@agent-native/core 0.83.0 → 0.84.0

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -3789,6 +3789,81 @@ export function shouldBlockInProductCodeEditingSurface(input: {
   );
 }
 
+type RecurringJobsRuntimeEnvKey =
+  | "AGENT_NATIVE_DISABLE_RECURRING_JOBS"
+  | "AGENT_NATIVE_ENABLE_LOCAL_RECURRING_JOBS"
+  | "APP_URL"
+  | "BETTER_AUTH_URL"
+  | "DEPLOY_URL"
+  | "NODE_ENV"
+  | "URL"
+  | "VITE_APP_URL"
+  | "VITE_WORKSPACE_GATEWAY_URL"
+  | "WORKSPACE_GATEWAY_URL";
+
+type RecurringJobsRuntimeEnv = Partial<
+  Record<RecurringJobsRuntimeEnvKey, string | undefined>
+>;
+
+function isTruthyEnv(value: string | undefined): boolean {
+  return /^(1|true|yes|on)$/i.test(value?.trim() ?? "");
+}
+
+function isLoopbackAppUrl(value: string | undefined): boolean {
+  const raw = value?.trim();
+  if (!raw) return false;
+
+  const candidates = /^[a-z][a-z0-9+.-]*:\/\//i.test(raw)
+    ? [raw]
+    : [raw, `http://${raw}`];
+  for (const candidate of candidates) {
+    try {
+      const url = new URL(candidate);
+      const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+      if (
+        host === "localhost" ||
+        host === "127.0.0.1" ||
+        host === "0.0.0.0" ||
+        host === "::1" ||
+        host === "tauri.localhost" ||
+        host.endsWith(".localhost")
+      ) {
+        return true;
+      }
+    } catch {}
+  }
+
+  return false;
+}
+
+export function shouldDisableRecurringJobsRuntime(
+  env: RecurringJobsRuntimeEnv = process.env,
+): boolean {
+  if (isTruthyEnv(env.AGENT_NATIVE_DISABLE_RECURRING_JOBS)) return true;
+
+  const isLocalRuntime =
+    env.NODE_ENV === "development" ||
+    env.NODE_ENV === "test" ||
+    [
+      env.APP_URL,
+      env.BETTER_AUTH_URL,
+      env.DEPLOY_URL,
+      env.URL,
+      env.VITE_APP_URL,
+      env.VITE_WORKSPACE_GATEWAY_URL,
+      env.WORKSPACE_GATEWAY_URL,
+    ].some(isLoopbackAppUrl);
+
+  if (
+    isLocalRuntime &&
+    isTruthyEnv(env.AGENT_NATIVE_ENABLE_LOCAL_RECURRING_JOBS)
+  ) {
+    return false;
+  }
+
+  return isLocalRuntime;
+}
+
 export function createAgentChatPlugin(
   options?: AgentChatPluginOptions,
 ): NitroPluginDef {
@@ -7994,56 +8069,69 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
         }),
       );
 
+      const disableRecurringJobsRuntime = shouldDisableRecurringJobsRuntime();
+
       // ─── Recurring Jobs Scheduler ──────────────────────────────────────
       // Poll every 60 seconds for due recurring jobs and execute them.
       // Uses setInterval so it works in all deployment environments without
       // requiring Nitro experimental tasks configuration.
-      try {
-        const { processRecurringJobs } = await import("../jobs/scheduler.js");
+      if (disableRecurringJobsRuntime) {
+        if (process.env.DEBUG) {
+          console.log(
+            "[recurring-jobs] Scheduler disabled for local development",
+          );
+        }
+      } else {
+        try {
+          const { processRecurringJobs } = await import("../jobs/scheduler.js");
 
-        const schedulerDeps = {
-          getActions: () => ({
-            ...templateScripts,
-            ...resourceScripts,
-            ...docsScripts,
-            ...(lazyContext ? frameworkContextTool : {}),
-            ...chatScripts,
-            ...jobTools,
-            ...automationTools,
-            ...notificationTools,
-            ...progressTools,
-            ...fetchTool,
-            ...webSearchTool,
-            ...toolActions,
-          }),
-          getSystemPrompt: async (owner: string) => {
-            const resources = await loadResourcesForPrompt(
-              owner,
-              lazyContext,
-              options?.appId,
-            );
-            const schemaBlock = lazyContext
-              ? ""
-              : await buildSchemaBlock(owner, databaseToolsMode);
-            return basePrompt + resources + schemaBlock;
-          },
-          apiKey: options?.apiKey,
-          model: options?.model,
-          appId: options?.appId,
-        };
+          const schedulerDeps = {
+            getActions: () => ({
+              ...templateScripts,
+              ...resourceScripts,
+              ...docsScripts,
+              ...(lazyContext ? frameworkContextTool : {}),
+              ...chatScripts,
+              ...jobTools,
+              ...automationTools,
+              ...notificationTools,
+              ...progressTools,
+              ...fetchTool,
+              ...webSearchTool,
+              ...toolActions,
+            }),
+            getSystemPrompt: async (owner: string) => {
+              const resources = await loadResourcesForPrompt(
+                owner,
+                lazyContext,
+                options?.appId,
+              );
+              const schemaBlock = lazyContext
+                ? ""
+                : await buildSchemaBlock(owner, databaseToolsMode);
+              return basePrompt + resources + schemaBlock;
+            },
+            apiKey: options?.apiKey,
+            model: options?.model,
+            appId: options?.appId,
+          };
 
-        // Start after a 10-second delay to let the server fully initialize
-        setTimeout(() => {
-          setInterval(() => {
-            processRecurringJobs(schedulerDeps).catch((err) => {
-              console.error("[recurring-jobs] Scheduler error:", err?.message);
-            });
-          }, 60_000);
-          if (process.env.DEBUG)
-            console.log("[recurring-jobs] Scheduler started (60s interval)");
-        }, 10_000);
-      } catch (err) {
-        // Jobs module not available — skip silently
+          // Start after a 10-second delay to let the server fully initialize
+          setTimeout(() => {
+            setInterval(() => {
+              processRecurringJobs(schedulerDeps).catch((err) => {
+                console.error(
+                  "[recurring-jobs] Scheduler error:",
+                  err?.message,
+                );
+              });
+            }, 60_000);
+            if (process.env.DEBUG)
+              console.log("[recurring-jobs] Scheduler started (60s interval)");
+          }, 10_000);
+        } catch (err) {
+          // Jobs module not available — skip silently
+        }
       }
 
       // ─── Agent Teams orphan sweep ─────────────────────────────────────
@@ -8097,43 +8185,51 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
       })();
 
       // ─── Trigger Dispatcher (event-based automations) ─────────────────
-      try {
-        const { initTriggerDispatcher } =
-          await import("../triggers/dispatcher.js");
-        await initTriggerDispatcher({
-          getActions: () => ({
-            ...templateScripts,
-            ...resourceScripts,
-            ...docsScripts,
-            ...(lazyContext ? frameworkContextTool : {}),
-            ...chatScripts,
-            ...jobTools,
-            ...automationTools,
-            ...notificationTools,
-            ...progressTools,
-            ...fetchTool,
-            ...webSearchTool,
-            ...toolActions,
-          }),
-          getSystemPrompt: async (owner: string) => {
-            const resources = await loadResourcesForPrompt(
-              owner,
-              lazyContext,
-              options?.appId,
-            );
-            const schemaBlock = lazyContext
-              ? ""
-              : await buildSchemaBlock(owner, databaseToolsMode);
-            return basePrompt + resources + schemaBlock;
-          },
-          apiKey: options?.apiKey,
-          model: options?.model,
-          appId: options?.appId,
-        });
-        if (process.env.DEBUG)
-          console.log("[triggers] Trigger dispatcher initialized");
-      } catch (err) {
-        // Triggers module not available — skip silently
+      if (disableRecurringJobsRuntime) {
+        if (process.env.DEBUG) {
+          console.log(
+            "[triggers] Trigger dispatcher disabled for local development",
+          );
+        }
+      } else {
+        try {
+          const { initTriggerDispatcher } =
+            await import("../triggers/dispatcher.js");
+          await initTriggerDispatcher({
+            getActions: () => ({
+              ...templateScripts,
+              ...resourceScripts,
+              ...docsScripts,
+              ...(lazyContext ? frameworkContextTool : {}),
+              ...chatScripts,
+              ...jobTools,
+              ...automationTools,
+              ...notificationTools,
+              ...progressTools,
+              ...fetchTool,
+              ...webSearchTool,
+              ...toolActions,
+            }),
+            getSystemPrompt: async (owner: string) => {
+              const resources = await loadResourcesForPrompt(
+                owner,
+                lazyContext,
+                options?.appId,
+              );
+              const schemaBlock = lazyContext
+                ? ""
+                : await buildSchemaBlock(owner, databaseToolsMode);
+              return basePrompt + resources + schemaBlock;
+            },
+            apiKey: options?.apiKey,
+            model: options?.model,
+            appId: options?.appId,
+          });
+          if (process.env.DEBUG)
+            console.log("[triggers] Trigger dispatcher initialized");
+        } catch (err) {
+          // Triggers module not available — skip silently
+        }
       }
     })().catch((err) => {
       // If the init fails, the routes never get registered and requests

package/corpus/core/src/server/core-routes-plugin.ts

@@ -715,6 +715,9 @@ export interface CoreRoutesPluginOptions {
   /** Per-template override mapping deep-link params → client SPA path.
    *  See `createOpenRouteHandler`. */
   resolveOpenPath?: import("./open-route.js").OpenRouteOptions["resolveOpenPath"];
+  /** Per-template allowlist for open-route targets that may redirect without
+   *  a browser session. See `createOpenRouteHandler`. */
+  allowUnauthenticatedOpen?: import("./open-route.js").OpenRouteOptions["allowUnauthenticatedOpen"];
   /** Env key configuration. Enables env-status and env-vars routes. */
   envKeys?: EnvKeyConfig[];
   /**
@@ -3196,7 +3199,10 @@ export function createCoreRoutesPlugin(
         // guard bypasses this exact path so it can serve its own login form.
         getH3App(nitroApp).use(
           `${P}/open`,
-          createOpenRouteHandler({ resolveOpenPath: options.resolveOpenPath }),
+          createOpenRouteHandler({
+            resolveOpenPath: options.resolveOpenPath,
+            allowUnauthenticatedOpen: options.allowUnauthenticatedOpen,
+          }),
         );
       }
 

package/corpus/core/src/server/open-route.ts

@@ -73,6 +73,15 @@ export interface OpenRouteOptions {
     view?: string;
     params: Record<string, string>;
   }) => string | null | undefined;
+  /** Per-template escape hatch for public deep-link targets. Return true only
+   *  when the resolved SPA target is safe to show without a session. The open
+   *  route will redirect without writing application state. */
+  allowUnauthenticatedOpen?: (params: {
+    app?: string;
+    view?: string;
+    params: Record<string, string>;
+    target: string;
+  }) => boolean | Promise<boolean>;
 }
 
 function getRequestUrl(event: H3Event): string {
@@ -180,11 +189,60 @@ export function createOpenRouteHandler(options: OpenRouteOptions = {}) {
     const toParam = search.get("to") ?? undefined;
     const compose = search.get("compose") ?? undefined;
 
+    // Build the navigation payload from every non-reserved query param
+    // (record ids + filters: threadId, eventId, dashboardId, f_*, ...).
+    const navParams: Record<string, string> = {};
+    for (const [k, v] of search.entries()) {
+      if (RESERVED.has(k)) continue;
+      navParams[k] = v;
+    }
+    const navPayload: Record<string, unknown> = { ...navParams };
+    if (view) navPayload.view = view;
+
+    // Resolve the SPA path to redirect to.
+    let target =
+      safeRelativePath(toParam) ??
+      safeRelativePath(
+        options.resolveOpenPath?.({ app, view, params: navParams }) ??
+          (view ? `/${view}` : null),
+      ) ??
+      "/";
+
+    // Forward filter params (f_*) onto the redirect so dashboards/lists open
+    // pre-filtered even before the navigate command is drained.
+    const filters = new URLSearchParams();
+    for (const [k, v] of search.entries()) {
+      if (k.startsWith("f_")) filters.set(k, v);
+    }
+    target = appendSearchParams(target, filters);
+    const embedParams = new URLSearchParams();
+    for (const key of [
+      EMBED_MODE_QUERY_PARAM,
+      EMBED_TOKEN_QUERY_PARAM,
+      MCP_APP_CHAT_BRIDGE_QUERY_PARAM,
+    ]) {
+      const value = search.get(key);
+      if (value) embedParams.set(key, value);
+    }
+    target = appendSearchParams(target, embedParams);
+    target = withCollapsedAgentSidebarParam(target);
+    target = withConfiguredRedirectBasePath(target);
+
     // Resolve the BROWSER session. When unauthenticated, serve the same login
     // form the guard would — at this URL — so the post-login reload returns
-    // here authenticated.
+    // here authenticated. Public templates may opt specific deep-link targets
+    // into anonymous redirect; no app-state writes happen without a session.
     const session = await getSession(event);
     if (!session?.email) {
+      const allowAnonymous = await options.allowUnauthenticatedOpen?.({
+        app,
+        view,
+        params: navParams,
+        target,
+      });
+      if (allowAnonymous) {
+        return redirect(event, target, requestHasEmbedAuthMarker(event));
+      }
       const html = getConfiguredLoginHtml(event);
       if (html) {
         return new Response(html, {
@@ -196,16 +254,6 @@ export function createOpenRouteHandler(options: OpenRouteOptions = {}) {
       // the user to the view; nothing to scope the navigate write to.
     }
 
-    // Build the navigation payload from every non-reserved query param
-    // (record ids + filters: threadId, eventId, dashboardId, f_*, ...).
-    const navParams: Record<string, string> = {};
-    for (const [k, v] of search.entries()) {
-      if (RESERVED.has(k)) continue;
-      navParams[k] = v;
-    }
-    const navPayload: Record<string, unknown> = { ...navParams };
-    if (view) navPayload.view = view;
-
     if (session?.email) {
       try {
         await appStatePut(session.email, "navigate", navPayload, {
@@ -258,35 +306,6 @@ export function createOpenRouteHandler(options: OpenRouteOptions = {}) {
       }
     }
 
-    // Resolve the SPA path to redirect to.
-    let target =
-      safeRelativePath(toParam) ??
-      safeRelativePath(
-        options.resolveOpenPath?.({ app, view, params: navParams }) ??
-          (view ? `/${view}` : null),
-      ) ??
-      "/";
-
-    // Forward filter params (f_*) onto the redirect so dashboards/lists open
-    // pre-filtered even before the navigate command is drained.
-    const filters = new URLSearchParams();
-    for (const [k, v] of search.entries()) {
-      if (k.startsWith("f_")) filters.set(k, v);
-    }
-    target = appendSearchParams(target, filters);
-    const embedParams = new URLSearchParams();
-    for (const key of [
-      EMBED_MODE_QUERY_PARAM,
-      EMBED_TOKEN_QUERY_PARAM,
-      MCP_APP_CHAT_BRIDGE_QUERY_PARAM,
-    ]) {
-      const value = search.get(key);
-      if (value) embedParams.set(key, value);
-    }
-    target = appendSearchParams(target, embedParams);
-    target = withCollapsedAgentSidebarParam(target);
-    target = withConfiguredRedirectBasePath(target);
-
     return redirect(event, target, requestHasEmbedAuthMarker(event));
   });
 }

package/corpus/core/src/shared/reasoning-effort.ts

@@ -113,6 +113,8 @@ function supportsClaudeXHigh(model: string) {
   // silently falling back to the lower "high" tier.
   // claude-fable-5 is a Mythos-class model and also supports xhigh.
   if (model.includes("fable-5")) return true;
+  // Sonnet 5 supports the expanded effort ladder through Builder/Anthropic.
+  if (model.includes("sonnet-5")) return true;
   // opus-4-7 introduced xhigh; all opus-4.x successors (4-8, 4-9…) should too.
   const opusMatch = model.match(/opus-4-(\d+)/);
   if (opusMatch) {

package/corpus/core/src/sharing/access.ts

@@ -233,6 +233,23 @@ export interface ResolvedAccess {
   resource: any;
 }
 
+async function publicAccessRoleForResource(
+  reg: ShareableResourceRegistration,
+  resource: any,
+  ctx: AccessContext,
+): Promise<ShareRole> {
+  const roleResolver = reg.publicAccessRole;
+  if (!roleResolver) return "viewer";
+  return typeof roleResolver === "function"
+    ? await roleResolver(resource, ctx)
+    : roleResolver;
+}
+
+function higherShareRole(a: ShareRole, b: ShareRole | null): ShareRole {
+  if (!b) return a;
+  return ROLE_RANK[b] > ROLE_RANK[a] ? b : a;
+}
+
 /**
  * Return the effective role the current user has on a specific resource, or
  * null if they have no access. Loads the resource and relevant share rows.
@@ -263,9 +280,12 @@ export async function resolveAccess(
     return { role: "owner", resource };
   }
   if (resource.visibility === "public" && reg.allowPublic !== false) {
-    // No share row needed; default viewer unless upgraded below.
+    // No share row needed; default viewer unless the resource registration
+    // deliberately grants a stronger public-by-link role or explicit shares
+    // upgrade the current principal.
+    const publicRole = await publicAccessRoleForResource(reg, resource, ctx);
     const role = await highestShareRole(reg, resourceId, ctx, resource);
-    return { role: role ?? "viewer", resource };
+    return { role: higherShareRole(publicRole, role), resource };
   }
   // `visibility === "public"` on an `allowPublic: false` resource is treated
   // as private: only owner + explicit shares grant access. Falls through to

package/corpus/core/src/sharing/registry.ts

@@ -56,6 +56,24 @@ export interface ShareableResourceRegistration {
    * Default: `true` (matches the historical behavior — most resources can be public).
    */
   allowPublic?: boolean;
+  /**
+   * Optional role granted by a public-by-link read. Most resources should omit
+   * this so public visibility remains viewer-only. Use narrowly for local or
+   * otherwise constrained resources where the resource owner intentionally wants
+   * unauthenticated link holders to do more than view.
+   */
+  publicAccessRole?:
+    | "viewer"
+    | "editor"
+    | "admin"
+    | ((
+        resource: any,
+        ctx: { userEmail?: string; orgId?: string },
+      ) =>
+        | "viewer"
+        | "editor"
+        | "admin"
+        | Promise<"viewer" | "editor" | "admin">);
   /**
    * When `true`, individual user shares (`principalType: "user"`) must target
    * an email that is already a member of the same org as the resource, OR has

package/corpus/core/src/styles/agent-native.css

@@ -167,17 +167,6 @@
   container: agent-native-main / inline-size;
 }
 
-.agent-layout-main-surface::before,
-.agent-sidebar-main-surface::before {
-  content: "";
-  position: absolute;
-  inset: 0;
-  z-index: 20;
-  pointer-events: none;
-  border-radius: inherit;
-  box-shadow: var(--agent-native-raised-outline);
-}
-
 .agent-layout-shell
   :where(.agent-layout-main-surface, .agent-sidebar-main-surface)
   > :first-child
@@ -537,6 +526,57 @@
   }
 }
 
+/* Guided questions size themselves from the rendered container, not viewport
+   breakpoints, so they stay readable in narrow chat sidebars. */
+.guided-question-flow {
+  container-type: inline-size;
+  container-name: guided-question-flow;
+}
+
+.guided-question-flow-options {
+  grid-template-columns: minmax(0, 1fr);
+}
+
+@container guided-question-flow (min-width: 42rem) {
+  .guided-question-flow-inner {
+    padding: 2rem;
+  }
+
+  .guided-question-flow-header {
+    margin-bottom: 1.5rem;
+  }
+
+  .guided-question-flow-title {
+    font-size: 1.5rem;
+    line-height: 2rem;
+  }
+
+  .guided-question-flow-options {
+    grid-template-columns: repeat(2, minmax(0, 1fr));
+  }
+
+  .guided-question-flow-footer {
+    margin-top: 1.25rem;
+    padding-top: 1rem;
+  }
+}
+
+@container guided-question-flow (max-width: 24rem) {
+  .guided-question-flow-description {
+    font-size: 0.8125rem;
+    line-height: 1.25rem;
+  }
+
+  .guided-question-flow-footer {
+    align-items: stretch;
+    flex-direction: column;
+  }
+
+  .guided-question-flow-footer > :last-child {
+    justify-content: flex-end;
+  }
+}
+
 /* Connect AI card: use the card width, not the viewport, so narrow embedded
    sidebars stack the copy and actions before the secondary button clips. */
 .agent-builder-setup-card {
@@ -548,6 +588,32 @@
   container-name: agent-builder-setup;
 }
 
+.agent-builder-setup-card--sidebar .agent-builder-setup-card__actions {
+  gap: 0.25rem;
+}
+
+.agent-builder-setup-card--sidebar .agent-builder-setup-card__builder-button {
+  justify-content: center;
+  min-height: 2rem;
+}
+
+.agent-builder-setup-card--sidebar .agent-builder-setup-card__key-button {
+  align-self: center;
+  justify-content: center;
+  width: auto;
+  min-height: 1.5rem;
+  height: 1.5rem;
+  border: 0;
+  background: transparent;
+  color: hsl(var(--muted-foreground));
+  padding-inline: 0.25rem;
+}
+
+.agent-builder-setup-card--sidebar .agent-builder-setup-card__key-button:hover {
+  background: transparent;
+  color: hsl(var(--foreground));
+}
+
 @container agent-builder-setup (max-width: 560px) {
   .agent-builder-setup-card__content {
     align-items: stretch;
@@ -564,23 +630,19 @@
 
   .agent-builder-setup-card__builder-cta {
     align-items: stretch;
-    flex: 1 1 11rem;
+    flex: 0 1 auto;
   }
 
-  .agent-builder-setup-card__builder-button,
-  .agent-builder-setup-card__key-button {
+  .agent-builder-setup-card__builder-button {
     justify-content: center;
     min-width: 0;
     width: 100%;
   }
 
   .agent-builder-setup-card__key-button {
-    border: 1px solid hsl(var(--border));
-    background: hsl(var(--background));
-    color: hsl(var(--foreground));
-    flex: 1 1 8rem;
-    height: 2rem;
-    padding-inline: 0.75rem;
+    flex: 0 0 auto;
+    min-width: 0;
+    width: auto;
   }
 }
 
@@ -629,6 +691,28 @@
   overflow: visible;
 }
 
+[data-agent-empty-state="compact-setup"] > .agent-chat-scroll {
+  flex: 0 0 auto;
+  overflow: visible;
+}
+
+[data-agent-empty-state="compact-setup"] .agent-empty-state {
+  height: auto;
+  min-height: 5rem;
+  gap: 0.5rem;
+  padding-block: 0.875rem;
+}
+
+[data-agent-empty-state="compact-setup"] .agent-empty-state > div:first-child {
+  width: 2rem;
+  height: 2rem;
+}
+
+[data-agent-empty-state="compact-setup"] .agent-empty-state svg {
+  width: 1rem;
+  height: 1rem;
+}
+
 .agent-thinking-indicator {
   display: inline-flex;
   align-items: center;