@agent-native/core 0.92.12 → 0.93.0

package/corpus/templates/dispatch/changelog/2026-07-10-connect-slack-workspaces-with-oauth-and-manage-channel-ident.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-07-10
+---
+
+Connect Slack workspaces with OAuth, Agent view, and direct messages, then manage channel identity, memory, routines, policies, and AI budgets.

package/corpus/templates/dispatch/changelog/2026-07-10-microsoft-teams-bots-and-discord-slash-commands-can-now-conn.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-07-10
+---
+
+Microsoft Teams bots and Discord slash commands can now connect with verified webhooks, while Telegram topics and WhatsApp replies preserve conversation context.

package/corpus/templates/dispatch/changelog/2026-07-10-slack-and-telegram-now-route-uptime-monitor-requests-to-anal.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-10
+---
+
+Slack and Telegram now route uptime-monitor requests to Analytics and return the created monitor link

package/corpus/templates/forms/.agents/skills/capture-learnings/SKILL.md

@@ -11,11 +11,14 @@ metadata:
 
 # Capture Learnings
 
-This is background knowledge, not a slash command. **Your memory index is loaded at the start of every conversation.** Use `save-memory` proactively when you learn something worth remembering.
+This is background knowledge, not a slash command. **Organization learnings and your personal memory index are loaded at the start of every conversation, including Slack/integration turns.** Capture durable context proactively when you learn something worth remembering.
 
 ## How to Read & Write Memories
 
-Memories are stored as **resources** in the SQL database (personal scope), not as files on disk.
+Memories are stored as **resources** in the SQL database, not as files on disk.
+
+- **Team/organization knowledge:** shared `LEARNINGS.md`. Read it first, merge the new fact, then write the full updated file with the `resources` tool using `scope: "shared"`. Shared scope resolves to the active organization; it must never leak to another organization in the same deployment.
+- **Personal knowledge:** `memory/MEMORY.md` plus `memory/<name>.md`, written with `save-memory`.
 
 - **Save a memory:** `save-memory --name <name> --type <type> --description "..." --content "..."`
 - **Read a memory:** `resource-read --path memory/<name>.md`
@@ -33,6 +36,14 @@ Memories are stored as **resources** in the SQL database (personal scope), not a
 
 ## When to Capture
 
+### Team and organization knowledge (`LEARNINGS.md`, shared scope)
+- Canonical destinations and workflows (for example, which Content database receives a type of Slack request)
+- Required intake fields, ownership, prioritization conventions, metric definitions, and approved terminology
+- Durable external references that the whole team needs, including the canonical page/database URL
+- Corrections or decisions that should affect every organization member's future Slack and app conversations
+
+Store the fact and a concise provenance link when available. Do not paste full private conversations, customer data, credentials, or secrets into learnings. Put stable always-on policy in shared `AGENTS.md`; put learned facts and evolving conventions in shared `LEARNINGS.md`.
+
 ### User Preferences & Memory (`user`)
 - **Tone and style** — "I prefer casual tone", "don't use emojis", "keep replies short"
 - **Personal context** — contacts, relationships, habits ("my wife's email is...", "I'm in PST timezone")
@@ -58,19 +69,21 @@ Memories are stored as **resources** in the SQL database (personal scope), not a
 - Things obvious from reading the code
 - Standard language/framework behavior
 - Temporary debugging notes
-- Anything already in AGENTS.md or skills
+- Anything already in AGENTS.md, shared LEARNINGS.md, or skills
 - Ephemeral task details (use tasks/plans instead)
 
 ## Key Rules
 
-1. **Save proactively — don't ask permission.** When you learn something, save it immediately.
-2. **One memory per topic** — e.g. `coding-style`, `project-alpha`, not one giant dump
-3. **Read before updating** — if a memory exists, read it first and merge, don't overwrite
-4. **Keep descriptions concise** — the index is loaded every conversation
-5. **Memories are SQL-backed** — safe for personal info, persist across sessions, not in git
+1. **Save proactively — don't ask permission.** When you learn something durable, save it immediately at the correct scope.
+2. **Choose scope by audience.** Organization workflow or reference → shared `LEARNINGS.md`; one person's preference/context → personal memory.
+3. **One memory per topic** — e.g. `coding-style`, `project-alpha`, not one giant dump
+4. **Read before updating** — if a memory exists, read it first and merge, don't overwrite
+5. **Keep descriptions concise** — the index is loaded every conversation
+6. **Memories are SQL-backed** — they persist across sessions and are not in git; still minimize sensitive content
 
 ## Graduation
 
 When a memory is referenced repeatedly, it may belong in AGENTS.md or a skill:
-- Saving a memory is lightweight (auto-apply, personal scope)
+- Saving a personal memory is lightweight (auto-apply, personal scope)
+- Shared LEARNINGS.md is the lightweight organization knowledge layer
 - Updating AGENTS.md or a skill is heavier (affects all users/agents)

package/corpus/templates/forms/.agents/skills/form-publishing/SKILL.md

@@ -63,6 +63,7 @@ Each form has a `settings` JSON object:
   "successMessage": "Thank you! Your response has been recorded.",
   "redirectUrl": null,
   "showProgressBar": false,
+  "anonymous": false,
   "integrations": []
 }
 ```
@@ -73,8 +74,14 @@ Each form has a `settings` JSON object:
 | `successMessage`   | string  | Message shown after successful submission  |
 | `redirectUrl`      | string  | URL to redirect to after submission        |
 | `showProgressBar`  | boolean | Show progress bar for multi-section forms  |
+| `anonymous`        | boolean | Suppress IP, submitter identity, chat/run ids, page URL, and client-surface metadata for every response |
 | `integrations`     | array   | Webhook/Slack/Discord notification configs |
 
+For a genuinely anonymous form, set `anonymous: true` when creating the form.
+Do not describe an ordinary published form as anonymous: published forms accept
+public responses, but only anonymous mode suppresses identifying and source
+metadata.
+
 ## Integration Types
 
 Forms can notify external services on submission:

package/corpus/templates/forms/AGENTS.md

@@ -28,6 +28,10 @@ Detailed building, publishing, response, storage, and UI rules live in
   combined dashboard/report requests.
 - For form setup/configuration previews, call `preview-form`. It returns a
   native inline summary/table and an "Open editor" expansion path.
+- For an anonymous feedback form or survey, create all fields in one
+  `create-form` call with `status: "published"`, verify the persisted form, and
+  return the action's exact public `/f/<slug>` response URL rather than only
+  the private editor link.
 - Form UX should stay focused: clear labels, sensible validation, minimal
   required fields, and progressive disclosure for advanced settings.
 - Public form submission endpoints must be intentionally public; keep management

package/corpus/templates/forms/actions/create-form.ts

@@ -1,5 +1,5 @@
 import { defineAction, embedApp } from "@agent-native/core";
-import { buildDeepLink } from "@agent-native/core/server";
+import { buildDeepLink, getAppProductionUrl } from "@agent-native/core/server";
 import {
   getRequestUserEmail,
   getRequestOrgId,
@@ -11,6 +11,7 @@ import { getDb, schema } from "../server/db/index.js";
 import { assertIntegrationUrlsAllowed } from "../server/lib/integrations.js";
 import { assertValidFields } from "../server/lib/validate-fields.js";
 import type { FormField, FormSettings } from "../shared/types.js";
+import { assertPublishableForm } from "./lib/assert-publishable-form.js";
 
 const nanoid = customAlphabet(
   "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ",
@@ -34,7 +35,8 @@ function formDeepLink(formId: string): string {
 }
 
 export default defineAction({
-  description: "Create a new form.",
+  description:
+    "Create a draft or published form. Set settings.anonymous=true to suppress submitter IP, identity, and source metadata. Published forms return a direct public response URL; drafts return an editor URL.",
   schema: z.object({
     title: z.string().optional().describe("Form title"),
     description: z.string().optional().describe("Form description"),
@@ -48,7 +50,9 @@ export default defineAction({
     settings: z
       .union([z.string(), z.record(z.string(), z.any())])
       .optional()
-      .describe("Form settings object (or JSON string of the same)"),
+      .describe(
+        "Form settings object (or JSON string). Set anonymous=true for strict no-IP, no-identity, no-source-metadata responses.",
+      ),
     slug: z.string().optional().describe("Custom URL slug"),
     status: z
       .enum(["draft", "published", "closed"])
@@ -96,12 +100,15 @@ export default defineAction({
     if (args.settings) {
       if (typeof args.settings === "string") {
         try {
-          settings = JSON.parse(args.settings);
+          settings = { ...defaultSettings, ...JSON.parse(args.settings) };
         } catch {
           throw new Error("--settings must be valid JSON");
         }
       } else {
-        settings = args.settings as unknown as FormSettings;
+        settings = {
+          ...defaultSettings,
+          ...(args.settings as unknown as FormSettings),
+        };
       }
     }
     // Reject blocked integration URLs at save time. fireIntegrations also
@@ -112,6 +119,9 @@ export default defineAction({
     if (!ownerEmail) throw new Error("no authenticated user");
     const orgId = getRequestOrgId();
     const status = args.status || "draft";
+    if (status === "published") {
+      assertPublishableForm(fields);
+    }
     const description = args.description || null;
     const visibility = "private" as const;
 
@@ -136,6 +146,12 @@ export default defineAction({
     // (Neon and similar pooled-Postgres setups occasionally route the read
     // to a replica that hasn't replicated the write yet), which then throws
     // a 500 even though the form was created successfully.
+    const editorUrl = formDeepLink(id);
+    const publicUrl =
+      status === "published"
+        ? `${getAppProductionUrl()}/f/${encodeURIComponent(slug)}`
+        : undefined;
+
     return {
       id,
       title,
@@ -149,13 +165,34 @@ export default defineAction({
       responseCount: 0,
       createdAt: now,
       updatedAt: now,
+      editorUrl,
+      publicUrl,
     };
   },
   link: ({ result }) => {
-    const id = (result as { id?: string } | null)?.id;
+    const created = result as {
+      id?: string;
+      slug?: string;
+      status?: string;
+      settings?: FormSettings;
+      editorUrl?: string;
+      publicUrl?: string;
+    } | null;
+    const id = created?.id;
     if (!id) return null;
+    if (created?.status === "published" && created.slug) {
+      if (!created.publicUrl) return null;
+      return {
+        url: created.publicUrl,
+        label:
+          created.settings?.anonymous === true
+            ? "Open anonymous form"
+            : "Open public form",
+        view: "public-form",
+      };
+    }
     return {
-      url: formDeepLink(id),
+      url: created?.editorUrl ?? formDeepLink(id),
       label: "Open form in Forms",
       view: "form",
     };

package/corpus/templates/forms/actions/lib/assert-publishable-form.ts

@@ -0,0 +1,38 @@
+import type { FormField } from "../../shared/types.js";
+
+/** Reject forms that would be unusable if published. */
+export function assertPublishableForm(fields: FormField[]): void {
+  const issues: string[] = [];
+  if (fields.length === 0) {
+    issues.push("form has no fields");
+  }
+
+  const optionTypes = new Set(["select", "multiselect", "radio"]);
+  for (const [index, field] of fields.entries()) {
+    const label = String(field?.label ?? "").trim();
+    if (!label) {
+      issues.push(`field #${index + 1} is missing a label`);
+    }
+    if (
+      optionTypes.has(field?.type) &&
+      (!Array.isArray(field?.options) || field.options.length === 0)
+    ) {
+      issues.push(`field "${label || `#${index + 1}`}" has no options`);
+    }
+    if (
+      field?.required &&
+      (field.type === "number" || field.type === "scale") &&
+      field.validation?.min !== undefined &&
+      field.validation?.max !== undefined &&
+      Number(field.validation.min) > Number(field.validation.max)
+    ) {
+      issues.push(`required field "${label || `#${index + 1}`}" has min > max`);
+    }
+  }
+
+  if (issues.length > 0) {
+    throw new Error(
+      `Cannot publish: ${issues.join("; ")}. Fix these before publishing.`,
+    );
+  }
+}

package/corpus/templates/forms/actions/patch-form-fields.ts

@@ -19,6 +19,7 @@ import { getDb, schema } from "../server/db/index.js";
 import { applyFieldOps } from "../server/lib/merge-fields.js";
 import { assertValidFields } from "../server/lib/validate-fields.js";
 import type { FormField } from "../shared/types.js";
+import { assertPublishableForm } from "./lib/assert-publishable-form.js";
 
 const fieldOpSchema = z.union([
   z.object({
@@ -91,6 +92,9 @@ export default defineAction({
 
     // Validate the result before persisting.
     assertValidFields(nextFields);
+    if (existing.status === "published") {
+      assertPublishableForm(nextFields);
+    }
 
     const now = new Date().toISOString();
     await db

package/corpus/templates/forms/actions/update-form.ts

@@ -7,6 +7,7 @@ import { getDb, schema } from "../server/db/index.js";
 import { assertIntegrationUrlsAllowed } from "../server/lib/integrations.js";
 import { assertValidFields } from "../server/lib/validate-fields.js";
 import type { FormField, FormSettings } from "../shared/types.js";
+import { assertPublishableForm } from "./lib/assert-publishable-form.js";
 
 function slugify(text: string): string {
   return text
@@ -118,42 +119,7 @@ export default defineAction({
         effectiveFields = [];
       }
 
-      const issues: string[] = [];
-      if (effectiveFields.length === 0) {
-        issues.push("form has no fields");
-      }
-      const optionTypes = new Set(["select", "multiselect", "radio"]);
-      for (const [idx, field] of effectiveFields.entries()) {
-        const label = String(field?.label ?? "").trim();
-        if (!label) {
-          issues.push(`field #${idx + 1} is missing a label`);
-        }
-        if (
-          optionTypes.has(field?.type) &&
-          (!Array.isArray(field?.options) || field.options.length === 0)
-        ) {
-          issues.push(`field "${label || `#${idx + 1}`}" has no options`);
-        }
-        // For required Number/Scale fields, conflicting min/max would
-        // render the field unsubmittable — block publish on that too.
-        if (
-          field?.required &&
-          (field?.type === "number" || field?.type === "scale") &&
-          field?.validation?.min !== undefined &&
-          field?.validation?.max !== undefined &&
-          Number(field.validation.min) > Number(field.validation.max)
-        ) {
-          issues.push(
-            `required field "${label || `#${idx + 1}`}" has min > max`,
-          );
-        }
-      }
-
-      if (issues.length > 0) {
-        throw new Error(
-          `Cannot publish: ${issues.join("; ")}. Fix these before publishing.`,
-        );
-      }
+      assertPublishableForm(effectiveFields);
     }
 
     await db

package/corpus/templates/forms/app/i18n/ar-SA.ts

@@ -192,6 +192,9 @@ const messages = {
       successMessage: "رسالة النجاح",
       defaultSuccessMessage: "شكرا لك! تم تسجيل ردك.",
       redirectUrl: "رابط إعادة التوجيه (اختياري)",
+      anonymousResponses: "ردود مجهولة الهوية",
+      anonymousResponsesDescription:
+        "عدم الاحتفاظ بعناوين IP أو هوية المجيب أو بيانات المصدر الوصفية.",
       saveSettings: "حفظ الإعدادات",
     },
     integrations: {

package/corpus/templates/forms/app/i18n/de-DE.ts

@@ -191,6 +191,9 @@ const messages = {
       successMessage: "Erfolgsmeldung",
       defaultSuccessMessage: "Danke! Deine Antwort wurde gespeichert.",
       redirectUrl: "Weiterleitungs-URL (optional)",
+      anonymousResponses: "Anonyme Antworten",
+      anonymousResponsesDescription:
+        "IP-Adressen, Identität der antwortenden Person und Quellmetadaten nicht speichern.",
       saveSettings: "Einstellungen speichern",
     },
     integrations: {

package/corpus/templates/forms/app/i18n/en-US.ts

@@ -189,6 +189,9 @@ const messages = {
       successMessage: "Success message",
       defaultSuccessMessage: "Thank you! Your response has been recorded.",
       redirectUrl: "Redirect URL (optional)",
+      anonymousResponses: "Anonymous responses",
+      anonymousResponsesDescription:
+        "Do not retain IP addresses, submitter identity, or source metadata.",
       saveSettings: "Save Settings",
     },
     integrations: {

package/corpus/templates/forms/app/i18n/es-ES.ts

@@ -192,6 +192,9 @@ const messages = {
       successMessage: "Mensaje de éxito",
       defaultSuccessMessage: "Gracias! Tu respuesta se ha registrado.",
       redirectUrl: "URL de redirección (opcional)",
+      anonymousResponses: "Respuestas anónimas",
+      anonymousResponsesDescription:
+        "No conservar direcciones IP, identidad del remitente ni metadatos de origen.",
       saveSettings: "Guardar ajustes",
     },
     integrations: {

package/corpus/templates/forms/app/i18n/fr-FR.ts

@@ -193,6 +193,9 @@ const messages = {
       successMessage: "Message de réussite",
       defaultSuccessMessage: "Merci ! Votre réponse a été enregistrée.",
       redirectUrl: "URL de redirection (facultatif)",
+      anonymousResponses: "Réponses anonymes",
+      anonymousResponsesDescription:
+        "Ne pas conserver les adresses IP, l’identité du répondant ni les métadonnées de provenance.",
       saveSettings: "Enregistrer les paramètres",
     },
     integrations: {

package/corpus/templates/forms/app/i18n/hi-IN.ts

@@ -188,6 +188,9 @@ const messages = {
       successMessage: "सफलता संदेश",
       defaultSuccessMessage: "धन्यवाद! आपकी प्रतिक्रिया रिकॉर्ड हो गई है।",
       redirectUrl: "रीडायरेक्ट URL (वैकल्पिक)",
+      anonymousResponses: "गुमनाम प्रतिक्रियाएँ",
+      anonymousResponsesDescription:
+        "IP पते, प्रतिक्रिया देने वाले की पहचान या स्रोत मेटाडेटा सहेजें नहीं।",
       saveSettings: "सेटिंग्स सहेजें",
     },
     integrations: {

package/corpus/templates/forms/app/i18n/ja-JP.ts

@@ -189,6 +189,9 @@ const messages = {
       successMessage: "成功メッセージ",
       defaultSuccessMessage: "ありがとうございます！回答が記録されました。",
       redirectUrl: "リダイレクト URL（任意）",
+      anonymousResponses: "匿名の回答",
+      anonymousResponsesDescription:
+        "IP アドレス、回答者の身元、送信元メタデータを保存しません。",
       saveSettings: "設定を保存",
     },
     integrations: {

package/corpus/templates/forms/app/i18n/ko-KR.ts

@@ -186,6 +186,9 @@ const messages = {
       successMessage: "성공 메시지",
       defaultSuccessMessage: "감사합니다! 응답이 기록되었습니다.",
       redirectUrl: "리디렉션 URL(선택 사항)",
+      anonymousResponses: "익명 응답",
+      anonymousResponsesDescription:
+        "IP 주소, 응답자 신원 또는 출처 메타데이터를 저장하지 않습니다.",
       saveSettings: "설정 저장",
     },
     integrations: {

package/corpus/templates/forms/app/i18n/pt-BR.ts

@@ -192,6 +192,9 @@ const messages = {
       successMessage: "Mensagem de sucesso",
       defaultSuccessMessage: "Obrigado! Sua resposta foi registrada.",
       redirectUrl: "URL de redirecionamento (opcional)",
+      anonymousResponses: "Respostas anônimas",
+      anonymousResponsesDescription:
+        "Não guardar endereços IP, identidade do respondente nem metadados de origem.",
       saveSettings: "Salvar configurações",
     },
     integrations: {

package/corpus/templates/forms/app/i18n/zh-CN.ts

@@ -178,6 +178,8 @@ const messages = {
       successMessage: "成功消息",
       defaultSuccessMessage: "谢谢！你的回复已记录。",
       redirectUrl: "重定向 URL（可选）",
+      anonymousResponses: "匿名回复",
+      anonymousResponsesDescription: "不保留 IP 地址、回复者身份或来源元数据。",
       saveSettings: "保存设置",
     },
     integrations: {

package/corpus/templates/forms/app/i18n/zh-TW.ts

@@ -178,6 +178,9 @@ const messages = {
       successMessage: "成功訊息",
       defaultSuccessMessage: "謝謝！你的回覆已紀錄。",
       redirectUrl: "重新導向 URL（可選）",
+      anonymousResponses: "匿名回覆",
+      anonymousResponsesDescription:
+        "不保留 IP 位址、回覆者身分或來源中繼資料。",
       saveSettings: "儲存設定",
     },
     integrations: {

package/corpus/templates/forms/app/pages/FormBuilderPage.tsx

@@ -1532,6 +1532,23 @@ function SettingsEditor({
         />
       </div>
 
+      <div className="flex items-start justify-between gap-4 rounded-lg border p-3">
+        <div className="space-y-1">
+          <Label htmlFor="anonymous-responses" className="text-xs">
+            {t("builder.settings.anonymousResponses")}
+          </Label>
+          <p className="text-xs leading-5 text-muted-foreground">
+            {t("builder.settings.anonymousResponsesDescription")}
+          </p>
+        </div>
+        <Switch
+          id="anonymous-responses"
+          checked={settings.anonymous === true}
+          onCheckedChange={(anonymous) => update({ anonymous })}
+          aria-label={t("builder.settings.anonymousResponses")}
+        />
+      </div>
+
       <Button onClick={() => onSave(settings)} className="w-full" size="sm">
         {t("builder.settings.saveSettings")}
       </Button>

package/corpus/templates/forms/changelog/2026-07-10-agent-created-published-forms-now-return-the-anonymous-publi.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-10
+---
+
+Agent-created published forms now return the anonymous public response link

package/corpus/templates/forms/changelog/2026-07-10-published-forms-can-no-longer-be-edited-into-an-unusable-emp.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-10
+---
+
+Published forms can no longer be edited into an unusable empty or optionless state.

package/corpus/templates/forms/server/handlers/submissions.ts

@@ -210,7 +210,8 @@ export const submitForm = defineEventHandler(async (event: H3Event) => {
 
   const now = new Date().toISOString();
   const responseId = nanoid();
-  const ip = getRequestIP(event) ?? null;
+  const anonymous = settings.anonymous === true;
+  const ip = anonymous ? null : (getRequestIP(event) ?? null);
 
   // Optional metadata sent by trusted clients (e.g. the framework's
   // FeedbackButton, which forwards the logged-in user's email so we can see
@@ -218,7 +219,7 @@ export const submitForm = defineEventHandler(async (event: H3Event) => {
   // when present; cross-app feedback submissions fall back to the client hint,
   // which is useful context but not verified identity.
   const meta =
-    typeof body._meta === "object" && body._meta !== null
+    !anonymous && typeof body._meta === "object" && body._meta !== null
       ? (body._meta as {
           submitterEmail?: unknown;
           chatSessionId?: unknown;
@@ -228,7 +229,7 @@ export const submitForm = defineEventHandler(async (event: H3Event) => {
           clientSurface?: unknown;
         })
       : null;
-  const session = await getSession(event).catch(() => null);
+  const session = anonymous ? null : await getSession(event).catch(() => null);
   const submitterEmail =
     cleanSubmitterEmail(session?.email) ??
     cleanSubmitterEmail(meta?.submitterEmail);

package/corpus/templates/forms/server/plugins/agent-chat.ts

@@ -15,6 +15,7 @@ Core rules:
 - Never hardcode API keys, tokens, webhook URLs, signing secrets, customer data, or credential-looking literals. Use placeholders or configured integrations.
 - Inspect the current state when it matters. Use \`view-screen\` when the active form, selected field, publish state, response table, or current route is unclear.
 - Use \`create-form\`, \`update-form\`, \`patch-form-fields\`, \`restore-form\`, and \`delete-form\` for form lifecycle and field edits.
+- When the user asks for an anonymous feedback form or survey, create the complete form atomically with \`status: "published"\`, then return the exact public response URL from the successful action result. Do not return only the private editor link, and do not claim it is live without verifying the saved status and fields.
 - Use \`preview-form\` when the user asks about a form's setup, fields, configuration, publish state, or response count. It renders a native chat summary.
 - Use \`response-insights\` for response analytics. Do not invent SQL or fake chart data. Pass \`displayMode: "chart"\` for chart-only requests, \`displayMode: "table"\` only when the user asks for a table/rows, and \`displayMode: "insights"\` only for combined dashboards or reports.
 - Use \`list-responses\` and \`export-responses\` for response data review and export. When the user asks to see, open, or view all responses for a form, call \`navigate\` with \`view: "responses"\` instead of listing rows in chat.

package/corpus/templates/forms/shared/types.ts

@@ -72,6 +72,11 @@ export interface FormSettings {
   successMessage?: string;
   redirectUrl?: string;
   showProgressBar?: boolean;
+  /**
+   * Strict response privacy mode. When enabled, submissions do not retain the
+   * request IP, submitter identity, chat/run ids, page URL, or client surface.
+   */
+  anonymous?: boolean;
   integrations?: FormIntegration[];
   /**
    * Origins permitted to POST submissions cross-origin (e.g. from embedded

package/corpus/templates/mail/.agents/skills/capture-learnings/SKILL.md

@@ -11,11 +11,14 @@ metadata:
 
 # Capture Learnings
 
-This is background knowledge, not a slash command. **Your memory index is loaded at the start of every conversation.** Use `save-memory` proactively when you learn something worth remembering.
+This is background knowledge, not a slash command. **Organization learnings and your personal memory index are loaded at the start of every conversation, including Slack/integration turns.** Capture durable context proactively when you learn something worth remembering.
 
 ## How to Read & Write Memories
 
-Memories are stored as **resources** in the SQL database (personal scope), not as files on disk.
+Memories are stored as **resources** in the SQL database, not as files on disk.
+
+- **Team/organization knowledge:** shared `LEARNINGS.md`. Read it first, merge the new fact, then write the full updated file with the `resources` tool using `scope: "shared"`. Shared scope resolves to the active organization; it must never leak to another organization in the same deployment.
+- **Personal knowledge:** `memory/MEMORY.md` plus `memory/<name>.md`, written with `save-memory`.
 
 - **Save a memory:** `save-memory --name <name> --type <type> --description "..." --content "..."`
 - **Read a memory:** `resource-read --path memory/<name>.md`
@@ -33,6 +36,14 @@ Memories are stored as **resources** in the SQL database (personal scope), not a
 
 ## When to Capture
 
+### Team and organization knowledge (`LEARNINGS.md`, shared scope)
+- Canonical destinations and workflows (for example, which Content database receives a type of Slack request)
+- Required intake fields, ownership, prioritization conventions, metric definitions, and approved terminology
+- Durable external references that the whole team needs, including the canonical page/database URL
+- Corrections or decisions that should affect every organization member's future Slack and app conversations
+
+Store the fact and a concise provenance link when available. Do not paste full private conversations, customer data, credentials, or secrets into learnings. Put stable always-on policy in shared `AGENTS.md`; put learned facts and evolving conventions in shared `LEARNINGS.md`.
+
 ### User Preferences & Memory (`user`)
 - **Tone and style** — "I prefer casual tone", "don't use emojis", "keep replies short"
 - **Personal context** — contacts, relationships, habits ("my wife's email is...", "I'm in PST timezone")
@@ -58,19 +69,21 @@ Memories are stored as **resources** in the SQL database (personal scope), not a
 - Things obvious from reading the code
 - Standard language/framework behavior
 - Temporary debugging notes
-- Anything already in AGENTS.md or skills
+- Anything already in AGENTS.md, shared LEARNINGS.md, or skills
 - Ephemeral task details (use tasks/plans instead)
 
 ## Key Rules
 
-1. **Save proactively — don't ask permission.** When you learn something, save it immediately.
-2. **One memory per topic** — e.g. `coding-style`, `project-alpha`, not one giant dump
-3. **Read before updating** — if a memory exists, read it first and merge, don't overwrite
-4. **Keep descriptions concise** — the index is loaded every conversation
-5. **Memories are SQL-backed** — safe for personal info, persist across sessions, not in git
+1. **Save proactively — don't ask permission.** When you learn something durable, save it immediately at the correct scope.
+2. **Choose scope by audience.** Organization workflow or reference → shared `LEARNINGS.md`; one person's preference/context → personal memory.
+3. **One memory per topic** — e.g. `coding-style`, `project-alpha`, not one giant dump
+4. **Read before updating** — if a memory exists, read it first and merge, don't overwrite
+5. **Keep descriptions concise** — the index is loaded every conversation
+6. **Memories are SQL-backed** — they persist across sessions and are not in git; still minimize sensitive content
 
 ## Graduation
 
 When a memory is referenced repeatedly, it may belong in AGENTS.md or a skill:
-- Saving a memory is lightweight (auto-apply, personal scope)
+- Saving a personal memory is lightweight (auto-apply, personal scope)
+- Shared LEARNINGS.md is the lightweight organization knowledge layer
 - Updating AGENTS.md or a skill is heavier (affects all users/agents)

package/corpus/templates/mail/app/components/layout/AppLayout.tsx

@@ -1419,7 +1419,7 @@ function AppLayoutInner({ children }: AppLayoutProps) {
             )}
             <div
               className={cn(
-                "flex flex-col overflow-hidden bg-[var(--mail-drawer-surface)] backdrop-blur-2xl border-e border-border/30 shadow-2xl transition-[width] duration-200 ease-out",
+                "flex flex-col overflow-hidden bg-[var(--mail-drawer-surface)] backdrop-blur-2xl transition-[width] duration-200 ease-out",
                 showCollapsedSidebar ? "w-12" : "w-64",
                 sidebarPinned && !isMobile
                   ? "absolute start-0 top-12 bottom-0 z-10"
@@ -2011,7 +2011,7 @@ function StandardLayout({ children }: AppLayoutProps) {
             className="fixed inset-0 z-30 bg-[var(--mail-overlay-scrim)]"
             onClick={() => setSidebarOpen(false)}
           />
-          <div className="fixed start-0 top-0 bottom-0 z-40 flex w-64 flex-col overflow-hidden bg-[var(--mail-drawer-surface)] backdrop-blur-2xl border-e border-border/30 shadow-2xl">
+          <div className="fixed start-0 top-0 bottom-0 z-40 flex w-64 flex-col overflow-hidden bg-[var(--mail-drawer-surface)] backdrop-blur-2xl">
             <div className="min-h-0 flex-1 overflow-y-auto p-4">
               <div className="space-y-0.5">
                 {[