@agent-native/core 0.83.0 → 0.84.1

package/corpus/core/src/eval/runner.ts

@@ -78,6 +78,20 @@ export async function scoreEval(
   const threshold =
     opts.thresholdOverride ?? evalCase.threshold ?? DEFAULT_EVAL_THRESHOLD;
 
+  if (evalCase.skipReason) {
+    return {
+      eval: evalCase.name,
+      threshold,
+      scores: [],
+      status: "skipped",
+      skipReason: evalCase.skipReason,
+      // Keep the legacy boolean gate friendly: skipped rows do not fail CI.
+      passed: true,
+      avgScore: 0,
+      durationMs: 0,
+    };
+  }
+
   let run: AgentRunOutput;
   if (evalCase.run) {
     run = await evalCase.run({
@@ -104,6 +118,7 @@ export async function scoreEval(
     scores,
     // A run that errored, or any sub-threshold scorer, fails the case.
     passed: run.ok && scores.every((s) => s.passed),
+    status: run.ok && scores.every((s) => s.passed) ? "passed" : "failed",
     avgScore,
     durationMs: run.durationMs,
     error: run.ok ? undefined : run.error,
@@ -120,14 +135,18 @@ export async function runEvals(
   for (const evalCase of evals) {
     const row = await scoreEval(evalCase, runner, opts);
     results.push(row);
-    if (opts.persist) await persistEvalRow(row).catch(() => {});
+    if (opts.persist && row.status !== "skipped") {
+      await persistEvalRow(row).catch(() => {});
+    }
   }
 
   const passed = results.filter((r) => r.passed).length;
+  const skipped = results.filter((r) => r.status === "skipped").length;
   return {
     total: results.length,
     passed,
-    failed: results.length - passed,
+    failed: results.filter((r) => r.status !== "skipped" && !r.passed).length,
+    skipped,
     results,
   };
 }
@@ -301,12 +320,15 @@ export async function runEvalSuite(
     evals = loaded.evals;
   }
 
+  const needsRunner = evals.some((evalCase) => !evalCase.skipReason);
   const runner =
     opts.runner ??
-    (await createAgentRunner({
-      actions: opts.actions ?? (await discoverActions(cwd)),
-      systemPrompt: opts.systemPrompt,
-    }));
+    (needsRunner
+      ? await createAgentRunner({
+          actions: opts.actions ?? (await discoverActions(cwd)),
+          systemPrompt: opts.systemPrompt,
+        })
+      : createInertRunner());
 
   const report = await runEvals(evals, runner, {
     thresholdOverride: opts.thresholdOverride,
@@ -332,3 +354,16 @@ async function discoverActions(
     return {};
   }
 }
+
+function createInertRunner(): AgentRunner {
+  return {
+    engine: {} as AgentRunner["engine"],
+    model: "inert",
+    async runAgent() {
+      throw new Error("Eval unexpectedly requested the agent runner");
+    },
+    analyzeContext() {
+      throw new Error("Eval unexpectedly requested analyze context");
+    },
+  };
+}

package/corpus/core/src/eval/types.ts

@@ -133,6 +133,12 @@ export interface EvalRunContext {
 export interface Eval {
   name: string;
   input: EvalInput;
+  /**
+   * Skip this case without running the agent or scorers. Use for opt-in
+   * suites that need secrets, live provider credentials, or manual/nightly
+   * gates. Skipped rows are reported distinctly and do not fail the suite.
+   */
+  skipReason?: string;
   /**
    * Optional override for how the agent is run for this case. Defaults to the
    * runner's headless `runAgent`. Use this to do custom setup (seed data,
@@ -159,6 +165,10 @@ export interface EvalResultRow {
   eval: string;
   threshold: number;
   scores: ScorerResult[];
+  /** Explicit row status for reports. Older consumers can still read `passed`. */
+  status?: "passed" | "failed" | "skipped";
+  /** Human-readable reason when `status` is `skipped`. */
+  skipReason?: string;
   /** True only when every scorer passed. */
   passed: boolean;
   /** Mean of the scorer scores, for at-a-glance ranking. */
@@ -173,5 +183,6 @@ export interface EvalRunReport {
   total: number;
   passed: number;
   failed: number;
+  skipped?: number;
   results: EvalResultRow[];
 }

package/corpus/core/src/observability/traces.ts

@@ -1,5 +1,5 @@
 import type { AgentLoopUsage } from "../agent/production-agent.js";
-import type { AgentChatEvent } from "../agent/types.js";
+import type { AgentChatEvent, AgentToolInput } from "../agent/types.js";
 import { type AgentSpan, endAgentSpan, startAgentSpan } from "./tracing.js";
 import type { TraceSpan, TraceSummary, ObservabilityConfig } from "./types.js";
 import { DEFAULT_OBSERVABILITY_CONFIG } from "./types.js";
@@ -115,7 +115,7 @@ export async function instrumentAgentLoop(opts: {
       spanId: string;
       startMs: number;
       toolName: string;
-      input: Record<string, string>;
+      input: AgentToolInput;
       otelSpan: AgentSpan | null;
       endResult?: { status: "success" | "error"; errorMessage: string | null };
     }
@@ -148,7 +148,7 @@ export async function instrumentAgentLoop(opts: {
           spanId: string;
           startMs: number;
           toolName: string;
-          input: Record<string, string>;
+          input: AgentToolInput;
           otelSpan: AgentSpan | null;
           // Set by the done handler if it fires before the span promise
           // resolves, so the resolved span is ended with the correct status.

package/corpus/core/src/onboarding/default-steps.ts

@@ -54,7 +54,7 @@ const LLM_KEY_METHODS: LlmKeyMethod[] = [
     provider: "openrouter",
     id: "openrouter-key",
     label: "OpenRouter",
-    description: "OpenRouter models with your own OpenRouter key.",
+    description: "OpenRouter models, including GLM 5.2, with your own key.",
   },
   {
     provider: "groq",

package/corpus/core/src/scripts/agent-engines/manage-agent-engine.ts

@@ -54,7 +54,7 @@ export const tool: ActionTool = {
       model: {
         type: "string",
         description:
-          "Model ID (e.g. 'gpt-5.5', 'claude-sonnet-4-6', 'gemini-3-1-pro'). Required for \"set-app-default\"; optional for \"set\" and \"test\" where it defaults to the engine's default model.",
+          "Model ID (e.g. 'gpt-5.5', 'claude-sonnet-5', 'gemini-3-1-pro'). Required for \"set-app-default\"; optional for \"set\" and \"test\" where it defaults to the engine's default model.",
       },
       baseUrl: {
         type: "string",

package/corpus/core/src/scripts/agent-engines/set-agent-engine.ts

@@ -27,7 +27,7 @@ export const tool: ActionTool = {
       model: {
         type: "string",
         description:
-          "Model ID to use with this engine (e.g. 'gpt-5.5', 'claude-sonnet-4-6'). Defaults to the engine's default model if omitted.",
+          "Model ID to use with this engine (e.g. 'gpt-5.5', 'claude-sonnet-5'). Defaults to the engine's default model if omitted.",
       },
     },
     required: ["engine"],

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -3789,6 +3789,81 @@ export function shouldBlockInProductCodeEditingSurface(input: {
   );
 }
 
+type RecurringJobsRuntimeEnvKey =
+  | "AGENT_NATIVE_DISABLE_RECURRING_JOBS"
+  | "AGENT_NATIVE_ENABLE_LOCAL_RECURRING_JOBS"
+  | "APP_URL"
+  | "BETTER_AUTH_URL"
+  | "DEPLOY_URL"
+  | "NODE_ENV"
+  | "URL"
+  | "VITE_APP_URL"
+  | "VITE_WORKSPACE_GATEWAY_URL"
+  | "WORKSPACE_GATEWAY_URL";
+
+type RecurringJobsRuntimeEnv = Partial<
+  Record<RecurringJobsRuntimeEnvKey, string | undefined>
+>;
+
+function isTruthyEnv(value: string | undefined): boolean {
+  return /^(1|true|yes|on)$/i.test(value?.trim() ?? "");
+}
+
+function isLoopbackAppUrl(value: string | undefined): boolean {
+  const raw = value?.trim();
+  if (!raw) return false;
+
+  const candidates = /^[a-z][a-z0-9+.-]*:\/\//i.test(raw)
+    ? [raw]
+    : [raw, `http://${raw}`];
+  for (const candidate of candidates) {
+    try {
+      const url = new URL(candidate);
+      const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+      if (
+        host === "localhost" ||
+        host === "127.0.0.1" ||
+        host === "0.0.0.0" ||
+        host === "::1" ||
+        host === "tauri.localhost" ||
+        host.endsWith(".localhost")
+      ) {
+        return true;
+      }
+    } catch {}
+  }
+
+  return false;
+}
+
+export function shouldDisableRecurringJobsRuntime(
+  env: RecurringJobsRuntimeEnv = process.env,
+): boolean {
+  if (isTruthyEnv(env.AGENT_NATIVE_DISABLE_RECURRING_JOBS)) return true;
+
+  const isLocalRuntime =
+    env.NODE_ENV === "development" ||
+    env.NODE_ENV === "test" ||
+    [
+      env.APP_URL,
+      env.BETTER_AUTH_URL,
+      env.DEPLOY_URL,
+      env.URL,
+      env.VITE_APP_URL,
+      env.VITE_WORKSPACE_GATEWAY_URL,
+      env.WORKSPACE_GATEWAY_URL,
+    ].some(isLoopbackAppUrl);
+
+  if (
+    isLocalRuntime &&
+    isTruthyEnv(env.AGENT_NATIVE_ENABLE_LOCAL_RECURRING_JOBS)
+  ) {
+    return false;
+  }
+
+  return isLocalRuntime;
+}
+
 export function createAgentChatPlugin(
   options?: AgentChatPluginOptions,
 ): NitroPluginDef {
@@ -7994,56 +8069,69 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
         }),
       );
 
+      const disableRecurringJobsRuntime = shouldDisableRecurringJobsRuntime();
+
       // ─── Recurring Jobs Scheduler ──────────────────────────────────────
       // Poll every 60 seconds for due recurring jobs and execute them.
       // Uses setInterval so it works in all deployment environments without
       // requiring Nitro experimental tasks configuration.
-      try {
-        const { processRecurringJobs } = await import("../jobs/scheduler.js");
+      if (disableRecurringJobsRuntime) {
+        if (process.env.DEBUG) {
+          console.log(
+            "[recurring-jobs] Scheduler disabled for local development",
+          );
+        }
+      } else {
+        try {
+          const { processRecurringJobs } = await import("../jobs/scheduler.js");
 
-        const schedulerDeps = {
-          getActions: () => ({
-            ...templateScripts,
-            ...resourceScripts,
-            ...docsScripts,
-            ...(lazyContext ? frameworkContextTool : {}),
-            ...chatScripts,
-            ...jobTools,
-            ...automationTools,
-            ...notificationTools,
-            ...progressTools,
-            ...fetchTool,
-            ...webSearchTool,
-            ...toolActions,
-          }),
-          getSystemPrompt: async (owner: string) => {
-            const resources = await loadResourcesForPrompt(
-              owner,
-              lazyContext,
-              options?.appId,
-            );
-            const schemaBlock = lazyContext
-              ? ""
-              : await buildSchemaBlock(owner, databaseToolsMode);
-            return basePrompt + resources + schemaBlock;
-          },
-          apiKey: options?.apiKey,
-          model: options?.model,
-          appId: options?.appId,
-        };
+          const schedulerDeps = {
+            getActions: () => ({
+              ...templateScripts,
+              ...resourceScripts,
+              ...docsScripts,
+              ...(lazyContext ? frameworkContextTool : {}),
+              ...chatScripts,
+              ...jobTools,
+              ...automationTools,
+              ...notificationTools,
+              ...progressTools,
+              ...fetchTool,
+              ...webSearchTool,
+              ...toolActions,
+            }),
+            getSystemPrompt: async (owner: string) => {
+              const resources = await loadResourcesForPrompt(
+                owner,
+                lazyContext,
+                options?.appId,
+              );
+              const schemaBlock = lazyContext
+                ? ""
+                : await buildSchemaBlock(owner, databaseToolsMode);
+              return basePrompt + resources + schemaBlock;
+            },
+            apiKey: options?.apiKey,
+            model: options?.model,
+            appId: options?.appId,
+          };
 
-        // Start after a 10-second delay to let the server fully initialize
-        setTimeout(() => {
-          setInterval(() => {
-            processRecurringJobs(schedulerDeps).catch((err) => {
-              console.error("[recurring-jobs] Scheduler error:", err?.message);
-            });
-          }, 60_000);
-          if (process.env.DEBUG)
-            console.log("[recurring-jobs] Scheduler started (60s interval)");
-        }, 10_000);
-      } catch (err) {
-        // Jobs module not available — skip silently
+          // Start after a 10-second delay to let the server fully initialize
+          setTimeout(() => {
+            setInterval(() => {
+              processRecurringJobs(schedulerDeps).catch((err) => {
+                console.error(
+                  "[recurring-jobs] Scheduler error:",
+                  err?.message,
+                );
+              });
+            }, 60_000);
+            if (process.env.DEBUG)
+              console.log("[recurring-jobs] Scheduler started (60s interval)");
+          }, 10_000);
+        } catch (err) {
+          // Jobs module not available — skip silently
+        }
       }
 
       // ─── Agent Teams orphan sweep ─────────────────────────────────────
@@ -8097,43 +8185,51 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
       })();
 
       // ─── Trigger Dispatcher (event-based automations) ─────────────────
-      try {
-        const { initTriggerDispatcher } =
-          await import("../triggers/dispatcher.js");
-        await initTriggerDispatcher({
-          getActions: () => ({
-            ...templateScripts,
-            ...resourceScripts,
-            ...docsScripts,
-            ...(lazyContext ? frameworkContextTool : {}),
-            ...chatScripts,
-            ...jobTools,
-            ...automationTools,
-            ...notificationTools,
-            ...progressTools,
-            ...fetchTool,
-            ...webSearchTool,
-            ...toolActions,
-          }),
-          getSystemPrompt: async (owner: string) => {
-            const resources = await loadResourcesForPrompt(
-              owner,
-              lazyContext,
-              options?.appId,
-            );
-            const schemaBlock = lazyContext
-              ? ""
-              : await buildSchemaBlock(owner, databaseToolsMode);
-            return basePrompt + resources + schemaBlock;
-          },
-          apiKey: options?.apiKey,
-          model: options?.model,
-          appId: options?.appId,
-        });
-        if (process.env.DEBUG)
-          console.log("[triggers] Trigger dispatcher initialized");
-      } catch (err) {
-        // Triggers module not available — skip silently
+      if (disableRecurringJobsRuntime) {
+        if (process.env.DEBUG) {
+          console.log(
+            "[triggers] Trigger dispatcher disabled for local development",
+          );
+        }
+      } else {
+        try {
+          const { initTriggerDispatcher } =
+            await import("../triggers/dispatcher.js");
+          await initTriggerDispatcher({
+            getActions: () => ({
+              ...templateScripts,
+              ...resourceScripts,
+              ...docsScripts,
+              ...(lazyContext ? frameworkContextTool : {}),
+              ...chatScripts,
+              ...jobTools,
+              ...automationTools,
+              ...notificationTools,
+              ...progressTools,
+              ...fetchTool,
+              ...webSearchTool,
+              ...toolActions,
+            }),
+            getSystemPrompt: async (owner: string) => {
+              const resources = await loadResourcesForPrompt(
+                owner,
+                lazyContext,
+                options?.appId,
+              );
+              const schemaBlock = lazyContext
+                ? ""
+                : await buildSchemaBlock(owner, databaseToolsMode);
+              return basePrompt + resources + schemaBlock;
+            },
+            apiKey: options?.apiKey,
+            model: options?.model,
+            appId: options?.appId,
+          });
+          if (process.env.DEBUG)
+            console.log("[triggers] Trigger dispatcher initialized");
+        } catch (err) {
+          // Triggers module not available — skip silently
+        }
       }
     })().catch((err) => {
       // If the init fails, the routes never get registered and requests

package/corpus/core/src/server/core-routes-plugin.ts

@@ -715,6 +715,9 @@ export interface CoreRoutesPluginOptions {
   /** Per-template override mapping deep-link params → client SPA path.
    *  See `createOpenRouteHandler`. */
   resolveOpenPath?: import("./open-route.js").OpenRouteOptions["resolveOpenPath"];
+  /** Per-template allowlist for open-route targets that may redirect without
+   *  a browser session. See `createOpenRouteHandler`. */
+  allowUnauthenticatedOpen?: import("./open-route.js").OpenRouteOptions["allowUnauthenticatedOpen"];
   /** Env key configuration. Enables env-status and env-vars routes. */
   envKeys?: EnvKeyConfig[];
   /**
@@ -3196,7 +3199,10 @@ export function createCoreRoutesPlugin(
         // guard bypasses this exact path so it can serve its own login form.
         getH3App(nitroApp).use(
           `${P}/open`,
-          createOpenRouteHandler({ resolveOpenPath: options.resolveOpenPath }),
+          createOpenRouteHandler({
+            resolveOpenPath: options.resolveOpenPath,
+            allowUnauthenticatedOpen: options.allowUnauthenticatedOpen,
+          }),
         );
       }
 

package/corpus/core/src/server/open-route.ts

@@ -73,6 +73,15 @@ export interface OpenRouteOptions {
     view?: string;
     params: Record<string, string>;
   }) => string | null | undefined;
+  /** Per-template escape hatch for public deep-link targets. Return true only
+   *  when the resolved SPA target is safe to show without a session. The open
+   *  route will redirect without writing application state. */
+  allowUnauthenticatedOpen?: (params: {
+    app?: string;
+    view?: string;
+    params: Record<string, string>;
+    target: string;
+  }) => boolean | Promise<boolean>;
 }
 
 function getRequestUrl(event: H3Event): string {
@@ -180,11 +189,60 @@ export function createOpenRouteHandler(options: OpenRouteOptions = {}) {
     const toParam = search.get("to") ?? undefined;
     const compose = search.get("compose") ?? undefined;
 
+    // Build the navigation payload from every non-reserved query param
+    // (record ids + filters: threadId, eventId, dashboardId, f_*, ...).
+    const navParams: Record<string, string> = {};
+    for (const [k, v] of search.entries()) {
+      if (RESERVED.has(k)) continue;
+      navParams[k] = v;
+    }
+    const navPayload: Record<string, unknown> = { ...navParams };
+    if (view) navPayload.view = view;
+
+    // Resolve the SPA path to redirect to.
+    let target =
+      safeRelativePath(toParam) ??
+      safeRelativePath(
+        options.resolveOpenPath?.({ app, view, params: navParams }) ??
+          (view ? `/${view}` : null),
+      ) ??
+      "/";
+
+    // Forward filter params (f_*) onto the redirect so dashboards/lists open
+    // pre-filtered even before the navigate command is drained.
+    const filters = new URLSearchParams();
+    for (const [k, v] of search.entries()) {
+      if (k.startsWith("f_")) filters.set(k, v);
+    }
+    target = appendSearchParams(target, filters);
+    const embedParams = new URLSearchParams();
+    for (const key of [
+      EMBED_MODE_QUERY_PARAM,
+      EMBED_TOKEN_QUERY_PARAM,
+      MCP_APP_CHAT_BRIDGE_QUERY_PARAM,
+    ]) {
+      const value = search.get(key);
+      if (value) embedParams.set(key, value);
+    }
+    target = appendSearchParams(target, embedParams);
+    target = withCollapsedAgentSidebarParam(target);
+    target = withConfiguredRedirectBasePath(target);
+
     // Resolve the BROWSER session. When unauthenticated, serve the same login
     // form the guard would — at this URL — so the post-login reload returns
-    // here authenticated.
+    // here authenticated. Public templates may opt specific deep-link targets
+    // into anonymous redirect; no app-state writes happen without a session.
     const session = await getSession(event);
     if (!session?.email) {
+      const allowAnonymous = await options.allowUnauthenticatedOpen?.({
+        app,
+        view,
+        params: navParams,
+        target,
+      });
+      if (allowAnonymous) {
+        return redirect(event, target, requestHasEmbedAuthMarker(event));
+      }
       const html = getConfiguredLoginHtml(event);
       if (html) {
         return new Response(html, {
@@ -196,16 +254,6 @@ export function createOpenRouteHandler(options: OpenRouteOptions = {}) {
       // the user to the view; nothing to scope the navigate write to.
     }
 
-    // Build the navigation payload from every non-reserved query param
-    // (record ids + filters: threadId, eventId, dashboardId, f_*, ...).
-    const navParams: Record<string, string> = {};
-    for (const [k, v] of search.entries()) {
-      if (RESERVED.has(k)) continue;
-      navParams[k] = v;
-    }
-    const navPayload: Record<string, unknown> = { ...navParams };
-    if (view) navPayload.view = view;
-
     if (session?.email) {
       try {
         await appStatePut(session.email, "navigate", navPayload, {
@@ -258,35 +306,6 @@ export function createOpenRouteHandler(options: OpenRouteOptions = {}) {
       }
     }
 
-    // Resolve the SPA path to redirect to.
-    let target =
-      safeRelativePath(toParam) ??
-      safeRelativePath(
-        options.resolveOpenPath?.({ app, view, params: navParams }) ??
-          (view ? `/${view}` : null),
-      ) ??
-      "/";
-
-    // Forward filter params (f_*) onto the redirect so dashboards/lists open
-    // pre-filtered even before the navigate command is drained.
-    const filters = new URLSearchParams();
-    for (const [k, v] of search.entries()) {
-      if (k.startsWith("f_")) filters.set(k, v);
-    }
-    target = appendSearchParams(target, filters);
-    const embedParams = new URLSearchParams();
-    for (const key of [
-      EMBED_MODE_QUERY_PARAM,
-      EMBED_TOKEN_QUERY_PARAM,
-      MCP_APP_CHAT_BRIDGE_QUERY_PARAM,
-    ]) {
-      const value = search.get(key);
-      if (value) embedParams.set(key, value);
-    }
-    target = appendSearchParams(target, embedParams);
-    target = withCollapsedAgentSidebarParam(target);
-    target = withConfiguredRedirectBasePath(target);
-
     return redirect(event, target, requestHasEmbedAuthMarker(event));
   });
 }

package/corpus/core/src/shared/reasoning-effort.ts

@@ -113,6 +113,8 @@ function supportsClaudeXHigh(model: string) {
   // silently falling back to the lower "high" tier.
   // claude-fable-5 is a Mythos-class model and also supports xhigh.
   if (model.includes("fable-5")) return true;
+  // Sonnet 5 supports the expanded effort ladder through Builder/Anthropic.
+  if (model.includes("sonnet-5")) return true;
   // opus-4-7 introduced xhigh; all opus-4.x successors (4-8, 4-9…) should too.
   const opusMatch = model.match(/opus-4-(\d+)/);
   if (opusMatch) {

package/corpus/core/src/sharing/access.ts

@@ -233,6 +233,23 @@ export interface ResolvedAccess {
   resource: any;
 }
 
+async function publicAccessRoleForResource(
+  reg: ShareableResourceRegistration,
+  resource: any,
+  ctx: AccessContext,
+): Promise<ShareRole> {
+  const roleResolver = reg.publicAccessRole;
+  if (!roleResolver) return "viewer";
+  return typeof roleResolver === "function"
+    ? await roleResolver(resource, ctx)
+    : roleResolver;
+}
+
+function higherShareRole(a: ShareRole, b: ShareRole | null): ShareRole {
+  if (!b) return a;
+  return ROLE_RANK[b] > ROLE_RANK[a] ? b : a;
+}
+
 /**
  * Return the effective role the current user has on a specific resource, or
  * null if they have no access. Loads the resource and relevant share rows.
@@ -263,9 +280,12 @@ export async function resolveAccess(
     return { role: "owner", resource };
   }
   if (resource.visibility === "public" && reg.allowPublic !== false) {
-    // No share row needed; default viewer unless upgraded below.
+    // No share row needed; default viewer unless the resource registration
+    // deliberately grants a stronger public-by-link role or explicit shares
+    // upgrade the current principal.
+    const publicRole = await publicAccessRoleForResource(reg, resource, ctx);
     const role = await highestShareRole(reg, resourceId, ctx, resource);
-    return { role: role ?? "viewer", resource };
+    return { role: higherShareRole(publicRole, role), resource };
   }
   // `visibility === "public"` on an `allowPublic: false` resource is treated
   // as private: only owner + explicit shares grant access. Falls through to