@agent-native/core 0.91.1 → 0.92.0

package/corpus/templates/analytics/changelog/2026-07-08-console-details-expand-inline-under-each-row-and-the-event-t.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-08
+---
+
+Console details expand inline under each row, and the event timeline highlights, auto-scrolls, and supports search

package/corpus/templates/analytics/changelog/2026-07-08-dashboard-tables-keep-their-size-while-loading.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-08
+---
+
+Dashboard charts and tables keep their layout steady while loading.

package/corpus/templates/analytics/changelog/2026-07-08-monitoring-uptime-and-errors-tabs-now-clearly-show-which-view-is-active.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-08
+---
+
+Monitoring Uptime and Errors tabs now clearly show which view is active.

package/corpus/templates/analytics/changelog/2026-07-08-session-replay-keeps-a-usable-stage-when-dev-tools-is-open-a.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-08
+---
+
+Session replay keeps a usable stage when Dev Tools is open and shows the event timeline on medium screens

package/corpus/templates/analytics/changelog/2026-07-08-session-replay-resumes-after-scrubbing-and-expands-console-r.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-08
+---
+
+Session replay resumes after scrubbing and expands console rows without jumping the playhead

package/corpus/templates/analytics/changelog/2026-07-08-session-replay-uses-stock-rrweb-sizing-again-so-recorded.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-08
+---
+
+Session replay uses stock rrweb sizing again so recorded pages reassemble correctly instead of showing a blank stage

package/corpus/templates/analytics/changelog/2026-07-08-session-replays-wait-for-full-load-keep-a-normal-viewport-an.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-08
+---
+
+Session replays wait for full load, keep a normal viewport, and scrub the timeline reliably

package/corpus/templates/analytics/changelog/2026-07-08-sidebar-dashboard-menus-now-open-above-the-dashboard-canvas.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-08
+---
+
+Sidebar dashboard menus now open above the dashboard canvas

package/corpus/templates/analytics/changelog/2026-07-08-uptime-alerting-clarifies-in-app-inbox-vs-email-and-lets-you-paste-slack-or-webhook-urls-per-monitor.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-08
+---
+
+Uptime alerting clarifies in-app inbox vs email and lets you paste Slack or webhook URLs per monitor.

package/corpus/templates/analytics/docs/uptime-monitoring.md

@@ -60,10 +60,12 @@ Each check runs on the server (`server/lib/uptime-monitors.ts`):
 
 - On a transition **into failure**, it opens a `monitor_incidents` row (one per
   continuous failure streak) and calls `notifyWithDelivery` with a clear title
-  and body plus metadata
-  `{ kind: "uptime_monitor", monitorId, url, statusCode, latencyMs, failedAssertions }`.
-  The `inbox` channel is always included; `email`/`slack`/`webhook` are added
-  when configured, and email uses the monitor's `emailRecipients`.
+  and body plus safe inbox metadata
+  `{ kind: "uptime_monitor", monitorId, url, statusCode, latencyMs, failedAssertions, emailRecipients }`.
+  The `inbox` channel is the in-app bell; `email` uses the monitor's
+  `emailRecipients`; `slack` / `webhook` use the monitor's optional
+  delivery-only `slackWebhookUrl` / `webhookUrl` (falling back to workspace
+  `NOTIFICATIONS_SLACK_WEBHOOK_URL` / `NOTIFICATIONS_WEBHOOK_URL` when unset).
 - While an incident is open it will not re-alert. After an incident resolves,
   `cooldownMinutes` suppresses a fresh "down" alert for that window to prevent
   flapping.
@@ -119,13 +121,13 @@ have their schema.
 Every operation is an owner-scoped action, so the agent can create and triage
 monitors from chat exactly like the UI:
 
-| action              | method | what it does                                                                                                                                                        |
-| ------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `save-monitor`      | POST   | create or update a monitor (name, url, method, interval, timeout, expected status, assertions, redirects, severity, channels, email recipients, cooldown, enabled). |
-| `list-monitors`     | GET    | list monitors with latest status, latency, and 24h/7d uptime %.                                                                                                     |
-| `get-monitor`       | GET    | one monitor plus its recent check results and incidents.                                                                                                            |
-| `delete-monitor`    | POST   | delete a monitor and its results + incidents.                                                                                                                       |
-| `run-monitor-check` | POST   | run one check now, record it, and open/resolve incidents.                                                                                                           |
+| action              | method | what it does                                                                                                                                                                                     |
+| ------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `save-monitor`      | POST   | create or update a monitor (name, url, method, interval, timeout, expected status, assertions, redirects, severity, channels, email recipients, optional Slack/webhook URLs, cooldown, enabled). |
+| `list-monitors`     | GET    | list monitors with latest status, latency, and 24h/7d uptime %.                                                                                                                                  |
+| `get-monitor`       | GET    | one monitor plus its recent check results and incidents.                                                                                                                                         |
+| `delete-monitor`    | POST   | delete a monitor and its results + incidents.                                                                                                                                                    |
+| `run-monitor-check` | POST   | run one check now, record it, and open/resolve incidents.                                                                                                                                        |
 
 Example prompts:
 

package/corpus/templates/analytics/package.json

@@ -73,7 +73,6 @@
     "@types/react": "catalog:",
     "@types/react-dom": "catalog:",
     "@types/three": "^0.176.0",
-    "@typescript/native-preview": "catalog:",
     "@vitejs/plugin-react-swc": "^4.0.0",
     "chart.js": "^4.5.1",
     "chartjs-node-canvas": "^5.0.0",
@@ -101,7 +100,8 @@
     "tailwindcss": "catalog:",
     "three": "^0.176.0",
     "tsx": "^4.20.3",
-    "typescript": "^6.0.3",
+    "typescript": "catalog:",
+    "typescript-7": "catalog:",
     "vaul": "^1.1.2",
     "vite": "catalog:",
     "vitest": "catalog:"

package/corpus/templates/analytics/server/db/schema-monitoring.ts

@@ -70,6 +70,10 @@ export const monitors = table("monitors", {
   channels: text("channels").notNull().default('["inbox"]'),
   /** Email recipients as JSON array of addresses. */
   emailRecipients: text("email_recipients").notNull().default("[]"),
+  /** Optional per-monitor Slack incoming webhook URL (overrides workspace env). */
+  slackWebhookUrl: text("slack_webhook_url"),
+  /** Optional per-monitor generic webhook URL (overrides workspace env). */
+  webhookUrl: text("webhook_url"),
   /** Minutes to suppress repeat alerts while an incident is ongoing. */
   cooldownMinutes: integer("cooldown_minutes").notNull().default(15),
   enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),

package/corpus/templates/analytics/server/lib/uptime-monitors.ts

@@ -101,6 +101,8 @@ export interface MonitorInput {
   severity?: MonitorSeverity;
   channels?: string[];
   emailRecipients?: string[];
+  slackWebhookUrl?: string | null;
+  webhookUrl?: string | null;
   cooldownMinutes?: number;
   enabled?: boolean;
 }
@@ -120,6 +122,8 @@ export interface Monitor {
   severity: MonitorSeverity;
   channels: string[];
   emailRecipients: string[];
+  slackWebhookUrl: string | null;
+  webhookUrl: string | null;
   cooldownMinutes: number;
   enabled: boolean;
   lastStatus: MonitorStatus | null;
@@ -462,11 +466,50 @@ function normalizeEmailRecipients(recipients: string[] | undefined): string[] {
   return normalized;
 }
 
+function normalizeOptionalHttpUrl(
+  value: string | null | undefined,
+  label: string,
+): string | null {
+  const trimmed = typeof value === "string" ? value.trim() : "";
+  if (!trimmed) return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw badRequest(`${label} must be an absolute http(s) URL`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw badRequest(`${label} must be an absolute http(s) URL`);
+  }
+  return trimmed;
+}
+
 function ensureInboxChannel(channels: string[]): string[] {
   const normalized = channels.map((c) => c.trim()).filter(Boolean);
   return normalized.includes("inbox") ? normalized : ["inbox", ...normalized];
 }
 
+function monitorNotifyMetadata(monitor: Monitor): Record<string, unknown> {
+  return {
+    kind: "uptime_monitor",
+    monitorId: monitor.id,
+    monitorName: monitor.name,
+    url: monitor.url,
+    emailRecipients: monitor.emailRecipients,
+    requestedChannels: monitor.channels,
+  };
+}
+
+function monitorNotifyDeliveryMetadata(
+  monitor: Monitor,
+): Record<string, string> | undefined {
+  const delivery: Record<string, string> = {};
+  if (monitor.slackWebhookUrl)
+    delivery.slackWebhookUrl = monitor.slackWebhookUrl;
+  if (monitor.webhookUrl) delivery.webhookUrl = monitor.webhookUrl;
+  return Object.keys(delivery).length > 0 ? delivery : undefined;
+}
+
 // ---------------------------------------------------------------------------
 // Pure evaluation core (unit-tested)
 // ---------------------------------------------------------------------------
@@ -891,6 +934,8 @@ function rowToMonitor(row: any): Monitor {
     severity: row.severity === "warning" ? "warning" : "critical",
     channels: safeJsonParse<string[]>(row.channels, ["inbox"]),
     emailRecipients: safeJsonParse<string[]>(row.emailRecipients, []),
+    slackWebhookUrl: row.slackWebhookUrl?.trim() || null,
+    webhookUrl: row.webhookUrl?.trim() || null,
     cooldownMinutes: Number(row.cooldownMinutes ?? 15),
     enabled: row.enabled === true || row.enabled === 1,
     lastStatus: (row.lastStatus ?? null) as MonitorStatus | null,
@@ -1121,6 +1166,11 @@ export async function saveMonitor(
   const severity = input.severity === "warning" ? "warning" : "critical";
   const emailRecipients = normalizeEmailRecipients(input.emailRecipients);
   const channels = normalizeChannels(input.channels, emailRecipients);
+  const slackWebhookUrl = normalizeOptionalHttpUrl(
+    input.slackWebhookUrl,
+    "Slack webhook URL",
+  );
+  const webhookUrl = normalizeOptionalHttpUrl(input.webhookUrl, "Webhook URL");
   const cooldownMinutes = clampInt(input.cooldownMinutes ?? 15, 0, 24 * 60, 15);
   const enabled = input.enabled ?? true;
 
@@ -1138,6 +1188,8 @@ export async function saveMonitor(
     severity,
     channels: JSON.stringify(channels),
     emailRecipients: JSON.stringify(emailRecipients),
+    slackWebhookUrl,
+    webhookUrl,
     cooldownMinutes,
     enabled,
   };
@@ -1440,16 +1492,14 @@ async function notifyMonitorDown(monitor: Monitor, outcome: CheckOutcome) {
       body: `${host} is ${label}${detail}.${latency}`,
       channels: ensureInboxChannel(monitor.channels),
       metadata: {
-        kind: "uptime_monitor",
-        monitorId: monitor.id,
-        monitorName: monitor.name,
-        url: monitor.url,
+        ...monitorNotifyMetadata(monitor),
+        ...(monitorNotifyDeliveryMetadata(monitor)
+          ? { delivery: monitorNotifyDeliveryMetadata(monitor) }
+          : {}),
         status: outcome.status,
         statusCode: outcome.statusCode,
         latencyMs: outcome.latencyMs,
         failedAssertions: outcome.failedAssertions,
-        emailRecipients: monitor.emailRecipients,
-        requestedChannels: monitor.channels,
       },
     },
     { owner: monitor.ownerEmail },
@@ -1475,16 +1525,14 @@ async function notifyMonitorRecovered(
       body: `${host} is back up${downFor ? ` after ${downFor} of downtime` : ""}.${latency}`,
       channels: ensureInboxChannel(monitor.channels),
       metadata: {
-        kind: "uptime_monitor",
-        monitorId: monitor.id,
-        monitorName: monitor.name,
-        url: monitor.url,
+        ...monitorNotifyMetadata(monitor),
+        ...(monitorNotifyDeliveryMetadata(monitor)
+          ? { delivery: monitorNotifyDeliveryMetadata(monitor) }
+          : {}),
         status: "up",
         statusCode: outcome.statusCode,
         latencyMs: outcome.latencyMs,
         incidentId: incident.id,
-        emailRecipients: monitor.emailRecipients,
-        requestedChannels: monitor.channels,
       },
     },
     { owner: monitor.ownerEmail },

package/corpus/templates/analytics/server/plugins/db.ts

@@ -1114,6 +1114,16 @@ const runAnalyticsMigrations = runMigrations(
       name: "status-pages-scope-updated-idx",
       sql: `CREATE INDEX IF NOT EXISTS status_pages_scope_updated_idx ON status_pages (owner_email, org_id, updated_at)`,
     },
+    {
+      version: 106,
+      name: "uptime-monitors-slack-webhook-url",
+      sql: `ALTER TABLE monitors ADD COLUMN IF NOT EXISTS slack_webhook_url TEXT`,
+    },
+    {
+      version: 107,
+      name: "uptime-monitors-webhook-url",
+      sql: `ALTER TABLE monitors ADD COLUMN IF NOT EXISTS webhook_url TEXT`,
+    },
   ],
   { table: "analytics_migrations" },
 );

package/corpus/templates/assets/.agents/skills/self-modifying-code/SKILL.md

@@ -28,7 +28,19 @@ Not all modifications are equal. Use this to decide what level of care is needed
 | 1: Data       | Files in `data/`      | JSON state, generated content, markdown          | Nothing — these are routine       |
 | 2: Source     | App code              | Components, routes, styles, scripts              | Run `pnpm typecheck && pnpm lint` |
 | 3: Config     | Project config        | `package.json`, `tsconfig.json`, `vite.config.*` | Ask for explicit approval first   |
-| 4: Off limits | Secrets and framework | `.env`, `@agent-native/core` internals           | Never modify these                |
+| 4: Off limits | Secrets and framework | `.env`, `@agent-native/*` packages & overrides   | Never modify these                |
+
+Tier 4 includes **all** of the following — not only editing package source:
+
+- Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
+- `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
+  target any `@agent-native/*` package
+- Local patches, vendored copies, or invented "dispatch/core behavior"
+  shims meant to paper over a version skew or failed upgrade
+
+When an older branch needs current packages, use **`agent-native upgrade`**
+(see the `upgrade-agent-native` skill). If upgrade or typecheck fails, fix
+**app** code or stop and ask — do not patch the framework.
 
 ## Git Checkpoint Pattern
 
@@ -74,13 +86,19 @@ inline strings in components.
 ## Don't
 
 - Don't modify `.env` files or files containing secrets
-- Don't modify `@agent-native/core` package internals
+- Don't modify `@agent-native/core`, `@agent-native/dispatch`, or other
+  `@agent-native/*` package internals (including under `node_modules`)
+- Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
+  `@agent-native/*` to "make the app run" after a version bump
+- Don't invent local dispatch/core behavior overrides when upgrade fails —
+  run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested
 - Don't skip the typecheck/lint step after editing source code
 - Don't make source changes without a git checkpoint to roll back to
 
 ## Related Skills
 
+- **upgrade-agent-native** — supported path to bring an older app/workspace current
 - **storing-data** — Tier 1 modifications (data files) are the safest and most common
 - **actions** — The agent can create or modify actions to add new capabilities
 - **delegate-to-agent** — Self-modification requests come through the agent chat

package/corpus/templates/assets/.agents/skills/upgrade-agent-native/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: upgrade-agent-native
+description: >-
+  Bring an older Agent Native app or workspace current. Use when updating
+  @agent-native/core, fixing a broken upgrade, or when tempted to patch or
+  override core/dispatch packages to make an old branch run.
+scope: dev
+metadata:
+  internal: true
+---
+
+# Upgrade Agent Native
+
+## Rule
+
+When an older Agent Native app/branch needs to run on current packages, use
+`agent-native upgrade`. Never "fix" upgrade breakage with
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
+edits under `node_modules/@agent-native/*` — especially not against
+`@agent-native/core` or `@agent-native/dispatch`.
+
+## Why
+
+Agents often respond to a failed core bump by inventing framework patches and
+dispatch behavior overrides. That hides the real app-level break, drifts from
+upstream, and makes the next upgrade worse. The supported path is bump →
+install → refresh scaffold skills → verify, then fix **app** code only.
+
+## How
+
+1. **Doctor first (optional but recommended)**
+
+   ```bash
+   npx @agent-native/core@latest upgrade check
+   ```
+
+   This reports framework overrides/patches and pending `@agent-native/*`
+   bumps. If overrides/patches are present, remove them before continuing.
+
+2. **Run the upgrade**
+
+   ```bash
+   npx @agent-native/core@latest upgrade
+   ```
+
+   Or from an already-installed CLI: `pnpm exec agent-native upgrade` /
+   `agent-native upgrade`.
+
+   What it does:
+
+   - Blocks (unless `--force`) when `@agent-native/*` overrides/patches exist
+   - Rewrites non-local `@agent-native/*` dependency pins to `latest`
+   - Runs the package manager install
+   - Runs `skills update scaffold --project`
+   - Runs `typecheck` when the project has that script
+
+3. **If upgrade or typecheck fails**
+
+   - Read the concrete error
+   - Fix **app** source, actions, config, or env — not framework packages
+   - Re-run `agent-native upgrade` or `pnpm typecheck`
+   - Stop and ask the user if you cannot fix the app-level error
+
+4. **Dry-run / partial runs**
+
+   ```bash
+   agent-native upgrade --dry-run
+   agent-native upgrade --skip-verify
+   agent-native upgrade --skip-install   # package.json bumps only
+   ```
+
+## Don't
+
+- Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
+  `patchedDependencies` for any `@agent-native/*` package
+- Don't edit `node_modules/@agent-native/core` or
+  `node_modules/@agent-native/dispatch`
+- Don't invent local "dispatch behavior" shims to paper over version skew
+- Don't keep iterating with more framework patches after a failed install
+- Don't skip `skills update scaffold --project` after a core bump (the
+  upgrade command does this for you)
+
+## Related Skills
+
+- **self-modifying-code** — Tier 4: framework packages are off limits
+- **agent-native-docs** — version-matched docs after the bump
+- **portability** — keep app code provider-agnostic across upgrades

package/corpus/templates/assets/package.json

@@ -55,7 +55,6 @@
     "@types/node": "^24.2.1",
     "@types/react": "catalog:",
     "@types/react-dom": "catalog:",
-    "@typescript/native-preview": "catalog:",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "next-themes": "^0.4.6",
@@ -67,7 +66,8 @@
     "tailwind-merge": "^3.5.0",
     "tailwindcss": "catalog:",
     "tsx": "^4.20.3",
-    "typescript": "^6.0.3",
+    "typescript": "catalog:",
+    "typescript-7": "catalog:",
     "vite": "catalog:",
     "vitest": "catalog:"
   }

package/corpus/templates/brain/.agents/skills/self-modifying-code/SKILL.md

@@ -28,7 +28,19 @@ Not all modifications are equal. Use this to decide what level of care is needed
 | 1: Data       | Files in `data/`      | JSON state, generated content, markdown          | Nothing — these are routine       |
 | 2: Source     | App code              | Components, routes, styles, scripts              | Run `pnpm typecheck && pnpm lint` |
 | 3: Config     | Project config        | `package.json`, `tsconfig.json`, `vite.config.*` | Ask for explicit approval first   |
-| 4: Off limits | Secrets and framework | `.env`, `@agent-native/core` internals           | Never modify these                |
+| 4: Off limits | Secrets and framework | `.env`, `@agent-native/*` packages & overrides   | Never modify these                |
+
+Tier 4 includes **all** of the following — not only editing package source:
+
+- Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
+- `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
+  target any `@agent-native/*` package
+- Local patches, vendored copies, or invented "dispatch/core behavior"
+  shims meant to paper over a version skew or failed upgrade
+
+When an older branch needs current packages, use **`agent-native upgrade`**
+(see the `upgrade-agent-native` skill). If upgrade or typecheck fails, fix
+**app** code or stop and ask — do not patch the framework.
 
 ## Git Checkpoint Pattern
 
@@ -74,13 +86,19 @@ inline strings in components.
 ## Don't
 
 - Don't modify `.env` files or files containing secrets
-- Don't modify `@agent-native/core` package internals
+- Don't modify `@agent-native/core`, `@agent-native/dispatch`, or other
+  `@agent-native/*` package internals (including under `node_modules`)
+- Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
+  `@agent-native/*` to "make the app run" after a version bump
+- Don't invent local dispatch/core behavior overrides when upgrade fails —
+  run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested
 - Don't skip the typecheck/lint step after editing source code
 - Don't make source changes without a git checkpoint to roll back to
 
 ## Related Skills
 
+- **upgrade-agent-native** — supported path to bring an older app/workspace current
 - **storing-data** — Tier 1 modifications (data files) are the safest and most common
 - **actions** — The agent can create or modify actions to add new capabilities
 - **delegate-to-agent** — Self-modification requests come through the agent chat

package/corpus/templates/brain/.agents/skills/upgrade-agent-native/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: upgrade-agent-native
+description: >-
+  Bring an older Agent Native app or workspace current. Use when updating
+  @agent-native/core, fixing a broken upgrade, or when tempted to patch or
+  override core/dispatch packages to make an old branch run.
+scope: dev
+metadata:
+  internal: true
+---
+
+# Upgrade Agent Native
+
+## Rule
+
+When an older Agent Native app/branch needs to run on current packages, use
+`agent-native upgrade`. Never "fix" upgrade breakage with
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
+edits under `node_modules/@agent-native/*` — especially not against
+`@agent-native/core` or `@agent-native/dispatch`.
+
+## Why
+
+Agents often respond to a failed core bump by inventing framework patches and
+dispatch behavior overrides. That hides the real app-level break, drifts from
+upstream, and makes the next upgrade worse. The supported path is bump →
+install → refresh scaffold skills → verify, then fix **app** code only.
+
+## How
+
+1. **Doctor first (optional but recommended)**
+
+   ```bash
+   npx @agent-native/core@latest upgrade check
+   ```
+
+   This reports framework overrides/patches and pending `@agent-native/*`
+   bumps. If overrides/patches are present, remove them before continuing.
+
+2. **Run the upgrade**
+
+   ```bash
+   npx @agent-native/core@latest upgrade
+   ```
+
+   Or from an already-installed CLI: `pnpm exec agent-native upgrade` /
+   `agent-native upgrade`.
+
+   What it does:
+
+   - Blocks (unless `--force`) when `@agent-native/*` overrides/patches exist
+   - Rewrites non-local `@agent-native/*` dependency pins to `latest`
+   - Runs the package manager install
+   - Runs `skills update scaffold --project`
+   - Runs `typecheck` when the project has that script
+
+3. **If upgrade or typecheck fails**
+
+   - Read the concrete error
+   - Fix **app** source, actions, config, or env — not framework packages
+   - Re-run `agent-native upgrade` or `pnpm typecheck`
+   - Stop and ask the user if you cannot fix the app-level error
+
+4. **Dry-run / partial runs**
+
+   ```bash
+   agent-native upgrade --dry-run
+   agent-native upgrade --skip-verify
+   agent-native upgrade --skip-install   # package.json bumps only
+   ```
+
+## Don't
+
+- Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
+  `patchedDependencies` for any `@agent-native/*` package
+- Don't edit `node_modules/@agent-native/core` or
+  `node_modules/@agent-native/dispatch`
+- Don't invent local "dispatch behavior" shims to paper over version skew
+- Don't keep iterating with more framework patches after a failed install
+- Don't skip `skills update scaffold --project` after a core bump (the
+  upgrade command does this for you)
+
+## Related Skills
+
+- **self-modifying-code** — Tier 4: framework packages are off limits
+- **agent-native-docs** — version-matched docs after the bump
+- **portability** — keep app code provider-agnostic across upgrades

package/corpus/templates/brain/package.json

@@ -48,7 +48,6 @@
     "@types/node": "^25.8.0",
     "@types/react": "catalog:",
     "@types/react-dom": "catalog:",
-    "@typescript/native-preview": "catalog:",
     "@vitejs/plugin-react-swc": "^4.3.1",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
@@ -58,7 +57,8 @@
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.6.0",
     "tailwindcss": "catalog:",
-    "typescript": "^6.0.3",
+    "typescript": "catalog:",
+    "typescript-7": "catalog:",
     "vite": "catalog:",
     "vitest": "catalog:"
   }

package/corpus/templates/calendar/.agents/skills/self-modifying-code/SKILL.md

@@ -28,7 +28,19 @@ Not all modifications are equal. Use this to decide what level of care is needed
 | 1: Data       | Files in `data/`      | JSON state, generated content, markdown          | Nothing — these are routine       |
 | 2: Source     | App code              | Components, routes, styles, scripts              | Run `pnpm typecheck && pnpm lint` |
 | 3: Config     | Project config        | `package.json`, `tsconfig.json`, `vite.config.*` | Ask for explicit approval first   |
-| 4: Off limits | Secrets and framework | `.env`, `@agent-native/core` internals           | Never modify these                |
+| 4: Off limits | Secrets and framework | `.env`, `@agent-native/*` packages & overrides   | Never modify these                |
+
+Tier 4 includes **all** of the following — not only editing package source:
+
+- Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
+- `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
+  target any `@agent-native/*` package
+- Local patches, vendored copies, or invented "dispatch/core behavior"
+  shims meant to paper over a version skew or failed upgrade
+
+When an older branch needs current packages, use **`agent-native upgrade`**
+(see the `upgrade-agent-native` skill). If upgrade or typecheck fails, fix
+**app** code or stop and ask — do not patch the framework.
 
 ## Git Checkpoint Pattern
 
@@ -74,13 +86,19 @@ inline strings in components.
 ## Don't
 
 - Don't modify `.env` files or files containing secrets
-- Don't modify `@agent-native/core` package internals
+- Don't modify `@agent-native/core`, `@agent-native/dispatch`, or other
+  `@agent-native/*` package internals (including under `node_modules`)
+- Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
+  `@agent-native/*` to "make the app run" after a version bump
+- Don't invent local dispatch/core behavior overrides when upgrade fails —
+  run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested
 - Don't skip the typecheck/lint step after editing source code
 - Don't make source changes without a git checkpoint to roll back to
 
 ## Related Skills
 
+- **upgrade-agent-native** — supported path to bring an older app/workspace current
 - **storing-data** — Tier 1 modifications (data files) are the safest and most common
 - **actions** — The agent can create or modify actions to add new capabilities
 - **delegate-to-agent** — Self-modification requests come through the agent chat