@agent-native/core 0.90.3 → 0.90.5

package/corpus/core/src/cli/design-connect.ts

@@ -33,6 +33,16 @@ const BRIDGE_OPERATIONS = [
 
 type BridgeOperation = (typeof BRIDGE_OPERATIONS)[number];
 
+const SERVER_REGISTRATION_BRIDGE_OPERATIONS = new Set<BridgeOperation>([
+  "select",
+  "resolveNodeToFile",
+  "readFile",
+  "applyEdit",
+  "writeFile",
+  "captureSnapshot",
+  "captureState",
+]);
+
 /** Additive manifest capability flags advertised alongside the operation list. */
 const MANIFEST_CAPABILITIES = {
   listFiles: true,
@@ -507,6 +517,47 @@ function sendJson(
   res.end(`${JSON.stringify(body, null, 2)}\n`);
 }
 
+function sendText(
+  res: ServerResponse,
+  statusCode: number,
+  body: string,
+  contentType: string,
+) {
+  res.writeHead(statusCode, {
+    "content-type": contentType,
+    "access-control-allow-origin": "*",
+    "access-control-allow-methods": "GET, POST, OPTIONS",
+    "access-control-allow-headers": "content-type, x-bridge-token",
+    "access-control-allow-private-network": "true",
+  });
+  res.end(body);
+}
+
+function sendBytes(
+  res: ServerResponse,
+  statusCode: number,
+  body: Buffer,
+  headers: Headers,
+) {
+  const responseHeaders: Record<string, string> = {
+    "access-control-allow-origin": "*",
+    "access-control-allow-methods": "GET, HEAD, POST, OPTIONS",
+    "access-control-allow-headers": "content-type, x-bridge-token",
+    "access-control-allow-private-network": "true",
+  };
+  for (const name of [
+    "content-type",
+    "cache-control",
+    "etag",
+    "last-modified",
+  ]) {
+    const value = headers.get(name);
+    if (value) responseHeaders[name] = value;
+  }
+  res.writeHead(statusCode, responseHeaders);
+  res.end(body);
+}
+
 function sameOrigin(a: string, b: string): boolean {
   try {
     return new URL(a).origin === new URL(b).origin;
@@ -531,6 +582,23 @@ function resolvePreviewSnapshotUrl(
   return parsed.toString();
 }
 
+function resolvePreviewProxyUrl(
+  devServerUrl: string,
+  requestUrl: string | undefined,
+): string {
+  const base = normalizeHttpUrl(devServerUrl);
+  const parsedRequest = new URL(requestUrl ?? "/", base);
+  const parsed = new URL(
+    `${parsedRequest.pathname}${parsedRequest.search}`,
+    `${base}/`,
+  );
+  parsed.hash = "";
+  if (!sameOrigin(parsed.toString(), base)) {
+    throw new Error("Proxy URL must stay on the connected dev server.");
+  }
+  return parsed.toString();
+}
+
 async function fetchPreviewSnapshot(
   devServerUrl: string,
   targetUrl: string,
@@ -579,6 +647,79 @@ async function fetchPreviewSnapshot(
   }
 }
 
+async function fetchPreviewProxyResource(
+  devServerUrl: string,
+  targetUrl: string,
+  redirects = 0,
+): Promise<{
+  url: string;
+  status: number;
+  headers: Headers;
+  body: Buffer;
+}> {
+  if (redirects > 5) {
+    throw new Error("Too many redirects while proxying preview resource.");
+  }
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 10_000);
+  try {
+    const response = await fetch(targetUrl, {
+      method: "GET",
+      redirect: "manual",
+      signal: controller.signal,
+    });
+    const location = response.headers.get("location");
+    if (location && response.status >= 300 && response.status < 400) {
+      const redirected = new URL(location, targetUrl);
+      redirected.hash = "";
+      if (!sameOrigin(redirected.toString(), devServerUrl)) {
+        throw new Error("Proxy redirect left the connected dev server.");
+      }
+      return fetchPreviewProxyResource(
+        devServerUrl,
+        redirected.toString(),
+        redirects + 1,
+      );
+    }
+    return {
+      url: response.url || targetUrl,
+      status: response.status,
+      headers: response.headers,
+      body: Buffer.from(await response.arrayBuffer()),
+    };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function addLiveEditBaseHref(html: string, href: string): string {
+  const escapedHref = href.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
+  const baseTag = `<base href="${escapedHref}">`;
+  if (/<base\b/i.test(html)) return html;
+  if (/<head\b[^>]*>/i.test(html)) {
+    return html.replace(/<head\b[^>]*>/i, (match) => `${match}${baseTag}`);
+  }
+  if (/<html\b[^>]*>/i.test(html)) {
+    return html.replace(
+      /<html\b[^>]*>/i,
+      (match) => `${match}<head>${baseTag}</head>`,
+    );
+  }
+  return `<!DOCTYPE html><html><head>${baseTag}<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"></head><body>${html}</body></html>`;
+}
+
+function injectLiveEditBridge(html: string, targetUrl: string, script: string) {
+  const withBase = addLiveEditBaseHref(html, targetUrl);
+  if (!script) return withBase;
+  if (withBase.includes("</body>")) {
+    return withBase.replace("</body>", `${script}</body>`);
+  }
+  if (withBase.includes("</html>")) {
+    return withBase.replace("</html>", `${script}</html>`);
+  }
+  return `${withBase}${script}`;
+}
+
 /** Read the full request body as a UTF-8 string. */
 async function readRequestBody(req: IncomingMessage): Promise<string> {
   return new Promise<string>((resolve, reject) => {
@@ -1046,6 +1187,7 @@ export async function startDesignConnectBridge(
   // an unauthenticated caller cannot read it.  The server-side grant action
   // obtains it out-of-band (via the exported bridge reference).
   const bridgeToken = crypto.randomBytes(32).toString("hex");
+  let liveEditBridgeScript = "";
 
   const server = http.createServer(
     (req: IncomingMessage, res: ServerResponse) => {
@@ -1077,6 +1219,97 @@ export async function startDesignConnectBridge(
         sendJson(res, 200, { ok: true, source: manifest.source });
         return;
       }
+      if (pathname === "/live-edit-bridge") {
+        if (req.method !== "POST") {
+          sendJson(res, 405, { ok: false, error: "method not allowed" });
+          return;
+        }
+        const tokenHeader = req.headers["x-bridge-token"];
+        const providedToken =
+          typeof tokenHeader === "string" ? tokenHeader : "";
+        let tokenValid = false;
+        try {
+          tokenValid =
+            providedToken.length === bridgeToken.length &&
+            crypto.timingSafeEqual(
+              Buffer.from(providedToken, "utf8"),
+              Buffer.from(bridgeToken, "utf8"),
+            );
+        } catch {
+          tokenValid = false;
+        }
+        if (!tokenValid) {
+          sendJson(res, 401, {
+            ok: false,
+            error: "invalid or missing bridge token",
+          });
+          return;
+        }
+        void (async () => {
+          try {
+            const raw = await readRequestBody(req);
+            const body = JSON.parse(raw) as Record<string, unknown>;
+            const script =
+              typeof body["script"] === "string" ? body["script"] : "";
+            if (!script.includes("agent-native:editor-chrome-ready")) {
+              sendJson(res, 400, {
+                ok: false,
+                error: "script must install the Agent Native editor bridge",
+              });
+              return;
+            }
+            liveEditBridgeScript = script;
+            sendJson(res, 200, { ok: true });
+          } catch (err: unknown) {
+            sendJson(res, 400, {
+              ok: false,
+              error: err instanceof Error ? err.message : String(err),
+            });
+          }
+        })();
+        return;
+      }
+      if (pathname === "/live-edit") {
+        if (req.method !== "GET") {
+          sendJson(res, 405, { ok: false, error: "method not allowed" });
+          return;
+        }
+        void (async () => {
+          try {
+            const requestUrl = new URL(req.url ?? "/", manifest.bridgeUrl);
+            const targetUrl = resolvePreviewSnapshotUrl(
+              manifest.devServerUrl,
+              requestUrl.searchParams.get("url") ??
+                requestUrl.searchParams.get("path"),
+            );
+            const snapshot = await fetchPreviewSnapshot(
+              manifest.devServerUrl,
+              targetUrl,
+            );
+            const includeEditorBridge =
+              requestUrl.searchParams.get("bridge") !== "0";
+            const html = injectLiveEditBridge(
+              snapshot.html,
+              new URL("/", manifest.bridgeUrl).toString(),
+              includeEditorBridge ? liveEditBridgeScript : "",
+            );
+            sendText(
+              res,
+              snapshot.status >= 400 ? snapshot.status : 200,
+              html,
+              snapshot.contentType.includes("html")
+                ? snapshot.contentType
+                : "text/html; charset=utf-8",
+            );
+          } catch (err: unknown) {
+            sendJson(res, 400, {
+              ok: false,
+              error: err instanceof Error ? err.message : String(err),
+            });
+          }
+        })();
+        return;
+      }
       if (pathname === "/snapshot") {
         if (req.method !== "GET") {
           sendJson(res, 405, { ok: false, error: "method not allowed" });
@@ -1356,6 +1589,33 @@ export async function startDesignConnectBridge(
         return;
       }
 
+      if (req.method === "GET" || req.method === "HEAD") {
+        void (async () => {
+          try {
+            const targetUrl = resolvePreviewProxyUrl(
+              manifest.devServerUrl,
+              req.url,
+            );
+            const proxied = await fetchPreviewProxyResource(
+              manifest.devServerUrl,
+              targetUrl,
+            );
+            sendBytes(
+              res,
+              proxied.status >= 400 ? proxied.status : 200,
+              req.method === "HEAD" ? Buffer.alloc(0) : proxied.body,
+              proxied.headers,
+            );
+          } catch (err: unknown) {
+            sendJson(res, 400, {
+              ok: false,
+              error: err instanceof Error ? err.message : String(err),
+            });
+          }
+        })();
+        return;
+      }
+
       sendJson(res, 404, { ok: false, error: "not found" });
     },
   );
@@ -1432,7 +1692,9 @@ export async function registerConnectionWithServer(
     devServerUrl: manifest.devServerUrl,
     bridgeUrl: manifest.bridgeUrl,
     rootPath: manifest.rootPath,
-    capabilities: manifest.capabilities,
+    capabilities: manifest.capabilities.filter((capability) =>
+      SERVER_REGISTRATION_BRIDGE_OPERATIONS.has(capability.operation),
+    ),
     routeManifest: {
       version: 1 as const,
       sourceType: "localhost" as const,

package/corpus/core/src/cli/index.ts

@@ -2,6 +2,7 @@
 
 import { execSync, spawn } from "child_process";
 import fs from "fs";
+import { createRequire } from "module";
 import path from "path";
 import { fileURLToPath } from "url";
 
@@ -253,11 +254,20 @@ function handleScaffoldImportError(err: any): never {
   throw err;
 }
 
+function findBinUpwards(binName: string): string | undefined {
+  let dir = process.cwd();
+  for (let i = 0; i < 20; i++) {
+    const candidate = path.join(dir, "node_modules", ".bin", binName);
+    if (fs.existsSync(candidate)) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return undefined;
+}
+
 function findViteBin(): string {
-  // Look for vite in node_modules/.bin
-  const localVite = path.resolve("node_modules/.bin/vite");
-  if (fs.existsSync(localVite)) return localVite;
-  return "vite"; // fallback to PATH
+  return findBinUpwards("vite") ?? "vite";
 }
 
 function findTsxBin(): string {
@@ -277,9 +287,7 @@ function findTypeScriptCompilerBin(): string {
 }
 
 function findReactRouterBin(): string {
-  const localBin = path.resolve("node_modules/.bin/react-router");
-  if (fs.existsSync(localBin)) return localBin;
-  return "react-router";
+  return findBinUpwards("react-router") ?? "react-router";
 }
 
 /** Check if the project uses React Router framework mode (has react-router.config.ts) */
@@ -290,6 +298,73 @@ function isReactRouterFramework(): boolean {
   );
 }
 
+function canResolveFromProject(specifier: string): boolean {
+  try {
+    const requireFromProject = createRequire(path.resolve("package.json"));
+    requireFromProject.resolve(specifier);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function projectUsesFsRoutes(): boolean {
+  for (const file of [
+    path.resolve("app/routes.ts"),
+    path.resolve("app/routes.tsx"),
+    path.resolve("routes.ts"),
+    path.resolve("routes.tsx"),
+  ]) {
+    try {
+      if (
+        fs.existsSync(file) &&
+        fs.readFileSync(file, "utf-8").includes("@react-router/fs-routes")
+      ) {
+        return true;
+      }
+    } catch {}
+  }
+  return false;
+}
+
+function validateReactRouterBuildDependencies(): void {
+  const required: Array<[packageName: string, specifier: string]> = [
+    ["react-router", "react-router"],
+    ["@react-router/dev", "@react-router/dev/vite"],
+    ["vite", "vite"],
+  ];
+  if (projectUsesFsRoutes()) {
+    required.push(["@react-router/fs-routes", "@react-router/fs-routes"]);
+  }
+
+  const missing = required
+    .filter(([, specifier]) => !canResolveFromProject(specifier))
+    .map(([packageName]) => packageName);
+
+  if (missing.length === 0) return;
+
+  const packageManager = fs.existsSync(path.resolve("pnpm-lock.yaml"))
+    ? "pnpm"
+    : fs.existsSync(path.resolve("yarn.lock"))
+      ? "yarn"
+      : "npm";
+  const installCommand =
+    packageManager === "pnpm"
+      ? `pnpm add ${missing.join(" ")}`
+      : packageManager === "yarn"
+        ? `yarn add ${missing.join(" ")}`
+        : `npm install ${missing.join(" ")}`;
+
+  console.error(
+    [
+      "React Router framework mode requires build packages that are not installed from this app root.",
+      `Missing: ${missing.join(", ")}`,
+      `Install them with: ${installCommand}`,
+    ].join("\n"),
+  );
+  process.exit(1);
+}
+
 function isWorkspaceRoot(): boolean {
   const pkgPath = path.resolve("package.json");
   if (!fs.existsSync(pkgPath)) return false;
@@ -488,6 +563,7 @@ switch (command) {
     // continuation only runs on success.
     (async () => {
       if (isReactRouterFramework()) {
+        validateReactRouterBuildDependencies();
         const rr = findReactRouterBin();
         console.log("Building (React Router framework mode)...");
         await runBuildStep(rr, ["build"], { label: "react-router-build" });
@@ -592,6 +668,7 @@ switch (command) {
     // Run TypeScript type checking
     // React Router framework mode generates route types first
     if (isReactRouterFramework()) {
+      validateReactRouterBuildDependencies();
       const rr = findReactRouterBin();
       try {
         execSync(`${rr} typegen`, { stdio: "inherit" });

package/corpus/core/src/cli/workspacify.ts

@@ -24,6 +24,12 @@ import fs from "fs";
 import path from "path";
 
 const POSTGRES_DEPENDENCY_VERSION = "^3.4.9";
+const REACT_ROUTER_BUILD_DEPENDENCIES = [
+  "@react-router/dev",
+  "@react-router/fs-routes",
+  "react-router",
+  "vite",
+] as const;
 
 export interface WorkspacifyOptions {
   /** Target app directory (already populated with the copied template) */
@@ -87,6 +93,7 @@ export function workspacifyApp(opts: WorkspacifyOptions): void {
       // Add the runtime package to workspace apps so production bundles do
       // not fail only after a hosted Postgres database is configured.
       pkg.dependencies.postgres ??= POSTGRES_DEPENDENCY_VERSION;
+      ensureReactRouterBuildDependencies(pkg);
       // pnpm build-script approvals belong at the workspace root. Leaving the
       // template's per-app setting in place makes pnpm warn on every install.
       if (pkg.pnpm && typeof pkg.pnpm === "object") {
@@ -156,6 +163,33 @@ export function workspacifyApp(opts: WorkspacifyOptions): void {
   }
 }
 
+function ensureReactRouterBuildDependencies(pkg: Record<string, any>): void {
+  const allDeps = {
+    ...pkg.dependencies,
+    ...pkg.devDependencies,
+    ...pkg.peerDependencies,
+  };
+  if (
+    !allDeps["@react-router/dev"] &&
+    !allDeps["react-router"] &&
+    !allDeps["@react-router/fs-routes"]
+  ) {
+    return;
+  }
+
+  pkg.dependencies = pkg.dependencies ?? {};
+  for (const key of REACT_ROUTER_BUILD_DEPENDENCIES) {
+    const existing =
+      pkg.dependencies[key] ??
+      pkg.devDependencies?.[key] ??
+      pkg.peerDependencies?.[key];
+    if (!existing) continue;
+    pkg.dependencies[key] = existing;
+    delete pkg.devDependencies?.[key];
+    delete pkg.peerDependencies?.[key];
+  }
+}
+
 function writeInheritedChatPlugin(
   appDir: string,
   workspaceCoreName: string,

package/corpus/core/src/client/KeepTabOpenNotice.tsx

@@ -9,23 +9,22 @@ import { cn } from "./utils.js";
 export const DEFAULT_KEEP_TAB_OPEN_AFTER_MS = 30_000;
 
 /**
- * Subtle, non-blocking notice that a long-running FOREGROUND agent turn
- * depends on this tab staying open.
+ * Subtle, non-blocking notice that a long-running client-continued foreground
+ * agent turn depends on this tab staying open.
  *
  * On hosted deployments a foreground turn runs in ~40s chunks and the CLIENT
- * re-POSTs `auto_continue` to start each next chunk — close the tab
- * mid-turn and the work silently stops at the next chunk boundary. Only
- * server-driven runs (`dispatchMode` starting with "background": the durable
- * background worker, or a server self-chained continuation) survive a closed
- * tab, and for those this notice never shows.
+ * may need to re-POST `auto_continue` to start each next chunk. Server-owned
+ * runs (`dispatchMode` starting with "background" or equal to
+ * "foreground-self-chain") survive a closed tab, and for those this notice
+ * never shows.
  *
  * Visibility rules (show only while the condition is true — no new
  * always-visible chrome):
- *   - a foreground-dispatched run for this thread has been continuously
+ *   - a client-continued foreground run for this thread has been continuously
  *     running for `showAfterMs` (default 30s — approaching the hosted ~40s
  *     chunk boundary where the client-driven continuation starts), and
- *   - the run is NOT background-dispatched (hidden immediately when the
- *     server owns recovery), and
+ *   - the run is not server-continued (hidden immediately when the server owns
+ *     recovery), and
  *   - this is a production client bundle (`hosted` auto-detect): local dev
  *     runs a turn unbounded in a single chunk that survives a closed tab,
  *     so the notice would be wrong there.
@@ -78,6 +77,13 @@ function isDevClientBundle(): boolean {
   }
 }
 
+function isServerContinuedDispatch(dispatchMode: string | null): boolean {
+  return (
+    dispatchMode === "foreground-self-chain" ||
+    dispatchMode?.startsWith("background") === true
+  );
+}
+
 export function KeepTabOpenNotice({
   threadId,
   enabled = true,
@@ -93,10 +99,9 @@ export function KeepTabOpenNotice({
     apiUrl,
     pollIntervalMs: NOTICE_POLL_INTERVAL_MS,
   });
-  const isBackgroundDispatch =
-    state.dispatchMode?.startsWith("background") === true;
+  const isServerContinued = isServerContinuedDispatch(state.dispatchMode);
   const foregroundRunning =
-    state.status === "running" && Boolean(state.runId) && !isBackgroundDispatch;
+    state.status === "running" && Boolean(state.runId) && !isServerContinued;
 
   const [visible, setVisible] = useState(false);
   const runningSinceRef = useRef<number | null>(null);
@@ -109,7 +114,7 @@ export function KeepTabOpenNotice({
   }, [threadId]);
 
   useEffect(() => {
-    if (!effectiveHosted || isBackgroundDispatch) {
+    if (!effectiveHosted || isServerContinued) {
       // Server-owned turn (or non-hosted client): the tab is not load-bearing.
       // Hide immediately and reset — no linger.
       runningSinceRef.current = null;
@@ -143,7 +148,7 @@ export function KeepTabOpenNotice({
   }, [
     effectiveHosted,
     foregroundRunning,
-    isBackgroundDispatch,
+    isServerContinued,
     showAfterMs,
     visible,
   ]);

package/corpus/core/src/client/RunStuckBanner.tsx

@@ -175,15 +175,16 @@ export function RunStuckBanner({
   }
   const ownerId = autoRetryOwnerId ?? generatedOwnerIdRef.current;
   const backgroundWorkerStillAlive = isFreshBackgroundWorker(state);
-  // Background-dispatched runs are recovered by the SERVER (chained
-  // continuation chunks + lost-handoff sweep); an automatic client abort
-  // would kill a live server-chained run. Auto-retry is therefore disabled
-  // unconditionally for ANY background dispatch mode — not just a
-  // fresh-heartbeat worker — and the localStorage/Web-Locks auto-retry claim
-  // below is never taken for these runs (the adapter's follow loop is
-  // read-only, so multiple tabs need no retry dedup). Only the manual banner
-  // remains, on the wider background threshold from useRunStuckDetection.
-  const isBackgroundDispatch =
+  // Server-continued runs are recovered by the SERVER (chained continuation
+  // chunks + lost-handoff sweep); an automatic client abort would kill a live
+  // server-chained run. Auto-retry is therefore disabled unconditionally for
+  // these modes — not just a fresh-heartbeat worker — and the
+  // localStorage/Web-Locks auto-retry claim below is never taken for them (the
+  // adapter's follow loop is read-only, so multiple tabs need no retry dedup).
+  // Only the manual banner remains, on the wider server-owned threshold from
+  // useRunStuckDetection.
+  const isServerContinuedDispatch =
+    state.dispatchMode === "foreground-self-chain" ||
     state.dispatchMode?.startsWith("background") === true;
 
   const lastReportedRef = useRef<{
@@ -224,9 +225,9 @@ export function RunStuckBanner({
   useEffect(() => {
     if (
       !autoRetry ||
-      // Server owns recovery for background dispatch modes — never auto-abort
-      // (see comment on isBackgroundDispatch above).
-      isBackgroundDispatch ||
+      // Server owns recovery for these dispatch modes — never auto-abort (see
+      // comment on isServerContinuedDispatch above).
+      isServerContinuedDispatch ||
       backgroundWorkerStillAlive ||
       !state.isStuck ||
       !state.runId ||
@@ -263,7 +264,7 @@ export function RunStuckBanner({
     autoRetry,
     backgroundWorkerStillAlive,
     busy,
-    isBackgroundDispatch,
+    isServerContinuedDispatch,
     onRetry,
     ownerId,
     state.isStuck,