@agent-native/core 0.90.3 → 0.90.4

package/corpus/core/src/cli/workspacify.ts

@@ -24,6 +24,12 @@ import fs from "fs";
 import path from "path";
 
 const POSTGRES_DEPENDENCY_VERSION = "^3.4.9";
+const REACT_ROUTER_BUILD_DEPENDENCIES = [
+  "@react-router/dev",
+  "@react-router/fs-routes",
+  "react-router",
+  "vite",
+] as const;
 
 export interface WorkspacifyOptions {
   /** Target app directory (already populated with the copied template) */
@@ -87,6 +93,7 @@ export function workspacifyApp(opts: WorkspacifyOptions): void {
       // Add the runtime package to workspace apps so production bundles do
       // not fail only after a hosted Postgres database is configured.
       pkg.dependencies.postgres ??= POSTGRES_DEPENDENCY_VERSION;
+      ensureReactRouterBuildDependencies(pkg);
       // pnpm build-script approvals belong at the workspace root. Leaving the
       // template's per-app setting in place makes pnpm warn on every install.
       if (pkg.pnpm && typeof pkg.pnpm === "object") {
@@ -156,6 +163,33 @@ export function workspacifyApp(opts: WorkspacifyOptions): void {
   }
 }
 
+function ensureReactRouterBuildDependencies(pkg: Record<string, any>): void {
+  const allDeps = {
+    ...pkg.dependencies,
+    ...pkg.devDependencies,
+    ...pkg.peerDependencies,
+  };
+  if (
+    !allDeps["@react-router/dev"] &&
+    !allDeps["react-router"] &&
+    !allDeps["@react-router/fs-routes"]
+  ) {
+    return;
+  }
+
+  pkg.dependencies = pkg.dependencies ?? {};
+  for (const key of REACT_ROUTER_BUILD_DEPENDENCIES) {
+    const existing =
+      pkg.dependencies[key] ??
+      pkg.devDependencies?.[key] ??
+      pkg.peerDependencies?.[key];
+    if (!existing) continue;
+    pkg.dependencies[key] = existing;
+    delete pkg.devDependencies?.[key];
+    delete pkg.peerDependencies?.[key];
+  }
+}
+
 function writeInheritedChatPlugin(
   appDir: string,
   workspaceCoreName: string,

package/corpus/core/src/client/history/VersionHistoryPanel.tsx

@@ -1,5 +1,5 @@
 import { IconClock, IconRestore, IconTimeline } from "@tabler/icons-react";
-import type { ReactNode } from "react";
+import { useState, type ReactNode } from "react";
 
 import type { ResourceVersion } from "../../history/types.js";
 import { cn } from "../utils.js";
@@ -31,6 +31,7 @@ export function VersionHistoryPanel({
 }: VersionHistoryPanelProps) {
   const versions = useResourceVersions({ resourceType, resourceId, limit });
   const restore = useRestoreResourceVersion();
+  const [confirmRestoreId, setConfirmRestoreId] = useState<string | null>(null);
 
   return (
     <section
@@ -49,52 +50,81 @@ export function VersionHistoryPanel({
             Loading versions...
           </div>
         ) : versions.data?.versions.length ? (
-          versions.data.versions.map((version) => (
-            <article key={version.id} className="flex gap-3 px-4 py-3">
-              <div className="mt-0.5 flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-muted">
-                <IconClock className="h-4 w-4 text-muted-foreground" />
-              </div>
-              <div className="min-w-0 flex-1">
-                {renderVersion ? (
-                  renderVersion(version)
-                ) : (
-                  <>
-                    <div className="flex flex-wrap items-center gap-x-2 gap-y-1">
-                      <h3 className="truncate text-sm font-medium">
-                        {version.title ?? `Version ${version.versionNumber}`}
-                      </h3>
-                      <span className="text-xs text-muted-foreground">
-                        {formatVersionDate(version.createdAt)}
-                      </span>
-                    </div>
-                    {version.summary ? (
-                      <p className="mt-1 text-sm text-muted-foreground">
-                        {version.summary}
-                      </p>
-                    ) : null}
-                  </>
-                )}
-              </div>
-              <button
-                type="button"
-                className="inline-flex h-8 items-center gap-1.5 rounded-md border border-input px-2.5 text-xs font-medium hover:bg-accent disabled:cursor-not-allowed disabled:opacity-50"
-                disabled={restore.isPending}
-                onClick={() =>
-                  restore.mutate(
-                    { id: version.id },
-                    {
-                      onSuccess: (result) => {
-                        onRestored?.(result.version, result.result);
-                      },
-                    },
-                  )
-                }
-              >
-                <IconRestore className="h-3.5 w-3.5" />
-                Restore
-              </button>
-            </article>
-          ))
+          versions.data.versions.map((version) => {
+            const confirming = confirmRestoreId === version.id;
+            return (
+              <article key={version.id} className="flex gap-3 px-4 py-3">
+                <div className="mt-0.5 flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-muted">
+                  <IconClock className="h-4 w-4 text-muted-foreground" />
+                </div>
+                <div className="min-w-0 flex-1">
+                  {renderVersion ? (
+                    renderVersion(version)
+                  ) : (
+                    <>
+                      <div className="flex flex-wrap items-center gap-x-2 gap-y-1">
+                        <h3 className="truncate text-sm font-medium">
+                          {version.title ?? `Version ${version.versionNumber}`}
+                        </h3>
+                        <span className="text-xs text-muted-foreground">
+                          {formatVersionDate(version.createdAt)}
+                        </span>
+                      </div>
+                      {version.summary ? (
+                        <p className="mt-1 text-sm text-muted-foreground">
+                          {version.summary}
+                        </p>
+                      ) : null}
+                    </>
+                  )}
+                </div>
+                <div className="flex shrink-0 items-center gap-2">
+                  {confirming ? (
+                    <>
+                      <button
+                        type="button"
+                        className="inline-flex h-8 items-center rounded-md border border-input px-2.5 text-xs font-medium hover:bg-accent disabled:cursor-not-allowed disabled:opacity-50"
+                        disabled={restore.isPending}
+                        onClick={() => setConfirmRestoreId(null)}
+                      >
+                        Cancel
+                      </button>
+                      <button
+                        type="button"
+                        className="inline-flex h-8 items-center gap-1.5 rounded-md border border-destructive bg-destructive px-2.5 text-xs font-medium text-destructive-foreground hover:bg-destructive/90 disabled:cursor-not-allowed disabled:opacity-50"
+                        disabled={restore.isPending}
+                        onClick={() =>
+                          restore.mutate(
+                            { id: version.id },
+                            {
+                              onSuccess: (result) => {
+                                setConfirmRestoreId(null);
+                                onRestored?.(result.version, result.result);
+                              },
+                              onError: () => setConfirmRestoreId(null),
+                            },
+                          )
+                        }
+                      >
+                        <IconRestore className="h-3.5 w-3.5" />
+                        Confirm restore
+                      </button>
+                    </>
+                  ) : (
+                    <button
+                      type="button"
+                      className="inline-flex h-8 items-center gap-1.5 rounded-md border border-input px-2.5 text-xs font-medium hover:bg-accent disabled:cursor-not-allowed disabled:opacity-50"
+                      disabled={restore.isPending}
+                      onClick={() => setConfirmRestoreId(version.id)}
+                    >
+                      <IconRestore className="h-3.5 w-3.5" />
+                      Restore
+                    </button>
+                  )}
+                </div>
+              </article>
+            );
+          })
         ) : (
           <div className="px-4 py-6 text-sm text-muted-foreground">
             {emptyState}

package/corpus/core/src/client/history/index.ts

@@ -6,9 +6,12 @@ export {
 export {
   useCreateResourceVersion,
   useResourceHistory,
+  useResourceVersion,
   useResourceVersions,
   useRestoreResourceVersion,
   type CreateResourceVersionInput,
+  type GetResourceVersionInput,
+  type GetResourceVersionResult,
   type ListResourceHistoryResult,
   type ListResourceVersionsResult,
   type ResourceHistoryParams,

package/corpus/core/src/client/history/use-history.ts

@@ -30,6 +30,13 @@ export interface RestoreResourceVersionInput {
   versionNumber?: number;
 }
 
+export interface GetResourceVersionInput {
+  id?: string;
+  resourceType?: string;
+  resourceId?: string;
+  versionNumber?: number;
+}
+
 export interface ListResourceVersionsResult {
   versions: ResourceVersion[];
 }
@@ -39,6 +46,10 @@ export interface ListResourceHistoryResult {
   auditEvents: unknown[];
 }
 
+export interface GetResourceVersionResult {
+  version: ResourceVersion;
+}
+
 export interface RestoreResourceVersionResult {
   version: ResourceVersion;
   result: unknown;
@@ -72,6 +83,23 @@ export function useResourceHistory(
   );
 }
 
+export function useResourceVersion(
+  params: GetResourceVersionInput,
+  options?: { enabled?: boolean },
+) {
+  const enabled =
+    options?.enabled ??
+    Boolean(
+      params.id ||
+      (params.resourceType && params.resourceId && params.versionNumber),
+    );
+  return useActionQuery<GetResourceVersionResult>(
+    "get-resource-version",
+    params,
+    { enabled },
+  );
+}
+
 export function useCreateResourceVersion() {
   return useActionMutation<ResourceVersion, CreateResourceVersionInput>(
     "create-resource-version",

package/corpus/core/src/client/index.ts

@@ -791,9 +791,12 @@ export {
   VersionHistoryPanel,
   useCreateResourceVersion,
   useResourceHistory,
+  useResourceVersion,
   useResourceVersions,
   useRestoreResourceVersion,
   type CreateResourceVersionInput,
+  type GetResourceVersionInput,
+  type GetResourceVersionResult,
   type ListResourceHistoryResult,
   type ListResourceVersionsResult,
   type ResourceHistoryParams,
@@ -806,14 +809,19 @@ export {
   ReviewStatusBadge,
   ReviewThreadPanel,
   buildReviewThreads,
+  useConsumeReviewFeedback,
   useCreateReviewComment,
   useDeleteReviewComment,
   useReplyReviewComment,
   useResolveReviewThread,
   useReviewComments,
+  useReviewFeedback,
   useSetReviewStatus,
+  type ConsumeReviewFeedbackInput,
   type CreateReviewCommentInput,
   type DeleteReviewCommentInput,
+  type GetReviewFeedbackParams,
+  type GetReviewFeedbackResult,
   type ListReviewCommentsParams,
   type ListReviewCommentsResult,
   type ReplyReviewCommentInput,

package/corpus/core/src/client/review/index.ts

@@ -9,14 +9,19 @@ export {
   type ReviewThreadPanelProps,
 } from "./ReviewThreadPanel.js";
 export {
+  useConsumeReviewFeedback,
   useCreateReviewComment,
   useDeleteReviewComment,
   useReplyReviewComment,
   useResolveReviewThread,
   useReviewComments,
+  useReviewFeedback,
   useSetReviewStatus,
+  type ConsumeReviewFeedbackInput,
   type CreateReviewCommentInput,
   type DeleteReviewCommentInput,
+  type GetReviewFeedbackParams,
+  type GetReviewFeedbackResult,
   type ListReviewCommentsParams,
   type ListReviewCommentsResult,
   type ReplyReviewCommentInput,

package/corpus/core/src/client/review/use-review.ts

@@ -22,6 +22,17 @@ export interface ListReviewCommentsResult {
   reviewStatus: ReviewStatusEntry | null;
 }
 
+export interface GetReviewFeedbackParams {
+  resourceType: string;
+  resourceId: string;
+  includeHumanTargeted?: boolean;
+  limit?: number;
+}
+
+export interface GetReviewFeedbackResult {
+  comments: ReviewComment[];
+}
+
 export interface CreateReviewCommentInput {
   resourceType: string;
   resourceId: string;
@@ -59,6 +70,12 @@ export interface DeleteReviewCommentInput {
   commentId: string;
 }
 
+export interface ConsumeReviewFeedbackInput {
+  resourceType: string;
+  resourceId: string;
+  commentIds: string[];
+}
+
 export interface SetReviewStatusInput {
   resourceType: string;
   resourceId: string;
@@ -81,6 +98,20 @@ export function useReviewComments(
   );
 }
 
+export function useReviewFeedback(
+  params: GetReviewFeedbackParams,
+  options?: { enabled?: boolean },
+) {
+  return useActionQuery<GetReviewFeedbackResult>(
+    "get-review-feedback",
+    params,
+    {
+      enabled:
+        options?.enabled ?? Boolean(params.resourceType && params.resourceId),
+    },
+  );
+}
+
 export function useCreateReviewComment() {
   return useActionMutation<ReviewComment, CreateReviewCommentInput>(
     "create-review-comment",
@@ -95,18 +126,25 @@ export function useReplyReviewComment() {
 
 export function useResolveReviewThread() {
   return useActionMutation<
-    { threadId: string; resolved: true },
+    { threadId: string; resolved: true; updatedCount: number },
     ResolveReviewThreadInput
   >("resolve-review-thread");
 }
 
 export function useDeleteReviewComment() {
   return useActionMutation<
-    { commentId: string; deleted: true },
+    { commentId: string; deleted: true; updatedCount: number },
     DeleteReviewCommentInput
   >("delete-review-comment");
 }
 
+export function useConsumeReviewFeedback() {
+  return useActionMutation<
+    { consumedCommentIds: string[]; updatedCount: number },
+    ConsumeReviewFeedbackInput
+  >("consume-review-feedback");
+}
+
 export function useSetReviewStatus() {
   return useActionMutation<ReviewStatusEntry, SetReviewStatusInput>(
     "set-review-status",

package/corpus/core/src/history/actions/create-resource-version.ts

@@ -30,15 +30,18 @@ export default defineAction({
       "editor",
     );
     const registration = getVersionedResource(args.resourceType);
+    // Prefer the registered server snapshot when available so editors/agents
+    // cannot plant arbitrary restore payloads for managed resource types.
+    const serverSnapshot = registration?.getSnapshot
+      ? await registration.getSnapshot({
+          resourceType: args.resourceType,
+          resourceId: args.resourceId,
+          ctx: actionCtx,
+          access,
+        })
+      : undefined;
     const snapshot =
-      args.snapshot !== undefined
-        ? args.snapshot
-        : await registration?.getSnapshot?.({
-            resourceType: args.resourceType,
-            resourceId: args.resourceId,
-            ctx: actionCtx,
-            access,
-          });
+      serverSnapshot !== undefined ? serverSnapshot : args.snapshot;
 
     if (snapshot === undefined) {
       throw new Error(

package/corpus/core/src/history/index.ts

@@ -22,6 +22,5 @@ export {
   ensureResourceVersionsTable,
   getResourceVersionById,
   getResourceVersionByNumber,
-  insertResourceVersion,
   queryResourceVersions,
 } from "./store.js";

package/corpus/core/src/history/registry.ts

@@ -1,4 +1,8 @@
-import { ForbiddenError, resolveAccess } from "../sharing/access.js";
+import {
+  ForbiddenError,
+  resolveAccess,
+  type AccessContext,
+} from "../sharing/access.js";
 import { getShareableResource } from "../sharing/registry.js";
 import { roleSatisfies, type Visibility } from "../sharing/schema.js";
 import type {
@@ -31,6 +35,16 @@ export function listVersionedResources(): VersionedResourceRegistration[] {
   return Array.from(registrations.values());
 }
 
+function accessContextFrom(
+  ctx?: VersionedResourceContext,
+): AccessContext | undefined {
+  if (!ctx) return undefined;
+  return {
+    userEmail: ctx.userEmail ?? undefined,
+    orgId: ctx.orgId ?? undefined,
+  };
+}
+
 export async function resolveVersionedResourceAccess(
   resourceType: string,
   resourceId: string,
@@ -42,7 +56,11 @@ export async function resolveVersionedResourceAccess(
   }
 
   if (getShareableResource(resourceType)) {
-    const access = await resolveAccess(resourceType, resourceId);
+    const access = await resolveAccess(
+      resourceType,
+      resourceId,
+      accessContextFrom(ctx),
+    );
     if (!access) {
       return null;
     }
@@ -55,16 +73,10 @@ export async function resolveVersionedResourceAccess(
     };
   }
 
-  const userEmail = ctx?.userEmail ?? null;
-  if (!userEmail) {
-    return null;
-  }
-  return {
-    role: "owner",
-    ownerEmail: userEmail,
-    orgId: ctx?.orgId ?? null,
-    visibility: "private",
-  };
+  // Fail closed: unregistered types, and registered types without an access
+  // resolver that aren't shareable, never invent ownership. bypassScope on
+  // history queries is only safe after a real resource ACL.
+  return null;
 }
 
 export async function assertVersionedResourceAccess(

package/corpus/core/src/history/store.ts

@@ -1,4 +1,9 @@
-import { getDbExec, intType, isPostgres } from "../db/client.js";
+import {
+  getDbExec,
+  intType,
+  isPostgres,
+  isUniqueViolation,
+} from "../db/client.js";
 import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
 import type { Visibility } from "../sharing/schema.js";
 import type {
@@ -9,6 +14,8 @@ import type {
 
 let historyTableInitPromise: Promise<void> | undefined;
 
+const VERSION_INSERT_MAX_ATTEMPTS = 8;
+
 export interface InsertResourceVersionInput {
   resourceType: string;
   resourceId: string;
@@ -53,7 +60,7 @@ export async function ensureResourceVersionsTable(): Promise<void> {
       metadata_json TEXT
     )`;
       const indexes = [
-        `CREATE INDEX IF NOT EXISTS idx_agent_resource_versions_resource
+        `CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_resource_versions_resource_number
            ON agent_resource_versions (resource_type, resource_id, version_number)`,
         `CREATE INDEX IF NOT EXISTS idx_agent_resource_versions_owner
            ON agent_resource_versions (owner_email, created_at)`,
@@ -64,7 +71,7 @@ export async function ensureResourceVersionsTable(): Promise<void> {
       if (isPostgres()) {
         await ensureTableExists("agent_resource_versions", createSql);
         await ensureIndexExists(
-          "idx_agent_resource_versions_resource",
+          "idx_agent_resource_versions_resource_number",
           indexes[0],
         );
         await ensureIndexExists(
@@ -89,41 +96,55 @@ export async function insertResourceVersion(
 ): Promise<ResourceVersion> {
   await ensureResourceVersionsTable();
   const client = getDbExec();
-  const maxRows = await client.execute({
-    sql: `SELECT MAX(version_number) as max_version
+  const visibility =
+    input.visibility === "org" || input.visibility === "public"
+      ? input.visibility
+      : "private";
+  const actorKind = input.actorKind ?? "human";
+  const createdBy = input.createdBy ?? null;
+  const ownerEmail = input.ownerEmail ?? input.createdBy ?? null;
+  const orgId = input.orgId ?? null;
+  const title = input.title ?? null;
+  const summary = input.summary ?? null;
+  const metadata = input.metadata ?? null;
+  const snapshotJson = JSON.stringify(input.snapshot);
+  const metadataJson = stringifyOptionalJson(metadata);
+
+  let lastError: unknown;
+  for (let attempt = 0; attempt < VERSION_INSERT_MAX_ATTEMPTS; attempt++) {
+    const maxRows = await client.execute({
+      sql: `SELECT MAX(version_number) as max_version
        FROM agent_resource_versions
       WHERE resource_type = ? AND resource_id = ?`,
-    args: [input.resourceType, input.resourceId],
-  });
-  const versionNumber =
-    Number(
-      (maxRows.rows?.[0] as Record<string, unknown> | undefined)?.max_version ??
-        0,
-    ) + 1;
-  const id = createVersionId();
-  const createdAt = new Date().toISOString();
-  const version: ResourceVersion = {
-    id,
-    resourceType: input.resourceType,
-    resourceId: input.resourceId,
-    versionNumber,
-    createdAt,
-    createdBy: input.createdBy ?? null,
-    actorKind: input.actorKind ?? "human",
-    ownerEmail: input.ownerEmail ?? input.createdBy ?? null,
-    orgId: input.orgId ?? null,
-    visibility:
-      input.visibility === "org" || input.visibility === "public"
-        ? input.visibility
-        : "private",
-    title: input.title ?? null,
-    summary: input.summary ?? null,
-    snapshot: input.snapshot,
-    metadata: input.metadata ?? null,
-  };
+      args: [input.resourceType, input.resourceId],
+    });
+    const versionNumber =
+      Number(
+        (maxRows.rows?.[0] as Record<string, unknown> | undefined)
+          ?.max_version ?? 0,
+      ) + 1;
+    const id = createVersionId();
+    const createdAt = new Date().toISOString();
+    const version: ResourceVersion = {
+      id,
+      resourceType: input.resourceType,
+      resourceId: input.resourceId,
+      versionNumber,
+      createdAt,
+      createdBy,
+      actorKind,
+      ownerEmail,
+      orgId,
+      visibility,
+      title,
+      summary,
+      snapshot: input.snapshot,
+      metadata,
+    };
 
-  await client.execute({
-    sql: `INSERT INTO agent_resource_versions (
+    try {
+      await client.execute({
+        sql: `INSERT INTO agent_resource_versions (
       id,
       resource_type,
       resource_id,
@@ -139,25 +160,35 @@ export async function insertResourceVersion(
       snapshot_json,
       metadata_json
     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-    args: [
-      version.id,
-      version.resourceType,
-      version.resourceId,
-      version.versionNumber,
-      version.createdAt,
-      version.createdBy,
-      version.actorKind,
-      version.ownerEmail,
-      version.orgId,
-      version.visibility,
-      version.title,
-      version.summary,
-      JSON.stringify(version.snapshot),
-      stringifyOptionalJson(version.metadata),
-    ],
-  });
+        args: [
+          version.id,
+          version.resourceType,
+          version.resourceId,
+          version.versionNumber,
+          version.createdAt,
+          version.createdBy,
+          version.actorKind,
+          version.ownerEmail,
+          version.orgId,
+          version.visibility,
+          version.title,
+          version.summary,
+          snapshotJson,
+          metadataJson,
+        ],
+      });
+      return version;
+    } catch (error) {
+      lastError = error;
+      if (!isUniqueViolation(error)) {
+        throw error;
+      }
+    }
+  }
 
-  return version;
+  throw lastError instanceof Error
+    ? lastError
+    : new Error("Failed to allocate a unique resource version number");
 }
 
 export async function queryResourceVersions(