@agent-native/core 0.82.0 → 0.84.0

package/corpus/core/src/client/settings/useBuilderStatus.ts

@@ -188,7 +188,6 @@ export interface BuilderConnectFlow {
 
 const POLL_INTERVAL_MS = 2000;
 const POLL_TIMEOUT_MS = 5 * 60 * 1000;
-const POPUP_CLOSED_CONFIRMATION_GRACE_MS = 5000;
 const CALLBACK_SUCCESS_STATUS_RETRY_MS = 500;
 const CALLBACK_SUCCESS_STATUS_RETRIES = 10;
 const BUILDER_CONNECT_PARAM = "_an_connect";
@@ -447,15 +446,6 @@ function delay(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-function isPopupClosed(opened: Window | null): boolean {
-  if (!opened) return false;
-  try {
-    return opened.closed === true;
-  } catch {
-    return false;
-  }
-}
-
 function isTrustedBuilderConnectMessageOrigin(origin: string): boolean {
   if (typeof window !== "undefined" && origin === window.location.origin) {
     return true;
@@ -693,8 +683,6 @@ export function useBuilderConnectFlow(
       const clickTrackingSource =
         startOptions?.trackingSource ?? trackingSource;
       const clickTrackingFlow = startOptions?.trackingFlow ?? trackingFlow;
-      let openedPopup: Window | null = null;
-      let popupClosedAt: number | null = null;
       connectStartedAtRef.current = started;
       setConnecting(true);
       setError(null);
@@ -730,7 +718,6 @@ export function useBuilderConnectFlow(
           source: clickTrackingSource,
           flow: clickTrackingFlow,
         });
-        openedPopup = opened;
         if (!opened) {
           // Agent Native Desktop handles the popup in Electron and reports
           // null to the embedded webview, so null is not a blocker here.
@@ -783,7 +770,6 @@ export function useBuilderConnectFlow(
             );
           })();
         } else {
-          openedPopup = opened;
           showBuilderConnectPopupPlaceholder(opened);
           void (async () => {
             const s = await fetchStatus();
@@ -884,25 +870,6 @@ export function useBuilderConnectFlow(
           setError(
             `Couldn't save Builder credentials: ${s.connectError.message}. Try again or contact support.`,
           );
-        } else if (isPopupClosed(openedPopup)) {
-          popupClosedAt ??= Date.now();
-          if (Date.now() - popupClosedAt > POPUP_CLOSED_CONFIRMATION_GRACE_MS) {
-            stopPoll();
-            connectStartedAtRef.current = null;
-            setConnecting(false);
-            trackEvent("builder connect failed", {
-              feature: "builder",
-              stage: "client",
-              reason: "popup_closed_without_status",
-              source: clickTrackingSource,
-              flow:
-                cleanTrackingParam(clickTrackingFlow) ??
-                inferBuilderConnectTrackingFlow(clickTrackingSource),
-            });
-            setError(
-              "Builder finished, but this workspace couldn't confirm the saved credentials. Refresh this page or try Connect Builder.io again.",
-            );
-          }
         } else if (Date.now() - started > POLL_TIMEOUT_MS) {
           stopPoll();
           connectStartedAtRef.current = null;
@@ -972,7 +939,6 @@ export function useBuilderConnectFlow(
         )
           ? s?.connectError
           : null;
-        stopPoll();
         setHasFetchedStatus(true);
         if (s) {
           setConfigured(false);
@@ -983,13 +949,14 @@ export function useBuilderConnectFlow(
           statusConnectUrlAtRef.current = nextConnectUrl ? Date.now() : null;
           setOrgName(s.orgName ?? null);
         }
-        connectStartedAtRef.current = null;
-        setConnecting(false);
-        setError(
-          connectError
-            ? `Couldn't save Builder credentials: ${connectError.message}. Try again or contact support.`
-            : "Builder finished, but this workspace couldn't confirm the saved credentials. Refresh this page or try Connect Builder.io again.",
-        );
+        if (connectError) {
+          stopPoll();
+          connectStartedAtRef.current = null;
+          setConnecting(false);
+          setError(
+            `Couldn't save Builder credentials: ${connectError.message}. Try again or contact support.`,
+          );
+        }
         return;
       }
       stopPoll();

package/corpus/core/src/client/useProductionAgent.ts

@@ -1,6 +1,10 @@
 import { useState, useCallback, useRef } from "react";
 
-import type { AgentMessage, AgentChatEvent } from "../agent/types.js";
+import type {
+  AgentMessage,
+  AgentChatEvent,
+  AgentToolInput,
+} from "../agent/types.js";
 import { agentNativePath } from "./api-path.js";
 import { formatChatErrorText } from "./error-format.js";
 
@@ -10,7 +14,7 @@ export interface ProductionAgentMessage {
   content: string;
   toolCalls?: Array<{
     tool: string;
-    input: Record<string, string>;
+    input: AgentToolInput;
     result?: string;
   }>;
 }

package/corpus/core/src/deploy/build.ts

@@ -1135,7 +1135,7 @@ async function getHandler() {
         headers: {
           "Access-Control-Allow-Origin": "*",
           "Access-Control-Allow-Methods": "GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS",
-          "Access-Control-Allow-Headers": "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Embed-Target",
+          "Access-Control-Allow-Headers": "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,X-Agent-Native-Embed-Target",
         },
       });
     }

package/corpus/core/src/observability/traces.ts

@@ -1,5 +1,5 @@
 import type { AgentLoopUsage } from "../agent/production-agent.js";
-import type { AgentChatEvent } from "../agent/types.js";
+import type { AgentChatEvent, AgentToolInput } from "../agent/types.js";
 import { type AgentSpan, endAgentSpan, startAgentSpan } from "./tracing.js";
 import type { TraceSpan, TraceSummary, ObservabilityConfig } from "./types.js";
 import { DEFAULT_OBSERVABILITY_CONFIG } from "./types.js";
@@ -115,7 +115,7 @@ export async function instrumentAgentLoop(opts: {
       spanId: string;
       startMs: number;
       toolName: string;
-      input: Record<string, string>;
+      input: AgentToolInput;
       otelSpan: AgentSpan | null;
       endResult?: { status: "success" | "error"; errorMessage: string | null };
     }
@@ -148,7 +148,7 @@ export async function instrumentAgentLoop(opts: {
           spanId: string;
           startMs: number;
           toolName: string;
-          input: Record<string, string>;
+          input: AgentToolInput;
           otelSpan: AgentSpan | null;
           // Set by the done handler if it fires before the span promise
           // resolves, so the resolved span is ended with the correct status.

package/corpus/core/src/onboarding/default-steps.ts

@@ -54,7 +54,7 @@ const LLM_KEY_METHODS: LlmKeyMethod[] = [
     provider: "openrouter",
     id: "openrouter-key",
     label: "OpenRouter",
-    description: "OpenRouter models with your own OpenRouter key.",
+    description: "OpenRouter models, including GLM 5.2, with your own key.",
   },
   {
     provider: "groq",

package/corpus/core/src/scripts/agent-engines/manage-agent-engine.ts

@@ -54,7 +54,7 @@ export const tool: ActionTool = {
       model: {
         type: "string",
         description:
-          "Model ID (e.g. 'gpt-5.5', 'claude-sonnet-4-6', 'gemini-3-1-pro'). Required for \"set-app-default\"; optional for \"set\" and \"test\" where it defaults to the engine's default model.",
+          "Model ID (e.g. 'gpt-5.5', 'claude-sonnet-5', 'gemini-3-1-pro'). Required for \"set-app-default\"; optional for \"set\" and \"test\" where it defaults to the engine's default model.",
       },
       baseUrl: {
         type: "string",

package/corpus/core/src/scripts/agent-engines/set-agent-engine.ts

@@ -27,7 +27,7 @@ export const tool: ActionTool = {
       model: {
         type: "string",
         description:
-          "Model ID to use with this engine (e.g. 'gpt-5.5', 'claude-sonnet-4-6'). Defaults to the engine's default model if omitted.",
+          "Model ID to use with this engine (e.g. 'gpt-5.5', 'claude-sonnet-5'). Defaults to the engine's default model if omitted.",
       },
     },
     required: ["engine"],

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -3789,6 +3789,81 @@ export function shouldBlockInProductCodeEditingSurface(input: {
   );
 }
 
+type RecurringJobsRuntimeEnvKey =
+  | "AGENT_NATIVE_DISABLE_RECURRING_JOBS"
+  | "AGENT_NATIVE_ENABLE_LOCAL_RECURRING_JOBS"
+  | "APP_URL"
+  | "BETTER_AUTH_URL"
+  | "DEPLOY_URL"
+  | "NODE_ENV"
+  | "URL"
+  | "VITE_APP_URL"
+  | "VITE_WORKSPACE_GATEWAY_URL"
+  | "WORKSPACE_GATEWAY_URL";
+
+type RecurringJobsRuntimeEnv = Partial<
+  Record<RecurringJobsRuntimeEnvKey, string | undefined>
+>;
+
+function isTruthyEnv(value: string | undefined): boolean {
+  return /^(1|true|yes|on)$/i.test(value?.trim() ?? "");
+}
+
+function isLoopbackAppUrl(value: string | undefined): boolean {
+  const raw = value?.trim();
+  if (!raw) return false;
+
+  const candidates = /^[a-z][a-z0-9+.-]*:\/\//i.test(raw)
+    ? [raw]
+    : [raw, `http://${raw}`];
+  for (const candidate of candidates) {
+    try {
+      const url = new URL(candidate);
+      const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+      if (
+        host === "localhost" ||
+        host === "127.0.0.1" ||
+        host === "0.0.0.0" ||
+        host === "::1" ||
+        host === "tauri.localhost" ||
+        host.endsWith(".localhost")
+      ) {
+        return true;
+      }
+    } catch {}
+  }
+
+  return false;
+}
+
+export function shouldDisableRecurringJobsRuntime(
+  env: RecurringJobsRuntimeEnv = process.env,
+): boolean {
+  if (isTruthyEnv(env.AGENT_NATIVE_DISABLE_RECURRING_JOBS)) return true;
+
+  const isLocalRuntime =
+    env.NODE_ENV === "development" ||
+    env.NODE_ENV === "test" ||
+    [
+      env.APP_URL,
+      env.BETTER_AUTH_URL,
+      env.DEPLOY_URL,
+      env.URL,
+      env.VITE_APP_URL,
+      env.VITE_WORKSPACE_GATEWAY_URL,
+      env.WORKSPACE_GATEWAY_URL,
+    ].some(isLoopbackAppUrl);
+
+  if (
+    isLocalRuntime &&
+    isTruthyEnv(env.AGENT_NATIVE_ENABLE_LOCAL_RECURRING_JOBS)
+  ) {
+    return false;
+  }
+
+  return isLocalRuntime;
+}
+
 export function createAgentChatPlugin(
   options?: AgentChatPluginOptions,
 ): NitroPluginDef {
@@ -7994,56 +8069,69 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
         }),
       );
 
+      const disableRecurringJobsRuntime = shouldDisableRecurringJobsRuntime();
+
       // ─── Recurring Jobs Scheduler ──────────────────────────────────────
       // Poll every 60 seconds for due recurring jobs and execute them.
       // Uses setInterval so it works in all deployment environments without
       // requiring Nitro experimental tasks configuration.
-      try {
-        const { processRecurringJobs } = await import("../jobs/scheduler.js");
+      if (disableRecurringJobsRuntime) {
+        if (process.env.DEBUG) {
+          console.log(
+            "[recurring-jobs] Scheduler disabled for local development",
+          );
+        }
+      } else {
+        try {
+          const { processRecurringJobs } = await import("../jobs/scheduler.js");
 
-        const schedulerDeps = {
-          getActions: () => ({
-            ...templateScripts,
-            ...resourceScripts,
-            ...docsScripts,
-            ...(lazyContext ? frameworkContextTool : {}),
-            ...chatScripts,
-            ...jobTools,
-            ...automationTools,
-            ...notificationTools,
-            ...progressTools,
-            ...fetchTool,
-            ...webSearchTool,
-            ...toolActions,
-          }),
-          getSystemPrompt: async (owner: string) => {
-            const resources = await loadResourcesForPrompt(
-              owner,
-              lazyContext,
-              options?.appId,
-            );
-            const schemaBlock = lazyContext
-              ? ""
-              : await buildSchemaBlock(owner, databaseToolsMode);
-            return basePrompt + resources + schemaBlock;
-          },
-          apiKey: options?.apiKey,
-          model: options?.model,
-          appId: options?.appId,
-        };
+          const schedulerDeps = {
+            getActions: () => ({
+              ...templateScripts,
+              ...resourceScripts,
+              ...docsScripts,
+              ...(lazyContext ? frameworkContextTool : {}),
+              ...chatScripts,
+              ...jobTools,
+              ...automationTools,
+              ...notificationTools,
+              ...progressTools,
+              ...fetchTool,
+              ...webSearchTool,
+              ...toolActions,
+            }),
+            getSystemPrompt: async (owner: string) => {
+              const resources = await loadResourcesForPrompt(
+                owner,
+                lazyContext,
+                options?.appId,
+              );
+              const schemaBlock = lazyContext
+                ? ""
+                : await buildSchemaBlock(owner, databaseToolsMode);
+              return basePrompt + resources + schemaBlock;
+            },
+            apiKey: options?.apiKey,
+            model: options?.model,
+            appId: options?.appId,
+          };
 
-        // Start after a 10-second delay to let the server fully initialize
-        setTimeout(() => {
-          setInterval(() => {
-            processRecurringJobs(schedulerDeps).catch((err) => {
-              console.error("[recurring-jobs] Scheduler error:", err?.message);
-            });
-          }, 60_000);
-          if (process.env.DEBUG)
-            console.log("[recurring-jobs] Scheduler started (60s interval)");
-        }, 10_000);
-      } catch (err) {
-        // Jobs module not available — skip silently
+          // Start after a 10-second delay to let the server fully initialize
+          setTimeout(() => {
+            setInterval(() => {
+              processRecurringJobs(schedulerDeps).catch((err) => {
+                console.error(
+                  "[recurring-jobs] Scheduler error:",
+                  err?.message,
+                );
+              });
+            }, 60_000);
+            if (process.env.DEBUG)
+              console.log("[recurring-jobs] Scheduler started (60s interval)");
+          }, 10_000);
+        } catch (err) {
+          // Jobs module not available — skip silently
+        }
       }
 
       // ─── Agent Teams orphan sweep ─────────────────────────────────────
@@ -8097,43 +8185,51 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
       })();
 
       // ─── Trigger Dispatcher (event-based automations) ─────────────────
-      try {
-        const { initTriggerDispatcher } =
-          await import("../triggers/dispatcher.js");
-        await initTriggerDispatcher({
-          getActions: () => ({
-            ...templateScripts,
-            ...resourceScripts,
-            ...docsScripts,
-            ...(lazyContext ? frameworkContextTool : {}),
-            ...chatScripts,
-            ...jobTools,
-            ...automationTools,
-            ...notificationTools,
-            ...progressTools,
-            ...fetchTool,
-            ...webSearchTool,
-            ...toolActions,
-          }),
-          getSystemPrompt: async (owner: string) => {
-            const resources = await loadResourcesForPrompt(
-              owner,
-              lazyContext,
-              options?.appId,
-            );
-            const schemaBlock = lazyContext
-              ? ""
-              : await buildSchemaBlock(owner, databaseToolsMode);
-            return basePrompt + resources + schemaBlock;
-          },
-          apiKey: options?.apiKey,
-          model: options?.model,
-          appId: options?.appId,
-        });
-        if (process.env.DEBUG)
-          console.log("[triggers] Trigger dispatcher initialized");
-      } catch (err) {
-        // Triggers module not available — skip silently
+      if (disableRecurringJobsRuntime) {
+        if (process.env.DEBUG) {
+          console.log(
+            "[triggers] Trigger dispatcher disabled for local development",
+          );
+        }
+      } else {
+        try {
+          const { initTriggerDispatcher } =
+            await import("../triggers/dispatcher.js");
+          await initTriggerDispatcher({
+            getActions: () => ({
+              ...templateScripts,
+              ...resourceScripts,
+              ...docsScripts,
+              ...(lazyContext ? frameworkContextTool : {}),
+              ...chatScripts,
+              ...jobTools,
+              ...automationTools,
+              ...notificationTools,
+              ...progressTools,
+              ...fetchTool,
+              ...webSearchTool,
+              ...toolActions,
+            }),
+            getSystemPrompt: async (owner: string) => {
+              const resources = await loadResourcesForPrompt(
+                owner,
+                lazyContext,
+                options?.appId,
+              );
+              const schemaBlock = lazyContext
+                ? ""
+                : await buildSchemaBlock(owner, databaseToolsMode);
+              return basePrompt + resources + schemaBlock;
+            },
+            apiKey: options?.apiKey,
+            model: options?.model,
+            appId: options?.appId,
+          });
+          if (process.env.DEBUG)
+            console.log("[triggers] Trigger dispatcher initialized");
+        } catch (err) {
+          // Triggers module not available — skip silently
+        }
       }
     })().catch((err) => {
       // If the init fails, the routes never get registered and requests

package/corpus/core/src/server/core-routes-plugin.ts

@@ -715,6 +715,9 @@ export interface CoreRoutesPluginOptions {
   /** Per-template override mapping deep-link params → client SPA path.
    *  See `createOpenRouteHandler`. */
   resolveOpenPath?: import("./open-route.js").OpenRouteOptions["resolveOpenPath"];
+  /** Per-template allowlist for open-route targets that may redirect without
+   *  a browser session. See `createOpenRouteHandler`. */
+  allowUnauthenticatedOpen?: import("./open-route.js").OpenRouteOptions["allowUnauthenticatedOpen"];
   /** Env key configuration. Enables env-status and env-vars routes. */
   envKeys?: EnvKeyConfig[];
   /**
@@ -3196,7 +3199,10 @@ export function createCoreRoutesPlugin(
         // guard bypasses this exact path so it can serve its own login form.
         getH3App(nitroApp).use(
           `${P}/open`,
-          createOpenRouteHandler({ resolveOpenPath: options.resolveOpenPath }),
+          createOpenRouteHandler({
+            resolveOpenPath: options.resolveOpenPath,
+            allowUnauthenticatedOpen: options.allowUnauthenticatedOpen,
+          }),
         );
       }
 

package/corpus/core/src/server/open-route.ts

@@ -73,6 +73,15 @@ export interface OpenRouteOptions {
     view?: string;
     params: Record<string, string>;
   }) => string | null | undefined;
+  /** Per-template escape hatch for public deep-link targets. Return true only
+   *  when the resolved SPA target is safe to show without a session. The open
+   *  route will redirect without writing application state. */
+  allowUnauthenticatedOpen?: (params: {
+    app?: string;
+    view?: string;
+    params: Record<string, string>;
+    target: string;
+  }) => boolean | Promise<boolean>;
 }
 
 function getRequestUrl(event: H3Event): string {
@@ -180,11 +189,60 @@ export function createOpenRouteHandler(options: OpenRouteOptions = {}) {
     const toParam = search.get("to") ?? undefined;
     const compose = search.get("compose") ?? undefined;
 
+    // Build the navigation payload from every non-reserved query param
+    // (record ids + filters: threadId, eventId, dashboardId, f_*, ...).
+    const navParams: Record<string, string> = {};
+    for (const [k, v] of search.entries()) {
+      if (RESERVED.has(k)) continue;
+      navParams[k] = v;
+    }
+    const navPayload: Record<string, unknown> = { ...navParams };
+    if (view) navPayload.view = view;
+
+    // Resolve the SPA path to redirect to.
+    let target =
+      safeRelativePath(toParam) ??
+      safeRelativePath(
+        options.resolveOpenPath?.({ app, view, params: navParams }) ??
+          (view ? `/${view}` : null),
+      ) ??
+      "/";
+
+    // Forward filter params (f_*) onto the redirect so dashboards/lists open
+    // pre-filtered even before the navigate command is drained.
+    const filters = new URLSearchParams();
+    for (const [k, v] of search.entries()) {
+      if (k.startsWith("f_")) filters.set(k, v);
+    }
+    target = appendSearchParams(target, filters);
+    const embedParams = new URLSearchParams();
+    for (const key of [
+      EMBED_MODE_QUERY_PARAM,
+      EMBED_TOKEN_QUERY_PARAM,
+      MCP_APP_CHAT_BRIDGE_QUERY_PARAM,
+    ]) {
+      const value = search.get(key);
+      if (value) embedParams.set(key, value);
+    }
+    target = appendSearchParams(target, embedParams);
+    target = withCollapsedAgentSidebarParam(target);
+    target = withConfiguredRedirectBasePath(target);
+
     // Resolve the BROWSER session. When unauthenticated, serve the same login
     // form the guard would — at this URL — so the post-login reload returns
-    // here authenticated.
+    // here authenticated. Public templates may opt specific deep-link targets
+    // into anonymous redirect; no app-state writes happen without a session.
     const session = await getSession(event);
     if (!session?.email) {
+      const allowAnonymous = await options.allowUnauthenticatedOpen?.({
+        app,
+        view,
+        params: navParams,
+        target,
+      });
+      if (allowAnonymous) {
+        return redirect(event, target, requestHasEmbedAuthMarker(event));
+      }
       const html = getConfiguredLoginHtml(event);
       if (html) {
         return new Response(html, {
@@ -196,16 +254,6 @@ export function createOpenRouteHandler(options: OpenRouteOptions = {}) {
       // the user to the view; nothing to scope the navigate write to.
     }
 
-    // Build the navigation payload from every non-reserved query param
-    // (record ids + filters: threadId, eventId, dashboardId, f_*, ...).
-    const navParams: Record<string, string> = {};
-    for (const [k, v] of search.entries()) {
-      if (RESERVED.has(k)) continue;
-      navParams[k] = v;
-    }
-    const navPayload: Record<string, unknown> = { ...navParams };
-    if (view) navPayload.view = view;
-
     if (session?.email) {
       try {
         await appStatePut(session.email, "navigate", navPayload, {
@@ -258,35 +306,6 @@ export function createOpenRouteHandler(options: OpenRouteOptions = {}) {
       }
     }
 
-    // Resolve the SPA path to redirect to.
-    let target =
-      safeRelativePath(toParam) ??
-      safeRelativePath(
-        options.resolveOpenPath?.({ app, view, params: navParams }) ??
-          (view ? `/${view}` : null),
-      ) ??
-      "/";
-
-    // Forward filter params (f_*) onto the redirect so dashboards/lists open
-    // pre-filtered even before the navigate command is drained.
-    const filters = new URLSearchParams();
-    for (const [k, v] of search.entries()) {
-      if (k.startsWith("f_")) filters.set(k, v);
-    }
-    target = appendSearchParams(target, filters);
-    const embedParams = new URLSearchParams();
-    for (const key of [
-      EMBED_MODE_QUERY_PARAM,
-      EMBED_TOKEN_QUERY_PARAM,
-      MCP_APP_CHAT_BRIDGE_QUERY_PARAM,
-    ]) {
-      const value = search.get(key);
-      if (value) embedParams.set(key, value);
-    }
-    target = appendSearchParams(target, embedParams);
-    target = withCollapsedAgentSidebarParam(target);
-    target = withConfiguredRedirectBasePath(target);
-
     return redirect(event, target, requestHasEmbedAuthMarker(event));
   });
 }

package/corpus/core/src/shared/reasoning-effort.ts

@@ -113,6 +113,8 @@ function supportsClaudeXHigh(model: string) {
   // silently falling back to the lower "high" tier.
   // claude-fable-5 is a Mythos-class model and also supports xhigh.
   if (model.includes("fable-5")) return true;
+  // Sonnet 5 supports the expanded effort ladder through Builder/Anthropic.
+  if (model.includes("sonnet-5")) return true;
   // opus-4-7 introduced xhigh; all opus-4.x successors (4-8, 4-9…) should too.
   const opusMatch = model.match(/opus-4-(\d+)/);
   if (opusMatch) {