@agent-native/core 0.84.58 → 0.84.60

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @agent-native/core
 
+## 0.84.60
+
+### Patch Changes
+
+- 4b6ca6c: Loosen the document script CSP allowances so hosted Google Tag Manager scripts and framework inline bootstrap scripts do not trigger CSP violations.
+
+## 0.84.59
+
+### Patch Changes
+
+- 13379f1: Fix empty responses from non-Anthropic models (GPT-5.x, Gemini) on the Builder
+  gateway. Action tool schemas generated from `z.record(...)` emitted a
+  `propertyNames` JSON Schema keyword that OpenAI's function-calling validator
+  rejects with `400 invalid_function_parameters`, producing an empty assistant
+  turn. Tool schemas now strip `propertyNames` so they stay portable across
+  providers (Anthropic already ignored it).
+
 ## 0.84.58
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.84.58",
+  "version": "0.84.60",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/action.ts

@@ -832,6 +832,80 @@ function wrapRunWithAudit(
 // Schema → JSON Schema conversion
 // ---------------------------------------------------------------------------
 
+// Keywords whose value is a single subschema.
+const SUBSCHEMA_VALUE_KEYS = [
+  "items",
+  "additionalItems",
+  "contains",
+  "additionalProperties",
+  "not",
+  "if",
+  "then",
+  "else",
+] as const;
+// Keywords whose value is an array of subschemas.
+const SUBSCHEMA_ARRAY_KEYS = [
+  "allOf",
+  "anyOf",
+  "oneOf",
+  "prefixItems",
+] as const;
+// Keywords whose value is a map of name → subschema.
+const SUBSCHEMA_MAP_KEYS = [
+  "properties",
+  "patternProperties",
+  "$defs",
+  "definitions",
+  "dependentSchemas",
+] as const;
+
+/**
+ * Remove JSON Schema keywords that some providers' function-calling schema
+ * validators reject. OpenAI (and Gemini via the Builder gateway) reject
+ * `propertyNames` — which Zod v4 emits for `z.record(z.string(), …)` — with a
+ * `400 invalid_function_parameters` error, causing the model turn to produce no
+ * content (surfacing as an empty assistant response). Anthropic ignores the
+ * keyword, so stripping it is safe across providers and keeps action schemas
+ * portable. `propertyNames` only constrained object *keys*; the value/shape of
+ * the object is unaffected by its removal.
+ *
+ * Only descends through actual subschema positions (properties, items, union
+ * branches, definitions, etc.) — never through value-bearing keywords like
+ * `default`, `const`, `enum`, or `examples`, whose objects may legitimately
+ * contain a `propertyNames` data key that must be preserved.
+ */
+function stripUnsupportedSchemaKeywords<T>(node: T): T {
+  if (!node || typeof node !== "object" || Array.isArray(node)) return node;
+  const obj = node as Record<string, unknown>;
+
+  delete obj.propertyNames;
+
+  for (const key of SUBSCHEMA_VALUE_KEYS) {
+    // `items`/`additionalItems` may also be an array of subschemas.
+    const value = obj[key];
+    if (Array.isArray(value)) {
+      for (const sub of value) stripUnsupportedSchemaKeywords(sub);
+    } else {
+      stripUnsupportedSchemaKeywords(value);
+    }
+  }
+  for (const key of SUBSCHEMA_ARRAY_KEYS) {
+    const value = obj[key];
+    if (Array.isArray(value)) {
+      for (const sub of value) stripUnsupportedSchemaKeywords(sub);
+    }
+  }
+  for (const key of SUBSCHEMA_MAP_KEYS) {
+    const value = obj[key];
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      for (const sub of Object.values(value)) {
+        stripUnsupportedSchemaKeywords(sub);
+      }
+    }
+  }
+  return node;
+}
+
 /**
  * Convert a Standard Schema to JSON Schema for the Claude API.
  * Tries vendor-specific toJSONSchema first (Zod v4), then falls back
@@ -855,7 +929,7 @@ function schemaToJsonSchema(
       if (result && typeof result === "object") {
         delete result.$schema;
       }
-      return result as ActionTool["parameters"];
+      return stripUnsupportedSchemaKeywords(result) as ActionTool["parameters"];
     } catch {
       // Fall through to manual converter
     }
@@ -863,7 +937,7 @@ function schemaToJsonSchema(
 
   // Fallback: manual conversion from Zod v4 internal defs
   if (s._zod?.def) {
-    return zodDefToJsonSchema(s._zod.def);
+    return stripUnsupportedSchemaKeywords(zodDefToJsonSchema(s._zod.def));
   }
 
   // Last resort: empty object schema

package/corpus/core/src/server/ssr-handler.ts

@@ -261,8 +261,7 @@ function applyDefaultSpeculationRulesHeader(
  * Extract the plain JS body from a `<script ...>body</script>` string.
  * Returns `null` if the input is falsy or has no recognisable `</script>` end.
  * Used to compute the sha256 hash of framework-injected inline scripts so the
- * hash can be listed in the `script-src` CSP directive without relying on
- * `'unsafe-inline'`.
+ * hash can be listed in app-owned `script-src` CSP directives.
  */
 function extractScriptBody(scriptTag: string | null): string | null {
   if (!scriptTag) return null;
@@ -547,13 +546,10 @@ function augmentExistingReportOnlyCspForFrameworkScripts(
  *
  * A third directive, `script-src`, is emitted via `Content-Security-Policy-
  * Report-Only` rather than enforced when the app has no existing document CSP.
- * The framework injects deterministic inline scripts (the Sentry config block,
- * whose hash is computed once at process startup from the resolved env vars,
- * and — when `GA_MEASUREMENT_ID` is set — the gtag config block, whose hash is
- * derived from the same string `wrapWithAnalytics` embeds). It also loads
- * Google Tag Manager / GA4 from `GA_CSP_SCRIPT_HOSTS`. All of those are listed
- * here so the report-only policy reflects the code the framework itself injects
- * instead of reporting a violation on every page load.
+ * The framework injects inline scripts for analytics, Sentry, and template
+ * setup, and hosted apps need Google Tag Manager to load without noisy CSP
+ * diagnostics. The report-only policy is intentionally permissive for scripts:
+ * it includes `'unsafe-inline'` plus the known GA/GTM loader hosts.
  *
  * If an app or host already sends an enforced CSP with `script-src`,
  * `script-src-elem`, `connect-src`, `img-src`, or `default-src`, we merge only
@@ -577,20 +573,22 @@ function applyDocumentCsp(headers: Headers, sentryScript: string | null): void {
   if (process.env.NODE_ENV !== "production") return;
   if (process.env.AGENT_NATIVE_DISABLE_DOC_CSP === "1") return;
 
-  // script-src as Report-Only: list 'self', the framework-injected inline
-  // script hashes (Sentry config + gtag config), and the Google Analytics /
-  // Tag Manager loader hosts. These are exactly the scripts the framework
-  // itself injects, so listing them keeps the report-only policy from flagging
-  // GA on every page load (and keeps it safe to graduate to enforcement).
-  // Template theme-init hashes are NOT included here — see function comment.
+  // script-src as Report-Only: keep this deliberately loose so the framework's
+  // injected analytics and template bootstrap scripts do not look blocked in
+  // browser diagnostics.
   const sentryBody = extractScriptBody(sentryScript);
   const sentryHash = sentryBody ? computeInlineScriptHash(sentryBody) : null;
   const gaInlineBody = getGaInlineConfigScriptBody();
   const gaHash = gaInlineBody ? computeInlineScriptHash(gaInlineBody) : null;
   const gaHosts = gaInlineBody ? [...GA_CSP_SCRIPT_HOSTS] : [];
-  const gaScriptSrcTokens = [...(gaHash ? [gaHash] : []), ...gaHosts];
+  const gaScriptSrcTokens = [
+    "'unsafe-inline'",
+    ...(gaHash ? [gaHash] : []),
+    ...gaHosts,
+  ];
   const scriptSrcTokens = [
     "'self'",
+    "'unsafe-inline'",
     ...(sentryHash ? [sentryHash] : []),
     ...(gaHash ? [gaHash] : []),
     ...gaHosts,

package/corpus/templates/clips/app/i18n/ar-SA.ts

@@ -637,6 +637,11 @@ const messages = {
     s3SecretAccessKeyLabel: "مفتاح الوصول السري",
     s3RegionLabel: "المنطقة",
     s3PublicBaseUrlLabel: "عنوان URL الأساسي العام",
+    s3UrlInvalid:
+      "يجب أن يكون عنوان URL صالحًا (مثال: https://s3.us-east-1.amazonaws.com)",
+    s3BucketInvalid:
+      "يجب أن يتكون اسم الحاوية من 3 إلى 63 حرفًا صغيرًا أو رقمًا أو شرطة",
+    s3RegionInvalid: 'يجب أن تكون منطقة صالحة (مثال: us-east-1) أو "auto"',
     apiSetup: "إعداد الذكاء الاصطناعي",
     apiSetupDescription:
       "صِل الذكاء الاصطناعي باستخدام أرصدة Builder.io المجانية أو مفاتيح LLM الخاصة بك.",
@@ -651,6 +656,8 @@ const messages = {
     providerKeysSet: "تم تعيين {{count}}",
     checkingProviderKeys: "جار فحص مفاتيح المزود…",
     keySet: "تم التعيين",
+    keyCleared: "تم مسح بيانات اعتماد التخزين",
+    clearAllS3: "مسح بيانات الاعتماد",
     replaceKey: "استبدال المفتاح…",
     pasteProviderKey: "الصق مفتاح مزود أولًا.",
     apiKeySaved: "تم حفظ مفتاح API",

package/corpus/templates/clips/app/i18n/de-DE.ts

@@ -662,6 +662,12 @@ Alle sichtbaren Änderungen für Clips-Nutzer werden hier dokumentiert. Du kanns
     s3SecretAccessKeyLabel: "Geheimer Zugriffsschlüssel",
     s3RegionLabel: "Übersetzt: Region",
     s3PublicBaseUrlLabel: "Öffentliche Basis-URL",
+    s3UrlInvalid:
+      "Muss eine gültige URL sein (z. B. https://s3.us-east-1.amazonaws.com)",
+    s3BucketInvalid:
+      "Bucket-Name muss 3–63 Kleinbuchstaben, Zahlen oder Bindestriche enthalten",
+    s3RegionInvalid:
+      'Muss eine gültige Region sein (z. B. us-east-1) oder "auto"',
     apiSetup: "KI-Einrichtung",
     apiSetupDescription:
       "Verbinde KI mit kostenlosen Builder.io-Credits oder deinen eigenen LLM-Schlüsseln.",
@@ -676,6 +682,8 @@ Alle sichtbaren Änderungen für Clips-Nutzer werden hier dokumentiert. Du kanns
     providerKeysSet: "{{count}} gesetzt",
     checkingProviderKeys: "Anbieter-Schlüssel werden geprüft…",
     keySet: "Gesetzt",
+    keyCleared: "Speicher-Anmeldedaten gelöscht",
+    clearAllS3: "Anmeldedaten löschen",
     replaceKey: "Schlüssel ersetzen…",
     pasteProviderKey: "Füge zuerst einen Anbieter-Schlüssel ein.",
     apiKeySaved: "API-Schlüssel gespeichert",

package/corpus/templates/clips/app/i18n/en-US.ts

@@ -637,6 +637,11 @@ All notable user-facing changes to Clips are documented here. Open it any time f
     s3SecretAccessKeyLabel: "Secret access key",
     s3RegionLabel: "Region",
     s3PublicBaseUrlLabel: "Public base URL",
+    s3UrlInvalid:
+      "Must be a valid URL (e.g. https://s3.us-east-1.amazonaws.com)",
+    s3BucketInvalid:
+      "Bucket name must be 3–63 lowercase letters, numbers, or hyphens",
+    s3RegionInvalid: 'Must be a valid region (e.g. us-east-1) or "auto"',
     apiSetup: "AI setup",
     apiSetupDescription:
       "Connect AI with Builder.io free credits or your own LLM keys.",
@@ -651,6 +656,8 @@ All notable user-facing changes to Clips are documented here. Open it any time f
     providerKeysSet: "{{count}} set",
     checkingProviderKeys: "Checking provider keys…",
     keySet: "Set",
+    keyCleared: "Storage credentials cleared",
+    clearAllS3: "Clear credentials",
     replaceKey: "Replace key…",
     pasteProviderKey: "Paste a provider key first.",
     apiKeySaved: "API key saved",

package/corpus/templates/clips/app/i18n/es-ES.ts

@@ -654,6 +654,11 @@ Todos los cambios visibles para los usuarios de Clips se documentan aquí. Puede
     s3SecretAccessKeyLabel: "Clave de acceso secreta",
     s3RegionLabel: "Región",
     s3PublicBaseUrlLabel: "URL base pública",
+    s3UrlInvalid:
+      "Debe ser una URL válida (p. ej. https://s3.us-east-1.amazonaws.com)",
+    s3BucketInvalid:
+      "El nombre del bucket debe tener 3–63 letras minúsculas, números o guiones",
+    s3RegionInvalid: 'Debe ser una región válida (p. ej. us-east-1) o "auto"',
     apiSetup: "Configuración de IA",
     apiSetupDescription:
       "Conecta IA con créditos gratis de Builder.io o tus propias claves LLM.",
@@ -668,6 +673,8 @@ Todos los cambios visibles para los usuarios de Clips se documentan aquí. Puede
     providerKeysSet: "{{count}} configuradas",
     checkingProviderKeys: "Comprobando claves de proveedor…",
     keySet: "Configurada",
+    keyCleared: "Credenciales de almacenamiento borradas",
+    clearAllS3: "Borrar credenciales",
     replaceKey: "Reemplazar clave…",
     pasteProviderKey: "Pega primero una clave de proveedor.",
     apiKeySaved: "Clave de API guardada",

package/corpus/templates/clips/app/i18n/fr-FR.ts

@@ -655,6 +655,11 @@ Tous les changements visibles par les utilisateurs de Clips sont documentés ici
     s3SecretAccessKeyLabel: "Clé d’accès secrète",
     s3RegionLabel: "Région",
     s3PublicBaseUrlLabel: "URL de base publique",
+    s3UrlInvalid:
+      "Doit être une URL valide (ex. https://s3.us-east-1.amazonaws.com)",
+    s3BucketInvalid:
+      "Le nom du bucket doit contenir 3–63 lettres minuscules, chiffres ou tirets",
+    s3RegionInvalid: 'Doit être une région valide (ex. us-east-1) ou "auto"',
     apiSetup: "Configuration IA",
     apiSetupDescription:
       "Connectez l’IA avec les crédits gratuits Builder.io ou vos propres clés LLM.",
@@ -669,6 +674,8 @@ Tous les changements visibles par les utilisateurs de Clips sont documentés ici
     providerKeysSet: "{{count}} définies",
     checkingProviderKeys: "Vérification des clés fournisseur…",
     keySet: "Définie",
+    keyCleared: "Identifiants de stockage effacés",
+    clearAllS3: "Effacer les identifiants",
     replaceKey: "Remplacer la clé…",
     pasteProviderKey: "Collez d’abord une clé fournisseur.",
     apiKeySaved: "Clé API enregistrée",

package/corpus/templates/clips/app/i18n/hi-IN.ts

@@ -635,6 +635,10 @@ Clips में उपयोगकर्ताओं को दिखने व
     s3SecretAccessKeyLabel: "गुप्त एक्सेस कुंजी",
     s3RegionLabel: "क्षेत्र",
     s3PublicBaseUrlLabel: "सार्वजनिक बेस URL",
+    s3UrlInvalid:
+      "एक मान्य URL होना चाहिए (उदा. https://s3.us-east-1.amazonaws.com)",
+    s3BucketInvalid: "बकेट नाम 3–63 लोअरकेस अक्षर, अंक या हाइफ़न होने चाहिए",
+    s3RegionInvalid: 'एक मान्य क्षेत्र (उदा. us-east-1) या "auto" होना चाहिए',
     apiSetup: "AI सेटअप",
     apiSetupDescription:
       "Builder.io मुफ्त क्रेडिट या अपनी LLM keys के साथ AI कनेक्ट करें.",
@@ -649,6 +653,8 @@ Clips में उपयोगकर्ताओं को दिखने व
     providerKeysSet: "{{count}} सेट",
     checkingProviderKeys: "प्रोवाइडर कीज़ जाँची जा रही हैं…",
     keySet: "सेट",
+    keyCleared: "स्टोरेज क्रेडेंशियल साफ़ किए गए",
+    clearAllS3: "क्रेडेंशियल साफ़ करें",
     replaceKey: "की बदलें…",
     pasteProviderKey: "पहले प्रोवाइडर की पेस्ट करें।",
     apiKeySaved: "API की सहेजी गई",

package/corpus/templates/clips/app/i18n/ja-JP.ts

@@ -649,6 +649,12 @@ Clips のユーザー向けの主な変更はここに記録されます。コ
     s3SecretAccessKeyLabel: "シークレットアクセスキー",
     s3RegionLabel: "リージョン",
     s3PublicBaseUrlLabel: "公開ベース URL",
+    s3UrlInvalid:
+      "有効な URL を入力してください（例: https://s3.us-east-1.amazonaws.com）",
+    s3BucketInvalid:
+      "バケット名は 3〜63 文字の小文字、数字、またはハイフンで指定してください",
+    s3RegionInvalid:
+      '有効なリージョン（例: us-east-1）または "auto" を入力してください',
     apiSetup: "AI 設定",
     apiSetupDescription:
       "Builder.io の無料クレジット、または自分の LLM キーで AI を接続します。",
@@ -663,6 +669,8 @@ Clips のユーザー向けの主な変更はここに記録されます。コ
     providerKeysSet: "{{count}} 件設定済み",
     checkingProviderKeys: "プロバイダーキーを確認中…",
     keySet: "設定済み",
+    keyCleared: "ストレージ認証情報をクリアしました",
+    clearAllS3: "認証情報をクリア",
     replaceKey: "キーを置換…",
     pasteProviderKey: "先にプロバイダーキーを貼り付けてください。",
     apiKeySaved: "API キーを保存しました",

package/corpus/templates/clips/app/i18n/ko-KR.ts

@@ -641,6 +641,11 @@ Clips의 모든 사용자 대상 변경 사항은 여기에 기록됩니다. 명
     s3SecretAccessKeyLabel: "비밀 액세스 키",
     s3RegionLabel: "리전",
     s3PublicBaseUrlLabel: "공개 기본 URL",
+    s3UrlInvalid:
+      "유효한 URL이어야 합니다 (예: https://s3.us-east-1.amazonaws.com)",
+    s3BucketInvalid:
+      "버킷 이름은 3–63자의 소문자, 숫자 또는 하이픈이어야 합니다",
+    s3RegionInvalid: '유효한 리전(예: us-east-1) 또는 "auto"이어야 합니다',
     apiSetup: "AI 설정",
     apiSetupDescription:
       "Builder.io 무료 크레딧 또는 직접 보유한 LLM 키로 AI를 연결하세요.",
@@ -655,6 +660,8 @@ Clips의 모든 사용자 대상 변경 사항은 여기에 기록됩니다. 명
     providerKeysSet: "{{count}}개 설정됨",
     checkingProviderKeys: "제공자 키 확인 중…",
     keySet: "설정됨",
+    keyCleared: "스토리지 자격 증명이 삭제되었습니다",
+    clearAllS3: "자격 증명 삭제",
     replaceKey: "키 바꾸기…",
     pasteProviderKey: "먼저 제공자 키를 붙여넣으세요.",
     apiKeySaved: "API 키가 저장됨",

package/corpus/templates/clips/app/i18n/pt-BR.ts

@@ -652,6 +652,11 @@ Todas as mudanças visíveis para usuários do Clips são documentadas aqui. Voc
     s3SecretAccessKeyLabel: "Chave de acesso secreta",
     s3RegionLabel: "Região",
     s3PublicBaseUrlLabel: "URL base pública",
+    s3UrlInvalid:
+      "Deve ser uma URL válida (ex.: https://s3.us-east-1.amazonaws.com)",
+    s3BucketInvalid:
+      "O nome do bucket deve ter 3–63 letras minúsculas, números ou hifens",
+    s3RegionInvalid: 'Deve ser uma região válida (ex.: us-east-1) ou "auto"',
     apiSetup: "Configuração de IA",
     apiSetupDescription:
       "Conecte IA com créditos grátis da Builder.io ou suas próprias chaves LLM.",
@@ -666,6 +671,8 @@ Todas as mudanças visíveis para usuários do Clips são documentadas aqui. Voc
     providerKeysSet: "{{count}} configuradas",
     checkingProviderKeys: "Verificando chaves de provedor…",
     keySet: "Configurada",
+    keyCleared: "Credenciais de armazenamento limpas",
+    clearAllS3: "Limpar credenciais",
     replaceKey: "Substituir chave…",
     pasteProviderKey: "Cole primeiro uma chave de provedor.",
     apiKeySaved: "Chave de API salva",

package/corpus/templates/clips/app/i18n/zh-CN.ts

@@ -614,6 +614,9 @@ Clips 中所有面向用户的重要更改都会记录在这里。你可以随
     s3SecretAccessKeyLabel: "秘密访问密钥",
     s3RegionLabel: "区域",
     s3PublicBaseUrlLabel: "公共基础 URL",
+    s3UrlInvalid: "必须是有效的 URL（例如 https://s3.us-east-1.amazonaws.com）",
+    s3BucketInvalid: "存储桶名称必须为 3–63 个小写字母、数字或连字符",
+    s3RegionInvalid: '必须是有效的区域（例如 us-east-1）或 "auto"',
     apiSetup: "AI 设置",
     apiSetupDescription: "使用 Builder.io 免费额度或你自己的 LLM 密钥连接 AI。",
     builderEasySetup: "Builder.io 免费额度",
@@ -626,6 +629,8 @@ Clips 中所有面向用户的重要更改都会记录在这里。你可以随
     providerKeysSet: "已设置 {{count}} 个",
     checkingProviderKeys: "正在检查提供方密钥…",
     keySet: "已设置",
+    keyCleared: "存储凭证已清除",
+    clearAllS3: "清除凭证",
     replaceKey: "替换密钥…",
     pasteProviderKey: "请先粘贴提供方密钥。",
     apiKeySaved: "API 密钥已保存",

package/corpus/templates/clips/app/i18n/zh-TW.ts

@@ -607,6 +607,9 @@ const messages = {
     s3SecretAccessKeyLabel: "秘密存取金鑰",
     s3RegionLabel: "區域",
     s3PublicBaseUrlLabel: "公開基礎 URL",
+    s3UrlInvalid: "必須是有效的 URL（例如 https://s3.us-east-1.amazonaws.com）",
+    s3BucketInvalid: "儲存貯體名稱必須為 3–63 個小寫字母、數字或連字號",
+    s3RegionInvalid: '必須是有效的區域（例如 us-east-1）或 "auto"',
     apiSetup: "AI 設定",
     apiSetupDescription: "使用 Builder.io 免費額度或您自己的 LLM 金鑰連線 AI。",
     builderEasySetup: "Builder.io 免費額度",
@@ -619,6 +622,8 @@ const messages = {
     providerKeysSet: "已設定 {{count}} 個",
     checkingProviderKeys: "正在檢查提供方金鑰…",
     keySet: "已設定",
+    keyCleared: "儲存憑證已清除",
+    clearAllS3: "清除憑證",
     replaceKey: "替換金鑰…",
     pasteProviderKey: "請先貼上提供方金鑰。",
     apiKeySaved: "API 金鑰已儲存",