-      const frameworkEnvKeys: EnvKeyConfig[] = [
-        { key: "ENABLE_BUILDER", label: "Enable Builder.io features" },
-        {
-          key: "AGENT_ENGINE_PREFER_BYO_KEY",
-          label:
-            "Prefer BYO LLM key over Builder gateway (default: false — gateway wins)",
-        },
-        ...Object.values(PROVIDER_ENV_META).map(({ envVar, label }) => ({
-          key: envVar,
-          label,
-        })),
-      ];
+      const frameworkEnvKeys = getFrameworkEnvKeys();
       {
         const envKeys = [...frameworkEnvKeys, ...(options.envKeys ?? [])];
         const allowedEnvKeyNames = envKeys.map(({ key }) => key);

package/corpus/core/src/server/transcribe-voice.ts

@@ -30,6 +30,13 @@ import { createBuilderEngine } from "../agent/engine/builder-engine.js";
 import { appStateGet } from "../application-state/store.js";
 import { getOrgContext } from "../org/context.js";
 import { transcribeWithBuilder } from "../transcription/builder-transcription.js";
+import {
+  applyVoiceContextReplacements,
+  buildVoiceGuidanceBlock,
+  parseVoiceContextPack,
+  voiceContextTermsOnly,
+  type VoiceContextPack,
+} from "../voice/index.js";
 import { getSession } from "./auth.js";
 import {
   resolveHasBuilderPrivateKey,
@@ -146,6 +153,20 @@ export function createTranscribeVoiceHandler() {
           Buffer.from(instructionsPart.data).toString("utf8"),
         )
       : undefined;
+    const voiceContextPart = parts?.find(
+      (p) => p.name === "voiceContext" || p.name === "contextPack",
+    );
+    const voiceContext = voiceContextPart?.data
+      ? parseVoiceContextPack(
+          Buffer.from(voiceContextPart.data).toString("utf8"),
+        )
+      : undefined;
+    const voiceGuidance = buildVoiceGuidanceBlock({
+      instructions,
+      contextPack: voiceContextTermsOnly(voiceContext),
+    });
+    const applyVoiceContext = (value: string) =>
+      applyVoiceContextReplacements(value, voiceContext).trim();
 
     // Resolve provider preference. Per-request "provider" form field takes
     // precedence (the desktop client sends it on every dictation press),
@@ -220,7 +241,7 @@ export function createTranscribeVoiceHandler() {
     // does not want audio uploaded to any external provider. The client
     // shouldn't hit this endpoint when "browser" is selected; this is a
     // defense-in-depth refusal.
-    if (providerPref === "browser") {
+    if (providerPref === "browser" && !transcriptText) {
       setResponseStatus(event, 400);
       return {
         error:
@@ -238,7 +259,8 @@ export function createTranscribeVoiceHandler() {
       return await cleanupTranscriptText({
         event,
         text: transcriptText,
-        instructions,
+        instructions: voiceGuidance,
+        contextPack: voiceContext,
         providerPref,
         hasBuilderPrivateKey,
         withRequestContext,
@@ -282,9 +304,9 @@ export function createTranscribeVoiceHandler() {
           mimeType: mime,
           apiKey: geminiKey,
           language: language || undefined,
-          instructions,
+          instructions: voiceGuidance,
         });
-        const trimmed = text.trim();
+        const trimmed = applyVoiceContext(text);
         if (!trimmed) {
           setResponseStatus(event, 502);
           return { error: "Gemini returned an empty transcript." };
@@ -318,9 +340,9 @@ export function createTranscribeVoiceHandler() {
               ? BUILDER_GEMINI_TRANSCRIPTION_MODEL
               : undefined,
           language: language || undefined,
-          instructions,
+          instructions: voiceGuidance,
         });
-        return { text: (result.text ?? "").trim() };
+        return { text: applyVoiceContext(result.text ?? "") };
       } catch (err) {
         const message = (err as Error)?.message ?? String(err);
         if (message.includes("credits exhausted")) {
@@ -352,7 +374,8 @@ export function createTranscribeVoiceHandler() {
         audioBytes,
         mime,
         language,
-        instructions,
+        instructions: voiceGuidance,
+        contextPack: voiceContext,
       });
     }
 
@@ -368,9 +391,9 @@ export function createTranscribeVoiceHandler() {
           mimeType: mime,
           model: BUILDER_GEMINI_TRANSCRIPTION_MODEL,
           language: language || undefined,
-          instructions,
+          instructions: voiceGuidance,
         });
-        return { text: (result.text ?? "").trim() };
+        return { text: applyVoiceContext(result.text ?? "") };
       } catch (err) {
         const message = (err as Error)?.message ?? String(err);
         // Surface 402 (credits exhausted) as a 402 so the client can show
@@ -395,9 +418,9 @@ export function createTranscribeVoiceHandler() {
             mimeType: mime,
             apiKey: geminiKey,
             language: language || undefined,
-            instructions,
+            instructions: voiceGuidance,
           });
-          const trimmed = text.trim();
+          const trimmed = applyVoiceContext(text);
           if (trimmed) {
             console.log(`[transcribe-voice] Gemini → ${trimmed.length} chars`);
             return { text: trimmed };
@@ -465,7 +488,8 @@ export function createTranscribeVoiceHandler() {
       audioBytes,
       mime,
       language,
-      instructions,
+      instructions: voiceGuidance,
+      contextPack: voiceContext,
     });
   });
 }
@@ -484,6 +508,7 @@ async function callWhisperCompat({
   mime,
   language,
   instructions,
+  contextPack,
 }: {
   event: H3Event;
   provider: {
@@ -496,6 +521,7 @@ async function callWhisperCompat({
   mime: string;
   language?: string;
   instructions?: string;
+  contextPack?: VoiceContextPack;
 }): Promise<{ text: string } | { error: string }> {
   const ext = pickExtension(mime);
   const filename = `composer-voice.${ext}`;
@@ -531,7 +557,12 @@ async function callWhisperCompat({
       };
     }
     const data = (await res.json()) as { text?: string };
-    return { text: (data.text ?? "").trim() };
+    return {
+      text: applyVoiceContextReplacements(
+        (data.text ?? "").trim(),
+        contextPack,
+      ).trim(),
+    };
   } catch (err) {
     setResponseStatus(event, 502);
     return {
@@ -549,6 +580,7 @@ async function cleanupTranscriptText({
   event,
   text,
   instructions,
+  contextPack,
   providerPref,
   hasBuilderPrivateKey,
   withRequestContext,
@@ -557,6 +589,7 @@ async function cleanupTranscriptText({
   event: H3Event;
   text: string;
   instructions?: string;
+  contextPack?: VoiceContextPack;
   providerPref?: string;
   hasBuilderPrivateKey: () => Promise<boolean>;
   withRequestContext: <T>(fn: () => Promise<T>) => Promise<T>;
@@ -564,9 +597,11 @@ async function cleanupTranscriptText({
 }): Promise<{ text: string } | { error: string }> {
   const original = text.trim();
   if (!original) return { text: "" };
+  const finalizeText = (value: string) =>
+    applyVoiceContextReplacements(value || original, contextPack).trim();
 
   if (providerPref === "browser") {
-    return { text: original };
+    return { text: finalizeText(original) };
   }
 
   if (providerPref === "builder" || providerPref === "builder-gemini") {
@@ -581,7 +616,7 @@ async function cleanupTranscriptText({
       const cleaned = await withRequestContext(() =>
         cleanupWithBuilder({ text: original, instructions }),
       );
-      return { text: cleaned || original };
+      return { text: finalizeText(cleaned || original) };
     } catch (err) {
       setResponseStatus(event, 502);
       return {
@@ -605,7 +640,7 @@ async function cleanupTranscriptText({
         apiKey: geminiKey,
         instructions,
       });
-      return { text: cleaned || original };
+      return { text: finalizeText(cleaned || original) };
     } catch (err) {
       setResponseStatus(event, 502);
       return {
@@ -631,7 +666,7 @@ async function cleanupTranscriptText({
         apiKey,
         instructions,
       });
-      return { text: cleaned || original };
+      return { text: finalizeText(cleaned || original) };
     } catch (err) {
       setResponseStatus(event, 502);
       return {
@@ -645,7 +680,7 @@ async function cleanupTranscriptText({
       const cleaned = await withRequestContext(() =>
         cleanupWithBuilder({ text: original, instructions }),
       );
-      if (cleaned) return { text: cleaned };
+      if (cleaned) return { text: finalizeText(cleaned) };
     } catch {
       // Fall through to BYOK providers, then raw text.
     }
@@ -659,7 +694,7 @@ async function cleanupTranscriptText({
         apiKey: geminiKey,
         instructions,
       });
-      if (cleaned) return { text: cleaned };
+      if (cleaned) return { text: finalizeText(cleaned) };
     } catch {
       // Fall through.
     }
@@ -674,7 +709,7 @@ async function cleanupTranscriptText({
         apiKey: groqKey,
         instructions,
       });
-      if (cleaned) return { text: cleaned };
+      if (cleaned) return { text: finalizeText(cleaned) };
     } catch {
       // Fall through.
     }
@@ -689,13 +724,13 @@ async function cleanupTranscriptText({
         apiKey: openaiKey,
         instructions,
       });
-      if (cleaned) return { text: cleaned };
+      if (cleaned) return { text: finalizeText(cleaned) };
     } catch {
       // Fall through.
     }
   }
 
-  return { text: original };
+  return { text: finalizeText(original) };
 }
 
 async function cleanupWithBuilder({

package/corpus/core/src/shared/mcp-embed-headers.ts

@@ -87,6 +87,27 @@ export function isAgentNativeFirstPartyAppOrigin(
   }
 }
 
+export function isBuilderIoEmbedOrigin(
+  origin: string | null | undefined,
+): boolean {
+  if (!origin) return false;
+  try {
+    const url = new URL(origin);
+    const hostname = url.hostname.toLowerCase();
+    return (
+      url.protocol === "https:" &&
+      !url.username &&
+      !url.password &&
+      (hostname === "builder.io" ||
+        hostname.endsWith(".builder.io") ||
+        hostname === "builder.my" ||
+        hostname.endsWith(".builder.my"))
+    );
+  } catch {
+    return false;
+  }
+}
+
 export function isMcpEmbedCorsOrigin(
   origin: string | null | undefined,
 ): boolean {
@@ -96,7 +117,8 @@ export function isMcpEmbedCorsOrigin(
     isClaudeMcpContentOrigin(origin) ||
     isChatGptMcpSandboxOrigin(origin) ||
     isMcpProductHostOrigin(origin) ||
-    isAgentNativeFirstPartyAppOrigin(origin)
+    isAgentNativeFirstPartyAppOrigin(origin) ||
+    isBuilderIoEmbedOrigin(origin)
   );
 }