@agent-native/core 0.85.7 → 0.86.1

package/corpus/core/docs/content/sharing.mdx

@@ -5,7 +5,7 @@ description: "Google-Docs-style sharing, built into the framework. Every user-cr
 
 # Sharing & Privacy
 
-Every resource a user creates in an agent-native app — a document, a dashboard, a design, a deck, a video edit, a screen recording, a meeting transcript, a form, a booking link — is **private to the creator by default**. Other people see it only when the creator explicitly shares it, or changes its visibility to `org` or `public`.
+Every resource a user creates in an agent-native app — a document, a dashboard, a design, a deck, a screen recording, a meeting transcript, a form, a booking link — is **private to the creator by default**. Other people see it only when the creator explicitly shares it, or changes its visibility to `org` or `public`.
 
 It looks and works like Google Docs. The same share button, the same dialog, the same three-tier visibility model, the same per-user/per-org grants — across every template, with no per-app reinvention.
 
@@ -92,7 +92,6 @@ Every template that stores user-authored work uses this model. Concretely:
 - **Content** — documents
 - **Slides** — decks
 - **Design** — designs and assets
-- **Video** — compositions
 - **Clips** — screen recordings (Loom-style)
 - **Forms** — form definitions
 - **Calendar** — events and booking links

package/corpus/core/docs/content/skills-guide.mdx

@@ -120,9 +120,9 @@ Domain skills follow the same format as framework skills. They encode patterns s
 
 App-backed skills package an agent-native app as a skill marketplace artifact. The bundle can include agent instructions, exported skills, MCP connector metadata, hosted/local launch instructions, and UI surfaces such as MCP Apps.
 
-Current app-backed skills include `visual-plan` and `visual-recap` from Plan,
-`visual-edit` from Design, `assets` from Assets, and `content` for repo-backed
-docs/blog/MDX editing.
+Current app-backed skills include `visual-plan`, `visual-recap`, and
+`visualize-repo` from Plan, `visual-edit` from Design, `assets` from Assets, and
+`content` for repo-backed docs/blog/MDX editing.
 
 > **Full details below:** the mechanics of app-backed skills (manifest format, CLI commands, marketplace adapters, auto-update hashing) are covered in [App-backed skills — full details](#app-backed-skills-full).
 
@@ -332,6 +332,7 @@ offline work, or privacy-sensitive use.
 ```bash
 # Happy path: exported instructions plus hosted MCP connector.
 npx @agent-native/core@latest skills add visual-plan
+npx @agent-native/core@latest skills add visualize-repo
 npx @agent-native/core@latest skills add visual-edit
 npx @agent-native/core@latest skills add assets
 

package/corpus/core/docs/content/template-plan.mdx

@@ -6,11 +6,11 @@ description: "Agent-Native Plans turns your coding agent's plan into a structure
 # Visual Plans
 
 > **Most people install Plan as a skill, not a scaffolded app.** One CLI command
-> adds the `/visual-plan` and `/visual-recap` skills plus the hosted Plan
-> connector to your coding agent — see [Plan plugin & marketplace](/docs/plan-plugin)
-> for the plugin and marketplace routes. Forking the Plan template (covered under
-> [For developers](#for-developers)) is the secondary path, for self-hosting or
-> building on Plan itself.
+> adds the `/visual-plan`, `/visual-recap`, and `/visualize-repo` skills plus
+> the hosted Plan connector to your coding agent — see
+> [Plan plugin & marketplace](/docs/plan-plugin) for the plugin and marketplace
+> routes. Forking the Plan template (covered under [For developers](#for-developers))
+> is the secondary path, for self-hosting or building on Plan itself.
 
 Agent-Native Plans is visual plan mode for coding agents. It turns an ordinary
 Codex, Claude Code, Markdown, or pasted implementation plan into a structured
@@ -115,7 +115,8 @@ hit an OAuth wall:
 npx @agent-native/core@latest skills add visual-plan
 ```
 
-The command installs both commands: `/visual-plan` and `/visual-recap`.
+The command installs three commands: `/visual-plan`, `/visual-recap`, and
+`/visualize-repo`.
 
 If you are using a chat-based host that accepts MCP connector URLs directly
 (rather than a CLI-configured client), connect the hosted Plans connector at
@@ -358,6 +359,35 @@ and commenting, and returns the hosted URL. Local-files mode does not
 automatically make your coding agent's LLM local; choose a local or approved
 model if that privacy boundary matters too.
 
+## Repo visual docs {#visualize-repo}
+
+Use `/visualize-repo` when you want a durable visual documentation layer for a
+codebase instead of a one-off plan or recap. It creates or opens a local Plan
+MDX workspace, updates `agent-native.json` with an `apps.visualize-repo`
+local-files section, and serves the docs through the same localhost bridge:
+
+```bash
+npx @agent-native/core@latest visualize-repo --open
+```
+
+If no `agent-native.json` exists, the command bootstraps one and recommends a
+small starter set from the repo structure, such as `actions/`,
+`app/components/`, `app/pages/`, `server/db/schema.ts`, `src/`, `packages/`,
+`templates/`, `docs/`, or `content/`. You can target specific source anchors:
+
+```bash
+npx @agent-native/core@latest visualize-repo \
+  --target actions/webhooks.ts \
+  --target server/db/schema.ts \
+  --target app/components/PromptComposer.tsx
+```
+
+The starter folder lives at `.agent-native/visual-docs/repo-overview` by
+default. Comments stay local in `comments.json`, so reviewers can mark sections
+for a coding agent and the agent can update both code and MDX in the same
+change. Run `visualize-repo check` for local lint, and `visualize-repo verify`
+when you want the Plan renderer schema to validate the MDX.
+
 ## Desktop local file sync {#desktop-local-sync}
 
 Agent Native Desktop also gives hosted Plans a native local-folder bridge. This
@@ -409,6 +439,7 @@ touch local files.
 - "Run `/visual-recap` on this PR so I can review the shape of the change first."
 - "Use `/visual-recap` on the diff between `main` and this branch."
 - "Use `/visual-recap` in local-files mode so no recap content is written to the Plan DB."
+- "Run `/visualize-repo` and start with our public API actions and schema."
 
 ## Recovering from auth errors {#auth-errors}
 

package/corpus/core/docs/content/tracking.mdx

@@ -235,7 +235,7 @@ Privacy defaults are intentionally conservative but still useful for playback:
 - URLs are scrubbed with the same `scrubUrl()` helper used by browser analytics.
 - Replay capture is web-only and opt-in; it does not record native desktop screens.
 
-While recording, session replay also captures browser console output (`log`, `info`, `warn`, `error`, `debug`, plus window `error` / `unhandledrejection`) and network request metadata (`fetch` and XHR) as tagged rrweb custom events, so agents and the replay viewer can debug user-reported issues. Capture is on by default when replay is enabled; tune or disable it with the `sessionReplay.console` and `sessionReplay.network` options, each accepting a boolean or an options object (`{ maxEvents?: number }`). Request/response bodies and headers are never captured, URLs are scrubbed, messages are truncated, the recorder's own ingest/tracking traffic is excluded, and per-session budgets (1000 console / 2000 network events) add a truncation notice when exceeded.
+While recording, session replay also captures browser console output (`log`, `info`, `warn`, `error`, `debug`, plus window `error` / `unhandledrejection`) and network request metadata (`fetch` and XHR) as tagged rrweb custom events, so agents and the replay viewer can debug user-reported issues. Capture is on by default when replay is enabled; tune or disable it with the `sessionReplay.console` and `sessionReplay.network` options, each accepting a boolean or an options object (`{ maxEvents?: number }`, with `network` additionally accepting `captureErrorBodies` and `maxErrorBodyLength`). Request bodies and headers are never captured; response bodies are captured only as a bounded, redacted snippet for 5xx (server error) responses (`captureErrorBodies`, default true, capped at `maxErrorBodyLength` chars, default 2048) — non-5xx and network-failure responses never carry a body. URLs are scrubbed, messages are truncated, the recorder's own ingest/tracking traffic is excluded, and per-session budgets (1000 console / 2000 network events) add a truncation notice when exceeded.
 
 The Analytics template stores replay metadata in SQL (`session_recordings`) and stores chunks through private blob refs (`session_replay_chunks`). Browsers and agents never receive provider URLs. Playback goes through scoped server routes and the default agent tools return summaries or bounded replay events, not raw chunk table access.
 

package/corpus/core/docs/content/workspace-connections.mdx

@@ -264,7 +264,7 @@ The initial provider ids are:
 | `google_drive` | search, import, docs           | brain, content, slides         |
 | `hubspot`      | search, import, crm            | analytics, brain, mail         |
 | `granola`      | search, import, meetings, docs | brain, calendar, dispatch      |
-| `clips`        | search, import, meetings       | brain, clips, videos           |
+| `clips`        | search, import, meetings       | brain, clips                   |
 | `generic`      | search, import, docs           | custom webhooks and file drops |
 
 Credential keys are names only, such as `SLACK_BOT_TOKEN` or `GITHUB_TOKEN`. Provider metadata must never include actual credential values.

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.85.7",
+  "version": "0.86.1",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -63,6 +63,7 @@
     },
     "./agent-web": "./dist/agent-web/index.js",
     "./db": "./dist/db/index.js",
+    "./db-admin": "./dist/db-admin/index.js",
     "./db/schema": "./dist/db/schema.js",
     "./db/drizzle-config": "./dist/db/drizzle-config.js",
     "./client": "./dist/client/index.js",
@@ -212,8 +213,8 @@
     "@radix-ui/react-popover": "^1.1.15",
     "@radix-ui/react-select": "^2.2.6",
     "@radix-ui/react-tooltip": "^1.2.8",
-    "@react-router/dev": "^8.0.1",
-    "@react-router/fs-routes": "^8.0.1",
+    "@react-router/dev": "^8.1.0",
+    "@react-router/fs-routes": "^8.1.0",
     "@resvg/resvg-js": "^2.6.2",
     "@rrweb/record": "2.0.1",
     "@sentry/browser": "10.60.0",
@@ -288,8 +289,8 @@
     "@assistant-ui/tap": "^0.5.14",
     "@excalidraw/excalidraw": "0.18.1",
     "@excalidraw/mermaid-to-excalidraw": "2.2.2",
-    "@react-router/dev": "^8.0.1",
-    "@react-router/fs-routes": "^8.0.1",
+    "@react-router/dev": "^8.1.0",
+    "@react-router/fs-routes": "^8.1.0",
     "@supabase/supabase-js": "^2.49.0",
     "@tabler/icons-react": "^3.40.0",
     "@tailwindcss/typography": "^0.5.20",
@@ -317,7 +318,7 @@
     "playwright": "^1.61.1",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
-    "react-router": "^8.0.1",
+    "react-router": "^8.1.0",
     "tailwindcss": "catalog:",
     "typescript": "^6.0.3",
     "vite": "catalog:",

package/corpus/core/src/agent/run-store.ts

@@ -434,7 +434,7 @@ export async function insertRun(
   const client = getDbExec();
   const now = Date.now();
   await client.execute({
-    sql: `INSERT INTO agent_runs (id, thread_id, status, started_at, heartbeat_at, last_progress_at, turn_id, dispatch_mode, dispatch_payload) VALUES (?, ?, 'running', ?, ?, ?, ?, ?, ?)`,
+    sql: `INSERT INTO agent_runs (id, thread_id, status, started_at, heartbeat_at, last_progress_at, turn_id, dispatch_mode, dispatch_payload) VALUES (?, ?, 'running', ?, ?, ?, ?, ?, ?) ON CONFLICT (id) DO NOTHING`,
     args: [
       id,
       threadId,

package/corpus/core/src/chat-threads/store.ts

@@ -72,7 +72,8 @@ async function ensureTable(): Promise<void> {
           scope_id TEXT,
           scope_label TEXT,
           pinned_at ${intType()},
-          archived_at ${intType()}
+          archived_at ${intType()},
+          share_token_hash TEXT
         )
       `;
 
@@ -98,6 +99,7 @@ async function ensureTable(): Promise<void> {
           ["scope_label", "TEXT"],
           ["pinned_at", intType()],
           ["archived_at", intType()],
+          ["share_token_hash", "TEXT"],
         ] as const) {
           await ensureColumnExists(
             "chat_threads",
@@ -126,6 +128,12 @@ async function ensureTable(): Promise<void> {
           "chat_threads_scope_updated_idx",
           `CREATE INDEX IF NOT EXISTS chat_threads_scope_updated_idx ON chat_threads (scope_type, scope_id, updated_at)`,
         );
+        // Public share-link resolution looks threads up by token hash;
+        // without this index it degrades to a LIKE scan over every blob.
+        await ensureIndexExists(
+          "chat_threads_share_token_idx",
+          `CREATE INDEX IF NOT EXISTS chat_threads_share_token_idx ON chat_threads (share_token_hash)`,
+        );
         // One-time backfill of message_count for legacy rows written before
         // the column was maintained.
         await backfillLegacyMessageCounts(client);
@@ -144,6 +152,7 @@ async function ensureTable(): Promise<void> {
         ["scope_label", "TEXT"],
         ["pinned_at", intType()],
         ["archived_at", intType()],
+        ["share_token_hash", "TEXT"],
       ] as const) {
         try {
           await client.execute(
@@ -171,6 +180,7 @@ async function ensureTable(): Promise<void> {
       for (const ddl of [
         `CREATE INDEX IF NOT EXISTS chat_threads_owner_updated_idx ON chat_threads (owner_email, updated_at)`,
         `CREATE INDEX IF NOT EXISTS chat_threads_scope_updated_idx ON chat_threads (scope_type, scope_id, updated_at)`,
+        `CREATE INDEX IF NOT EXISTS chat_threads_share_token_idx ON chat_threads (share_token_hash)`,
       ]) {
         try {
           await client.execute(ddl);
@@ -858,14 +868,24 @@ export interface QueuedMessage {
  * Persist the user's queued (not-yet-sent) messages onto the thread.
  * Stored in thread_data JSON so it survives reloads without a schema
  * change. Safe to call often — the frontend debounces writes.
+ *
+ * Returns false when the thread is missing or `ownerEmail` doesn't match.
+ * Callers that already need an ownership check should pass `ownerEmail`
+ * here instead of doing their own getThread first — this path fires on
+ * debounced composer writes, so a redundant pre-read of the full
+ * thread_data blob is a real per-keystroke cost.
  */
 export async function setThreadQueuedMessages(
   threadId: string,
   queuedMessages: QueuedMessage[],
-): Promise<void> {
+  options: { ownerEmail?: string } = {},
+): Promise<boolean> {
   return withThreadDataLock(threadId, async () => {
     const thread = await getThread(threadId);
-    if (!thread) return;
+    if (!thread) return false;
+    if (options.ownerEmail && thread.ownerEmail !== options.ownerEmail) {
+      return false;
+    }
     let data: Record<string, unknown> = {};
     try {
       data = JSON.parse(thread.threadData);
@@ -883,6 +903,7 @@ export async function setThreadQueuedMessages(
       thread.messageCount,
       { preserveExistingQueuedMessages: false },
     );
+    return true;
   });
 }
 
@@ -981,10 +1002,11 @@ export async function createThreadShareLink(
 
     const now = Date.now();
     const token = generateShareToken();
+    const tokenHash = hashThreadShareToken(token);
     const data = parseThreadData(thread.threadData);
     const existing = normalizeThreadShare(data[THREAD_SHARE_DATA_KEY]);
     data[THREAD_SHARE_DATA_KEY] = {
-      tokenHash: hashThreadShareToken(token),
+      tokenHash,
       createdAt: existing?.createdAt ?? now,
       updatedAt: now,
       revokedAt: null,
@@ -997,6 +1019,10 @@ export async function createThreadShareLink(
       thread.preview,
       thread.messageCount,
     );
+    // Mirror the hash into the indexed column so getThreadByShareToken
+    // resolves via an equality lookup instead of a LIKE scan over every
+    // thread's blob. thread_data stays the source of truth for validation.
+    await setThreadShareTokenHashColumn(threadId, tokenHash);
 
     return {
       enabled: true,
@@ -1008,6 +1034,17 @@ export async function createThreadShareLink(
   });
 }
 
+async function setThreadShareTokenHashColumn(
+  threadId: string,
+  tokenHash: string | null,
+): Promise<void> {
+  const client = getDbExec();
+  await client.execute({
+    sql: `UPDATE chat_threads SET share_token_hash = ? WHERE id = ?`,
+    args: [tokenHash, threadId],
+  });
+}
+
 export async function revokeThreadShareLink(
   threadId: string,
   options: { ownerEmail?: string } = {},
@@ -1035,6 +1072,7 @@ export async function revokeThreadShareLink(
       thread.preview,
       thread.messageCount,
     );
+    await setThreadShareTokenHashColumn(threadId, null);
 
     return {
       enabled: false,
@@ -1053,16 +1091,40 @@ export async function getThreadByShareToken(
   await ensureTable();
   const tokenHash = hashThreadShareToken(cleanToken);
   const client = getDbExec();
-  const { rows } = await client.execute({
-    sql: `SELECT ${THREAD_COLUMNS} FROM chat_threads WHERE thread_data LIKE ? LIMIT 10`,
-    args: [`%${tokenHash}%`],
-  });
-  for (const row of rows) {
+
+  const validate = (row: Record<string, unknown>): ChatThread | null => {
     const thread = rowToThread(row);
+    // thread_data remains the source of truth: verify the stored share
+    // matches and is not revoked even when the indexed column matched.
     const stored = readStoredThreadShare(thread.threadData);
-    if (!stored?.tokenHash || stored.revokedAt) continue;
-    if (stored.tokenHash !== tokenHash) continue;
+    if (!stored?.tokenHash || stored.revokedAt) return null;
+    if (stored.tokenHash !== tokenHash) return null;
     return thread;
+  };
+
+  // Fast path: indexed equality lookup on the mirrored hash column.
+  const indexed = await client.execute({
+    sql: `SELECT ${THREAD_COLUMNS} FROM chat_threads WHERE share_token_hash = ? LIMIT 10`,
+    args: [tokenHash],
+  });
+  for (const row of indexed.rows) {
+    const thread = validate(row);
+    if (thread) return thread;
+  }
+
+  // Legacy fallback: shares created before the share_token_hash column
+  // existed only carry the hash inside the thread_data blob. Backfill the
+  // column on hit so the next lookup takes the indexed path.
+  const legacy = await client.execute({
+    sql: `SELECT ${THREAD_COLUMNS} FROM chat_threads WHERE share_token_hash IS NULL AND thread_data LIKE ? LIMIT 10`,
+    args: [`%${tokenHash}%`],
+  });
+  for (const row of legacy.rows) {
+    const thread = validate(row);
+    if (thread) {
+      await setThreadShareTokenHashColumn(thread.id, tokenHash).catch(() => {});
+      return thread;
+    }
   }
   return null;
 }

package/corpus/core/src/checkpoints/store.ts

@@ -1,5 +1,5 @@
 import { getDbExec, intType, isPostgres } from "../db/client.js";
-import { ensureTableExists } from "../db/ddl-guard.js";
+import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
 
 let _initPromise: Promise<void> | undefined;
 
@@ -17,16 +17,27 @@ async function ensureCheckpointTable(): Promise<void> {
           created_at ${intType()} NOT NULL
         )
       `;
+      // Hot read paths: getCheckpointsByThread filters on thread_id and
+      // sorts by created_at; getCheckpointByRunId filters on run_id.
+      const threadIdxSql = `CREATE INDEX IF NOT EXISTS agent_checkpoints_thread_created_idx ON agent_checkpoints (thread_id, created_at)`;
+      const runIdxSql = `CREATE INDEX IF NOT EXISTS agent_checkpoints_run_idx ON agent_checkpoints (run_id)`;
 
       if (isPostgres()) {
         // PG-guard: probe information_schema before issuing DDL to avoid ACCESS
         // EXCLUSIVE lock contention in fresh background-worker processes.
         await ensureTableExists("agent_checkpoints", createSql);
+        await ensureIndexExists(
+          "agent_checkpoints_thread_created_idx",
+          threadIdxSql,
+        );
+        await ensureIndexExists("agent_checkpoints_run_idx", runIdxSql);
         return;
       }
 
       // SQLite (local dev): no lock problem — keep the original behaviour.
       await client.execute(createSql);
+      await client.execute(threadIdxSql);
+      await client.execute(runIdxSql);
     })().catch((err) => {
       // Retry init on the next call after a failed startup.
       _initPromise = undefined;
@@ -64,7 +75,7 @@ export async function getCheckpointsByThread(threadId: string): Promise<
   await ensureCheckpointTable();
   const client = getDbExec();
   const { rows } = await client.execute({
-    sql: `SELECT id, thread_id, run_id, commit_sha, message, created_at FROM agent_checkpoints WHERE thread_id = ? ORDER BY created_at DESC`,
+    sql: `SELECT id, thread_id, run_id, commit_sha, message, created_at FROM agent_checkpoints WHERE thread_id = ? ORDER BY created_at DESC LIMIT 200`,
     args: [threadId],
   });
   return (rows as any[]).map((r) => ({

package/corpus/core/src/cli/create.ts

@@ -23,9 +23,9 @@ const REPO = "BuilderIO/agent-native";
 const TEMPLATES_DIR = "templates";
 const POSTGRES_DEPENDENCY_VERSION = "^3.4.9";
 const STANDALONE_EXACT_DEPENDENCY_OVERRIDES: Record<string, string> = {
-  "@react-router/dev": "8.0.1",
-  "@react-router/fs-routes": "8.0.1",
-  "react-router": "8.0.1",
+  "@react-router/dev": "8.1.0",
+  "@react-router/fs-routes": "8.1.0",
+  "react-router": "8.1.0",
 };
 const SENTRY_MINIMUM_RELEASE_AGE_EXCLUDES = ['"@sentry/*"'];
 const FIRST_PARTY_TARBALL_SYMLINK_EXCLUDES = [
@@ -844,7 +844,6 @@ function findLocalTemplate(name: string): string | undefined {
 
 function normalizeTemplateName(template: string): string {
   if (template === "blank") return "headless";
-  if (template === "video") return "videos";
   if (template === "image" || template === "images" || template === "asset") {
     return "assets";
   }