@agent-native/core 0.99.1 → 0.99.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.99.1",
+  "version": "0.99.3",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/src/templates/workspace-core/.agents/skills/native-navigation/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: native-navigation
+description: >-
+  Use when adding or reviewing UI navigation so internal routes preserve
+  normal SPA behavior plus Cmd/Ctrl-click and middle-click new-tab semantics.
+scope: dev
+---
+
+# Native Navigation
+
+## Rule
+
+Pure navigation must render a real React Router `<Link>` for same-SPA routes,
+a native `<a href>` for external/public or explicit new-tab destinations, or a
+shadcn `Button asChild` wrapper around one. Do not use a button whose only job
+is to call `navigate()`, `window.open()`, or `window.location`.
+
+## Why
+
+Browser modifier-click, middle-click, keyboard activation, accessibility, and
+normal client-side routing come from real links. Imperative JavaScript
+navigation hides the destination and blocks those browser semantics.
+
+## How
+
+```tsx
+import { Link } from "react-router";
+
+<Link to={`/items/${item.id}`}>...</Link>
+
+<Button asChild>
+  <Link to="/settings">Settings</Link>
+</Button>
+
+<a href={previewUrl} target="_blank" rel="noopener noreferrer">
+  Preview
+</a>
+```
+
+- Use `Link` for same-SPA internal routes.
+- Use `<a>` when the URL is external, crosses an app/public boundary, is an
+  auth or sign-in destination, or intentionally opens in a new tab.
+- Preserve query strings and hashes in `to` or `href`.
+- For cards with nested actions, link only the non-interactive card region or
+  use a transparent Link overlay; never nest links or buttons.
+- If selection mode changes click behavior, prevent default only for an
+  unmodified primary click and preserve modified clicks.
+
+Keep imperative navigation for post-mutation redirects, OAuth and popup flows,
+downloads, media/blob URLs, playback, keyboard shortcuts, and stateful tabs.
+
+## Review
+
+Search for `onClick={() => navigate`, `window.open`, `window.location`,
+`onAuxClick`, and buttons whose only purpose is routing. For each candidate,
+confirm whether it is pure navigation or a stateful workflow before changing
+it.
+
+Verify the rendered DOM exposes an `href`, then test normal click, Cmd/Ctrl-click,
+middle-click, keyboard Enter, and nested controls where applicable. Run oxfmt
+and focused app tests or typechecks for the touched package.
+
+## Related Skills
+
+- `client-side-routing`
+- `frontend-design`
+- `shadcn-ui`

package/corpus/core/src/demo/actions/toggle-demo-mode.ts

@@ -1,23 +0,0 @@
-import { z } from "zod";
-
-import { defineAction } from "../../action.js";
-import { writeAppState } from "../../application-state/script-helpers.js";
-
-export default defineAction({
-  description:
-    "Turn demo mode on or off. When demo mode is on, the UI replaces every email address with anonymous@builder.io and supported dashboards reshape chart values for presentations. Agent-visible results use the same anonymous email and anonymize numbers while keeping names, free text, labels, IDs, dates, and structure intact. Use when the user asks to 'hide my data', 'turn on demo mode', 'anonymize this for a screen share / recording', or similar. This is the same toggle as the Demo mode switch in settings.",
-  schema: z.object({
-    enabled: z
-      .boolean()
-      .describe("true to turn demo mode on, false to turn it off."),
-  }),
-  run: async ({ enabled }) => {
-    await writeAppState("demo-mode", { enabled });
-    return {
-      enabled,
-      message: enabled
-        ? "Demo mode is ON — UI emails are anonymized and supported dashboard charts are reshaped for presentation. Agent-visible emails and numbers are also anonymized. Names, free text, labels, IDs, and structure are preserved."
-        : "Demo mode is OFF — real data is shown again.",
-    };
-  },
-});

package/corpus/core/src/demo/config.ts

@@ -1,57 +0,0 @@
-/**
- * Demo mode gate.
- *
- * Demo mode replaces every email address with `anonymous@builder.io` and
- * anonymizes numbers in every action result — for both the UI and what the
- * agent sees — while preserving names, free text, labels, IDs, dates, URLs,
- * and structure so the app keeps working. The redaction WALK (see ./redact.ts)
- * is expensive on large payloads, so callers MUST gate it behind this function
- * and only walk when it returns true.
- *
- * This gate itself is intentionally cheap:
- *   - An env-forced deployment (a hosted demo site) short-circuits with zero
- *     I/O — `DEMO_MODE=true`.
- *   - The per-user runtime toggle lives in `application_state` under the
- *     `demo-mode` key (`{ enabled: boolean }`), written by the settings UI and
- *     the `toggle-demo-mode` agent action. It's read behind a short in-process
- *     TTL cache keyed by user, so a tight agent tool-call loop doesn't hit the
- *     DB on every result.
- */
-import { readAppState } from "../application-state/script-helpers.js";
-
-const TTL_MS = 3_000;
-const cache = new Map<string, { value: boolean; at: number }>();
-
-/** Deployment-wide force (hosted demo site). Zero cost — no I/O. */
-export function isDemoModeForced(): boolean {
-  return process.env.DEMO_MODE === "true";
-}
-
-/**
- * Whether demo-mode redaction should run for the current request/user.
- * Cheap by design — safe to call before every action result; the expensive
- * walk only happens when this is true.
- */
-export async function isDemoModeEnabled(): Promise<boolean> {
-  if (isDemoModeForced()) return true;
-  try {
-    let sessionKey = "_";
-    try {
-      const { getRequestUserEmail } =
-        await import("../server/request-context.js");
-      sessionKey = getRequestUserEmail() ?? process.env.AGENT_USER_EMAIL ?? "_";
-    } catch {
-      // request-context unavailable (CLI / non-server) — use default key
-    }
-    const now = Date.now();
-    const hit = cache.get(sessionKey);
-    if (hit && now - hit.at < TTL_MS) return hit.value;
-    const state = await readAppState("demo-mode");
-    const enabled = state?.enabled === true;
-    cache.set(sessionKey, { value: enabled, at: now });
-    return enabled;
-  } catch {
-    // No request context / DB unavailable — fail closed (no redaction).
-    return false;
-  }
-}

package/dist/demo/actions/toggle-demo-mode.d.ts

@@ -1,8 +0,0 @@
-declare const _default: import("../../action.js").ActionDefinition<{
-    enabled: boolean;
-}, {
-    enabled: boolean;
-    message: string;
-}>;
-export default _default;
-//# sourceMappingURL=toggle-demo-mode.d.ts.map

package/dist/demo/actions/toggle-demo-mode.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"toggle-demo-mode.d.ts","sourceRoot":"","sources":["../../../src/demo/actions/toggle-demo-mode.ts"],"names":[],"mappings":""}

package/dist/demo/actions/toggle-demo-mode.js

@@ -1,21 +0,0 @@
-import { z } from "zod";
-import { defineAction } from "../../action.js";
-import { writeAppState } from "../../application-state/script-helpers.js";
-export default defineAction({
-    description: "Turn demo mode on or off. When demo mode is on, the UI replaces every email address with anonymous@builder.io and supported dashboards reshape chart values for presentations. Agent-visible results use the same anonymous email and anonymize numbers while keeping names, free text, labels, IDs, dates, and structure intact. Use when the user asks to 'hide my data', 'turn on demo mode', 'anonymize this for a screen share / recording', or similar. This is the same toggle as the Demo mode switch in settings.",
-    schema: z.object({
-        enabled: z
-            .boolean()
-            .describe("true to turn demo mode on, false to turn it off."),
-    }),
-    run: async ({ enabled }) => {
-        await writeAppState("demo-mode", { enabled });
-        return {
-            enabled,
-            message: enabled
-                ? "Demo mode is ON — UI emails are anonymized and supported dashboard charts are reshaped for presentation. Agent-visible emails and numbers are also anonymized. Names, free text, labels, IDs, and structure are preserved."
-                : "Demo mode is OFF — real data is shown again.",
-        };
-    },
-});
-//# sourceMappingURL=toggle-demo-mode.js.map

package/dist/demo/actions/toggle-demo-mode.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"toggle-demo-mode.js","sourceRoot":"","sources":["../../../src/demo/actions/toggle-demo-mode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,2CAA2C,CAAC;AAE1E,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,4fAA4f;IAC9f,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,OAAO,EAAE,CAAC;aACP,OAAO,EAAE;aACT,QAAQ,CAAC,kDAAkD,CAAC;KAChE,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACzB,MAAM,aAAa,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9C,OAAO;YACL,OAAO;YACP,OAAO,EAAE,OAAO;gBACd,CAAC,CAAC,4NAA4N;gBAC9N,CAAC,CAAC,8CAA8C;SACnD,CAAC;IACJ,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\n\nimport { defineAction } from \"../../action.js\";\nimport { writeAppState } from \"../../application-state/script-helpers.js\";\n\nexport default defineAction({\n  description:\n    \"Turn demo mode on or off. When demo mode is on, the UI replaces every email address with anonymous@builder.io and supported dashboards reshape chart values for presentations. Agent-visible results use the same anonymous email and anonymize numbers while keeping names, free text, labels, IDs, dates, and structure intact. Use when the user asks to 'hide my data', 'turn on demo mode', 'anonymize this for a screen share / recording', or similar. This is the same toggle as the Demo mode switch in settings.\",\n  schema: z.object({\n    enabled: z\n      .boolean()\n      .describe(\"true to turn demo mode on, false to turn it off.\"),\n  }),\n  run: async ({ enabled }) => {\n    await writeAppState(\"demo-mode\", { enabled });\n    return {\n      enabled,\n      message: enabled\n        ? \"Demo mode is ON — UI emails are anonymized and supported dashboard charts are reshaped for presentation. Agent-visible emails and numbers are also anonymized. Names, free text, labels, IDs, and structure are preserved.\"\n        : \"Demo mode is OFF — real data is shown again.\",\n    };\n  },\n});\n"]}

package/dist/demo/config.d.ts

@@ -1,9 +0,0 @@
-/** Deployment-wide force (hosted demo site). Zero cost — no I/O. */
-export declare function isDemoModeForced(): boolean;
-/**
- * Whether demo-mode redaction should run for the current request/user.
- * Cheap by design — safe to call before every action result; the expensive
- * walk only happens when this is true.
- */
-export declare function isDemoModeEnabled(): Promise<boolean>;
-//# sourceMappingURL=config.d.ts.map

package/dist/demo/config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/demo/config.ts"],"names":[],"mappings":"AAwBA,oEAAoE;AACpE,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC,CAsB1D"}

package/dist/demo/config.js

@@ -1,58 +0,0 @@
-/**
- * Demo mode gate.
- *
- * Demo mode replaces every email address with `anonymous@builder.io` and
- * anonymizes numbers in every action result — for both the UI and what the
- * agent sees — while preserving names, free text, labels, IDs, dates, URLs,
- * and structure so the app keeps working. The redaction WALK (see ./redact.ts)
- * is expensive on large payloads, so callers MUST gate it behind this function
- * and only walk when it returns true.
- *
- * This gate itself is intentionally cheap:
- *   - An env-forced deployment (a hosted demo site) short-circuits with zero
- *     I/O — `DEMO_MODE=true`.
- *   - The per-user runtime toggle lives in `application_state` under the
- *     `demo-mode` key (`{ enabled: boolean }`), written by the settings UI and
- *     the `toggle-demo-mode` agent action. It's read behind a short in-process
- *     TTL cache keyed by user, so a tight agent tool-call loop doesn't hit the
- *     DB on every result.
- */
-import { readAppState } from "../application-state/script-helpers.js";
-const TTL_MS = 3_000;
-const cache = new Map();
-/** Deployment-wide force (hosted demo site). Zero cost — no I/O. */
-export function isDemoModeForced() {
-    return process.env.DEMO_MODE === "true";
-}
-/**
- * Whether demo-mode redaction should run for the current request/user.
- * Cheap by design — safe to call before every action result; the expensive
- * walk only happens when this is true.
- */
-export async function isDemoModeEnabled() {
-    if (isDemoModeForced())
-        return true;
-    try {
-        let sessionKey = "_";
-        try {
-            const { getRequestUserEmail } = await import("../server/request-context.js");
-            sessionKey = getRequestUserEmail() ?? process.env.AGENT_USER_EMAIL ?? "_";
-        }
-        catch {
-            // request-context unavailable (CLI / non-server) — use default key
-        }
-        const now = Date.now();
-        const hit = cache.get(sessionKey);
-        if (hit && now - hit.at < TTL_MS)
-            return hit.value;
-        const state = await readAppState("demo-mode");
-        const enabled = state?.enabled === true;
-        cache.set(sessionKey, { value: enabled, at: now });
-        return enabled;
-    }
-    catch {
-        // No request context / DB unavailable — fail closed (no redaction).
-        return false;
-    }
-}
-//# sourceMappingURL=config.js.map

package/dist/demo/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/demo/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAC;AAEtE,MAAM,MAAM,GAAG,KAAK,CAAC;AACrB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0C,CAAC;AAEhE,oEAAoE;AACpE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,MAAM,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,gBAAgB,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,IAAI,UAAU,GAAG,GAAG,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,mBAAmB,EAAE,GAC3B,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YAC/C,UAAU,GAAG,mBAAmB,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,MAAM;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;QACxC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * Demo mode gate.\n *\n * Demo mode replaces every email address with `anonymous@builder.io` and\n * anonymizes numbers in every action result — for both the UI and what the\n * agent sees — while preserving names, free text, labels, IDs, dates, URLs,\n * and structure so the app keeps working. The redaction WALK (see ./redact.ts)\n * is expensive on large payloads, so callers MUST gate it behind this function\n * and only walk when it returns true.\n *\n * This gate itself is intentionally cheap:\n *   - An env-forced deployment (a hosted demo site) short-circuits with zero\n *     I/O — `DEMO_MODE=true`.\n *   - The per-user runtime toggle lives in `application_state` under the\n *     `demo-mode` key (`{ enabled: boolean }`), written by the settings UI and\n *     the `toggle-demo-mode` agent action. It's read behind a short in-process\n *     TTL cache keyed by user, so a tight agent tool-call loop doesn't hit the\n *     DB on every result.\n */\nimport { readAppState } from \"../application-state/script-helpers.js\";\n\nconst TTL_MS = 3_000;\nconst cache = new Map<string, { value: boolean; at: number }>();\n\n/** Deployment-wide force (hosted demo site). Zero cost — no I/O. */\nexport function isDemoModeForced(): boolean {\n  return process.env.DEMO_MODE === \"true\";\n}\n\n/**\n * Whether demo-mode redaction should run for the current request/user.\n * Cheap by design — safe to call before every action result; the expensive\n * walk only happens when this is true.\n */\nexport async function isDemoModeEnabled(): Promise<boolean> {\n  if (isDemoModeForced()) return true;\n  try {\n    let sessionKey = \"_\";\n    try {\n      const { getRequestUserEmail } =\n        await import(\"../server/request-context.js\");\n      sessionKey = getRequestUserEmail() ?? process.env.AGENT_USER_EMAIL ?? \"_\";\n    } catch {\n      // request-context unavailable (CLI / non-server) — use default key\n    }\n    const now = Date.now();\n    const hit = cache.get(sessionKey);\n    if (hit && now - hit.at < TTL_MS) return hit.value;\n    const state = await readAppState(\"demo-mode\");\n    const enabled = state?.enabled === true;\n    cache.set(sessionKey, { value: enabled, at: now });\n    return enabled;\n  } catch {\n    // No request context / DB unavailable — fail closed (no redaction).\n    return false;\n  }\n}\n"]}