@agent-native/core 0.90.11 → 0.91.1

package/corpus/core/src/chat-threads/store.ts

@@ -6,13 +6,25 @@ import {
   normalizeThreadTitle,
 } from "../agent/thread-data-builder.js";
 import { getDbExec, intType, isPostgres } from "../db/client.js";
+import { createGetDb } from "../db/create-get-db.js";
 import {
   ensureColumnExists,
   ensureIndexExists,
   ensureTableExists,
 } from "../db/ddl-guard.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
+import { getRequestOrgId } from "../server/request-context.js";
+import { resolveAccess, type AccessContext } from "../sharing/access.js";
+import { registerShareableResource } from "../sharing/registry.js";
+import { roleSatisfies, type ShareRole } from "../sharing/schema.js";
 import { emitChatThreadChange } from "./emitter.js";
+import {
+  chatThreads,
+  chatThreadShares,
+  CHAT_THREAD_SHARES_CREATE_SQL,
+  CHAT_THREAD_SHARES_CREATE_SQL_PG,
+  CHAT_THREAD_SHARES_RESOURCE_INDEX_SQL,
+} from "./schema.js";
 
 let _initPromise: Promise<void> | undefined;
 
@@ -33,6 +45,7 @@ let _initPromise: Promise<void> | undefined;
 const _threadDataLocks = new Map<string, Promise<unknown>>();
 const DEFAULT_THREAD_DATA_UPDATE_ATTEMPTS = 12;
 const THREAD_DATA_CONFLICT_BACKOFF_MS = 25;
+const getChatThreadsDb = createGetDb({ chatThreads, chatThreadShares });
 
 export function withThreadDataLock<T>(
   threadId: string,
@@ -73,7 +86,9 @@ async function ensureTable(): Promise<void> {
           scope_label TEXT,
           pinned_at ${intType()},
           archived_at ${intType()},
-          share_token_hash TEXT
+          share_token_hash TEXT,
+          org_id TEXT,
+          visibility TEXT NOT NULL DEFAULT 'private'
         )
       `;
 
@@ -100,6 +115,8 @@ async function ensureTable(): Promise<void> {
           ["pinned_at", intType()],
           ["archived_at", intType()],
           ["share_token_hash", "TEXT"],
+          ["org_id", "TEXT"],
+          ["visibility", "TEXT NOT NULL DEFAULT 'private'"],
         ] as const) {
           await ensureColumnExists(
             "chat_threads",
@@ -107,6 +124,10 @@ async function ensureTable(): Promise<void> {
             `ALTER TABLE chat_threads ADD COLUMN IF NOT EXISTS ${col} ${type}`,
           );
         }
+        await ensureTableExists(
+          "chat_thread_shares",
+          CHAT_THREAD_SHARES_CREATE_SQL_PG,
+        );
         // Widen millisecond-timestamp columns that older deployments created as
         // 32-bit `INTEGER`; on Postgres the `Date.now()` written on every turn
         // overflows int4. No-op once widened / on fresh BIGINT databases.
@@ -134,6 +155,10 @@ async function ensureTable(): Promise<void> {
           "chat_threads_share_token_idx",
           `CREATE INDEX IF NOT EXISTS chat_threads_share_token_idx ON chat_threads (share_token_hash)`,
         );
+        await ensureIndexExists(
+          "chat_thread_shares_resource_idx",
+          CHAT_THREAD_SHARES_RESOURCE_INDEX_SQL,
+        );
         // One-time backfill of message_count for legacy rows written before
         // the column was maintained.
         await backfillLegacyMessageCounts(client);
@@ -153,6 +178,8 @@ async function ensureTable(): Promise<void> {
         ["pinned_at", intType()],
         ["archived_at", intType()],
         ["share_token_hash", "TEXT"],
+        ["org_id", "TEXT"],
+        ["visibility", "TEXT NOT NULL DEFAULT 'private'"],
       ] as const) {
         try {
           await client.execute(
@@ -162,6 +189,11 @@ async function ensureTable(): Promise<void> {
           // Column already exists.
         }
       }
+      try {
+        await client.execute(CHAT_THREAD_SHARES_CREATE_SQL);
+      } catch {
+        // Table already exists.
+      }
       // Widen millisecond-timestamp columns that older deployments created as
       // 32-bit `INTEGER`; on Postgres the `Date.now()` written on every turn
       // overflows int4. No-op once widened / on fresh BIGINT databases.
@@ -181,6 +213,7 @@ async function ensureTable(): Promise<void> {
         `CREATE INDEX IF NOT EXISTS chat_threads_owner_updated_idx ON chat_threads (owner_email, updated_at)`,
         `CREATE INDEX IF NOT EXISTS chat_threads_scope_updated_idx ON chat_threads (scope_type, scope_id, updated_at)`,
         `CREATE INDEX IF NOT EXISTS chat_threads_share_token_idx ON chat_threads (share_token_hash)`,
+        CHAT_THREAD_SHARES_RESOURCE_INDEX_SQL,
       ]) {
         try {
           await client.execute(ddl);
@@ -261,6 +294,8 @@ export interface ChatThread {
   scope: ChatThreadScope | null;
   pinnedAt: number | null;
   archivedAt: number | null;
+  orgId: string | null;
+  visibility: "private" | "org" | "public";
 }
 
 export interface ChatThreadSummary {
@@ -273,6 +308,8 @@ export interface ChatThreadSummary {
   scope: ChatThreadScope | null;
   pinnedAt: number | null;
   archivedAt: number | null;
+  orgId: string | null;
+  visibility: "private" | "org" | "public";
 }
 
 export interface ForkThreadSourceSnapshot {
@@ -297,6 +334,10 @@ function readNullableNumber(value: unknown): number | null {
   return Number.isFinite(n) && n > 0 ? n : null;
 }
 
+function readVisibility(value: unknown): "private" | "org" | "public" {
+  return value === "org" || value === "public" ? value : "private";
+}
+
 function normalizeForkSourceSnapshot(
   source: ForkThreadSourceSnapshot | null | undefined,
 ): {
@@ -359,6 +400,8 @@ function rowToThread(r: Record<string, unknown>): ChatThread {
     scope: readScope(r),
     pinnedAt: readNullableNumber(r.pinned_at),
     archivedAt: readNullableNumber(r.archived_at),
+    orgId: (r.org_id as string | null | undefined) ?? null,
+    visibility: readVisibility(r.visibility),
   };
 }
 
@@ -378,6 +421,8 @@ function rowToSummary(r: Record<string, unknown>): ChatThreadSummary | null {
     scope: readScope(r),
     pinnedAt: readNullableNumber(r.pinned_at),
     archivedAt: readNullableNumber(r.archived_at),
+    orgId: (r.org_id as string | null | undefined) ?? null,
+    visibility: readVisibility(r.visibility),
   };
 }
 
@@ -391,9 +436,10 @@ export async function createThread(
   const now = Date.now();
   const title = opts?.title ?? "";
   const scope = opts?.scope ?? null;
+  const orgId = getRequestOrgId() ?? null;
 
   await client.execute({
-    sql: `INSERT INTO chat_threads (id, owner_email, title, preview, thread_data, message_count, created_at, updated_at, scope_type, scope_id, scope_label) VALUES (?, ?, ?, '', '{}', 0, ?, ?, ?, ?, ?)`,
+    sql: `INSERT INTO chat_threads (id, owner_email, title, preview, thread_data, message_count, created_at, updated_at, scope_type, scope_id, scope_label, org_id, visibility) VALUES (?, ?, ?, '', '{}', 0, ?, ?, ?, ?, ?, ?, 'private')`,
     args: [
       id,
       ownerEmail,
@@ -403,6 +449,7 @@ export async function createThread(
       scope?.type ?? null,
       scope?.id ?? null,
       scope?.label ?? null,
+      orgId,
     ],
   });
 
@@ -418,10 +465,12 @@ export async function createThread(
     scope,
     pinnedAt: null,
     archivedAt: null,
+    orgId,
+    visibility: "private",
   };
 }
 
-const THREAD_COLUMNS = `id, owner_email, title, preview, thread_data, message_count, created_at, updated_at, scope_type, scope_id, scope_label, pinned_at, archived_at`;
+const THREAD_COLUMNS = `id, owner_email, title, preview, thread_data, message_count, created_at, updated_at, scope_type, scope_id, scope_label, pinned_at, archived_at, org_id, visibility`;
 // The list/summary path deliberately omits `thread_data`: it is the full
 // message-history JSON blob and selecting it for every row turns "open the
 // sidebar" into "download every conversation". The summary derives nothing
@@ -429,7 +478,41 @@ const THREAD_COLUMNS = `id, owner_email, title, preview, thread_data, message_co
 // (message_count is maintained on write and backfilled for legacy rows at
 // bootstrap). The detail path (`THREAD_COLUMNS` / `getThread`) still returns
 // the full blob.
-const SUMMARY_COLUMNS = `id, title, preview, message_count, created_at, updated_at, scope_type, scope_id, scope_label, pinned_at, archived_at`;
+const SUMMARY_COLUMNS = `id, title, preview, message_count, created_at, updated_at, scope_type, scope_id, scope_label, pinned_at, archived_at, org_id, visibility`;
+
+export function registerChatThreadsShareable(): void {
+  registerShareableResource({
+    type: "chat_thread",
+    resourceTable: chatThreads,
+    sharesTable: chatThreadShares,
+    displayName: "Chat",
+    titleColumn: "title",
+    getResourcePath: (thread) =>
+      `/?thread=${encodeURIComponent(String(thread.id ?? ""))}`,
+    getDb: () => getChatThreadsDb(),
+    allowPublic: false,
+    ownerAccessIgnoresOrg: true,
+  });
+}
+
+export async function ensureChatThreadTables(): Promise<void> {
+  await ensureTable();
+}
+
+export async function resolveThreadAccess(
+  userEmail: string | null | undefined,
+  threadId: string | null | undefined,
+  minRole: ShareRole | "owner" = "viewer",
+  ctx: Omit<AccessContext, "userEmail"> = {},
+): Promise<ChatThread | null> {
+  if (!userEmail || !threadId) return null;
+  const access = await resolveAccess("chat_thread", threadId, {
+    userEmail,
+    orgId: ctx.orgId,
+  });
+  if (!access || !roleSatisfies(access.role, minRole)) return null;
+  return await getThread(threadId);
+}
 
 export async function getThread(id: string): Promise<ChatThread | null> {
   await ensureTable();
@@ -445,7 +528,11 @@ export async function getThread(id: string): Promise<ChatThread | null> {
 export async function forkThread(
   sourceId: string,
   ownerEmail: string,
-  opts?: { id?: string; source?: ForkThreadSourceSnapshot | null },
+  opts?: {
+    id?: string;
+    source?: ForkThreadSourceSnapshot | null;
+    sourceAccessGranted?: boolean;
+  },
 ): Promise<ChatThread | null> {
   const snapshot = normalizeForkSourceSnapshot(opts?.source);
   let source = await getThread(sourceId);
@@ -494,13 +581,19 @@ export async function forkThread(
       messageCount: snapshot.messageCount,
     };
   }
-  if (!source || source.ownerEmail !== ownerEmail) return null;
+  if (
+    !source ||
+    (!opts?.sourceAccessGranted && source.ownerEmail !== ownerEmail)
+  ) {
+    return null;
+  }
   const id = opts?.id ?? generateId();
   const now = Date.now();
   const title = source.title ? `${source.title} (fork)` : "";
   const client = getDbExec();
+  const orgId = getRequestOrgId() ?? null;
   await client.execute({
-    sql: `INSERT INTO chat_threads (id, owner_email, title, preview, thread_data, message_count, created_at, updated_at, scope_type, scope_id, scope_label) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    sql: `INSERT INTO chat_threads (id, owner_email, title, preview, thread_data, message_count, created_at, updated_at, scope_type, scope_id, scope_label, org_id, visibility) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'private')`,
     args: [
       id,
       ownerEmail,
@@ -513,6 +606,7 @@ export async function forkThread(
       source.scope?.type ?? null,
       source.scope?.id ?? null,
       source.scope?.label ?? null,
+      orgId,
     ],
   });
   return {
@@ -527,6 +621,8 @@ export async function forkThread(
     scope: source.scope,
     pinnedAt: null,
     archivedAt: null,
+    orgId,
+    visibility: "private",
   };
 }
 
@@ -542,6 +638,28 @@ export interface ListThreadsOptions {
   scope?: { type: string; id: string };
   /** When true, returns only threads with no scope (general chats). */
   unscopedOnly?: boolean;
+  orgId?: string | null;
+}
+
+function chatThreadAccessSql(
+  userEmail: string,
+  orgId: string | null | undefined,
+): { sql: string; args: (string | number)[] } {
+  const normalizedEmail = userEmail.trim().toLowerCase();
+  const clauses = [
+    `LOWER(owner_email) = ?`,
+    `EXISTS (SELECT 1 FROM chat_thread_shares WHERE chat_thread_shares.resource_id = chat_threads.id AND chat_thread_shares.principal_type = 'user' AND LOWER(chat_thread_shares.principal_id) = ?)`,
+  ];
+  const args: (string | number)[] = [normalizedEmail, normalizedEmail];
+  if (orgId) {
+    clauses.push(`(visibility = 'org' AND org_id = ?)`);
+    args.push(orgId);
+    clauses.push(
+      `EXISTS (SELECT 1 FROM chat_thread_shares WHERE chat_thread_shares.resource_id = chat_threads.id AND chat_thread_shares.principal_type = 'org' AND chat_thread_shares.principal_id = ?)`,
+    );
+    args.push(orgId);
+  }
+  return { sql: `(${clauses.join(" OR ")})`, args };
 }
 
 export async function listThreads(
@@ -562,8 +680,12 @@ export async function listThreads(
   // maintained on every write and backfilled for legacy rows at bootstrap,
   // so the old `OR thread_data LIKE '%"messages"%'` substring scan over the
   // full blob is no longer needed here.
-  const filters: string[] = [`owner_email = ?`, `message_count > 0`];
-  const args: (string | number)[] = [ownerEmail];
+  const access = chatThreadAccessSql(
+    ownerEmail,
+    opts.orgId ?? getRequestOrgId(),
+  );
+  const filters: string[] = [access.sql, `message_count > 0`];
+  const args: (string | number)[] = [...access.args];
   if (opts.scope) {
     filters.push(`scope_type = ? AND scope_id = ?`);
     args.push(opts.scope.type, opts.scope.id);
@@ -588,7 +710,7 @@ export async function searchThreads(
   ownerEmail: string,
   query: string,
   limit = 50,
-  options: { scope?: { type: string; id: string } } = {},
+  options: { scope?: { type: string; id: string }; orgId?: string | null } = {},
 ): Promise<ChatThreadSummary[]> {
   await ensureTable();
   const client = getDbExec();
@@ -596,12 +718,16 @@ export async function searchThreads(
   // The count-guard uses the maintained/backfilled `message_count` column
   // (same as listThreads). The content match still scans `thread_data` —
   // search legitimately needs to look inside message history.
+  const access = chatThreadAccessSql(
+    ownerEmail,
+    options.orgId ?? getRequestOrgId(),
+  );
   const filters: string[] = [
-    `owner_email = ?`,
+    access.sql,
     `message_count > 0`,
     `(title LIKE ? ESCAPE '!' OR preview LIKE ? ESCAPE '!' OR thread_data LIKE ? ESCAPE '!')`,
   ];
-  const args: (string | number)[] = [ownerEmail, pattern, pattern, pattern];
+  const args: (string | number)[] = [...access.args, pattern, pattern, pattern];
   if (options.scope) {
     filters.push(`scope_type = ? AND scope_id = ?`);
     args.push(options.scope.type, options.scope.id);
@@ -1137,6 +1263,12 @@ export async function deleteThread(id: string): Promise<boolean> {
     args: [id],
   });
   if (result.rowsAffected > 0) {
+    await client
+      .execute({
+        sql: `DELETE FROM chat_thread_shares WHERE resource_id = ?`,
+        args: [id],
+      })
+      .catch(() => {});
     emitChatThreadChange(id);
     return true;
   }

package/corpus/core/src/cli/design-connect.ts

@@ -708,8 +708,42 @@ function addLiveEditBaseHref(html: string, href: string): string {
   return `<!DOCTYPE html><html><head>${baseTag}<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"></head><body>${html}</body></html>`;
 }
 
-function injectLiveEditBridge(html: string, targetUrl: string, script: string) {
-  const withBase = addLiveEditBaseHref(html, targetUrl);
+/**
+ * Rewrite the iframe path to the real target route before the proxied app's
+ * bundle runs. The bridge serves snapshots from its own `/live-edit` path, so a
+ * client-side-routed SPA would otherwise boot at "/live-edit", match no route,
+ * and render its 404. A synchronous inline script in `<head>` runs during parse
+ * (before deferred module bundles), so `history.replaceState` lands the SPA on
+ * the intended route. Assets still resolve via the injected `<base href>`.
+ */
+function injectPreBootLocationShim(html: string, targetPath: string): string {
+  const path = targetPath.trim();
+  if (!path || path === "/live-edit") return html;
+  const shim = `<script data-agent-native-live-edit-location>
+(function(){try{var p=${JSON.stringify(path)};if(p&&(location.pathname+location.search)!==p){history.replaceState(null,"",p);}}catch(e){}})();
+</script>`;
+  if (/<head\b[^>]*>/i.test(html)) {
+    return html.replace(/<head\b[^>]*>/i, (match) => `${match}${shim}`);
+  }
+  if (/<html\b[^>]*>/i.test(html)) {
+    return html.replace(
+      /<html\b[^>]*>/i,
+      (match) => `${match}<head>${shim}</head>`,
+    );
+  }
+  return `${shim}${html}`;
+}
+
+function injectLiveEditBridge(
+  html: string,
+  baseHref: string,
+  script: string,
+  targetPath: string,
+) {
+  const withBase = injectPreBootLocationShim(
+    addLiveEditBaseHref(html, baseHref),
+    targetPath,
+  );
   if (!script) return withBase;
   if (withBase.includes("</body>")) {
     return withBase.replace("</body>", `${script}</body>`);
@@ -1288,10 +1322,17 @@ export async function startDesignConnectBridge(
             );
             const includeEditorBridge =
               requestUrl.searchParams.get("bridge") !== "0";
+            // The dev server route the SPA must boot on (e.g. "/todo"), taken
+            // from the resolved snapshot target rather than the bridge's own
+            // "/live-edit" request path.
+            const targetParsed = new URL(targetUrl);
+            const targetPath =
+              `${targetParsed.pathname}${targetParsed.search}` || "/";
             const html = injectLiveEditBridge(
               snapshot.html,
               new URL("/", manifest.bridgeUrl).toString(),
               includeEditorBridge ? liveEditBridgeScript : "",
+              targetPath,
             );
             sendText(
               res,
@@ -1897,15 +1938,18 @@ export async function runDesign(argv: string[]) {
   console.error(`Routes:   ${manifest.routeCount}`);
   console.error(`Dev URL:  ${manifest.devServerUrl}`);
 
-  // Self-register with the design app server (best-effort).  When an app URL
-  // is available (via --app-url or env var) the CLI POSTs the bridge token to
-  // connect-localhost so the server row stores the real token.  Without this
-  // step grant-localhost-write-consent would mint a different token, causing
-  // every bridge write to return 401.
+  // Self-register with the design app server (best-effort): POST the bridge
+  // token to connect-localhost so the server row stores the real token. Without
+  // it, the bridge and server tokens diverge and every write returns 401.
   const appUrl = resolveAppUrl(parsed.appUrl);
   if (appUrl) {
-    const authToken = resolveAuthToken();
-    void registerConnectionWithServer(appUrl, bridge, authToken);
+    void registerConnectionWithServer(appUrl, bridge, resolveAuthToken());
+  } else {
+    // No app URL means the token never reaches the DB — surface it instead of
+    // silently skipping, since live-edit will then 401.
+    console.error(
+      "[design connect] No app URL resolved (pass --app-url or set AGENT_NATIVE_URL); skipping self-registration — live-edit will fail to authorize.",
+    );
   }
 
   return await new Promise<number>((resolve) => {

package/corpus/core/src/cli/workspace-dev.ts

@@ -83,6 +83,7 @@ const DEFAULT_PROXY_RESPONSE_TIMEOUT_MS = 5_000;
 const DEFAULT_PROXY_NON_HTML_RESPONSE_TIMEOUT_MS = 120_000;
 const APP_OUTPUT_TAIL_BYTES = 8_000;
 const POLLING_WATCH_INTERVAL_MS = "1000";
+const reportedDiscoverAppsReadFailures = new Set<string>();
 const STARTING_APP_RESPONSE_HEADERS: http.OutgoingHttpHeaders = {
   "content-type": "text/html; charset=utf-8",
   "cache-control": "no-store, no-cache, max-age=0, must-revalidate",
@@ -287,6 +288,23 @@ function readJson(file: string): any {
   }
 }
 
+function shouldReportDiscoverAppsReadFailure(
+  appsDir: string,
+  code: string | undefined,
+): boolean {
+  if (code === "ENOENT") return false;
+  const key = `${appsDir}:${code ?? "unknown"}`;
+  if (reportedDiscoverAppsReadFailures.has(key)) return false;
+  reportedDiscoverAppsReadFailures.add(key);
+  return true;
+}
+
+function shouldCaptureDiscoverAppsReadFailure(
+  code: string | undefined,
+): boolean {
+  return code !== "EACCES" && code !== "EPERM";
+}
+
 function discoverApps(appsDir: string, appPortStart: number): WorkspaceApp[] {
   if (!fs.existsSync(appsDir)) return [];
   // existsSync -> readdirSync is a TOCTOU race. Treat ENOENT as "no apps
@@ -296,15 +314,17 @@ function discoverApps(appsDir: string, appPortStart: number): WorkspaceApp[] {
     entries = fs.readdirSync(appsDir, { withFileTypes: true });
   } catch (err) {
     const code = (err as NodeJS.ErrnoException).code;
-    if (code !== "ENOENT") {
+    if (shouldReportDiscoverAppsReadFailure(appsDir, code)) {
       console.warn(
         `[workspace] Could not read ${appsDir} (${code ?? "unknown"}): ` +
           `${(err as Error).message}`,
       );
-      Sentry.captureException(err, {
-        tags: { handled: "dev-discover-readdir" },
-        level: "warning",
-      });
+      if (shouldCaptureDiscoverAppsReadFailure(code)) {
+        Sentry.captureException(err, {
+          tags: { handled: "dev-discover-readdir" },
+          level: "warning",
+        });
+      }
     }
     return [];
   }

package/corpus/core/src/client/AgentPanel.tsx

@@ -68,6 +68,7 @@ import {
 import { ErrorReportActions } from "./ErrorReportActions.js";
 import { FeedbackButton } from "./FeedbackButton.js";
 import { RunsTrayMenuItem } from "./progress/RunsTray.js";
+import { ShareButton } from "./sharing/ShareButton.js";
 // Lazy-load the full assistant-ui chat stack (tiptap composer + react-markdown +
 // assistant-ui + zod block schemas) so it is NOT in the static import closure of
 // every page. The header/tab chrome renders immediately; chat streams in once the
@@ -90,7 +91,7 @@ import {
   type AgentSidebarStateChangeDetail,
 } from "./agent-sidebar-state.js";
 import { trackEvent } from "./analytics.js";
-import { agentNativePath } from "./api-path.js";
+import { agentNativePath, appPath } from "./api-path.js";
 import { assistantUiRecoverableRenderErrorKind } from "./assistant-ui-recovery.js";
 import type { AssistantChatProps } from "./AssistantChat.js";
 import { shouldParentFrameOwnAgentPanel } from "./builder-frame.js";
@@ -1080,10 +1081,31 @@ function AgentPanelInner({
   const [headerMenuOpen, setHeaderMenuOpen] = useState(false);
   const [feedbackOpen, setFeedbackOpen] = useState(false);
 
+  const getChatThreadShareUrl = useCallback(
+    (threadId: string) => {
+      if (typeof window === "undefined") return undefined;
+      if (
+        threadUrlSync &&
+        typeof threadUrlSync === "object" &&
+        typeof threadUrlSync.getPath === "function"
+      ) {
+        return new URL(
+          appPath(threadUrlSync.getPath(threadId)),
+          window.location.origin,
+        ).toString();
+      }
+      const url = new URL(window.location.href);
+      url.searchParams.set("thread", threadId);
+      return url.toString();
+    },
+    [threadUrlSync],
+  );
+
   const renderHeaderActions = useCallback(
     ({
       activeChatSessionId,
       activeTabId,
+      activeTabMessageCount,
       addTab,
       clearActiveTab,
       closeAllTabs,
@@ -1095,6 +1117,7 @@ function AgentPanelInner({
     }: Pick<
       MultiTabAssistantChatHeaderProps,
       | "activeTabId"
+      | "activeTabMessageCount"
       | "addTab"
       | "clearActiveTab"
       | "closeAllTabs"
@@ -1110,6 +1133,28 @@ function AgentPanelInner({
             <SetupButton />
           </Suspense>
         )}
+        {(() => {
+          const activeTab =
+            mode === "chat" && activeChatSessionId
+              ? tabs.find((tab) => tab.id === activeChatSessionId)
+              : undefined;
+          if (
+            !activeTab ||
+            (activeTabMessageCount <= 0 && activeTab.status === "idle")
+          ) {
+            return null;
+          }
+          return (
+            <ShareButton
+              resourceType="chat_thread"
+              resourceId={activeTab.id}
+              resourceTitle={activeTab.label || "Chat"}
+              shareUrl={getChatThreadShareUrl(activeTab.id)}
+              trigger="icon"
+              triggerClassName="h-7 w-7"
+            />
+          );
+        })()}
         <FeedbackButton
           variant="icon"
           side="bottom"
@@ -1331,6 +1376,7 @@ function AgentPanelInner({
       closeOtherCliTabs,
       closeTabHint,
       feedbackOpen,
+      getChatThreadShareUrl,
       headerMenuOpen,
       isFullscreen,
       mode,
@@ -1361,25 +1407,42 @@ function AgentPanelInner({
       ) {
         return null;
       }
+      const activeTab = activeTabId
+        ? tabs.find((tab) => tab.id === activeTabId)
+        : undefined;
+      const canShareActiveTab =
+        activeTab && (activeTabMessageCount > 0 || activeTab.status !== "idle");
 
       return (
         <div className="pointer-events-none absolute inset-x-0 top-3 z-[60] flex justify-end px-3 sm:top-4 sm:px-4">
-          <button
-            type="button"
-            data-agent-page-new-chat=""
-            aria-label={t("agentPanel.newChat")}
-            onClick={() => {
-              addTab();
-            }}
-            className="pointer-events-auto inline-flex h-8 items-center gap-1.5 rounded-md border border-border bg-background/95 px-2.5 text-xs font-medium text-foreground shadow-sm backdrop-blur transition-colors hover:bg-accent focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
-          >
-            <IconPlus size={14} />
-            <span>{t("agentPanel.newChat")}</span>
-          </button>
+          <div className="pointer-events-auto flex items-center gap-1">
+            {canShareActiveTab ? (
+              <ShareButton
+                resourceType="chat_thread"
+                resourceId={activeTab.id}
+                resourceTitle={activeTab.label || "Chat"}
+                shareUrl={getChatThreadShareUrl(activeTab.id)}
+                trigger="icon"
+                triggerClassName="h-8 w-8 border border-border bg-background/95 shadow-sm backdrop-blur hover:bg-accent"
+              />
+            ) : null}
+            <button
+              type="button"
+              data-agent-page-new-chat=""
+              aria-label={t("agentPanel.newChat")}
+              onClick={() => {
+                addTab();
+              }}
+              className="inline-flex h-8 items-center gap-1.5 rounded-md border border-border bg-background/95 px-2.5 text-xs font-medium text-foreground shadow-sm backdrop-blur transition-colors hover:bg-accent focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
+            >
+              <IconPlus size={14} />
+              <span>{t("agentPanel.newChat")}</span>
+            </button>
+          </div>
         </div>
       );
     },
-    [t],
+    [getChatThreadShareUrl, t],
   );
 
   // Ref callback: scroll the active tab into view in the overflow container.
@@ -1404,6 +1467,7 @@ function AgentPanelInner({
     ({
       tabs,
       activeTabId,
+      activeTabMessageCount,
       setActiveTabId,
       addTab,
       clearActiveTab,
@@ -1432,6 +1496,7 @@ function AgentPanelInner({
             {renderHeaderActions({
               activeChatSessionId: activeTabId,
               activeTabId,
+              activeTabMessageCount,
               addTab,
               clearActiveTab,
               closeAllTabs,