@agent-native/core 0.91.2 → 0.92.1

package/corpus/templates/clips/desktop/src-tauri/src/tray.rs

@@ -8,7 +8,7 @@ use crate::clips::{force_show_popover, toggle_popover};
 use crate::dlog;
 use crate::state::{TrayAnchor, TrayMeetings};
 use crate::tray_meetings::{build_meetings_section, handle_meeting_menu_click, MeetingItem};
-use crate::util::is_recording_active;
+use crate::util::{is_meeting_active, is_recording_active};
 use crate::TRAY_PNG;
 
 /// Build the full tray menu with the given upcoming-meetings list. Used both
@@ -22,15 +22,18 @@ fn build_menu_with_meetings(
     let meetings_submenu = build_meetings_section(app, meetings)?;
     let show_item = MenuItem::with_id(app, "show", "Show popover", true, None::<&str>)?;
     let recording_active = is_recording_active(app);
+    let meeting_active = is_meeting_active(app);
     let stop_item = MenuItem::with_id(
         app,
         "stop",
-        if recording_active {
+        if meeting_active {
+            "Stop meeting notes"
+        } else if recording_active {
             "Stop recording"
         } else {
             "No active recording"
         },
-        recording_active,
+        recording_active || meeting_active,
         None::<&str>,
     )?;
     let has_last_dictation = app
@@ -132,7 +135,11 @@ pub fn build_tray(app: &tauri::App) -> Result<(), Box<dyn std::error::Error>> {
             match id_ref {
                 "show" => force_show_popover(app),
                 "stop" => {
-                    let _ = app.emit("clips:recorder-stop", ());
+                    if is_meeting_active(app) {
+                        let _ = app.emit("clips:pill-stop", serde_json::json!({}));
+                    } else {
+                        let _ = app.emit("clips:recorder-stop", ());
+                    }
                 }
                 "paste-last-dictation" => {
                     let app = app.clone();
@@ -213,8 +220,13 @@ pub fn build_tray(app: &tauri::App) -> Result<(), Box<dyn std::error::Error>> {
             {
                 let app = tray.app_handle();
                 let active = is_recording_active(app);
-                dlog!("[clips-tray] tray click — is_recording_active={}", active);
-                if active {
+                let meeting_active = is_meeting_active(app);
+                dlog!(
+                    "[clips-tray] tray click — is_recording_active={} is_meeting_active={}",
+                    active,
+                    meeting_active
+                );
+                if active && !meeting_active {
                     let _ = app.emit("clips:recorder-stop", ());
                 } else {
                     toggle_popover(app);

package/corpus/templates/clips/server/lib/recording-upload-state.ts

@@ -1,5 +1,10 @@
 import { getDbExec, isPostgres } from "@agent-native/core/db";
 
+const STALE_CHUNK_PRUNE_LIMIT = 100;
+const STALE_CHUNK_PRUNE_MIN_INTERVAL_MS = 5 * 60 * 1000;
+const DEFAULT_STALE_CHUNK_TTL_MS = 6 * 60 * 60 * 1000;
+const lastPruneByOwner = new Map<string, number>();
+
 function escapeLike(value: string): string {
   return value.replace(/[!%_]/g, (match) => `!${match}`);
 }
@@ -8,6 +13,10 @@ function chunkPrefix(recordingId: string): string {
   return `recording-chunks-${recordingId}-`;
 }
 
+function allChunksPrefix(): string {
+  return "recording-chunks-";
+}
+
 function likePrefix(prefix: string): string {
   return `${escapeLike(prefix)}%`;
 }
@@ -89,6 +98,17 @@ export async function listRecordingChunkKeys(
   return rows.map((row) => String(row.key));
 }
 
+export async function deleteRecordingChunks(
+  ownerEmail: string,
+  recordingId: string,
+): Promise<number> {
+  const result = await getDbExec().execute({
+    sql: `DELETE FROM application_state WHERE session_id = ? AND key LIKE ? ESCAPE '!'`,
+    args: [ownerEmail, likePrefix(chunkPrefix(recordingId))],
+  });
+  return result.rowsAffected ?? 0;
+}
+
 export async function sumRecordingChunkBytes(
   ownerEmail: string,
   recordingId: string,
@@ -102,3 +122,46 @@ export async function sumRecordingChunkBytes(
   });
   return numberFromRowValue(rows[0]?.bytes);
 }
+
+export async function pruneStaleRecordingChunks(
+  ownerEmail: string,
+  options: {
+    now?: number;
+    ttlMs?: number;
+    minIntervalMs?: number;
+  } = {},
+): Promise<number> {
+  const now = options.now ?? Date.now();
+  const minIntervalMs =
+    options.minIntervalMs ?? STALE_CHUNK_PRUNE_MIN_INTERVAL_MS;
+  const lastPrune = lastPruneByOwner.get(ownerEmail) ?? 0;
+  if (minIntervalMs > 0 && now - lastPrune < minIntervalMs) return 0;
+  lastPruneByOwner.set(ownerEmail, now);
+
+  const ttlMs = options.ttlMs ?? DEFAULT_STALE_CHUNK_TTL_MS;
+  const cutoff = new Date(now - ttlMs).toISOString();
+  const createdAtExpression = isPostgres()
+    ? `value::jsonb ->> 'createdAt'`
+    : `json_extract(value, '$.createdAt')`;
+  const { rows } = await getDbExec().execute({
+    sql: `SELECT key FROM application_state WHERE session_id = ? AND key LIKE ? ESCAPE '!' AND ${createdAtExpression} IS NOT NULL AND ${createdAtExpression} < ? LIMIT ?`,
+    args: [
+      ownerEmail,
+      likePrefix(allChunksPrefix()),
+      cutoff,
+      STALE_CHUNK_PRUNE_LIMIT,
+    ],
+  });
+
+  let purged = 0;
+  for (const row of rows) {
+    const key = String(row.key ?? "");
+    if (!key) continue;
+    const result = await getDbExec().execute({
+      sql: `DELETE FROM application_state WHERE session_id = ? AND key = ?`,
+      args: [ownerEmail, key],
+    });
+    purged += result.rowsAffected ?? 0;
+  }
+  return purged;
+}

package/corpus/templates/clips/server/lib/video-storage.ts

@@ -25,6 +25,10 @@ export function requiresConfiguredVideoStorage(): boolean {
   return process.env.NODE_ENV === "production" || !isLikelyLocalDatabase();
 }
 
+export function allowsSqlRecordingChunkScratch(): boolean {
+  return !requiresConfiguredVideoStorage();
+}
+
 interface VideoStorageResolveContext {
   userEmail?: string;
   orgId?: string | null;

package/corpus/templates/clips/server/routes/api/recordings/[recordingId]/thumbnail.post.ts

@@ -28,6 +28,10 @@ import {
   getEventOwnerContext,
   ownerEmailMatches,
 } from "../../../../lib/recordings.js";
+import {
+  requiresConfiguredVideoStorage,
+  STORAGE_SETUP_REQUIRED_REASON,
+} from "../../../../lib/video-storage.js";
 
 const MAX_THUMBNAIL_BYTES = 2 * 1024 * 1024;
 
@@ -154,12 +158,9 @@ export default defineEventHandler(async (event: H3Event) => {
       return { error: "Thumbnail bytes do not match Content-Type" };
     }
 
-    // Try the configured file-upload provider first (Builder.io or a
-    // user-registered one). In dev / solo mode no provider is usually
-    // configured and `uploadFile()` returns `null` — in that case we fall
-    // back to a base64 `data:` URL inline in the `recordings.thumbnail_url`
-    // column. It's not glamorous but it unblocks the library grid
-    // immediately and mirrors what `set-thumbnail` does.
+    // Try the configured file-upload provider first. Hosted/persistent SQL
+    // must not store base64 data URLs in recordings.thumbnail_url; local dev can
+    // still fall back inline to keep the first-frame preview flow lightweight.
     const uploaded = await uploadFile({
       data: bytes,
       mimeType,
@@ -177,15 +178,20 @@ export default defineEventHandler(async (event: H3Event) => {
         bytes: bytes.byteLength,
       });
     } else {
+      if (requiresConfiguredVideoStorage()) {
+        setResponseStatus(event, 409);
+        return {
+          ok: false,
+          error: STORAGE_SETUP_REQUIRED_REASON,
+          storageSetupRequired: true,
+        };
+      }
       const base64 = Buffer.from(bytes).toString("base64");
       url = `data:${mimeType};base64,${base64}`;
-      console.log(
-        "[thumbnail] no provider configured, stored inline data URL",
-        {
-          recordingId,
-          bytes: bytes.byteLength,
-        },
-      );
+      console.log("[thumbnail] local storage fallback stored inline data URL", {
+        recordingId,
+        bytes: bytes.byteLength,
+      });
     }
 
     await db

package/corpus/templates/clips/server/routes/api/uploads/[recordingId]/chunk.post.ts

@@ -37,7 +37,11 @@ import {
 import finalizeRecording from "../../../../../actions/finalize-recording.js";
 import { getDb, schema } from "../../../../db/index.js";
 import { debugLog } from "../../../../lib/debug.js";
-import { sumRecordingChunkBytes } from "../../../../lib/recording-upload-state.js";
+import {
+  deleteRecordingChunks,
+  pruneStaleRecordingChunks,
+  sumRecordingChunkBytes,
+} from "../../../../lib/recording-upload-state.js";
 import {
   getEventOwnerContext,
   ownerEmailMatches,
@@ -49,6 +53,7 @@ import {
 } from "../../../../lib/resumable-session.js";
 import { isStreamingUploadDisabled } from "../../../../lib/streaming-upload-mode.js";
 import {
+  allowsSqlRecordingChunkScratch,
   shouldRejectVideoUploadWithoutStorage,
   STORAGE_SETUP_REQUIRED_REASON,
 } from "../../../../lib/video-storage.js";
@@ -175,6 +180,13 @@ export default defineEventHandler(async (event: H3Event) => {
   debugLog("[chunk] resolved owner:", ownerEmail);
 
   return runWithRequestContext({ userEmail: ownerEmail, orgId }, async () => {
+    await pruneStaleRecordingChunks(ownerEmail).catch((err) => {
+      console.warn("[chunk] stale recording chunk prune failed:", {
+        ownerEmail,
+        err: err instanceof Error ? err.message : String(err),
+      });
+    });
+
     const db = getDb();
 
     // Verify the recording belongs to the current user.
@@ -271,6 +283,15 @@ export default defineEventHandler(async (event: H3Event) => {
         storageSetupRequired: true,
       };
     }
+    if (!allowsSqlRecordingChunkScratch()) {
+      setResponseStatus(event, 409);
+      return {
+        ok: false,
+        error:
+          "Recording upload storage is configured, but this upload did not start a resumable storage session. Refresh and start the recording again.",
+        storageSetupRequired: false,
+      };
+    }
 
     const raw = await readRawBody(event, false);
     const bodySize = raw ? raw.byteLength : 0;
@@ -320,6 +341,12 @@ export default defineEventHandler(async (event: H3Event) => {
           ? latestState.failureReason
           : "Recording upload has already failed.";
       if (latestState?.status === "failed") {
+        await deleteRecordingChunks(ownerEmail, recordingId).catch((err) => {
+          console.warn("[chunk] failed upload chunk cleanup failed:", {
+            recordingId,
+            err: err instanceof Error ? err.message : String(err),
+          });
+        });
         return failedUploadResponse(latestReason);
       }
 
@@ -333,6 +360,12 @@ export default defineEventHandler(async (event: H3Event) => {
       if (current?.status === "failed") {
         const reason =
           current.failureReason ?? "Recording upload has already failed.";
+        await deleteRecordingChunks(ownerEmail, recordingId).catch((err) => {
+          console.warn("[chunk] failed recording chunk cleanup failed:", {
+            recordingId,
+            err: err instanceof Error ? err.message : String(err),
+          });
+        });
         await writeAppState(`recording-upload-${recordingId}`, {
           recordingId,
           status: "failed",
@@ -364,6 +397,12 @@ export default defineEventHandler(async (event: H3Event) => {
         maxBytes: MAX_RECORDING_UPLOAD_BYTES,
         updatedAt: now,
       });
+      await deleteRecordingChunks(ownerEmail, recordingId).catch((err) => {
+        console.warn("[chunk] oversized upload chunk cleanup failed:", {
+          recordingId,
+          err: err instanceof Error ? err.message : String(err),
+        });
+      });
       setResponseStatus(event, 413);
       return {
         ok: false,

package/corpus/templates/content/.agents/skills/actions/SKILL.md

@@ -377,6 +377,11 @@ Most operations should be actions. You only need custom routes in `server/routes
 - **Webhooks** — external services POST to a specific URL
 - **OAuth callbacks** — redirect-based flows that need specific URL patterns
 
+When the agent needs a durable image or file URL, call the core `upload-image`
+action or use `uploadFile()` in server code. Do not write base64 into SQL,
+markdown, deck/design JSON, or action results. `_agentImages` on action results
+is for ephemeral vision previews only, not persistence.
+
 If it's a standard CRUD operation, data query, or a wrapper around an action, use the action instead.
 
 ## Legacy Pattern (bare export)

package/corpus/templates/content/.agents/skills/real-time-sync/SKILL.md

@@ -50,7 +50,7 @@ The agent modifies data in SQL, but the UI runs in the browser. SSE bridges same
 
    For list/sidebar queries, use the same pattern — pass the counter into the queryKey of every list query you want to keep fresh.
 
-4. **Fallback** polling calls `/_agent-native/poll?since=N`. It runs every 2 seconds until SSE is connected, then relaxes to 15 seconds (`SSE_FALLBACK_INTERVAL_MS`). If SSE is disabled or unavailable (e.g., edge/serverless deployments), polling continues at the 2 s cadence. Polling is the universal serverless fallback — it detects DB timestamp changes even when the write happened in a different process or invocation.
+4. **Fallback** polling calls `/_agent-native/poll?since=N`. It runs every 2 seconds until SSE is connected, then relaxes to 15 seconds (`SSE_FALLBACK_INTERVAL_MS`). If SSE is disabled or unavailable (e.g., edge/serverless deployments), polling continues at the 2 s cadence. Polling is the universal serverless fallback: new framework writes are read from the durable `sync_events` log, while the older DB timestamp scan remains as a slower safety net for direct SQL writes and older processes.
 
 5. When the agent writes to the database, the version increments, SSE/polling detects it, and React Query refetches the affected queries.
 

package/corpus/templates/content/.agents/skills/security/SKILL.md

@@ -51,6 +51,13 @@ export default defineAction({
 
 The legacy `parameters:` field (plain JSON Schema) has no runtime validation — do not use it for new code.
 
+## Large Payloads
+
+Do not accept or persist unbounded base64/file blobs through actions, SQL writes,
+or `application_state`. Route uploads through the file-upload provider and store
+references. This prevents database bloat, slow hot paths, and accidental secret
+or customer-data embedding inside binary payloads.
+
 ## SQL Injection
 
 Never concatenate user input into SQL strings. Use Drizzle ORM's query builder (always safe) or parameterized queries:

package/corpus/templates/content/.agents/skills/self-modifying-code/SKILL.md

@@ -28,7 +28,19 @@ Not all modifications are equal. Use this to decide what level of care is needed
 | 1: Data       | Files in `data/`      | JSON state, generated content, markdown          | Nothing — these are routine       |
 | 2: Source     | App code              | Components, routes, styles, scripts              | Run `pnpm typecheck && pnpm lint` |
 | 3: Config     | Project config        | `package.json`, `tsconfig.json`, `vite.config.*` | Ask for explicit approval first   |
-| 4: Off limits | Secrets and framework | `.env`, `@agent-native/core` internals           | Never modify these                |
+| 4: Off limits | Secrets and framework | `.env`, `@agent-native/*` packages & overrides   | Never modify these                |
+
+Tier 4 includes **all** of the following — not only editing package source:
+
+- Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
+- `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
+  target any `@agent-native/*` package
+- Local patches, vendored copies, or invented "dispatch/core behavior"
+  shims meant to paper over a version skew or failed upgrade
+
+When an older branch needs current packages, use **`agent-native upgrade`**
+(see the `upgrade-agent-native` skill). If upgrade or typecheck fails, fix
+**app** code or stop and ask — do not patch the framework.
 
 ## Git Checkpoint Pattern
 
@@ -74,13 +86,19 @@ inline strings in components.
 ## Don't
 
 - Don't modify `.env` files or files containing secrets
-- Don't modify `@agent-native/core` package internals
+- Don't modify `@agent-native/core`, `@agent-native/dispatch`, or other
+  `@agent-native/*` package internals (including under `node_modules`)
+- Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
+  `@agent-native/*` to "make the app run" after a version bump
+- Don't invent local dispatch/core behavior overrides when upgrade fails —
+  run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested
 - Don't skip the typecheck/lint step after editing source code
 - Don't make source changes without a git checkpoint to roll back to
 
 ## Related Skills
 
+- **upgrade-agent-native** — supported path to bring an older app/workspace current
 - **storing-data** — Tier 1 modifications (data files) are the safest and most common
 - **actions** — The agent can create or modify actions to add new capabilities
 - **delegate-to-agent** — Self-modification requests come through the agent chat

package/corpus/templates/content/.agents/skills/storing-data/SKILL.md

@@ -13,7 +13,9 @@ metadata:
 
 ## Rule
 
-All application data lives in **SQL** (SQLite locally, persistent database in production). The agent and UI share the same database. Do not store durable app data in the filesystem unless the app is explicitly running a Local File Mode artifact flow described below.
+All application data lives in **SQL** (SQLite locally, persistent database in production). The agent and UI share the same database. SQL stores structured records, metadata, references, and searchable text — not large raw file payloads. Do not store durable app data in the filesystem unless the app is explicitly running a Local File Mode artifact flow described below.
+
+Large binary or file-like payloads (images, video/audio, PDFs, ZIPs, screenshots, session replay chunks, thumbnails, generated assets, `data:` URLs, and base64 file bodies) must go through configured file/blob storage such as `uploadFile()` or `putPrivateBlob()`. Persist only the returned URL, asset id, or opaque blob handle in SQL. If storage is unavailable in hosted or persistent-database mode, fail closed with setup guidance instead of falling back to base64 in `application_state`, `settings`, `resources`, or app tables. Local SQLite-only dev fallbacks may exist for tiny assets, but they must be capped, documented as dev-only, and kept off hot list/read paths.
 
 **Local File Mode exception:** some artifact apps (Content, Plans, Slides, Dashboards, Designs, etc.) can intentionally use repo files as the source of truth for the artifact itself. This must be explicit via `agent-native.json`, `AGENT_NATIVE_MODE=local-files`, or an app-owned local-file action helper. In that mode, the UI and agent still go through app actions, but those actions read/write scoped files through `@agent-native/core/local-artifacts` instead of SQL rows. App state, auth, settings, credentials, collaboration metadata, and hosted database mode remain SQL. File-to-database or file-to-provider synchronization is an explicit sync step, not an implicit side effect of editing.
 
@@ -136,6 +138,7 @@ Polling streams database changes to the UI. When the agent writes to the databas
 - Use the `settings` store for app configuration and user preferences
 - Use `application-state` for ephemeral UI state that the agent and UI share
 - Use `oauth-tokens` for OAuth credentials
+- Use `uploadFile()` or `putPrivateBlob()` for large files/blob data and store only URLs, ids, or handles in SQL
 - Use core DB scripts (`db-schema`, `db-query`, `db-exec`, `db-patch`) for ad-hoc database operations
 - Use `db-exec --statements` instead of several separate `db-exec` calls for related writes; it is faster and rolls back the whole batch if one statement fails
 - Reach for `db-patch` instead of `db-exec UPDATE` whenever you're making a small change to a large text/JSON column — it's much cheaper on tokens
@@ -146,6 +149,7 @@ Polling streams database changes to the UI. When the agent writes to the databas
 - Don't store app state in localStorage, sessionStorage, or cookies (except for UI-only preferences like sidebar width)
 - Don't keep state only in memory (server variables, global stores)
 - Don't use Redis or any external state store for app data
+- Don't store large files, base64 blobs, `data:` URLs, screenshots, videos, audio, PDFs, ZIPs, or session replay chunks directly in SQL rows, `application_state`, `settings`, or `resources`
 - Don't implement product features with raw SQL or `getDbExec()` when Drizzle can express the query
 - Don't write SQLite-only or Postgres-only SQL in app code
 - Don't interpolate user input directly into SQL queries — use Drizzle ORM's query builder

package/corpus/templates/content/.agents/skills/upgrade-agent-native/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: upgrade-agent-native
+description: >-
+  Bring an older Agent Native app or workspace current. Use when updating
+  @agent-native/core, fixing a broken upgrade, or when tempted to patch or
+  override core/dispatch packages to make an old branch run.
+scope: dev
+metadata:
+  internal: true
+---
+
+# Upgrade Agent Native
+
+## Rule
+
+When an older Agent Native app/branch needs to run on current packages, use
+`agent-native upgrade`. Never "fix" upgrade breakage with
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
+edits under `node_modules/@agent-native/*` — especially not against
+`@agent-native/core` or `@agent-native/dispatch`.
+
+## Why
+
+Agents often respond to a failed core bump by inventing framework patches and
+dispatch behavior overrides. That hides the real app-level break, drifts from
+upstream, and makes the next upgrade worse. The supported path is bump →
+install → refresh scaffold skills → verify, then fix **app** code only.
+
+## How
+
+1. **Doctor first (optional but recommended)**
+
+   ```bash
+   npx @agent-native/core@latest upgrade check
+   ```
+
+   This reports framework overrides/patches and pending `@agent-native/*`
+   bumps. If overrides/patches are present, remove them before continuing.
+
+2. **Run the upgrade**
+
+   ```bash
+   npx @agent-native/core@latest upgrade
+   ```
+
+   Or from an already-installed CLI: `pnpm exec agent-native upgrade` /
+   `agent-native upgrade`.
+
+   What it does:
+
+   - Blocks (unless `--force`) when `@agent-native/*` overrides/patches exist
+   - Rewrites non-local `@agent-native/*` dependency pins to `latest`
+   - Runs the package manager install
+   - Runs `skills update scaffold --project`
+   - Runs `typecheck` when the project has that script
+
+3. **If upgrade or typecheck fails**
+
+   - Read the concrete error
+   - Fix **app** source, actions, config, or env — not framework packages
+   - Re-run `agent-native upgrade` or `pnpm typecheck`
+   - Stop and ask the user if you cannot fix the app-level error
+
+4. **Dry-run / partial runs**
+
+   ```bash
+   agent-native upgrade --dry-run
+   agent-native upgrade --skip-verify
+   agent-native upgrade --skip-install   # package.json bumps only
+   ```
+
+## Don't
+
+- Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
+  `patchedDependencies` for any `@agent-native/*` package
+- Don't edit `node_modules/@agent-native/core` or
+  `node_modules/@agent-native/dispatch`
+- Don't invent local "dispatch behavior" shims to paper over version skew
+- Don't keep iterating with more framework patches after a failed install
+- Don't skip `skills update scaffold --project` after a core bump (the
+  upgrade command does this for you)
+
+## Related Skills
+
+- **self-modifying-code** — Tier 4: framework packages are off limits
+- **agent-native-docs** — version-matched docs after the bump
+- **portability** — keep app code provider-agnostic across upgrades

package/corpus/templates/content/AGENTS.md

@@ -9,6 +9,10 @@ Detailed document editing, Notion, storage, and UI rules live in
 
 ## Core Rules
 
+- Store large file/blob payloads in configured file/blob storage, not SQL: no
+  base64, `data:` URLs, images, video/audio, PDFs, ZIPs, screenshots,
+  thumbnails, or replay chunks in app tables, `application_state`, `settings`,
+  or `resources`; persist URLs, ids, or handles instead.
 - Never hardcode API keys, tokens, webhook URLs, signing secrets, private Builder/internal data, customer data, or credential-looking literals. Use secrets/OAuth/runtime configuration and obvious placeholders in examples.
 - Use actions for documents, blocks, comments, media, sharing, navigation, and
   Notion integration. Do not mutate document rows directly unless a skill says to

package/corpus/templates/content/actions/_batch-utils.ts

@@ -0,0 +1,8 @@
+export function chunks<T>(items: T[], size: number): T[][] {
+  if (items.length === 0) return [];
+  const out: T[][] = [];
+  for (let index = 0; index < items.length; index += size) {
+    out.push(items.slice(index, index + size));
+  }
+  return out;
+}

package/corpus/templates/content/actions/_builder-cms-read-client.ts

@@ -59,8 +59,9 @@ const BUILDER_CMS_DEFAULT_READ_LIMIT = 500;
 const BUILDER_CMS_MAX_READ_LIMIT = 1000;
 const BUILDER_CMS_PAGE_SIZE = 100;
 const BUILDER_CMS_READ_RETRIES = 2;
-const BUILDER_CMS_ENTRY_FIELDS =
-  "id,name,published,lastUpdated,createdDate,data.title,data.handle,data.url,data.slug,data.date,data.description,data.status,data.author,data.image,data.blocks,data.blocksString";
+const BUILDER_CMS_METADATA_ENTRY_FIELDS =
+  "id,name,published,lastUpdated,createdDate,data.title,data.handle,data.url,data.slug,data.date,data.description,data.status,data.author,data.image";
+const BUILDER_CMS_BODY_ENTRY_FIELDS = `${BUILDER_CMS_METADATA_ENTRY_FIELDS},data.blocks,data.blocksString`;
 
 function builderContentApiHost() {
   return (
@@ -489,7 +490,7 @@ async function readBuilderCmsContentEntriesViaMcp(args: {
             modelName: args.model,
             limit: pageLimit,
             offset,
-            fields: BUILDER_CMS_ENTRY_FIELDS,
+            fields: BUILDER_CMS_METADATA_ENTRY_FIELDS,
             enrich: true,
           },
         },
@@ -599,7 +600,7 @@ async function readBuilderCmsContentEntriesViaMcp(args: {
             modelName: args.model,
             limit: 1,
             query: { id: entry.id },
-            fields: BUILDER_CMS_ENTRY_FIELDS,
+            fields: BUILDER_CMS_METADATA_ENTRY_FIELDS,
             enrich: true,
           },
         },
@@ -649,6 +650,7 @@ async function readBuilderCmsContentEntriesViaContentApi(args: {
   // bare reference id.
   url.searchParams.set("enrich", "true");
   url.searchParams.set("noCache", "true");
+  url.searchParams.set("fields", BUILDER_CMS_METADATA_ENTRY_FIELDS);
 
   const limit = readLimit(args.limit);
   const startOffset =
@@ -814,7 +816,7 @@ export async function readBuilderCmsContentEntry(args: {
   url.searchParams.set("enrich", "true");
   url.searchParams.set("noCache", "true");
   url.searchParams.set("cachebust", String(Date.now()));
-  url.searchParams.set("fields", BUILDER_CMS_ENTRY_FIELDS);
+  url.searchParams.set("fields", BUILDER_CMS_BODY_ENTRY_FIELDS);
 
   const response = await fetchBuilderContentPage({
     fetchImpl: args.fetchImpl ?? fetch,