@agent-native/core 0.96.0 → 0.98.0

package/dist/server/agent-chat/recurring-jobs-runtime.js

@@ -0,0 +1,53 @@
+// ---------------------------------------------------------------------------
+// Recurring-jobs runtime gating: decide whether this process should run the
+// local recurring-job scheduler loop (disabled by default on hosted runtimes
+// that already run a dedicated sweep, enabled by default for local/dev).
+// ---------------------------------------------------------------------------
+function isTruthyEnv(value) {
+    return /^(1|true|yes|on)$/i.test(value?.trim() ?? "");
+}
+function isLoopbackAppUrl(value) {
+    const raw = value?.trim();
+    if (!raw)
+        return false;
+    const candidates = /^[a-z][a-z0-9+.-]*:\/\//i.test(raw)
+        ? [raw]
+        : [raw, `http://${raw}`];
+    for (const candidate of candidates) {
+        try {
+            const url = new URL(candidate);
+            const host = url.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+            if (host === "localhost" ||
+                host === "127.0.0.1" ||
+                host === "0.0.0.0" ||
+                host === "::1" ||
+                host === "tauri.localhost" ||
+                host.endsWith(".localhost")) {
+                return true;
+            }
+        }
+        catch { }
+    }
+    return false;
+}
+export function shouldDisableRecurringJobsRuntime(env = process.env) {
+    if (isTruthyEnv(env.AGENT_NATIVE_DISABLE_RECURRING_JOBS))
+        return true;
+    const isLocalRuntime = env.NODE_ENV === "development" ||
+        env.NODE_ENV === "test" ||
+        [
+            env.APP_URL,
+            env.BETTER_AUTH_URL,
+            env.DEPLOY_URL,
+            env.URL,
+            env.VITE_APP_URL,
+            env.VITE_WORKSPACE_GATEWAY_URL,
+            env.WORKSPACE_GATEWAY_URL,
+        ].some(isLoopbackAppUrl);
+    if (isLocalRuntime &&
+        isTruthyEnv(env.AGENT_NATIVE_ENABLE_LOCAL_RECURRING_JOBS)) {
+        return false;
+    }
+    return isLocalRuntime;
+}
+//# sourceMappingURL=recurring-jobs-runtime.js.map

package/dist/server/agent-chat/recurring-jobs-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recurring-jobs-runtime.js","sourceRoot":"","sources":["../../../src/server/agent-chat/recurring-jobs-runtime.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAkB9E,SAAS,WAAW,CAAC,KAAyB;IAC5C,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,MAAM,GAAG,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAEvB,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;QACrD,CAAC,CAAC,CAAC,GAAG,CAAC;QACP,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,GAAG,EAAE,CAAC,CAAC;IAC3B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAChE,IACE,IAAI,KAAK,WAAW;gBACpB,IAAI,KAAK,WAAW;gBACpB,IAAI,KAAK,SAAS;gBAClB,IAAI,KAAK,KAAK;gBACd,IAAI,KAAK,iBAAiB;gBAC1B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC3B,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,GAAG,GAA4B,OAAO,CAAC,GAAG;IAE1C,IAAI,WAAW,CAAC,GAAG,CAAC,mCAAmC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtE,MAAM,cAAc,GAClB,GAAG,CAAC,QAAQ,KAAK,aAAa;QAC9B,GAAG,CAAC,QAAQ,KAAK,MAAM;QACvB;YACE,GAAG,CAAC,OAAO;YACX,GAAG,CAAC,eAAe;YACnB,GAAG,CAAC,UAAU;YACd,GAAG,CAAC,GAAG;YACP,GAAG,CAAC,YAAY;YAChB,GAAG,CAAC,0BAA0B;YAC9B,GAAG,CAAC,qBAAqB;SAC1B,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE3B,IACE,cAAc;QACd,WAAW,CAAC,GAAG,CAAC,wCAAwC,CAAC,EACzD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC","sourcesContent":["// ---------------------------------------------------------------------------\n// Recurring-jobs runtime gating: decide whether this process should run the\n// local recurring-job scheduler loop (disabled by default on hosted runtimes\n// that already run a dedicated sweep, enabled by default for local/dev).\n// ---------------------------------------------------------------------------\n\ntype RecurringJobsRuntimeEnvKey =\n  | \"AGENT_NATIVE_DISABLE_RECURRING_JOBS\"\n  | \"AGENT_NATIVE_ENABLE_LOCAL_RECURRING_JOBS\"\n  | \"APP_URL\"\n  | \"BETTER_AUTH_URL\"\n  | \"DEPLOY_URL\"\n  | \"NODE_ENV\"\n  | \"URL\"\n  | \"VITE_APP_URL\"\n  | \"VITE_WORKSPACE_GATEWAY_URL\"\n  | \"WORKSPACE_GATEWAY_URL\";\n\ntype RecurringJobsRuntimeEnv = Partial<\n  Record<RecurringJobsRuntimeEnvKey, string | undefined>\n>;\n\nfunction isTruthyEnv(value: string | undefined): boolean {\n  return /^(1|true|yes|on)$/i.test(value?.trim() ?? \"\");\n}\n\nfunction isLoopbackAppUrl(value: string | undefined): boolean {\n  const raw = value?.trim();\n  if (!raw) return false;\n\n  const candidates = /^[a-z][a-z0-9+.-]*:\\/\\//i.test(raw)\n    ? [raw]\n    : [raw, `http://${raw}`];\n  for (const candidate of candidates) {\n    try {\n      const url = new URL(candidate);\n      const host = url.hostname.toLowerCase().replace(/^\\[|\\]$/g, \"\");\n      if (\n        host === \"localhost\" ||\n        host === \"127.0.0.1\" ||\n        host === \"0.0.0.0\" ||\n        host === \"::1\" ||\n        host === \"tauri.localhost\" ||\n        host.endsWith(\".localhost\")\n      ) {\n        return true;\n      }\n    } catch {}\n  }\n\n  return false;\n}\n\nexport function shouldDisableRecurringJobsRuntime(\n  env: RecurringJobsRuntimeEnv = process.env,\n): boolean {\n  if (isTruthyEnv(env.AGENT_NATIVE_DISABLE_RECURRING_JOBS)) return true;\n\n  const isLocalRuntime =\n    env.NODE_ENV === \"development\" ||\n    env.NODE_ENV === \"test\" ||\n    [\n      env.APP_URL,\n      env.BETTER_AUTH_URL,\n      env.DEPLOY_URL,\n      env.URL,\n      env.VITE_APP_URL,\n      env.VITE_WORKSPACE_GATEWAY_URL,\n      env.WORKSPACE_GATEWAY_URL,\n    ].some(isLoopbackAppUrl);\n\n  if (\n    isLocalRuntime &&\n    isTruthyEnv(env.AGENT_NATIVE_ENABLE_LOCAL_RECURRING_JOBS)\n  ) {\n    return false;\n  }\n\n  return isLocalRuntime;\n}\n"]}

package/dist/server/agent-chat/request-surface.d.ts

@@ -0,0 +1,8 @@
+export declare function isLocalhost(event: any): boolean;
+export type AgentChatRequestSurface = "app" | "dev-frame" | "desktop";
+export declare function shouldBlockInProductCodeEditingSurface(input: {
+    surface?: string | null;
+    userAgent?: string | null;
+    host?: string | null;
+}): boolean;
+//# sourceMappingURL=request-surface.d.ts.map

package/dist/server/agent-chat/request-surface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-surface.d.ts","sourceRoot":"","sources":["../../../src/server/agent-chat/request-surface.ts"],"names":[],"mappings":"AAMA,wBAAgB,WAAW,CAAC,KAAK,EAAE,GAAG,GAAG,OAAO,CAW/C;AAED,MAAM,MAAM,uBAAuB,GAAG,KAAK,GAAG,WAAW,GAAG,SAAS,CAAC;AAoBtE,wBAAgB,sCAAsC,CAAC,KAAK,EAAE;IAC5D,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GAAG,OAAO,CA2BV"}

package/dist/server/agent-chat/request-surface.js

@@ -0,0 +1,56 @@
+// ---------------------------------------------------------------------------
+// Request-surface classification: distinguishes the framework-owned in-app
+// chat/dev-frame/desktop surfaces from arbitrary browser requests so
+// production code-editing tools stay blocked outside trusted surfaces.
+// ---------------------------------------------------------------------------
+export function isLocalhost(event) {
+    try {
+        const host = event.node?.req?.headers?.host || event.headers?.get?.("host") || "";
+        const hostname = host.split(":")[0];
+        return (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1");
+    }
+    catch {
+        return false;
+    }
+}
+function normalizeAgentChatRequestSurface(value) {
+    const normalized = (value ?? "").trim().toLowerCase();
+    if (normalized === "app" ||
+        normalized === "dev-frame" ||
+        normalized === "desktop") {
+        return normalized;
+    }
+    return null;
+}
+function isBrowserUserAgent(userAgent) {
+    return /Mozilla\/|Chrome\/|Safari\/|Firefox\/|Edg\//i.test(userAgent ?? "");
+}
+export function shouldBlockInProductCodeEditingSurface(input) {
+    const surface = normalizeAgentChatRequestSurface(input.surface);
+    if (surface === "dev-frame")
+        return false;
+    if (surface === "desktop")
+        return false;
+    if (surface === "app")
+        return true;
+    // Legacy clients used to send `frame` for any iframe, which includes the
+    // app-rendered sidebar inside preview frames. Treat unknown explicit surface
+    // values as app-owned so they cannot accidentally receive dev code tools.
+    if (input.surface && input.surface.trim())
+        return true;
+    const userAgent = input.userAgent ?? "";
+    if (/AgentNativeDesktop/i.test(userAgent))
+        return false;
+    // Missing header from an older browser client. Be conservative for browser
+    // UAs on any host, because preview URLs can be non-local while still running
+    // a dev-mode app whose in-product chat would be reloaded by source edits.
+    if (isBrowserUserAgent(userAgent))
+        return true;
+    const host = (input.host ?? "").toLowerCase();
+    const hostname = host.split(":")[0] ?? "";
+    return (hostname === "localhost" ||
+        hostname === "127.0.0.1" ||
+        hostname === "::1" ||
+        hostname === "[::1]");
+}
+//# sourceMappingURL=request-surface.js.map

package/dist/server/agent-chat/request-surface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-surface.js","sourceRoot":"","sources":["../../../src/server/agent-chat/request-surface.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2EAA2E;AAC3E,qEAAqE;AACrE,uEAAuE;AACvE,8EAA8E;AAE9E,MAAM,UAAU,WAAW,CAAC,KAAU;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,CACL,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,CAC3E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAID,SAAS,gCAAgC,CACvC,KAAgC;IAEhC,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IACE,UAAU,KAAK,KAAK;QACpB,UAAU,KAAK,WAAW;QAC1B,UAAU,KAAK,SAAS,EACxB,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,SAAoC;IAC9D,OAAO,8CAA8C,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,sCAAsC,CAAC,KAItD;IACC,MAAM,OAAO,GAAG,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAEnC,yEAAyE;IACzE,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IACxC,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAExD,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,kBAAkB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/C,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,KAAK;QAClB,QAAQ,KAAK,OAAO,CACrB,CAAC;AACJ,CAAC","sourcesContent":["// ---------------------------------------------------------------------------\n// Request-surface classification: distinguishes the framework-owned in-app\n// chat/dev-frame/desktop surfaces from arbitrary browser requests so\n// production code-editing tools stay blocked outside trusted surfaces.\n// ---------------------------------------------------------------------------\n\nexport function isLocalhost(event: any): boolean {\n  try {\n    const host =\n      event.node?.req?.headers?.host || event.headers?.get?.(\"host\") || \"\";\n    const hostname = host.split(\":\")[0];\n    return (\n      hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport type AgentChatRequestSurface = \"app\" | \"dev-frame\" | \"desktop\";\n\nfunction normalizeAgentChatRequestSurface(\n  value: string | null | undefined,\n): AgentChatRequestSurface | null {\n  const normalized = (value ?? \"\").trim().toLowerCase();\n  if (\n    normalized === \"app\" ||\n    normalized === \"dev-frame\" ||\n    normalized === \"desktop\"\n  ) {\n    return normalized;\n  }\n  return null;\n}\n\nfunction isBrowserUserAgent(userAgent: string | null | undefined): boolean {\n  return /Mozilla\\/|Chrome\\/|Safari\\/|Firefox\\/|Edg\\//i.test(userAgent ?? \"\");\n}\n\nexport function shouldBlockInProductCodeEditingSurface(input: {\n  surface?: string | null;\n  userAgent?: string | null;\n  host?: string | null;\n}): boolean {\n  const surface = normalizeAgentChatRequestSurface(input.surface);\n  if (surface === \"dev-frame\") return false;\n  if (surface === \"desktop\") return false;\n  if (surface === \"app\") return true;\n\n  // Legacy clients used to send `frame` for any iframe, which includes the\n  // app-rendered sidebar inside preview frames. Treat unknown explicit surface\n  // values as app-owned so they cannot accidentally receive dev code tools.\n  if (input.surface && input.surface.trim()) return true;\n\n  const userAgent = input.userAgent ?? \"\";\n  if (/AgentNativeDesktop/i.test(userAgent)) return false;\n\n  // Missing header from an older browser client. Be conservative for browser\n  // UAs on any host, because preview URLs can be non-local while still running\n  // a dev-mode app whose in-product chat would be reloaded by source edits.\n  if (isBrowserUserAgent(userAgent)) return true;\n\n  const host = (input.host ?? \"\").toLowerCase();\n  const hostname = host.split(\":\")[0] ?? \"\";\n  return (\n    hostname === \"localhost\" ||\n    hostname === \"127.0.0.1\" ||\n    hostname === \"::1\" ||\n    hostname === \"[::1]\"\n  );\n}\n"]}

package/dist/server/agent-chat/run-code-tools.d.ts

@@ -0,0 +1,17 @@
+import type { ActionEntry } from "../../agent/production-agent.js";
+/**
+ * Load the sandboxed code-execution tool entries for one action registry:
+ * `run-code` plus its `get-code-execution` poll companion. The poll tool is
+ * registered ALONGSIDE run-code everywhere run-code appears, so the durable
+ * background-execution guidance run-code emits ("check it with
+ * get-code-execution") always points at a callable tool. Returns an empty
+ * registry when the coding module is unavailable (e.g. bundled browser
+ * build), mirroring the prior silent-skip behavior.
+ *
+ * Exported for tests — the plugin init calls this for the prod, lean, and dev
+ * tool bags, so a spec on this helper pins the real registration wiring.
+ */
+export declare function loadRunCodeToolEntries(supplier: () => Record<string, ActionEntry>, runCodeOptions?: {
+    bridgeTools?: string[];
+}): Promise<Record<string, ActionEntry>>;
+//# sourceMappingURL=run-code-tools.d.ts.map

package/dist/server/agent-chat/run-code-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-code-tools.d.ts","sourceRoot":"","sources":["../../../src/server/agent-chat/run-code-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,EAC3C,cAAc,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GAC1C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAgCtC"}

package/dist/server/agent-chat/run-code-tools.js

@@ -0,0 +1,55 @@
+/**
+ * Load the sandboxed code-execution tool entries for one action registry:
+ * `run-code` plus its `get-code-execution` poll companion. The poll tool is
+ * registered ALONGSIDE run-code everywhere run-code appears, so the durable
+ * background-execution guidance run-code emits ("check it with
+ * get-code-execution") always points at a callable tool. Returns an empty
+ * registry when the coding module is unavailable (e.g. bundled browser
+ * build), mirroring the prior silent-skip behavior.
+ *
+ * Exported for tests — the plugin init calls this for the prod, lean, and dev
+ * tool bags, so a spec on this helper pins the real registration wiring.
+ */
+export async function loadRunCodeToolEntries(supplier, runCodeOptions) {
+    try {
+        const { createRunCodeEntry, createGetCodeExecutionEntry } = await import("../../coding-tools/run-code.js");
+        const entries = {
+            "run-code": createRunCodeEntry(supplier, runCodeOptions),
+            "get-code-execution": createGetCodeExecutionEntry(),
+        };
+        // Data programs: stored JS scripts executed through this same run-code
+        // sandbox, cached in SQL, and rendered by dashboard panels. Registered
+        // identically to run-code — same try/dynamic-import guard, silently
+        // skipped when the module is unavailable (e.g. bundled browser build) —
+        // so every app gets the primitive without per-template wiring.
+        try {
+            const { initDataPrograms, createDataProgramActions } = await import("../../data-programs/index.js");
+            const appId = resolveDataProgramsAppId();
+            initDataPrograms({ appId, getActions: supplier });
+            Object.assign(entries, createDataProgramActions({ appId, getActions: supplier }));
+        }
+        catch {
+            // Module unavailable — skip silently, mirroring the run-code guard above.
+        }
+        return entries;
+    }
+    catch {
+        // Module unavailable (e.g. bundled browser build) — skip silently.
+        return {};
+    }
+}
+/**
+ * Resolve the stable app identity data programs are scoped under. Mirrors
+ * the precedent in `cli/agent.ts` (`AGENT_NATIVE_APP_ID` env override, then
+ * `APP_ID`, then a fixed fallback) — data programs don't need a per-call
+ * agent-supplied appId the way staged datasets do (staged datasets are
+ * scratch space the agent explicitly stages into); a data program is a
+ * persisted resource scoped to "this app deployment".
+ */
+function resolveDataProgramsAppId() {
+    return (process.env.AGENT_NATIVE_APP_ID?.trim() ||
+        process.env.APP_ID?.trim() ||
+        process.env.APP_NAME?.trim() ||
+        "app");
+}
+//# sourceMappingURL=run-code-tools.js.map

package/dist/server/agent-chat/run-code-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-code-tools.js","sourceRoot":"","sources":["../../../src/server/agent-chat/run-code-tools.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAA2C,EAC3C,cAA2C;IAE3C,IAAI,CAAC;QACH,MAAM,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,GACvD,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACjD,MAAM,OAAO,GAAgC;YAC3C,UAAU,EAAE,kBAAkB,CAAC,QAAQ,EAAE,cAAc,CAAC;YACxD,oBAAoB,EAAE,2BAA2B,EAAE;SACpD,CAAC;QAEF,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;QACxE,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,GAClD,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,wBAAwB,EAAE,CAAC;YACzC,gBAAgB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CACX,OAAO,EACP,wBAAwB,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAC1D,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB;IAC/B,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE;QACvC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE;QAC1B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE;QAC5B,KAAK,CACN,CAAC;AACJ,CAAC","sourcesContent":["import type { ActionEntry } from \"../../agent/production-agent.js\";\n\n/**\n * Load the sandboxed code-execution tool entries for one action registry:\n * `run-code` plus its `get-code-execution` poll companion. The poll tool is\n * registered ALONGSIDE run-code everywhere run-code appears, so the durable\n * background-execution guidance run-code emits (\"check it with\n * get-code-execution\") always points at a callable tool. Returns an empty\n * registry when the coding module is unavailable (e.g. bundled browser\n * build), mirroring the prior silent-skip behavior.\n *\n * Exported for tests — the plugin init calls this for the prod, lean, and dev\n * tool bags, so a spec on this helper pins the real registration wiring.\n */\nexport async function loadRunCodeToolEntries(\n  supplier: () => Record<string, ActionEntry>,\n  runCodeOptions?: { bridgeTools?: string[] },\n): Promise<Record<string, ActionEntry>> {\n  try {\n    const { createRunCodeEntry, createGetCodeExecutionEntry } =\n      await import(\"../../coding-tools/run-code.js\");\n    const entries: Record<string, ActionEntry> = {\n      \"run-code\": createRunCodeEntry(supplier, runCodeOptions),\n      \"get-code-execution\": createGetCodeExecutionEntry(),\n    };\n\n    // Data programs: stored JS scripts executed through this same run-code\n    // sandbox, cached in SQL, and rendered by dashboard panels. Registered\n    // identically to run-code — same try/dynamic-import guard, silently\n    // skipped when the module is unavailable (e.g. bundled browser build) —\n    // so every app gets the primitive without per-template wiring.\n    try {\n      const { initDataPrograms, createDataProgramActions } =\n        await import(\"../../data-programs/index.js\");\n      const appId = resolveDataProgramsAppId();\n      initDataPrograms({ appId, getActions: supplier });\n      Object.assign(\n        entries,\n        createDataProgramActions({ appId, getActions: supplier }),\n      );\n    } catch {\n      // Module unavailable — skip silently, mirroring the run-code guard above.\n    }\n\n    return entries;\n  } catch {\n    // Module unavailable (e.g. bundled browser build) — skip silently.\n    return {};\n  }\n}\n\n/**\n * Resolve the stable app identity data programs are scoped under. Mirrors\n * the precedent in `cli/agent.ts` (`AGENT_NATIVE_APP_ID` env override, then\n * `APP_ID`, then a fixed fallback) — data programs don't need a per-call\n * agent-supplied appId the way staged datasets do (staged datasets are\n * scratch space the agent explicitly stages into); a data program is a\n * persisted resource scoped to \"this app deployment\".\n */\nfunction resolveDataProgramsAppId(): string {\n  return (\n    process.env.AGENT_NATIVE_APP_ID?.trim() ||\n    process.env.APP_ID?.trim() ||\n    process.env.APP_NAME?.trim() ||\n    \"app\"\n  );\n}\n"]}

package/dist/server/agent-chat/script-entries.d.ts

@@ -0,0 +1,47 @@
+import type { ActionEntry } from "../../agent/production-agent.js";
+import type { DatabaseToolsMode } from "../../scripts/db/tool-mode.js";
+/**
+ * Creates db-* tools (db-query, db-exec, db-patch, db-schema) as native tools.
+ * By default these let the agent inspect the app's own SQL database; raw SQL
+ * writes are only exposed when the app explicitly opts into write mode.
+ * Scoping to the current user/org is enforced automatically in production via
+ * temp views.
+ *
+ * In dev mode template actions are invoked via bash and the agent can call
+ * `pnpm action db-query ...` — but in production there is no bash, so these
+ * must be registered as native tools for the agent to reach the app DB at all.
+ */
+export declare function createDbScriptEntries(mode?: DatabaseToolsMode, options?: {
+    extensionTools?: boolean;
+}): Promise<Record<string, ActionEntry>>;
+/**
+ * Creates read-only package lookup tools so agents can inspect version-matched
+ * framework docs and source bundled in @agent-native/core at runtime.
+ */
+export declare function createDocsScriptEntries(): Promise<Record<string, ActionEntry>>;
+/**
+ * Creates resource ScriptEntries available in both prod and dev modes.
+ */
+export declare function shouldDefaultResourceWriteToWorkspace(path: string): boolean;
+export declare function createResourceScriptEntries(): Promise<Record<string, ActionEntry>>;
+/**
+ * Creates a unified chat-history ActionEntry that dispatches to search, open,
+ * rename, or lightweight organization actions.
+ */
+export declare function createChatScriptEntries(): Promise<Record<string, ActionEntry>>;
+/**
+ * Creates the consolidated manage-agent-engine tool (list / set / test).
+ * Let the agent inspect and configure the active LLM engine.
+ */
+export declare function createAgentEngineScriptEntries(appId?: string): Promise<Record<string, ActionEntry>>;
+/**
+ * Creates the manage-agent-loop-settings tool. Lets the agent inspect and
+ * configure the loop step limit it may hit on long-running work.
+ */
+export declare function createAgentLoopSettingsScriptEntries(): Promise<Record<string, ActionEntry>>;
+/**
+ * Creates the call-agent ActionEntry for cross-agent A2A communication.
+ * Binds selfAppId so the agent cannot call itself via call-agent.
+ */
+export declare function createCallAgentScriptEntry(selfAppId?: string): Promise<Record<string, ActionEntry>>;
+//# sourceMappingURL=script-entries.d.ts.map

package/dist/server/agent-chat/script-entries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"script-entries.d.ts","sourceRoot":"","sources":["../../../src/server/agent-chat/script-entries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAQnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AA6CvE;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,GAAE,iBAA0B,EAChC,OAAO,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACzC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CA4ItC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAwEA;AAED;;GAEG;AACH,wBAAgB,qCAAqC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAW3E;AAED,wBAAsB,2BAA2B,IAAI,OAAO,CAC1D,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAuPA;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CACtD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAqJA;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAClD,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAqBtC;AAED;;;GAGG;AACH,wBAAsB,oCAAoC,IAAI,OAAO,CACnE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAC5B,CAUA;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAYtC"}