@agent-native/core 0.92.10 → 0.92.11

package/corpus/templates/design/actions/present-design-variants.ts

@@ -6,8 +6,8 @@ import {
 } from "@agent-native/core/application-state";
 import { seedFromText } from "@agent-native/core/collab";
 import { buildDeepLink } from "@agent-native/core/server";
-import { assertAccess } from "@agent-native/core/sharing";
-import { eq } from "drizzle-orm";
+import { accessFilter, assertAccess } from "@agent-native/core/sharing";
+import { and, eq, inArray } from "drizzle-orm";
 import { nanoid } from "nanoid";
 import { z } from "zod";
 
@@ -18,6 +18,7 @@ import {
   mergeCanvasFramePlacements,
   type CanvasFramePlacement,
 } from "../shared/canvas-frames.js";
+import { isUniqueConstraintViolation } from "../shared/db-conflict.js";
 import { annotateScreenHtmlForPersist } from "../shared/screen-annotation.js";
 
 const VARIANT_GAP = 96;
@@ -120,6 +121,336 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 
+const MAX_FILENAME_INSERT_ATTEMPTS = 5;
+
+/**
+ * True only when `rawSet` proves none of its screens has ever been removed by
+ * delete-file.ts. This action stamps every variant set it creates with
+ * `screenCount` — the exact number of screens it generated, which never
+ * changes afterward (present-design-variants.ts never mutates an existing
+ * set's `screenCount`, and delete-file.ts's `pruneDesignVariantSets` only
+ * ever shortens/removes a set's `screens` array, never touches `screenCount`).
+ * The moment any member is deleted, `screens.length` drops below the
+ * recorded `screenCount` (or the whole entry is removed once <=1 screens
+ * remain) — either way, `screens.length === screenCount` no longer holds. So
+ * this equality proves no delete-file call has EVER resolved against this
+ * set.
+ *
+ * IMPORTANT: this does NOT prove the user never picked a screen from the set.
+ * A pick only exists as a chat instruction (see `VARIANT_PICK_SUBMIT_MESSAGE`)
+ * until the agent's follow-up turn actually calls delete-file for the losers;
+ * there is no synchronous server-side seam that records a pick before that
+ * turn runs (an agent retry after a run cutoff, or a second
+ * present-design-variants call, can both land before the delete-file calls
+ * do). So `isUntouchedVariantSet` is used only to decide whether a set is
+ * eligible to be *marked* superseded — never as authority to delete its
+ * files. See `markSupersededVariantSets` / `deleteVariantSetsByIds` below.
+ * Sets without a numeric `screenCount` at all (legacy data predating this
+ * field) are NOT treated as untouched either, since we cannot prove those
+ * were never picked.
+ */
+function isUntouchedVariantSet(
+  rawSet: unknown,
+): rawSet is { screens: unknown[]; screenCount: number } & Record<
+  string,
+  unknown
+> {
+  return (
+    isRecord(rawSet) &&
+    Array.isArray(rawSet.screens) &&
+    typeof rawSet.screenCount === "number" &&
+    rawSet.screens.length === rawSet.screenCount
+  );
+}
+
+function collectUnmarkedSupersededCandidateIds(
+  variantSets: Record<string, unknown>,
+): string[] {
+  const setIds: string[] = [];
+  for (const [setId, rawSet] of Object.entries(variantSets)) {
+    if (!isUntouchedVariantSet(rawSet)) continue;
+    if (isRecord(rawSet) && rawSet.superseded === true) continue;
+    setIds.push(setId);
+  }
+  return setIds;
+}
+
+function screenFileIdsForSet(rawSet: { screens: unknown[] }): string[] {
+  const fileIds = new Set<string>();
+  for (const screen of rawSet.screens) {
+    const id = isRecord(screen)
+      ? screen.id
+      : typeof screen === "string"
+        ? screen
+        : undefined;
+    if (typeof id === "string") fileIds.add(id);
+  }
+  return Array.from(fileIds);
+}
+
+function pruneKeyedRecordForIds(
+  value: unknown,
+  ids: string[],
+): Record<string, unknown> {
+  const next = isRecord(value) ? { ...value } : {};
+  for (const id of ids) delete next[id];
+  return next;
+}
+
+/**
+ * Marks each PREVIOUS present-design-variants set for this design that is
+ * proven untouched (see `isUntouchedVariantSet`) as `superseded: true`,
+ * whenever a new variant set is created for the same design. This is
+ * bookkeeping ONLY — it never deletes files, never touches `canvasFrames` or
+ * `screenMetadata`, and is always safe to run unconditionally. A set with
+ * `superseded: true` still renders normally; the flag only makes it eligible
+ * for the opt-in `deleteSupersededSetIds` path below.
+ *
+ * Deletion is intentionally NOT automatic here. The failure mode this
+ * guards against: set V1=[S1,S2,S3] is generated; the user picks S2 in chat;
+ * before the agent's delete-file turn for S1/S3 actually runs (run cutoff,
+ * retry, or a second present-design-variants call arriving first),
+ * `screens.length === screenCount` still holds for V1 — a pick is not
+ * observable server-side until delete-file resolves it. Auto-deleting on
+ * that inference would have hard-deleted the picked screen S2 with no
+ * recovery. So this function only records bookkeeping; real deletion
+ * requires the agent to explicitly name the set via `deleteSupersededSetIds`
+ * — see that action param's description for the discipline expected of
+ * callers.
+ */
+async function markSupersededVariantSets(
+  designId: string,
+): Promise<{ markedSetIds: string[] }> {
+  const db = getDb();
+
+  // Cheap early-exit read so the common case (no stale variant set to mark)
+  // never bumps the design's updatedAt via a no-op mutateDesignData call —
+  // mutateDesignDataUnlocked always advances updatedAt on every commit, even
+  // when the payload is unchanged. The authoritative check still runs inside
+  // the mutate() callback below, so a race against this snapshot is harmless.
+  const [designRow] = await db
+    .select({ data: schema.designs.data })
+    .from(schema.designs)
+    .where(
+      and(
+        eq(schema.designs.id, designId),
+        accessFilter(schema.designs, schema.designShares),
+      ),
+    );
+  if (!designRow) return { markedSetIds: [] };
+  let precheckVariantSets: Record<string, unknown> = {};
+  if (designRow.data) {
+    try {
+      const parsed: unknown = JSON.parse(designRow.data);
+      if (isRecord(parsed) && isRecord(parsed.designVariantSets)) {
+        precheckVariantSets = parsed.designVariantSets;
+      }
+    } catch {
+      return { markedSetIds: [] };
+    }
+  }
+  if (collectUnmarkedSupersededCandidateIds(precheckVariantSets).length === 0) {
+    return { markedSetIds: [] };
+  }
+
+  let markedSetIds: string[] = [];
+
+  await mutateDesignData({
+    designId,
+    mutate: (current, { updatedAt }) => {
+      const variantSets = isRecord(current.designVariantSets)
+        ? current.designVariantSets
+        : {};
+      const setIds = collectUnmarkedSupersededCandidateIds(variantSets);
+      markedSetIds = setIds;
+      if (setIds.length === 0) return current;
+
+      const nextVariantSets = { ...variantSets };
+      for (const setId of setIds) {
+        const rawSet = variantSets[setId];
+        if (isRecord(rawSet)) {
+          nextVariantSets[setId] = { ...rawSet, superseded: true };
+        }
+      }
+
+      return {
+        ...current,
+        designVariantSets: nextVariantSets,
+        updatedAt,
+      };
+    },
+    isApplied: (current) => {
+      const variantSets = isRecord(current.designVariantSets)
+        ? current.designVariantSets
+        : {};
+      return markedSetIds.every(
+        (setId) =>
+          isRecord(variantSets[setId]) &&
+          variantSets[setId]!.superseded === true,
+      );
+    },
+  });
+
+  return { markedSetIds };
+}
+
+/**
+ * Explicit, opt-in permanent deletion of specific variant sets by id. This is
+ * the ONLY path that hard-deletes variant-set files; it never runs
+ * automatically. The caller (the agent) must pass `deleteSupersededSetIds`
+ * naming the exact sets it knows were abandoned without any user pick — e.g.
+ * generating a brand-new set after the user asked to see different options.
+ * Never pass a previous set's id here on the strength of a guess or a retry;
+ * only do so when there is no reason to believe the user discussed or picked
+ * one of its screens.
+ *
+ * As a safety net, a requested id is only honored when the set is already
+ * flagged `superseded: true` by `markSupersededVariantSets` (i.e. proven
+ * untouched by any delete-file call as of this same run). A set that has
+ * already had even one delete-file call resolve against it — the normal sign
+ * that a pick is mid-flight — is never marked superseded and is therefore
+ * never eligible here, regardless of what the caller requests.
+ */
+async function deleteVariantSetsByIds(
+  designId: string,
+  requestedSetIds: string[],
+): Promise<{ removedSetIds: string[]; removedFileIds: string[] }> {
+  const db = getDb();
+
+  // Same cheap early-exit as markSupersededVariantSets: skip the
+  // updatedAt-bumping mutateDesignData commit when none of the requested set
+  // ids currently qualifies for deletion. The authoritative check still runs
+  // inside the mutate() callback below.
+  const [designRow] = await db
+    .select({ data: schema.designs.data })
+    .from(schema.designs)
+    .where(
+      and(
+        eq(schema.designs.id, designId),
+        accessFilter(schema.designs, schema.designShares),
+      ),
+    );
+  if (!designRow) return { removedSetIds: [], removedFileIds: [] };
+  let precheckVariantSets: Record<string, unknown> = {};
+  if (designRow.data) {
+    try {
+      const parsed: unknown = JSON.parse(designRow.data);
+      if (isRecord(parsed) && isRecord(parsed.designVariantSets)) {
+        precheckVariantSets = parsed.designVariantSets;
+      }
+    } catch {
+      return { removedSetIds: [], removedFileIds: [] };
+    }
+  }
+  if (
+    !requestedSetIds.some((setId) => {
+      const rawSet = precheckVariantSets[setId];
+      return (
+        isRecord(rawSet) &&
+        rawSet.superseded === true &&
+        Array.isArray(rawSet.screens)
+      );
+    })
+  ) {
+    return { removedSetIds: [], removedFileIds: [] };
+  }
+
+  let removedSetIds: string[] = [];
+  let removedFileIds: string[] = [];
+
+  await mutateDesignData({
+    designId,
+    mutate: (current, { updatedAt }) => {
+      const variantSets = isRecord(current.designVariantSets)
+        ? current.designVariantSets
+        : {};
+      const setIds: string[] = [];
+      const fileIds = new Set<string>();
+      for (const setId of requestedSetIds) {
+        const rawSet = variantSets[setId];
+        if (
+          !isRecord(rawSet) ||
+          rawSet.superseded !== true ||
+          !Array.isArray(rawSet.screens)
+        ) {
+          continue;
+        }
+        setIds.push(setId);
+        for (const id of screenFileIdsForSet(
+          rawSet as { screens: unknown[] },
+        )) {
+          fileIds.add(id);
+        }
+      }
+      removedSetIds = setIds;
+      removedFileIds = Array.from(fileIds);
+      if (setIds.length === 0) return current;
+
+      const nextVariantSets = { ...variantSets };
+      for (const setId of setIds) delete nextVariantSets[setId];
+
+      return {
+        ...current,
+        canvasFrames: pruneKeyedRecordForIds(
+          current.canvasFrames,
+          removedFileIds,
+        ),
+        screenMetadata: pruneKeyedRecordForIds(
+          current.screenMetadata,
+          removedFileIds,
+        ),
+        designVariantSets: nextVariantSets,
+        updatedAt,
+      };
+    },
+    isApplied: (current) => {
+      const variantSets = isRecord(current.designVariantSets)
+        ? current.designVariantSets
+        : {};
+      return removedSetIds.every((setId) => !(setId in variantSets));
+    },
+  });
+
+  if (removedFileIds.length > 0) {
+    await db
+      .delete(schema.designFiles)
+      .where(inArray(schema.designFiles.id, removedFileIds));
+
+    // Closes the small window between the metadata prune above and the
+    // physical row delete: mirrors delete-file.ts's before/delete/after
+    // pattern so a sibling request that refreshed canvasFrames/screenMetadata
+    // for one of these now-deleted ids in that window still gets swept.
+    await mutateDesignData({
+      designId,
+      mutate: (current, { updatedAt }) => ({
+        ...current,
+        canvasFrames: pruneKeyedRecordForIds(
+          current.canvasFrames,
+          removedFileIds,
+        ),
+        screenMetadata: pruneKeyedRecordForIds(
+          current.screenMetadata,
+          removedFileIds,
+        ),
+        updatedAt,
+      }),
+      isApplied: (current) => {
+        const frames = isRecord(current.canvasFrames)
+          ? current.canvasFrames
+          : {};
+        const metadata = isRecord(current.screenMetadata)
+          ? current.screenMetadata
+          : {};
+        return removedFileIds.every(
+          (id) => !(id in frames) && !(id in metadata),
+        );
+      },
+    });
+  }
+
+  return { removedSetIds, removedFileIds };
+}
+
 function slugify(value: string, fallback: string) {
   return (
     value
@@ -432,7 +763,10 @@ export default defineAction({
     "compact representative screen; pass concise labels/descriptions/features " +
     "and omit content when full HTML would be too large. Design will render " +
     "compact screens from the direction data. Expand the chosen direction " +
-    "after the user picks.",
+    "after the user picks. Screens from an earlier variant set are never " +
+    "deleted automatically: if you are knowingly replacing your own earlier " +
+    "set that the user never picked from or discussed, pass its set id in " +
+    "deleteSupersededSetIds; otherwise leave old sets in place.",
   schema: z.object({
     designId: z.string().describe("Design project ID to show variants for"),
     prompt: z
@@ -446,6 +780,19 @@ export default defineAction({
       .describe(
         "2-5 concise, visually distinct generated design options to place as overview screens (3 is the sweet spot). Prefer short label/description/features for each direction; include inline HTML content only when it is compact enough to finish.",
       ),
+    deleteSupersededSetIds: z
+      .array(z.string())
+      .optional()
+      .describe(
+        "OPT-IN permanent deletion of earlier variant sets you are knowingly " +
+          "replacing. Pass a previous variantSetId ONLY when you created that " +
+          "set yourself and the user never picked, kept, or discussed any of " +
+          "its screens (e.g. the user asked for a completely different set of " +
+          "directions). If the user may have picked a screen — even if the " +
+          "losing screens have not been deleted yet — do NOT pass the set id: " +
+          "deletion is permanent and would destroy the picked screen. Ids are " +
+          "only honored for sets provably untouched by any delete-file call.",
+      ),
   }),
   mcpApp: {
     compactCatalog: true,
@@ -458,9 +805,22 @@ export default defineAction({
       height: 720,
     }),
   },
-  run: async ({ designId, prompt, variants }) => {
+  run: async ({ designId, prompt, variants, deleteSupersededSetIds }) => {
     await assertAccess("design", designId, "editor");
 
+    // Non-destructive bookkeeping: flag earlier still-complete variant sets
+    // as superseded. Files are NEVER deleted automatically — a user's pick
+    // exists only as a chat instruction until the agent's delete-file turn
+    // runs, so an automatic sweep here could destroy the picked screen. Real
+    // deletion happens only for set ids the caller explicitly opts into via
+    // `deleteSupersededSetIds` below (and only when the set is provably
+    // untouched by any delete-file call).
+    await markSupersededVariantSets(designId);
+    const variantSetCleanup =
+      deleteSupersededSetIds && deleteSupersededSetIds.length > 0
+        ? await deleteVariantSetsByIds(designId, deleteSupersededSetIds)
+        : { removedSetIds: [], removedFileIds: [] };
+
     const db = getDb();
     const now = new Date().toISOString();
     const existingFiles = await db
@@ -475,9 +835,8 @@ export default defineAction({
       const variant = variants[index]!;
       const label = variant.label.trim() || optionName(index);
       const slug = slugify(label, `option-${index + 1}`);
-      const preferredFilename = `variant-${slug}.html`;
-      const filename = uniqueFilename(preferredFilename, usedFilenames);
-      const fileId = nanoid();
+      let filename = uniqueFilename(`variant-${slug}.html`, usedFilenames);
+      let fileId = nanoid();
       const providedContent = variant.content?.trim();
       const initialSize = inferVariantSize(variant, prompt);
       const rawContent =
@@ -491,15 +850,43 @@ export default defineAction({
       // operations as soon as it lands on the overview board.
       const content = annotateScreenHtmlForPersist(rawContent, "html");
 
-      await db.insert(schema.designFiles).values({
-        id: fileId,
-        designId,
-        filename,
-        fileType: "html",
-        content,
-        createdAt: now,
-        updatedAt: now,
-      });
+      // `usedFilenames` is a snapshot taken once at the top of run(), so a
+      // concurrent present-design-variants call (an agent retry after a
+      // timeout is the common trigger) can independently compute the same
+      // (designId, filename) pair and win the insert first. The
+      // `design_files_design_filename_unique_idx` unique index (see
+      // server/plugins/db.ts) turns the loser's insert into a constraint
+      // error instead of a silently duplicated screen; recover by refreshing
+      // the real filename list from the DB, picking a fresh unique name, and
+      // retrying — bounded so a persistent non-race failure still surfaces.
+      for (let attempt = 0; ; attempt += 1) {
+        try {
+          await db.insert(schema.designFiles).values({
+            id: fileId,
+            designId,
+            filename,
+            fileType: "html",
+            content,
+            createdAt: now,
+            updatedAt: now,
+          });
+          break;
+        } catch (err) {
+          if (
+            !isUniqueConstraintViolation(err) ||
+            attempt >= MAX_FILENAME_INSERT_ATTEMPTS
+          ) {
+            throw err;
+          }
+          const freshFiles = await db
+            .select({ filename: schema.designFiles.filename })
+            .from(schema.designFiles)
+            .where(eq(schema.designFiles.designId, designId));
+          for (const file of freshFiles) usedFilenames.add(file.filename);
+          filename = uniqueFilename(`variant-${slug}.html`, usedFilenames);
+          fileId = nanoid();
+        }
+      }
       await seedFromText(fileId, content);
 
       screens.push({
@@ -542,6 +929,13 @@ export default defineAction({
           id: variantSetId,
           prompt: prompt ?? "Pick a direction",
           createdAt: now,
+          // Immutable record of how many screens this set started with, so a
+          // later present-design-variants call can prove no delete-file call
+          // has ever resolved against any of this set's screens — see
+          // markSupersededVariantSets / isUntouchedVariantSet above.
+          // delete-file.ts's pruneDesignVariantSets only ever shortens or
+          // removes `screens`; it never rewrites this field.
+          screenCount: screens.length,
           screens: screens.map((screen) => ({
             id: screen.id,
             variantId: screen.variantId,
@@ -638,6 +1032,8 @@ export default defineAction({
       screens,
       path: `/design/${encodeURIComponent(designId)}?view=overview`,
       embed: true,
+      cleanedUpPreviousVariantScreens: variantSetCleanup.removedFileIds.length,
+      deletedSupersededSetIds: variantSetCleanup.removedSetIds,
       fallbackInstructions: FALLBACK_INSTRUCTIONS,
       nextRequiredAction:
         'Wait for the user to pick a screen in chat. Then delete each unchosen variant screen with delete-file at most once, call get-design-snapshot exactly once with fileId for the chosen screen, and call edit-design with that same fileId in a bounded pass. Use mode "replace-file" to replace the representative direction screen with a complete but compact requested app/product UI in the chosen visual style. Prioritize the primary workflow and render secondary details as visible controls, states, or affordances if the full feature list is too large for one reliable edit. Do not leave a direction board, variant brief, or summary card as the final result. Do not repeat delete/snapshot cycles. Do not call generate-design after a variant pick. Stop after the first successful edit-design save.',

package/corpus/templates/design/actions/preview-source-edit.ts

@@ -9,6 +9,7 @@ import {
 import {
   applySourceEdit,
   previewSourceDiff,
+  sourceContentHash,
 } from "../shared/source-workspace.js";
 
 const sourceEditSchema = z.discriminatedUnion("kind", [
@@ -77,7 +78,19 @@ export default defineAction({
       conflict:
         workspace.sourceType === "inline" ? null : "unsupported-source-backend",
       currentVersionHash: live.versionHash,
-      nextVersionHash: next.changed ? undefined : live.versionHash,
+      // The hash the file WOULD have after this edit is applied. Do NOT pass
+      // this as apply-source-edit's expectedVersionHash — that CAS compares
+      // against the CURRENT pre-edit hash, so the post-edit hash would always
+      // fail; pass `currentVersionHash` (above) instead to close the
+      // preview→apply race, exactly as the code workbench's inline-provider
+      // does. `nextVersionHash` is for detecting that the preview's target
+      // content changed (compare a later preview/read against it) and for
+      // optimistic client bookkeeping of the expected post-apply hash.
+      // When nothing changed, the content is still `live.content`, so there
+      // is no new hash to report.
+      nextVersionHash: next.changed
+        ? sourceContentHash(next.content)
+        : undefined,
       editsApplied: next.editsApplied,
       diff: previewSourceDiff(live.content, next.content),
     };

package/corpus/templates/design/actions/run-design-audit.ts

@@ -66,8 +66,20 @@ function extractSelector(tagHtml: string, tagName: string): string | undefined {
   if (idMatch) return `#${idMatch[1] ?? idMatch[2]}`;
   const classMatch = tagHtml.match(/\bclass\s*=\s*(?:"([^"]*?)"|'([^']*?)')/i);
   if (classMatch) {
-    const first = (classMatch[1] ?? classMatch[2] ?? "").trim().split(/\s+/)[0];
-    if (first) return `${tagName.toLowerCase()}.${first}`;
+    const classNames = (classMatch[1] ?? classMatch[2] ?? "")
+      .trim()
+      .split(/\s+/)
+      .filter(Boolean);
+    if (classNames.length > 0) {
+      // Include every class, not just the first: Tailwind screens commonly
+      // have several sibling elements sharing one common utility class (e.g.
+      // two buttons both carrying "h-4" but differing in every other class).
+      // A first-class-only selector is ambiguous and apply-a11y-fix's
+      // deterministic edit engine (which treats every dot segment after the
+      // tag as a required class, see shared/code-layer.ts) would match the
+      // wrong element among several sharing only that one class.
+      return `${tagName.toLowerCase()}.${classNames.join(".")}`;
+    }
   }
   return undefined;
 }
@@ -104,6 +116,13 @@ function checkMissingAlt(html: string): A11yFinding[] {
   return findings;
 }
 
+/** Escape regex metacharacters so untrusted HTML attribute values (e.g. an
+ * author-supplied `id`) can be safely interpolated into a `RegExp` source
+ * string instead of crashing the audit or matching unintended text. */
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
 /** Check form inputs without an associated <label> or aria-label/aria-labelledby. */
 function checkMissingLabels(html: string): A11yFinding[] {
   const findings: A11yFinding[] = [];
@@ -126,7 +145,10 @@ function checkMissingLabels(html: string): A11yFinding[] {
     const idMatch = tag.match(/\bid\s*=\s*(?:"([^"]*?)"|'([^']*?)')/i);
     const inputId = idMatch?.[1] ?? idMatch?.[2];
     const hasExplicitLabel = inputId
-      ? new RegExp(`for\\s*=\\s*(?:"${inputId}"|'${inputId}')`, "i").test(html)
+      ? new RegExp(
+          `for\\s*=\\s*(?:"${escapeRegExp(inputId)}"|'${escapeRegExp(inputId)}')`,
+          "i",
+        ).test(html)
       : false;
     const hasImplicitLabel = isWrappedByLabel(html, inputStart, inputEnd);
 

package/corpus/templates/design/actions/show-design-questions.ts

@@ -87,6 +87,16 @@ export default defineAction({
       .describe(
         "1-8 focused design-intake questions. Prefer 4-6 concise questions " +
           "with useful choices, Other enabled, and Decide for me where appropriate.",
+      )
+      .refine(
+        (questions) =>
+          new Set(questions.map((question) => question.id)).size ===
+          questions.length,
+        {
+          message:
+            "Question ids must be unique — duplicate ids share one answer " +
+            "slot in the form, silently discarding one question's answer.",
+        },
       ),
   }),
   mcpApp: {