@agent-native/core 0.95.0 → 0.95.1

package/corpus/core/src/deploy/build.ts

@@ -32,6 +32,7 @@ import { normalizeAppBasePath } from "../server/app-base-path.js";
 import {
   DEFAULT_SSR_CDN_CACHE_CONTROL,
   DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL,
+  DEFAULT_SSR_NETLIFY_VARY,
   DEFAULT_SPECULATION_RULES_PATH,
   DEFAULT_SSR_CACHE_CONTROL,
 } from "../shared/cache-control.js";
@@ -908,6 +909,7 @@ function injectHeadScript(html, script) {
 const DEFAULT_SSR_CACHE_CONTROL = ${JSON.stringify(DEFAULT_SSR_CACHE_CONTROL)};
 const DEFAULT_SSR_CDN_CACHE_CONTROL = ${JSON.stringify(DEFAULT_SSR_CDN_CACHE_CONTROL)};
 const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = ${JSON.stringify(DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL)};
+const DEFAULT_SSR_NETLIFY_VARY = ${JSON.stringify(DEFAULT_SSR_NETLIFY_VARY)};
 const DEFAULT_SPECULATION_RULES_PATH = ${JSON.stringify(DEFAULT_SPECULATION_RULES_PATH)};
 const IMMUTABLE_ASSET_CACHE_CONTROL = ${JSON.stringify(IMMUTABLE_ASSET_CACHE_CONTROL)};
 const IMMUTABLE_ASSET_PATHS = new Set(${JSON.stringify(
@@ -1003,6 +1005,7 @@ function applyDefaultSsrCacheHeader(headers, status, pathname) {
   // Netlify-specific header so SSR HTML/.data are served from the shared
   // durable CDN cache instead of stampeding origin — for every visitor.
   headers.set("netlify-cdn-cache-control", DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL);
+  headers.set("netlify-vary", DEFAULT_SSR_NETLIFY_VARY);
 }
 
 function applyDefaultSpeculationRulesHeader(headers, status, basePath) {

package/corpus/core/src/integrations/catalog.ts

@@ -137,10 +137,10 @@ const BUILT_IN_CHANNEL_CATALOG = [
     credentialRequirements: [
       {
         key: "SLACK_BOT_TOKEN",
-        label: "Slack Bot Token",
+        label: "Slack Bot Token (legacy)",
         required: false,
         helpText:
-          "OAuth & Permissions → Bot User OAuth Token (starts with `xoxb-`).",
+          "Legacy single-workspace fallback only. For new setups, install Slack from Settings → Messaging; managed OAuth stores each workspace token automatically.",
       },
       {
         key: "SLACK_CLIENT_ID",

package/corpus/core/src/server/auth.ts

@@ -1627,7 +1627,7 @@ function loginHtmlResponse(loginHtml: string, event: H3Event): Response {
     headers: {
       "Content-Type": "text/html; charset=utf-8",
       // The sign-in document is part of the public server shell. Keep it on the
-      // same short-fresh/long-SWR CDN policy as React Router SSR so hosted
+      // same long-fresh/long-SWR CDN policy as React Router SSR so hosted
       // template roots do not invoke origin just to render anonymous login UI.
       // The login HTML is env-INDEPENDENT (a Google-only app always renders a
       // working button), so a cached copy is never "wrong" — never downgrade

package/corpus/core/src/server/credential-provider.ts

@@ -78,6 +78,8 @@ const APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([
   "OPENAI_API_KEY",
   "OPENAI_BASE_URL",
   "OPENROUTER_API_KEY",
+  "GOOGLE_CLIENT_ID",
+  "GOOGLE_CLIENT_SECRET",
   "GOOGLE_GENERATIVE_AI_API_KEY",
   "GROQ_API_KEY",
   "MISTRAL_API_KEY",
@@ -93,9 +95,11 @@ function isAppProvidedDeployCredentialKey(key: string | undefined): boolean {
  * single-tenant contexts. In hosted production with a shared database, every
  * signed-in user needs their own user/org/workspace credential for
  * identity-bearing provider keys so one deploy key does not silently
- * impersonate another tenant. App-provided LLM provider keys are different:
- * they intentionally let the app developer pay for model usage for users of
- * that deployed app, so key-aware callers may use those env vars.
+ * impersonate another tenant. App-provided service credentials are different:
+ * they configure the deployed app itself rather than identifying a user. This
+ * includes LLM keys that let the app developer pay for model usage and OAuth
+ * client credentials whose per-user identity remains in scoped OAuth tokens.
+ * Key-aware callers may use those env vars.
  *
  * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic
  * provider secrets. This stricter helper remains for legacy call sites with

package/corpus/core/src/shared/cache-control.ts

@@ -1,15 +1,21 @@
-export const DEFAULT_SSR_CACHE_CONTROL =
-  "public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
+export const DEFAULT_SSR_CACHE_CONTROL = "public, max-age=0, must-revalidate";
 
-export const DEFAULT_SSR_CDN_CACHE_CONTROL = DEFAULT_SSR_CACHE_CONTROL;
+export const DEFAULT_SSR_CDN_CACHE_CONTROL =
+  "public, s-maxage=3600, stale-while-revalidate=604800, stale-if-error=3600";
 
 export const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL =
-  "public, durable, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
+  "public, durable, s-maxage=3600, stale-while-revalidate=604800, stale-if-error=3600";
+
+// React Router data requests can select a subset of route loaders with
+// `?_routes=...`. Ignore every other query parameter (UTM tags, click ids,
+// and similar tracking noise) so they cannot fragment Netlify's SSR cache.
+export const DEFAULT_SSR_NETLIFY_VARY = "query=_routes";
 
 export const DEFAULT_SSR_CACHE_HEADERS = {
   "cache-control": DEFAULT_SSR_CACHE_CONTROL,
   "cdn-cache-control": DEFAULT_SSR_CDN_CACHE_CONTROL,
   "netlify-cdn-cache-control": DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL,
+  "netlify-vary": DEFAULT_SSR_NETLIFY_VARY,
 } as const;
 
 export const DEFAULT_SPECULATION_RULES_PATH =

package/corpus/templates/analytics/app/lib/data-sources.ts

@@ -748,14 +748,15 @@ export const dataSources: DataSource[] = [
   {
     id: "slack",
     name: "Slack",
-    description: "Channel messages and workspace search",
+    description:
+      "Channel history and workspace search. Prefer a Slack workspace integration from Settings > Connections; a local bot token remains available as a legacy fallback.",
     category: "communication",
     icon: IconMessage,
     envKeys: ["SLACK_BOT_TOKEN"],
     docsUrl: "https://api.slack.com/methods",
     walkthroughSteps: [
       {
-        title: "Create a Slack App",
+        title: "Create a Slack App for local fallback access",
         description:
           "Go to api.slack.com/apps, create a new app, and add OAuth scopes: channels:read, channels:history, search:read.",
         url: "https://api.slack.com/apps",
@@ -767,10 +768,10 @@ export const dataSources: DataSource[] = [
           'Under "OAuth & Permissions", install the app and copy the Bot User OAuth Token.',
       },
       {
-        title: "Enter your Bot Token",
+        title: "Enter your local fallback Bot Token",
         description: 'Paste the Bot User OAuth Token (starts with "xoxb-").',
         inputKey: "SLACK_BOT_TOKEN",
-        inputLabel: "Bot Token",
+        inputLabel: "Bot Token (legacy local fallback)",
         inputPlaceholder: "xoxb-...",
         inputType: "password",
       },

package/corpus/templates/analytics/changelog/2026-07-10-slack-token-setup-marked-legacy.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-10
+---
+
+Slack data-source setup now favors workspace connections and identifies raw bot tokens as a legacy local fallback.

package/corpus/templates/analytics/server/lib/credential-keys.ts

@@ -107,10 +107,14 @@ export const credentialKeys: CredentialKeyConfig[] = [
     required: false,
   },
   // Slack
-  { key: "SLACK_BOT_TOKEN", label: "Slack Bot Token", required: false },
+  {
+    key: "SLACK_BOT_TOKEN",
+    label: "Slack Bot Token (legacy local fallback)",
+    required: false,
+  },
   {
     key: "SLACK_BOT_TOKEN_2",
-    label: "Slack Bot Token (secondary)",
+    label: "Slack Bot Token (legacy secondary fallback)",
     required: false,
   },
   // Notion

package/corpus/templates/brain/changelog/2026-07-10-slack-backfill-token-marked-legacy.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-10
+---
+
+Slack backfills now favor workspace connections while clearly marking raw bot tokens as a local fallback.

package/corpus/templates/brain/server/register-secrets.ts

@@ -2,9 +2,9 @@ import { registerRequiredSecret } from "@agent-native/core/secrets";
 
 registerRequiredSecret({
   key: "SLACK_BOT_TOKEN",
-  label: "Slack Bot Token",
+  label: "Slack Bot Token (local fallback)",
   description:
-    "Optional Slack bot token for channel backfills. Brain only scans allow-listed channels and never enumerates DMs.",
+    "Optional local fallback for Brain channel backfills. Prefer a Slack workspace integration in Settings > Connections. Brain only scans allow-listed channels and never enumerates DMs.",
   docsUrl: "https://api.slack.com/authentication/token-types",
   scope: "workspace",
   kind: "api-key",

package/corpus/templates/clips/app/components/library/library-layout.tsx

@@ -154,6 +154,9 @@ export function LibraryLayout({ children }: LibraryLayoutProps) {
   );
   const [headerSlot, setHeaderSlot] = useState<HTMLElement | null>(null);
   const showCollapsedSidebar = sidebarCollapsed && !isMobile;
+  const sidebarHasNewRecordingAction = isMobile
+    ? sidebarOpen
+    : !sidebarCollapsed;
 
   // Routes whose page renders its own h-12 toolbar. Layout still mounts Sidebar
   // + AgentSidebar, but skips its own header so there's no double-header.
@@ -603,7 +606,10 @@ export function LibraryLayout({ children }: LibraryLayoutProps) {
             </div>
           )}
           <main className="agent-native-app-main flex min-h-0 flex-1 flex-col overflow-y-auto">
-            <PageHeaderSlotProvider slot={headerSlot}>
+            <PageHeaderSlotProvider
+              slot={headerSlot}
+              sidebarHasNewRecordingAction={sidebarHasNewRecordingAction}
+            >
               {children}
             </PageHeaderSlotProvider>
           </main>

package/corpus/templates/clips/app/components/library/page-header.tsx

@@ -7,24 +7,40 @@ import {
 } from "react";
 import { createPortal } from "react-dom";
 
-const PageHeaderSlotContext = createContext<HTMLElement | null>(null);
+interface PageHeaderSlotContextValue {
+  slot: HTMLElement | null;
+  sidebarHasNewRecordingAction: boolean;
+}
+
+const PageHeaderSlotContext = createContext<PageHeaderSlotContextValue>({
+  slot: null,
+  sidebarHasNewRecordingAction: false,
+});
 
 export function PageHeaderSlotProvider({
   slot,
+  sidebarHasNewRecordingAction,
   children,
 }: {
   slot: HTMLElement | null;
+  sidebarHasNewRecordingAction: boolean;
   children: ReactNode;
 }) {
   return (
-    <PageHeaderSlotContext.Provider value={slot}>
+    <PageHeaderSlotContext.Provider
+      value={{ slot, sidebarHasNewRecordingAction }}
+    >
       {children}
     </PageHeaderSlotContext.Provider>
   );
 }
 
+export function usePageHeaderLayout() {
+  return useContext(PageHeaderSlotContext);
+}
+
 export function PageHeader({ children }: { children: ReactNode }) {
-  const slot = useContext(PageHeaderSlotContext);
+  const { slot } = usePageHeaderLayout();
   const [ready, setReady] = useState(false);
   useEffect(() => setReady(true), []);
   if (!ready || !slot) return null;

package/corpus/templates/clips/app/routes/_app.library._index.tsx

@@ -4,6 +4,7 @@ import { IconPlayerRecord } from "@tabler/icons-react";
 import { NavLink } from "react-router";
 
 import { LibraryGrid } from "@/components/library/library-grid";
+import { usePageHeaderLayout } from "@/components/library/page-header";
 
 const SEO_TITLE =
   "Agent-Native Clips - Open Source, agent-friendly Loom alternative";
@@ -24,24 +25,27 @@ export function meta() {
 
 export default function LibraryIndexRoute() {
   const t = useT();
+  const { sidebarHasNewRecordingAction } = usePageHeaderLayout();
   return (
     <LibraryGrid
       view="library"
       folderId={null}
       title="Library"
       extraActions={
-        <Button
-          className="gap-1.5 bg-primary text-primary-foreground shadow-sm hover:bg-primary/90"
-          size="sm"
-          asChild
-        >
-          <NavLink to="/record" aria-label={t("navigation.newRecording")}>
-            <IconPlayerRecord className="h-4 w-4" />
-            <span className="hidden sm:inline">
-              {t("navigation.newRecording")}
-            </span>
-          </NavLink>
-        </Button>
+        !sidebarHasNewRecordingAction && (
+          <Button
+            className="gap-1.5 bg-primary text-primary-foreground shadow-sm hover:bg-primary/90"
+            size="sm"
+            asChild
+          >
+            <NavLink to="/record" aria-label={t("navigation.newRecording")}>
+              <IconPlayerRecord className="h-4 w-4" />
+              <span className="hidden sm:inline">
+                {t("navigation.newRecording")}
+              </span>
+            </NavLink>
+          </Button>
+        )
       }
     />
   );

package/corpus/templates/clips/changelog/2026-07-10-new-recording-appears-once-when-the-library-sidebar-is-open.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-10
+---
+
+New recording appears once when the library sidebar is open.

package/corpus/templates/clips/changelog/2026-07-10-slack-token-fallback-guidance.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-10
+---
+
+Slack setup now more clearly separates the legacy unfurl token fallback from workspace connections and messaging automations.

package/corpus/templates/clips/server/register-secrets.ts

@@ -212,7 +212,7 @@ registerRequiredSecret({
   key: "SLACK_BOT_TOKEN",
   label: "Slack Bot Token (legacy)",
   description:
-    "Legacy single-workspace bot token fallback for Clips link unfurls. New installs should use the Slack OAuth connect flow.",
+    "Legacy single-workspace bot token fallback for Clips link unfurls. New installs should use the Clips Slack workspace connection; new messaging automations should connect Slack in Settings > Messaging.",
   docsUrl: "https://api.slack.com/apps",
   scope: "workspace",
   kind: "api-key",

package/corpus/templates/content/app/components/editor/DocumentEditor.tsx

@@ -50,7 +50,6 @@ import {
 } from "@/hooks/use-notion";
 import {
   canWriteLinkedLocalSource,
-  readDocumentFromLinkedLocalSource,
   writeDocumentToLinkedLocalSource,
 } from "@/lib/local-content-source-files";
 import { cn } from "@/lib/utils";
@@ -538,71 +537,6 @@ function DocumentEditorBody({ documentId, document }: DocumentEditorBodyProps) {
     }
   }, [document, documentId]);
 
-  useEffect(() => {
-    if (!isInitializedRef.current || !isLinkedLocalSourceDocument) {
-      return;
-    }
-
-    let cancelled = false;
-    readDocumentFromLinkedLocalSource(document)
-      .then((result) => {
-        if (cancelled) return;
-        if (!result.ok) {
-          toast.error(t("editor.couldNotReadLocalSourceFile"), {
-            description: result.error,
-          });
-          return;
-        }
-
-        const fileDocument = result.document;
-        setLocalTitle(fileDocument.title);
-        setLocalContent(fileDocument.content);
-        setLocalContentUpdatedAt(result.updatedAt);
-        lastSavedTitleRef.current = {
-          title: fileDocument.title,
-          updatedAt: result.updatedAt,
-        };
-        lastSavedContentRef.current = {
-          content: fileDocument.content,
-          updatedAt: result.updatedAt,
-        };
-        queryClient.setQueryData(
-          ["action", "get-document", { id: documentId }],
-          (old: Document | undefined) =>
-            old && typeof old === "object" ? { ...old, ...fileDocument } : old,
-        );
-        queryClient.setQueryData(
-          ["action", "list-documents", undefined],
-          (old: any) => {
-            const docs = old?.documents ?? (Array.isArray(old) ? old : null);
-            if (!Array.isArray(docs)) return old;
-            const nextDocs = docs.map((doc: Document) =>
-              doc.id === documentId ? { ...doc, ...fileDocument } : doc,
-            );
-            return Array.isArray(old)
-              ? nextDocs
-              : { ...old, documents: nextDocs };
-          },
-        );
-      })
-      .catch((error) => {
-        if (cancelled) return;
-        toast.error(t("editor.couldNotReadLocalSourceFile"), {
-          description:
-            error instanceof Error ? error.message : t("empty.genericError"),
-        });
-      });
-
-    return () => {
-      cancelled = true;
-    };
-  }, [
-    documentId,
-    document.source?.path,
-    isLinkedLocalSourceDocument,
-    queryClient,
-  ]);
-
   // NOTE: External body changes (agent edit, Notion pull, update-document) are
   // reconciled into the editor by VisualEditor via its content prop + the
   // updatedAt gate. The effects below keep DocumentEditor's own mirror

package/corpus/templates/content/app/routes/_app.local-files.tsx

@@ -814,13 +814,6 @@ export default function LocalFilesRoute() {
             count: restoredDirectories.length,
           }),
         });
-        await pullDirectories(restoredDirectories, {
-          showToast: false,
-          syncControlResources: false,
-        });
-        await connectLocalComponentWorkspaces(restoredDirectories, {
-          showToast: false,
-        });
         return;
       }
 
@@ -835,13 +828,6 @@ export default function LocalFilesRoute() {
           count: restoredDirectories.length,
         }),
       });
-      await pullDirectories(restoredDirectories, {
-        showToast: false,
-        syncControlResources: false,
-      });
-      await connectLocalComponentWorkspaces(restoredDirectories, {
-        showToast: false,
-      });
     };
     restoreDirectories()
       .catch((err) => {
@@ -943,32 +929,6 @@ export default function LocalFilesRoute() {
     return { directories: nextDirectories, result };
   }
 
-  async function pullDirectories(
-    selectedDirectories: SelectedDirectory[],
-    {
-      showToast = true,
-      syncControlResources = true,
-    }: { showToast?: boolean; syncControlResources?: boolean } = {},
-  ) {
-    let activeDirectories = selectedDirectories;
-    let latestResult: ImportContentSourceResult | null = null;
-    for (const directory of selectedDirectories) {
-      const pulled = await pullDirectoryFiles(directory, activeDirectories, {
-        syncControlResources,
-      });
-      latestResult = pulled.result;
-      activeDirectories = pulled.directories;
-    }
-    if (latestResult) {
-      setStatus({
-        kind: "success",
-        title: t("localFiles.foldersPulled"),
-        detail: resultSummary(latestResult, t),
-      });
-      if (showToast) toast.success(t("localFiles.pulledLocalFiles"));
-    }
-  }
-
   async function connectLocalComponentWorkspaces(
     selectedDirectories: SelectedDirectory[],
     { showToast = true }: { showToast?: boolean } = {},
@@ -1029,7 +989,13 @@ export default function LocalFilesRoute() {
       });
 
       setBusy(`pull:${selected.id}`);
-      await pullDirectories(nextDirectories);
+      const { result } = await pullDirectoryFiles(selected, nextDirectories);
+      setStatus({
+        kind: "success",
+        title: t("localFiles.foldersPulled"),
+        detail: resultSummary(result, t),
+      });
+      toast.success(t("localFiles.pulledLocalFiles"));
       await connectLocalComponentWorkspaces([selected]);
     } catch (err) {
       setStatus({
@@ -1171,12 +1137,6 @@ export default function LocalFilesRoute() {
         title: t("localFiles.folderRemoved"),
         detail: directory.name,
       });
-      if (nextDirectories.length === 1) {
-        await pullDirectories(nextDirectories, {
-          showToast: false,
-          syncControlResources: false,
-        });
-      }
     } catch (err) {
       setStatus({
         kind: "error",

package/corpus/templates/content/changelog/2026-07-10-local-folders-now-wait-for-an-explicit-pull-before-content-r.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-10
+---
+
+Local folders now wait for an explicit pull before Content reads them

package/corpus/templates/content/package.json

@@ -81,7 +81,7 @@
     "@swc/core": "^1.13.3",
     "@tailwindcss/typography": "^0.5.16",
     "@tailwindcss/vite": "catalog:",
-    "@tanstack/react-query": "^5.99.2",
+    "@tanstack/react-query": "5.101.2",
     "@types/node": "^24.2.1",
     "@types/react": "catalog:",
     "@types/react-dom": "catalog:",