@agent-native/core 0.97.0 → 0.98.1

package/corpus/README.md

@@ -27,5 +27,5 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- core files: 2198
-- template files: 5395
+- core files: 2233
+- template files: 5475

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,61 @@
 # @agent-native/core
 
+## 0.98.1
+
+### Patch Changes
+
+- ee7b5b3: Keep assistant chat's duplicate-message recovery installed when assistant-ui swaps the underlying thread runtime during reconnects or thread changes.
+- ee7b5b3: Use the browser's preferred language for more accurate realtime voice transcripts.
+- ee7b5b3: Prevent chat and realtime voice from starting before AI provider readiness is known, and reliably surface setup when no provider is connected.
+- ee7b5b3: Update the session replay recorder to the latest stable rrweb release for more faithful browser capture.
+- ee7b5b3: Skip degenerate hand-drawn frame paths that can overflow the browser call stack while a visual block is still measuring.
+- ee7b5b3: Type nullable organization parameters in integration scope, budget, and workspace MCP queries so PostgreSQL can reliably prepare them.
+- ee7b5b3: Prevent sync-driven request storms by preserving in-flight reads, filtering same-tab action echoes, targeting action-query invalidation, refreshing shared run state from change events, and backing idle Dispatch monitoring away from fixed polling.
+- ee7b5b3: Reduce the width and height of centered full-page chat composers for a more compact starting state.
+- ee7b5b3: Use dated changelog filenames when a hand-written entry omits its release date.
+- ee7b5b3: Polish realtime voice settings, keep them open while using nested pickers, and add live microphone selection.
+- ee7b5b3: Show the full Builder model catalog in the app default model setting instead of filtering suggestions to the current model.
+- ee7b5b3: Support app-scoped encryption keys so multi-app development environments can safely read each app's encrypted data.
+- ee7b5b3: Keep full-page chat open when a user navigates to Settings.
+- ee7b5b3: Keep API key settings compact and move unconfigured providers and custom credentials behind a single New menu.
+- ee7b5b3: Ignore expected browser autoplay-policy rejections emitted by recorded media during session replay playback.
+- ee7b5b3: Let realtime voice discover and load app tools on demand while preserving guarded action execution.
+- ee7b5b3: Prevent the agent prompt composer from crashing when a destroyed editor reconnects after remount or browser history restoration.
+- ee7b5b3: Keep realtime voice waveforms visible between turns, show a clear connection spinner, complete the spoken ready greeting, prioritize navigation tools, flatten the orb into a translucent surface, preserve chronological voice transcripts, improve transcription language accuracy, keep popovers and the voice dock clear of the agent panel, and add in-call language, intelligence, and voice controls.
+- ee7b5b3: Simplify the chat model picker to Claude, OpenAI, Gemini, and OpenRouter, with OpenRouter listed last.
+
+## 0.98.0
+
+### Minor Changes
+
+- 38ca6fa: Add an opt-in projected resource load to access checks so callers that only need the access decision can skip fetching heavy resource columns. Default behavior unchanged.
+
+  `resolveAccess()`/`assertAccess()` now accept `{ skipResourceBody: true }` (as the trailing options argument) to load only the columns the access decision itself reads — `id`, `ownerEmail`, `orgId`, `visibility` — instead of the full resource row (`resource` is typed as `AccessProjectedResource` in this mode). This is automatically ignored, falling back to a full row load, for any resource type registered with a `publicAccessRole` _function_ resolver, since that callback can read arbitrary resource fields the projection would have omitted. Passing nothing (the default) is a pure no-op: `loadResourceForAccess` still runs `db.select()` exactly as before, so none of the ~317 existing `assertAccess`/`resolveAccess` call sites change behavior.
+
+  This is a mechanism only — no call sites are migrated in this change. `templates/design/actions/update-design.ts`'s bare `assertAccess("design", id, "editor")` — which currently pulls the full `data` blob it doesn't otherwise need — was the motivating example and is the intended first adopter as a follow-up. Note: the `"design"` resource type itself is registered with a dynamic `publicAccessRole` resolver (`publicDesignAccessRole`), which the guard above always excludes from projection, so that specific call would keep loading the full row even after opting in; `"design-system"` (checked a few lines later in the same action) has no such resolver and is a real candidate. Follow-up migration work should account for this per resource type rather than assuming every `assertAccess`/`resolveAccess` call site benefits.
+
+### Patch Changes
+
+- 38ca6fa: Fix realtime voice microphone selection, connection teardown, stalled sessions, and compact audio-reactive controls.
+- 38ca6fa: Add an optional `agentInputSchema` to `defineAction` — a Standard Schema used ONLY to build the tool definition advertised to the model/MCP/A2A listings, while runtime validation keeps enforcing the full `schema`. Applied it in `templates/plan` to `create-visual-plan`, `create-ui-plan`, `create-plan-design`, `create-prototype-plan`, `update-visual-plan`, and `update-local-plan-folder`: their advertised `content`/`contentPatches` block shapes now show a compact `type` enum plus a pointer to `get-plan-blocks` instead of embedding the full per-block-type union, cutting each action's serialized tool definition by roughly half to three-quarters (largest actions went from ~55-58KB down to ~24-27KB; the rest from ~45-47KB down to ~13-15KB) without changing what content is accepted or how validation errors are reported.
+- 38ca6fa: Default app chats to compact first-turn tool and resource catalogs, keep uncommon actions, instructions, and integrations discoverable on demand, parallelize resource summaries, and record first-request prompt and tool payload sizes in run diagnostics.
+- 38ca6fa: Add optional content-free positive, negative, and neutral message sentiment tracking, enabled by default for first-party hosted apps with GPT-5.6 Luna.
+- 38ca6fa: Advertise and accept the standard `offline_access` OAuth scope so ChatGPT MCP apps can retain refresh-token access without repeated sign-in.
+- 38ca6fa: Removed the long-deprecated `ProductionAgentPanel` and `useProductionAgent` client exports (superseded by `AgentSidebar`/`AgentToggleButton`). No internal consumers remained.
+- 38ca6fa: Track content-free positive and negative sentiment events for explicit agent response feedback, including the associated model when available.
+- 38ca6fa: Render one cacheable, session-independent app shell for normal page requests and gate private UI through `AppProviders` on the client. Explicit auth pages remain cached login documents, signed-in visitors redirect without cache-buster query loops, APIs/actions remain server-protected, and generated edge workers now enforce the same anonymous public-shell cache policy as Nitro and Netlify.
+- 38ca6fa: Keep React Router hydration scoped to an app's workspace mount path so index redirects and nested pages route correctly.
+- 38ca6fa: Coalesce Nitro dev full-reloads so bursts of file edits trigger one server re-import instead of one per file.
+- 38ca6fa: Reduce serialized tool-schema payload on background agent runs. `webhook-handler.ts` and `google-docs-poller.ts` now defer framework-added tools (integration memory, `call-agent`) behind an attached `tool-search` entry on the first request, keeping only the app's own actions visible up front — `createIntegrationsPlugin` supplies the app action names via a new `initialToolNames` option. `scheduler.ts` (`SchedulerDeps.getInitialToolNames`), `dispatcher.ts` (`TriggerDispatcherDeps.getInitialToolNames`), and `agent-teams.ts` (`AgentTeamRunConfig.initialToolNames`) gained the same opt-in filtering plumbing (tool-search attach + `filterInitialEngineTools` + `availableTools` for mid-run expansion), inactive by default so existing behavior is unchanged until a caller supplies an initial tool list.
+- 38ca6fa: Reduce first-request token usage further: recurring jobs and automation triggers now defer framework-addition tools behind tool-search instead of always seeing the full registry; the MCP `ask_app` inner loop now uses the same compact initial-tool surface as interactive chat and A2A; the corpus-tools prompt (provider-api-request/provider-corpus-job/query-staged-dataset/run-code) no longer teaches tools by name that are missing from the first request's active tool set; oversized LEARNINGS.md/MEMORY.md content is capped instead of inlined in full outside lazy-context mode; and the First-Session Personalization block is now gated on the owner's persisted `personalization` flag instead of thread history, so a thread's system prompt stays byte-identical across turns 1 and 2 (fixing a prompt-cache break on every thread's second request).
+- 38ca6fa: Keep realtime voice setup actions on one line, describe Builder credits as free, and prevent false setup prompts by cross-checking successful connection statuses.
+- 38ca6fa: Explain browser loopback permissions and bridge lifecycle requirements when serving local Plans.
+- 38ca6fa: Motion polish across shared UI: overlay primitives (tooltip, popover, select, context/menubar menus) now scale from their trigger, exit with ease-out, and respect prefers-reduced-motion; new shared easing tokens (--ease-drawer, --ease-collapse, --ease-out-strong); press feedback on the shared Button and composer send button; GPU-friendly progress fills; chat tool cells (files-changed/edit/write) animate open/closed like other disclosures.
+- 38ca6fa: Add an Extensions docs shortcut and tighten the new-extension composer spacing.
+- 38ca6fa: Show retryable error states when extension lists, widget installs, slot metadata, or extension history fail to load instead of presenting persisted extensions as empty or missing.
+- Updated dependencies [38ca6fa]
+  - @agent-native/toolkit@0.4.7
+
 ## 0.97.0
 
 ### Minor Changes

package/corpus/core/docs/content/authentication.mdx

@@ -285,7 +285,7 @@ Unauthenticated MCP requests return a `WWW-Authenticate` challenge pointing at `
 
 </Diagram>
 
-Access tokens are signed with `A2A_SECRET` when set, otherwise `BETTER_AUTH_SECRET`. They carry the signed user/org identity and the `mcp:read`, `mcp:write`, and/or `mcp:apps` scopes, and are audience-bound to the exact MCP resource URL. Refresh tokens are stored only as hashes and rotate on every refresh. Tool calls and MCP Apps resource reads run inside the same request context as the signed-in user; the embedded MCP App iframe never receives raw OAuth tokens.
+Access tokens are signed with `A2A_SECRET` when set, otherwise `BETTER_AUTH_SECRET`. They carry the signed user/org identity and the `mcp:read`, `mcp:write`, `mcp:apps`, and/or `offline_access` scopes, and are audience-bound to the exact MCP resource URL. `offline_access` is advertised for hosts such as ChatGPT that require it before retaining refresh access. Refresh tokens are stored only as hashes and rotate on every refresh. Tool calls and MCP Apps resource reads run inside the same request context as the signed-in user; the embedded MCP App iframe never receives raw OAuth tokens.
 
 `npx @agent-native/core@latest connect <url> --client claude-code` writes the URL-only MCP entry for this standard flow. For clients that cannot perform remote MCP OAuth, use the Connect page or `npx @agent-native/core@latest connect --token <token>` fallback to write an explicit bearer-token entry.
 
@@ -380,7 +380,7 @@ Templates with **public pages** (share links, embeds, marketing pages) often nee
 /_agent-native/sign-in?return=<same-origin-path>
 ```
 
-When an anonymous viewer hits this URL, the framework's login page is served. After a successful sign-in (any flow — token, email/password, or Google OAuth), the viewer is 302'd to `return`.
+When an anonymous viewer hits this URL, the framework's login page is served. After a successful sign-in (any flow — token, email/password, or Google OAuth), the browser returns to `return`.
 
 The `return` parameter is validated as a **same-origin path**. Network-path references (`//evil.com/...`), absolute URLs, `data:` / `javascript:` schemes, and embedded control characters all fall back to `/`. The validated path is reconstructed from the URL parser, not echoed back from the input.
 
@@ -401,7 +401,7 @@ function SignInCta() {
 
 ### Bookmarked private paths
 
-When an anonymous user navigates directly to a private path like `/dashboard`, the framework already serves the login page at that URL — after successful sign-in, the page reloads and the user lands on `/dashboard`. No special handling needed; this works for token, email/password, **and** Google OAuth.
+Normal app pages use one impersonal, public-cacheable SSR shell for every visitor. `AppProviders` checks the session on the client; on a private path such as `/dashboard`, it redirects an anonymous visitor to `/_agent-native/sign-in?return=%2Fdashboard` before mounting private app UI. After sign-in, the visitor returns to `/dashboard`. Pass `isPublicPath` for public/SEO routes, or `sessionBypass` for a surface that authenticates through another scoped mechanism such as an MCP embed token.
 
 ### Behind the scenes: Google OAuth
 

package/corpus/core/docs/content/doctor.mdx

@@ -0,0 +1,170 @@
+---
+title: "Doctor (Code Checks)"
+description: "agent-native doctor scans a generated app's source for the framework's security and architecture invariants — the same code-safety guards this monorepo enforces on itself, ported to run against a single app root."
+---
+
+# Doctor (Code Checks)
+
+The agent can write this app's own source code. `agent-native doctor` is the automated check for that: it scans app source for the framework's security-critical code-safety invariants — the same class of check that lives in this framework's own CI as `scripts/guard-*.mjs` — ported to run against a single generated app instead of the framework's multi-template monorepo layout. It's read-only: doctor never edits your code, it only reports.
+
+## Quick start {#quick-start}
+
+```bash
+agent-native doctor
+```
+
+Every scaffolded app also gets a `pnpm doctor` script that runs the same command:
+
+```bash
+pnpm doctor
+```
+
+A clean run:
+
+```
+agent-native doctor: /path/to/app
+Guards run: no-drizzle-push, no-unscoped-credentials, no-unscoped-queries, no-env-credentials, db-tool-scoping, no-env-mutation, no-localhost-fallback
+Clean — no findings.
+```
+
+A run with findings prints one line per finding and exits `1`:
+
+```
+2 finding(s):
+  [no-env-credentials] server/routes/webhook.ts:14 — process.env.STRIPE_KEY read — not a deploy-level allowlisted key. User credentials must be read via resolveCredential(key, { userEmail, orgId }), never process.env.
+  [no-unscoped-queries] actions/list-notes.ts:9 — unscoped select on "notes" (drizzle) — add accessFilter/resolveAccess/assertAccess or an explicit ownerEmail/userEmail/orgId filter.
+
+agent-native doctor found issues above. Fix them, or add a `// guard:allow-<check> — reason` opt-out with reviewer approval.
+```
+
+## The seven guards {#guards}
+
+v1 ships 7 guards. Each is a pure scan over the app's source tree — `node_modules`, `.git`, `dist`, `build`, and other build-output directories are always skipped.
+
+| Guard                     | What it catches                                                                                                                                                                                                                            | Why it matters                                                                                                                                                                                                                                                                             |
+| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `no-drizzle-push`         | `drizzle-kit push` / `drizzle push` wired into a build/deploy script hook (`build`, `install`, `deploy`, `start`, `ci`, `release`, and their `pre`/`post` variants) or a `netlify.toml` build command                                      | `drizzle-kit push` can apply destructive schema changes on every deploy with no review step. Standalone `db:push` scripts are **not** flagged — those are explicit, human-invoked commands, not build hooks.                                                                               |
+| `no-unscoped-credentials` | `resolveCredential` / `hasCredential` / `saveCredential` / `deleteCredential` called with only one argument                                                                                                                                | The one-arg form skips the required `{ userEmail, orgId }` context object, so a per-user credential lookup can read (or delete) another tenant's credential.                                                                                                                               |
+| `no-unscoped-queries`     | A query in `actions/` or `server/` against a table built with `...ownableColumns()`, with no `accessFilter` / `resolveAccess` / `assertAccess` and no explicit `ownerEmail` / `userEmail` / `orgId` filter anywhere in the enclosing block | An unscoped `select`/`update`/`delete`/`insert` on a shared table returns or mutates another user's rows. Also flags a `mentionProviders` search closure that queries an ownable table without access control — every user who types `@` in chat would otherwise see rows owned by others. |
+| `no-env-credentials`      | Any `process.env.<KEY>` read whose key isn't on the fixed deploy-var allowlist (`DATABASE_URL`, `BETTER_AUTH_SECRET`, `NODE_ENV`, …), plus any dynamic `process.env[key]` read                                                             | `process.env` is one shared value per deployment, read on every signed-in user's request — reading a per-user credential from it pools every tenant onto the same secret. A dynamic key can never be safely allowlisted.                                                                   |
+| `db-tool-scoping`         | A table in `server/db/schema.ts` with no `owner_email` / `org_id` column and no matching entry in `agent-native.json`'s `doctor.dbToolScopingDenylist`                                                                                     | The agent's raw `db-query` / `db-exec` / `db-patch` tools can only safely expose tenant-scoped tables; an unscoped table needs an explicit, reviewed exception.                                                                                                                            |
+| `no-env-mutation`         | Production code assigning to, or `delete`-ing, `process.env.KEY`                                                                                                                                                                           | `process.env` is process-scoped, not request-scoped. A warm serverless container handles many concurrent requests in one process, so mutating `process.env` in a request handler leaks state across users. Use `runWithRequestContext` instead.                                            |
+| `no-localhost-fallback`   | The literal `"local@localhost"`, or `?? DEV_MODE_USER_EMAIL` / `\|\| DEV_MODE_USER_EMAIL`, used as a fallback identity                                                                                                                     | Falling back to a sentinel identity when there's no session pools every unauthenticated request onto one shared tenant. Throw or return 401 instead.                                                                                                                                       |
+
+Guard names are stable identifiers — the same strings work in `--only`, `agent-native.json`'s `doctor.disabledGuards`, and every finding's `guard` field.
+
+## Flags and exit codes {#flags}
+
+```
+agent-native doctor                        Scan app source for security-critical guard violations
+agent-native doctor --json                 Machine-readable report: { ok, findings, guardsRun, strict }
+agent-native doctor --only <guard,guard>   Run only the named guard(s)
+agent-native doctor --strict               Escalate findings to a hard failure when used by `agent-native build --strict`
+agent-native doctor --cwd <dir>            Run against a project root other than the current directory
+agent-native doctor --fix                  Not implemented in this version
+agent-native doctor --help                 Show this help
+```
+
+- `--only` takes a comma-separated list of guard names from the table above, e.g. `--only no-env-credentials,no-env-mutation`. An unknown name exits `2` with a usage error before any scan runs.
+- `--strict`, on the standalone `agent-native doctor` command, only tags the `--json` output's `strict` field — the command already exits `1` on any finding whether or not `--strict` is passed. It matters when `agent-native build --strict` runs doctor as a pre-step; see [The build hook](#build-hook).
+- `--fix` is reserved for a future version. Passing it today prints an error and exits `2` instead of silently doing nothing, so a script that already passes `--fix` fails loudly rather than getting a false "clean."
+
+Exit codes: **`0`** clean, **`1`** findings present, **`2`** usage or execution error (a bad `--cwd`, an unknown `--only` guard, or `--fix`).
+
+## The build hook {#build-hook}
+
+`agent-native build` always runs doctor as a pre-step before the real build. It's **warn-only by default**: findings print to stderr prefixed `[doctor]`, and the build continues. It only turns findings into a hard failure — `process.exit(1)` before the build runs — when:
+
+- `agent-native build --strict` was passed, or
+- `agent-native.json` sets `{ "doctor": { "failOnBuild": true } }`.
+
+If the doctor pre-step itself throws — an unreadable file, a bug in a guard — the build step catches it, logs a warning, and continues. A doctor bug never blocks a deploy on its own.
+
+## Per-app configuration {#config}
+
+`agent-native.json`'s optional `"doctor"` key. Every field is optional with an empty/false default, so a fresh app runs every v1 guard with zero config:
+
+```json
+{
+  "doctor": {
+    "disabledGuards": ["no-drizzle-push"],
+    "dbToolScopingDenylist": {
+      "legacy_import_log": "Write-only ingestion table, no per-user reads — reviewed 2026-06-01."
+    },
+    "failOnBuild": true
+  }
+}
+```
+
+| Key                     | Type                    | Effect                                                                                                                                                                                                                                     |
+| ----------------------- | ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `disabledGuards`        | `string[]`              | Guard names (from the table above) to skip — excluded from the default run and from the build hook. An explicit `--only` list overrides this and runs even a disabled guard.                                                               |
+| `dbToolScopingDenylist` | `Record<table, reason>` | Bare table name (the SQL name, not template-prefixed) → reviewer-readable reason. Used only by `db-tool-scoping`. A denylist entry with no matching table in `server/db/schema.ts` itself becomes a finding — "stale … entry — remove it." |
+| `failOnBuild`           | `boolean`               | See [The build hook](#build-hook). Default `false`.                                                                                                                                                                                        |
+
+## Opt-out markers {#opt-out}
+
+Five of the seven guards support a per-line comment marker with a required short reason after an em dash or hyphen:
+
+```ts
+// guard:allow-unscoped-credential — support tool reads any user's key by design, gated on admin role
+const key = resolveCredential("stripe_secret");
+```
+
+| Guard                     | Marker                                        | Placement                                                                                 |
+| ------------------------- | --------------------------------------------- | ----------------------------------------------------------------------------------------- |
+| `no-unscoped-credentials` | `// guard:allow-unscoped-credential — reason` | Same line as the call                                                                     |
+| `no-unscoped-queries`     | `// guard:allow-unscoped — reason`            | Anywhere in the enclosing block, or in the file's first 30 lines for a whole-file opt-out |
+| `no-env-credentials`      | `// guard:allow-env-credential — reason`      | Same line, or the line immediately above                                                  |
+| `no-env-mutation`         | `// guard:allow-env-mutation — reason`        | Same line, or the line immediately above                                                  |
+| `no-localhost-fallback`   | `// guard:allow-localhost-fallback — reason`  | Same line, or the line immediately above                                                  |
+
+`no-drizzle-push` has no opt-out marker — remove the forbidden script instead. `db-tool-scoping` doesn't use a code comment at all; add the table to `agent-native.json`'s `doctor.dbToolScopingDenylist` with a reason (above).
+
+A reason is required: `no-unscoped-credentials`, `no-env-credentials`, `no-env-mutation`, and `no-localhost-fallback` all reject a marker with no text after the dash — for `no-env-credentials` specifically, a reasonless marker still reports as an "opt-out invalid" finding rather than being silently accepted. `no-unscoped-queries`'s marker doesn't syntactically enforce a reason, but every opt-out should still carry one for the next reviewer.
+
+## JSON output for CI {#json-output}
+
+The actual `--json` payload also carries a `strict` field reflecting whether `--strict` was passed (the `--help` summary line above omits it for brevity):
+
+```json
+{
+  "ok": false,
+  "findings": [
+    {
+      "guard": "no-env-mutation",
+      "file": "server/middleware/auth.ts",
+      "line": 22,
+      "message": "process.env mutated in production code: process.env.AGENT_USER_EMAIL = userEmail. process.env is process-scoped, not request-scoped — use runWithRequestContext instead."
+    }
+  ],
+  "guardsRun": [
+    "no-drizzle-push",
+    "no-unscoped-credentials",
+    "no-unscoped-queries",
+    "no-env-credentials",
+    "db-tool-scoping",
+    "no-env-mutation",
+    "no-localhost-fallback"
+  ],
+  "strict": false
+}
+```
+
+`ok` is `true` only when `findings` is empty. `guardsRun` lists every guard that actually ran (after `--only` / `disabledGuards` filtering) — useful for confirming a guard wasn't silently skipped.
+
+The JSON report always writes to **stdout**, whether the run is clean or has findings — the exit code (`0` clean, `1` findings present) is the signal for pass/fail, not which stream the report landed on. A plain `agent-native doctor --json > report.json` captures the full report in every case, including a non-clean run; no stream redirection tricks needed. (Usage/execution errors — a bad `--cwd`, an unknown `--only` guard — still print their own JSON error payload to stderr and exit `2`; those aren't the report.)
+
+## Doctor vs. upgrade check vs. recap doctor {#relationship}
+
+`agent-native doctor` is one of three "doctor"-shaped commands in the CLI, each diagnosing a different domain — none are folded into a shared mega-doctor:
+
+- **`agent-native doctor`** (this page) — source-code safety invariants: data scoping, credential handling, environment-variable usage.
+- **`agent-native upgrade check`** — dependency-pin health: stale `@agent-native/*` pins, framework overrides/patches.
+- **`agent-native recap doctor`** — PR Visual Recap configuration health.
+
+## What's next
+
+- [**Security & Data Scoping**](/docs/security) — the `ownableColumns()` / access-guard model that `no-unscoped-queries` and `db-tool-scoping` enforce
+- [**Audit Log**](/docs/audit-log) — the durable record of who changed what, for after a mutation lands
+- [**Deployment**](/docs/deployment) — where `agent-native build` and `agent-native.json` fit into shipping

package/corpus/core/docs/content/external-agents.mdx

@@ -137,7 +137,7 @@ snapshot until you refresh/review it again, so rescan the connector after MCP
 tool or MCP App metadata changes. If you still have old per-app connectors
 enabled alongside Dispatch, refresh or reconnect each stale connector; updating
 Dispatch does not rewrite ChatGPT or Claude's cached Calendar/Mail/etc.
-snapshots. The `mcp:read` / `mcp:write` / `mcp:apps` scopes are the same ones
+snapshots. The `mcp:read` / `mcp:write` / `mcp:apps` / `offline_access` scopes are the same ones
 covered in [Standard remote MCP OAuth](#standard-oauth) below.
 
 Cursor, Goose, Postman, MCPJam, and VS Code GitHub Copilot use the same remote
@@ -284,13 +284,14 @@ The OAuth flow is authorization-code + PKCE with refresh-token rotation. Access
 
 Current scopes are:
 
-| Scope       | Allows                                                                    |
-| ----------- | ------------------------------------------------------------------------- |
-| `mcp:read`  | read-only MCP actions and ordinary tool/resource discovery                |
-| `mcp:write` | mutating actions and the `ask-agent` meta-tool                            |
-| `mcp:apps`  | MCP Apps resource listing/reading and inline UI rendering where supported |
+| Scope            | Allows                                                                    |
+| ---------------- | ------------------------------------------------------------------------- |
+| `mcp:read`       | read-only MCP actions and ordinary tool/resource discovery                |
+| `mcp:write`      | mutating actions and the `ask-agent` meta-tool                            |
+| `mcp:apps`       | MCP Apps resource listing/reading and inline UI rendering where supported |
+| `offline_access` | refresh-token access so compatible hosts can stay connected               |
 
-When the client requests no explicit scope, the app grants all three so the connector behaves like the browser-authorized Connect flow. Keep the bearer-token Connect page and `npx @agent-native/core@latest connect --token <token>` fallback around for local dev, fallback hosts, and clients where you need a ready-to-paste config block.
+When the client requests no explicit scope, the app grants all four so the connector behaves like the browser-authorized Connect flow and can refresh access without another sign-in. Keep the bearer-token Connect page and `npx @agent-native/core@latest connect --token <token>` fallback around for local dev, fallback hosts, and clients where you need a ready-to-paste config block.
 
 ## Catalog tiers {#catalog-tiers}
 

package/corpus/core/docs/content/locales/ar-SA/authentication.mdx

@@ -283,7 +283,7 @@ https://mail.agent-native.com/_agent-native/mcp
 
 </Diagram>
 
-يتم توقيع رموز الوصول باستخدام `A2A_SECRET` عند تعيينها، وإلا مع `BETTER_AUTH_SECRET`. وهي تحمل هوية المستخدم/المؤسسة الموقعة ونطاقات `mcp:read` و/أو `mcp:write` و/أو `mcp:apps`، وهي مرتبطة بالجمهور بمورد MCP الدقيق URL. يتم تخزين رموز التحديث فقط كتجزئة ويتم تدويرها عند كل تحديث. يتم تشغيل استدعاءات الأدوات وقراءات موارد تطبيقات MCP داخل نفس سياق الطلب مثل المستخدم الذي قام بتسجيل الدخول؛ لا يتلقى إطار iframe لتطبيق MCP المضمن رموز OAuth الأولية أبدًا.
+يتم توقيع رموز الوصول باستخدام `A2A_SECRET` عند تعيينها، وإلا مع `BETTER_AUTH_SECRET`. وهي تحمل هوية المستخدم/المؤسسة الموقعة ونطاقات `mcp:read` و/أو `mcp:write` و/أو `mcp:apps` and `offline_access`، وهي مرتبطة بالجمهور بمورد MCP الدقيق URL. يتم تخزين رموز التحديث فقط كتجزئة ويتم تدويرها عند كل تحديث. يتم تشغيل استدعاءات الأدوات وقراءات موارد تطبيقات MCP داخل نفس سياق الطلب مثل المستخدم الذي قام بتسجيل الدخول؛ لا يتلقى إطار iframe لتطبيق MCP المضمن رموز OAuth الأولية أبدًا.
 
 يكتب `npx @agent-native/core@latest connect <url> --client claude-code` إدخال URL فقط MCP لهذا التدفق القياسي. بالنسبة للعملاء الذين لا يمكنهم تنفيذ MCP OAuth عن بعد، استخدم صفحة الاتصال أو البديل `npx @agent-native/core@latest connect --token <token>` لكتابة إدخال صريح للرمز المميز للحامل.
 
@@ -400,7 +400,7 @@ function SignInCta() {
 
 ### المسارات الخاصة ذات الإشارات المرجعية
 
-عندما ينتقل مستخدم مجهول مباشرة إلى مسار خاص مثل `/dashboard`، فإن إطار العمل يخدم بالفعل صفحة تسجيل الدخول في URL - بعد تسجيل الدخول الناجح، تتم إعادة تحميل الصفحة ويصل المستخدم إلى `/dashboard`. لا حاجة إلى معالجة خاصة؛ يعمل هذا مع الرمز المميز والبريد الإلكتروني/كلمة المرور و**و**Google OAuth.
+تستخدم صفحات التطبيق العادية غلاف SSR واحدًا عامًا وقابلاً للتخزين المؤقت لجميع الزوار. يتحقق `AppProviders` من الجلسة على العميل؛ وفي مسار خاص مثل `/dashboard` يعيد توجيه الزائر المجهول إلى `/_agent-native/sign-in?return=%2Fdashboard` قبل عرض واجهة التطبيق الخاصة. بعد تسجيل الدخول يعود الزائر إلى `/dashboard`. استخدم `isPublicPath` للمسارات العامة أو مسارات SEO، أو `sessionBypass` لسطح تتم مصادقته بآلية محددة أخرى مثل رمز تضمين MCP.
 
 ### خلف الكواليس: Google OAuth
 

package/corpus/core/docs/content/locales/ar-SA/external-agents.mdx

@@ -136,7 +136,7 @@ ChatGPT: استخدم مساحة عمل حيث توجد موصلات MCP الم
 تغييرات البيانات التعريفية لتطبيق MCP. إذا كان لا يزال لديك موصلات قديمة لكل تطبيق
 ممكّن جنبًا إلى جنب مع Dispatch أو تحديث أو إعادة توصيل كل موصل قديم؛ التحديث
 لا يقوم Dispatch بإعادة كتابة تقويم/بريد ChatGPT أو Claude المخزن مؤقتًا/البريد/إلخ.
-لقطات. نطاقات `mcp:read` / `mcp:write` / `mcp:apps` هي نفسها الموضحة في
+لقطات. نطاقات `mcp:read` / `mcp:write` / `mcp:apps` / `offline_access` هي نفسها الموضحة في
 [OAuth القياسي لـ MCP البعيد](#standard-oauth) أدناه.
 
 يستخدم كل من Cursor وGoose وPostman وMCPJam وVS Code GitHub Copilot نفس جهاز التحكم عن بعد
@@ -283,13 +283,14 @@ https://dispatch.agent-native.com/_agent-native/mcp
 
 النطاقات الحالية هي:
 
-| النطاق      | يسمح                                                               |
-| ----------- | ------------------------------------------------------------------ |
-| `mcp:read`  | MCP actions للقراءة فقط واكتشاف الأدوات/الموارد العادية            |
-| `mcp:write` | تعديل actions والأداة الوصفية `ask-agent`                          |
-| `mcp:apps`  | قائمة/قراءة موارد تطبيقات MCP وعرض UI المضمن حيثما يكون ذلك متاحًا |
+| النطاق           | يسمح                                                               |
+| ---------------- | ------------------------------------------------------------------ |
+| `mcp:read`       | MCP actions للقراءة فقط واكتشاف الأدوات/الموارد العادية            |
+| `mcp:write`      | تعديل actions والأداة الوصفية `ask-agent`                          |
+| `mcp:apps`       | قائمة/قراءة موارد تطبيقات MCP وعرض UI المضمن حيثما يكون ذلك متاحًا |
+| `offline_access` | الوصول إلى رمز التحديث حتى يظل المضيف متصلاً                       |
 
-عندما لا يطلب العميل نطاقًا صريحًا، يمنح التطبيق الثلاثة جميعًا بحيث يتصرف الموصل مثل تدفق الاتصال المعتمد من المتصفح. احتفظ بصفحة Connect-token Connect و`npx @agent-native/core@latest connect --token <token>` الاحتياطية للمطورين المحليين والمضيفين الاحتياطيين والعملاء حيث تحتاج إلى كتلة تكوين جاهزة لللصق.
+عندما لا يطلب العميل نطاقًا صريحًا، يمنح التطبيق النطاقات الأربعة جميعًا بحيث يتصرف الموصل مثل تدفق الاتصال المعتمد من المتصفح ويمكنه تحديث الوصول دون تسجيل دخول آخر. احتفظ بصفحة Connect-token Connect و`npx @agent-native/core@latest connect --token <token>` الاحتياطية للمطورين المحليين والمضيفين الاحتياطيين والعملاء حيث تحتاج إلى كتلة تكوين جاهزة لللصق.
 
 ## طبقات الكتالوج {#catalog-tiers}
 

package/corpus/core/docs/content/locales/ar-SA/mcp-protocol.mdx

@@ -240,7 +240,7 @@ claude mcp add --transport http agent-native https://dispatch.agent-native.com/_
 
 ```http
 HTTP/1.1 401 Unauthorized
-WWW-Authenticate: Bearer resource_metadata="https://dispatch.agent-native.com/.well-known/oauth-protected-resource", scope="mcp:read mcp:write mcp:apps"
+WWW-Authenticate: Bearer resource_metadata="https://dispatch.agent-native.com/.well-known/oauth-protected-resource", scope="mcp:read mcp:write mcp:apps offline_access"
 ```
 
 اكتشاف نقاط النهاية:

package/corpus/core/docs/content/locales/ar-SA/security.mdx

@@ -388,6 +388,8 @@ A2A_SECRET=your-shared-secret-at-least-32-chars
 - [ ] \*\*لم يتم تعيين `AGENT_NATIVE_KEYS_WORKSPACE_FALLBACK` ما لم تشارك مؤسستك مفاتيح مساحة العمل فعليًا - راجع [Cross-User Tooling Secrets](#tooling-secrets)
 - [ ] في عمليات النشر متعددة المستأجرين، **يحضر المستخدمون `ANTHROPIC_API_KEY`** — يرفض إطار العمل الرجوع إلى env على مستوى النشر var
 
+شغّل `agent-native doctor` (أو `pnpm doctor` في تطبيق تم إنشاؤه بالقالب) للتحقق تلقائيًا من عناصر المخطط وبيانات الاعتماد ومتغيرات البيئة في هذه القائمة — يذكر كل اكتشاف اسم الحارس (guard) والملف والسطر. راجع وثائق [Doctor](/docs/doctor).
+
 ---
 
 تغطي الأقسام أدناه علامات البيئة المتخصصة التي تصل إليها فقط في عمليات نشر محددة. معظم التطبيقات لا تلمسها أبدًا.

package/corpus/core/docs/content/locales/de-DE/authentication.mdx

@@ -402,7 +402,7 @@ function SignInCta() {
 
 ### Private Pfade mit Lesezeichen versehen
 
-Wenn ein anonymer Benutzer direkt zu einem privaten Pfad wie `/dashboard` navigiert, stellt das Framework bereits die Anmeldeseite unter diesem URL bereit – nach erfolgreicher Anmeldung wird die Seite neu geladen und der Benutzer landet auf `/dashboard`. Keine besondere Handhabung erforderlich; Dies funktioniert für Token, E-Mail/Passwort, **und** Google OAuth.
+Normale App-Seiten verwenden für alle Besucher dieselbe unpersönliche, öffentlich cachebare SSR-Shell. `AppProviders` prüft die Sitzung im Client und leitet anonyme Besucher auf privaten Pfaden wie `/dashboard` zu `/_agent-native/sign-in?return=%2Fdashboard` weiter, bevor private App-UI gerendert wird. Nach der Anmeldung kehren sie zu `/dashboard` zurück. Verwenden Sie `isPublicPath` für öffentliche/SEO-Routen oder `sessionBypass` für Oberflächen mit einem anderen begrenzten Authentifizierungsmechanismus, etwa einem MCP-Embed-Token.
 
 ### Hinter den Kulissen: Google OAuth
 

package/corpus/core/docs/content/locales/de-DE/external-agents.mdx

@@ -136,7 +136,7 @@ Snapshot, bis Sie ihn erneut aktualisieren/überprüfen, also scannen Sie den Co
 Tool- oder MCP-App-Metadatenänderungen. Wenn Sie noch alte Pro-App-Konnektoren haben
 neben Dispatch aktiviert, jeden veralteten Connector aktualisieren oder erneut verbinden; Aktualisierung
 Dispatch schreibt den zwischengespeicherten Kalender/Mail/usw. von ChatGPT oder Claude nicht neu.
-Schnappschüsse. Die Bereiche `mcp:read` / `mcp:write` / `mcp:apps` sind
+Schnappschüsse. Die Bereiche `mcp:read` / `mcp:write` / `mcp:apps` / `offline_access` sind
 dieselben, die unten unter [Standard-OAuth für Remote-MCP](#standard-oauth)
 beschrieben werden.
 
@@ -284,13 +284,14 @@ Der OAuth-Fluss besteht aus Autorisierungscode + PKCE mit Aktualisierungstokenro
 
 Aktuelle Bereiche sind:
 
-| Geltungsbereich | Erlaubt                                                                             |
-| --------------- | ----------------------------------------------------------------------------------- |
-| `mcp:read`      | schreibgeschützt MCP actions und normale Tool-/Ressourcenerkennung                  |
-| `mcp:write`     | Mutation von actions und dem Meta-Tool `ask-agent`                                  |
-| `mcp:apps`      | MCP Auflisten/Lesen von Apps-Ressourcen und Inline-UI-Rendering, sofern unterstützt |
+| Geltungsbereich  | Erlaubt                                                                             |
+| ---------------- | ----------------------------------------------------------------------------------- |
+| `mcp:read`       | schreibgeschützt MCP actions und normale Tool-/Ressourcenerkennung                  |
+| `mcp:write`      | Mutation von actions und dem Meta-Tool `ask-agent`                                  |
+| `mcp:apps`       | MCP Auflisten/Lesen von Apps-Ressourcen und Inline-UI-Rendering, sofern unterstützt |
+| `offline_access` | Aktualisierungstokenzugriff, damit der Host verbunden bleibt                        |
 
-Wenn der Client keinen expliziten Bereich anfordert, gewährt die App alle drei, sodass sich der Connector wie der vom Browser autorisierte Connect-Flow verhält. Behalten Sie die Bearer-Token-Connect-Seite und den `npx @agent-native/core@latest connect --token <token>`-Fallback für lokale Entwickler, Fallback-Hosts und Clients bei, bei denen Sie einen sofort einfügbaren Konfigurationsblock benötigen.
+Wenn der Client keinen expliziten Bereich anfordert, gewährt die App alle vier, sodass sich der Connector wie der vom Browser autorisierte Connect-Flow verhält und den Zugriff ohne erneute Anmeldung aktualisieren kann. Behalten Sie die Bearer-Token-Connect-Seite und den `npx @agent-native/core@latest connect --token <token>`-Fallback für lokale Entwickler, Fallback-Hosts und Clients bei, bei denen Sie einen sofort einfügbaren Konfigurationsblock benötigen.
 
 ## Katalogstufen {#catalog-tiers}
 

package/corpus/core/docs/content/locales/de-DE/mcp-protocol.mdx

@@ -240,7 +240,7 @@ Die erste nicht authentifizierte MCP-Anfrage erhält:
 
 ```http
 HTTP/1.1 401 Unauthorized
-WWW-Authenticate: Bearer resource_metadata="https://dispatch.agent-native.com/.well-known/oauth-protected-resource", scope="mcp:read mcp:write mcp:apps"
+WWW-Authenticate: Bearer resource_metadata="https://dispatch.agent-native.com/.well-known/oauth-protected-resource", scope="mcp:read mcp:write mcp:apps offline_access"
 ```
 
 Erkennungsendpunkte:

package/corpus/core/docs/content/locales/de-DE/security.mdx

@@ -390,6 +390,8 @@ Dies war zuvor eine „Warnen und Akzeptieren“-Haltung – legen Sie das Gehei
 - [ ] `AGENT_NATIVE_KEYS_WORKSPACE_FALLBACK` ist **nicht** festgelegt, es sei denn, Ihre Organisation teilt tatsächlich Arbeitsbereichsschlüssel – siehe [Cross-User Tooling Secrets](#tooling-secrets)
 - [ ] In mandantenfähigen Bereitstellungen **bringen Benutzer ihr eigenes `ANTHROPIC_API_KEY` mit** – das Framework weigert sich, auf die Umgebungsvariable auf Bereitstellungsebene zurückzugreifen
 
+Führen Sie `agent-native doctor` aus (`pnpm doctor` in einer gescaffoldeten App), um die Schema-, Credential- und Umgebungsvariablen-Punkte dieser Checkliste automatisch zu prüfen – jeder Befund nennt Guard, Datei und Zeile. Siehe die [Doctor](/docs/doctor)-Dokumentation.
+
 ---
 
 In den folgenden Abschnitten werden Nischenumgebungsflags behandelt, die Sie nur in bestimmten Bereitstellungen erreichen. Die meisten Apps berühren sie nie.

package/corpus/core/docs/content/locales/es-ES/authentication.mdx

@@ -381,7 +381,7 @@ Las plantillas con **páginas públicas** (enlaces compartidos, incrustaciones,
 /_agent-native/sign-in?return=<same-origin-path>
 ```
 
-Cuando un espectador anónimo accede a este URL, se muestra la página de inicio de sesión del marco. Después de un inicio de sesión exitoso (cualquier flujo: token, correo electrónico/contraseña o Google OAuth), el espectador pasa a la ruta 302 a `return`.
+Cuando un espectador anónimo accede a este URL, se muestra la página de inicio de sesión del marco. Después de un inicio de sesión exitoso (cualquier flujo: token, correo electrónico/contraseña o Google OAuth), el navegador vuelve a `return`.
 
 El parámetro `return` se valida como **ruta del mismo origen**. Las referencias de ruta de red (`//evil.com/...`), los esquemas URL absolutos, `data:`/`javascript:` y los caracteres de control integrados recurren a `/`. La ruta validada se reconstruye a partir del analizador URL, no se repite desde la entrada.
 
@@ -402,7 +402,7 @@ function SignInCta() {
 
 ### Rutas privadas marcadas
 
-Cuando un usuario anónimo navega directamente a una ruta privada como `/dashboard`, el marco ya muestra la página de inicio de sesión en ese URL; después de iniciar sesión correctamente, la página se vuelve a cargar y el usuario llega a `/dashboard`. No se necesita manipulación especial; esto funciona para token, correo electrónico/contraseña y **y** Google OAuth.
+Las páginas normales de la aplicación usan una única shell SSR impersonal y almacenable en caché pública para todos los visitantes. `AppProviders` comprueba la sesión en el cliente; en una ruta privada como `/dashboard`, redirige al visitante anónimo a `/_agent-native/sign-in?return=%2Fdashboard` antes de montar la interfaz privada. Tras iniciar sesión, vuelve a `/dashboard`. Usa `isPublicPath` para rutas públicas o de SEO, o `sessionBypass` para una superficie autenticada mediante otro mecanismo limitado, como un token de inserción MCP.
 
 ### Detrás de escena: Google OAuth
 

package/corpus/core/docs/content/locales/es-ES/external-agents.mdx

@@ -136,7 +136,7 @@ instantánea hasta que la actualices/revises nuevamente, así que vuelve a escan
 o de la aplicación MCP. Si todavía tienes conectores antiguos por aplicación
 habilitado junto con Dispatch, actualiza o vuelve a conectar cada conector obsoleto; actualizando
 Dispatch no reescribe el calendario/correo/etc. almacenados en caché de ChatGPT o Claude.
-instantáneas. Los ámbitos `mcp:read` / `mcp:write` / `mcp:apps` son los mismos
+instantáneas. Los ámbitos `mcp:read` / `mcp:write` / `mcp:apps` / `offline_access` son los mismos
 que se explican más abajo en
 [OAuth remoto estándar de MCP](#standard-oauth).
 
@@ -284,13 +284,14 @@ El flujo OAuth es código de autorización + PKCE con rotación de token de actu
 
 Los alcances actuales son:
 
-| Alcance     | Permite                                                                                            |
-| ----------- | -------------------------------------------------------------------------------------------------- |
-| `mcp:read`  | MCP actions de solo lectura y descubrimiento de herramientas/recursos ordinarios                   |
-| `mcp:write` | mutando actions y la metaherramienta `ask-agent`                                                   |
-| `mcp:apps`  | Lista/lectura de recursos de aplicaciones MCP y representación en línea de UI donde sea compatible |
+| Alcance          | Permite                                                                                            |
+| ---------------- | -------------------------------------------------------------------------------------------------- |
+| `mcp:read`       | MCP actions de solo lectura y descubrimiento de herramientas/recursos ordinarios                   |
+| `mcp:write`      | mutando actions y la metaherramienta `ask-agent`                                                   |
+| `mcp:apps`       | Lista/lectura de recursos de aplicaciones MCP y representación en línea de UI donde sea compatible |
+| `offline_access` | Acceso al token de actualización para que el host permanezca conectado                             |
 
-Cuando el cliente no solicita ningún alcance explícito, la aplicación concede los tres para que el conector se comporte como el flujo de Connect autorizado por el navegador. Mantenga la página de conexión del token de portador y el respaldo `npx @agent-native/core@latest connect --token <token>` para desarrolladores locales, hosts de respaldo y clientes donde necesite un bloque de configuración listo para pegar.
+Cuando el cliente no solicita ningún alcance explícito, la aplicación concede los cuatro para que el conector se comporte como el flujo de Connect autorizado por el navegador y pueda actualizar el acceso sin otro inicio de sesión. Mantenga la página de conexión del token de portador y el respaldo `npx @agent-native/core@latest connect --token <token>` para desarrolladores locales, hosts de respaldo y clientes donde necesite un bloque de configuración listo para pegar.
 
 ## Niveles del catálogo {#catalog-tiers}
 

package/corpus/core/docs/content/locales/es-ES/mcp-protocol.mdx

@@ -240,7 +240,7 @@ La primera solicitud MCP no autenticada recibe:
 
 ```http
 HTTP/1.1 401 Unauthorized
-WWW-Authenticate: Bearer resource_metadata="https://dispatch.agent-native.com/.well-known/oauth-protected-resource", scope="mcp:read mcp:write mcp:apps"
+WWW-Authenticate: Bearer resource_metadata="https://dispatch.agent-native.com/.well-known/oauth-protected-resource", scope="mcp:read mcp:write mcp:apps offline_access"
 ```
 
 Puntos finales de descubrimiento:

package/corpus/core/docs/content/locales/es-ES/security.mdx

@@ -390,6 +390,8 @@ Esta era anteriormente una postura de "advertir y aceptar": establezca el secret
 - [ ] `AGENT_NATIVE_KEYS_WORKSPACE_FALLBACK` **no** está configurado a menos que su organización realmente comparta claves de espacio de trabajo; consulte [Cross-User Tooling Secrets](#tooling-secrets)
 - [ ] En implementaciones multiinquilino, **los usuarios traen su propio `ANTHROPIC_API_KEY`**: el marco se niega a recurrir a la var de entorno de nivel de implementación
 
+Ejecuta `agent-native doctor` (`pnpm doctor` en una app generada con el scaffold) para comprobar automáticamente los elementos de esquema, credenciales y variables de entorno de esta lista de verificación — cada hallazgo indica el guard, el archivo y la línea. Consulta la documentación de [Doctor](/docs/doctor).
+
 ---
 
 Las secciones siguientes cubren indicadores de entornos especializados que solo utiliza en implementaciones específicas. La mayoría de las aplicaciones nunca los tocan.

package/corpus/core/docs/content/locales/fr-FR/authentication.mdx

@@ -402,7 +402,7 @@ function SignInCta() {
 
 ### Chemins privés marqués
 
-Lorsqu'un utilisateur anonyme accède directement à un chemin privé tel que `/dashboard`, le framework dessert déjà la page de connexion sur ce URL : une fois la connexion réussie, la page se recharge et l'utilisateur atterrit sur `/dashboard`. Aucune manipulation particulière n'est nécessaire ; cela fonctionne pour le jeton, l'e-mail/mot de passe et **et** Google OAuth.
+Les pages normales de l’application utilisent une seule coque SSR impersonnelle et mise en cache publiquement pour tous les visiteurs. `AppProviders` vérifie la session côté client ; sur un chemin privé tel que `/dashboard`, il redirige un visiteur anonyme vers `/_agent-native/sign-in?return=%2Fdashboard` avant de monter l’interface privée. Après connexion, le visiteur revient sur `/dashboard`. Utilisez `isPublicPath` pour les routes publiques/SEO, ou `sessionBypass` pour une surface authentifiée par un autre mécanisme limité, tel qu’un jeton d’intégration MCP.
 
 ### Dans les coulisses : Google OAuth
 

package/corpus/core/docs/content/locales/fr-FR/external-agents.mdx

@@ -136,7 +136,7 @@ instantané jusqu'à ce que vous l'actualisiez/le révisiez à nouveau, donc ana
 ou de l'application MCP. Si vous disposez encore d'anciens connecteurs par application
 activé avec Dispatch, actualisez ou reconnectez chaque connecteur obsolète ; mise à jour
 Dispatch ne réécrit pas le calendrier/courrier/etc mis en cache de ChatGPT ou Claude.
-instantanés. Les portées `mcp:read` / `mcp:write` / `mcp:apps` sont les mêmes
+instantanés. Les portées `mcp:read` / `mcp:write` / `mcp:apps` / `offline_access` sont les mêmes
 que celles décrites plus bas dans
 [OAuth MCP distant standard](#standard-oauth).
 
@@ -284,13 +284,14 @@ Le flux OAuth est le code d'autorisation + PKCE avec rotation du jeton d'actuali
 
 Les champs d'application actuels sont les suivants :
 
-| Portée      | Autorise                                                                                      |
-| ----------- | --------------------------------------------------------------------------------------------- |
-| `mcp:read`  | MCP actions en lecture seule et découverte d'outils/ressources ordinaires                     |
-| `mcp:write` | mutation de actions et du méta-outil `ask-agent`                                              |
-| `mcp:apps`  | Liste/lecture des ressources des applications MCP et rendu UI en ligne lorsque pris en charge |
+| Portée           | Autorise                                                                                      |
+| ---------------- | --------------------------------------------------------------------------------------------- |
+| `mcp:read`       | MCP actions en lecture seule et découverte d'outils/ressources ordinaires                     |
+| `mcp:write`      | mutation de actions et du méta-outil `ask-agent`                                              |
+| `mcp:apps`       | Liste/lecture des ressources des applications MCP et rendu UI en ligne lorsque pris en charge |
+| `offline_access` | Accès au jeton d'actualisation afin que l'hôte reste connecté                                 |
 
-Lorsque le client ne demande aucune portée explicite, l'application accorde les trois afin que le connecteur se comporte comme le flux Connect autorisé par le navigateur. Conservez la page de connexion du jeton de porteur et la solution de secours `npx @agent-native/core@latest connect --token <token>` pour les développeurs locaux, les hôtes de secours et les clients pour lesquels vous avez besoin d'un bloc de configuration prêt à coller.
+Lorsque le client ne demande aucune portée explicite, l'application accorde les quatre afin que le connecteur se comporte comme le flux Connect autorisé par le navigateur et puisse actualiser l'accès sans nouvelle connexion. Conservez la page de connexion du jeton de porteur et la solution de secours `npx @agent-native/core@latest connect --token <token>` pour les développeurs locaux, les hôtes de secours et les clients pour lesquels vous avez besoin d'un bloc de configuration prêt à coller.
 
 ## Niveaux du catalogue {#catalog-tiers}
 

package/corpus/core/docs/content/locales/fr-FR/mcp-protocol.mdx

@@ -240,7 +240,7 @@ La première requête MCP non authentifiée reçoit :
 
 ```http
 HTTP/1.1 401 Unauthorized
-WWW-Authenticate: Bearer resource_metadata="https://dispatch.agent-native.com/.well-known/oauth-protected-resource", scope="mcp:read mcp:write mcp:apps"
+WWW-Authenticate: Bearer resource_metadata="https://dispatch.agent-native.com/.well-known/oauth-protected-resource", scope="mcp:read mcp:write mcp:apps offline_access"
 ```
 
 Points de terminaison de découverte :