@agent-native/dispatch 0.0.0-beta-20260819184657 → 0.0.0-beta-20260820150521

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.0.0-beta-20260819184657",
+  "version": "0.0.0-beta-20260820150521",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -87,7 +87,7 @@
     "tailwind-merge": "^3.5.0",
     "vaul": "^1.1.2",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "0.16.7"
+    "@agent-native/toolkit": "0.0.0-beta-20260820150521"
   },
   "devDependencies": {
     "@react-router/dev": "^8.1.0",
@@ -101,10 +101,10 @@
     "typescript-7": "npm:typescript@^7.0.2",
     "vite": "8.1.0",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.0.0-beta-20260819184657"
+    "@agent-native/core": "0.0.0-beta-20260820150521"
   },
   "peerDependencies": {
-    "@agent-native/core": "0.0.0-beta-20260819184657",
+    "@agent-native/core": "0.0.0-beta-20260820150521",
     "react": ">=19.2.7",
     "react-dom": ">=19.2.7",
     "react-router": ">=8"

package/src/server/lib/app-creation-store.spec.ts

@@ -6,6 +6,7 @@ import {
   getAppCreationSettings,
   listAvailableWorkspaceTemplates,
   listWorkspaceApps,
+  scaffoldWorkspaceAppFromTemplate,
   setAppCreationSettings,
   startWorkspaceAppCreation,
   updateWorkspaceAppMetadata,
@@ -23,6 +24,13 @@ const mocks = vi.hoisted(() => {
     settings,
     state,
     getSetting: vi.fn(async (key: string) => settings.get(key) ?? null),
+    mutateSetting: vi.fn(
+      async (key: string, updater: (current: any) => any) => {
+        const next = await updater(settings.get(key) ?? null);
+        settings.set(key, next);
+        return next;
+      },
+    ),
     putSetting: vi.fn(async (key: string, value: unknown) => {
       settings.set(key, value);
     }),
@@ -32,9 +40,19 @@ const mocks = vi.hoisted(() => {
       resource: {},
     })),
     getDbExec: vi.fn(() => ({
-      execute: vi.fn(async () => ({
-        rows: state.orgRole ? [{ role: state.orgRole }] : [],
-      })),
+      execute: vi.fn(async (statement: unknown) => {
+        const sql =
+          typeof statement === "string"
+            ? statement
+            : String((statement as { sql?: unknown })?.sql ?? "");
+        if (sql.includes("SELECT id FROM workspace_apps")) {
+          return { rows: [], rowsAffected: 0 };
+        }
+        return {
+          rows: state.orgRole ? [{ role: state.orgRole }] : [],
+          rowsAffected: 0,
+        };
+      }),
     })),
     resolveBuilderCredentialsDetailed: vi.fn(async () => ({
       privateKey: null as string | null,
@@ -78,6 +96,7 @@ vi.mock("@agent-native/core/db", async (importOriginal) => {
 
 vi.mock("@agent-native/core/settings", () => ({
   getSetting: (...args: any[]) => mocks.getSetting(...args),
+  mutateSetting: (...args: any[]) => mocks.mutateSetting(...args),
   putSetting: (...args: any[]) => mocks.putSetting(...args),
   getOrgSetting: (...args: any[]) => mocks.getOrgSetting(...args),
 }));
@@ -119,12 +138,32 @@ afterEach(() => {
   vi.unstubAllGlobals();
   vi.clearAllMocks();
   mocks.settings.clear();
+  mocks.getOrgSetting.mockReset();
+  mocks.getOrgSetting.mockResolvedValue(null);
+  mocks.mutateSetting.mockReset();
+  mocks.mutateSetting.mockImplementation(
+    async (key: string, updater: (current: any) => any) => {
+      const next = await updater(mocks.settings.get(key) ?? null);
+      mocks.settings.set(key, next);
+      return next;
+    },
+  );
   mocks.state.orgRole = "admin";
   mocks.getDbExec.mockReset();
   mocks.getDbExec.mockImplementation(() => ({
-    execute: vi.fn(async () => ({
-      rows: mocks.state.orgRole ? [{ role: mocks.state.orgRole }] : [],
-    })),
+    execute: vi.fn(async (statement: unknown) => {
+      const sql =
+        typeof statement === "string"
+          ? statement
+          : String((statement as { sql?: unknown })?.sql ?? "");
+      if (sql.includes("SELECT id FROM workspace_apps")) {
+        return { rows: [], rowsAffected: 0 };
+      }
+      return {
+        rows: mocks.state.orgRole ? [{ role: mocks.state.orgRole }] : [],
+        rowsAffected: 0,
+      };
+    }),
   }));
   mocks.resolveAccess.mockReset();
   mocks.resolveAccess.mockResolvedValue({ role: "viewer", resource: {} });
@@ -368,7 +407,7 @@ describe("listWorkspaceApps", () => {
     expect(apps.map((app) => app.id)).toEqual(["dispatch"]);
   });
 
-  it("does not create or expose apps when the org visibility setting cannot be read", async () => {
+  it("keeps legacy apps organization-visible when the org default cannot be read", async () => {
     stubManifest([
       { id: "dispatch", name: "Dispatch", path: "/dispatch" },
       { id: "private-app", name: "Private app", path: "/private-app" },
@@ -377,12 +416,12 @@ describe("listWorkspaceApps", () => {
       new Error("settings store unavailable"),
     );
 
-    await expect(
-      runWithRequestContext(
-        { userEmail: "dev@example.test", orgId: "org-123" },
-        () => listWorkspaceApps({ includeAgentCards: false }),
-      ),
-    ).rejects.toThrow("settings store unavailable");
+    const apps = await runWithRequestContext(
+      { userEmail: "dev@example.test", orgId: "org-123" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(apps.map((app) => app.id)).toEqual(["dispatch", "private-app"]);
   });
 
   it("fails closed when the workspace-app access schema is unavailable", async () => {
@@ -417,7 +456,7 @@ describe("listWorkspaceApps", () => {
     expect(mocks.resolveAccess).not.toHaveBeenCalled();
   });
 
-  it("uses the organization default only for apps with trusted creation metadata", async () => {
+  it("does not apply the current default retroactively to legacy apps", async () => {
     stubNoPendingContext();
     stubManifest([
       {
@@ -451,9 +490,8 @@ describe("listWorkspaceApps", () => {
     );
 
     expect(apps.find((app) => app.id === "legacy-app")?.visibility).toBe("org");
-    expect(apps.find((app) => app.id === "new-app")?.visibility).toBe(
-      "private",
-    );
+    expect(apps.find((app) => app.id === "new-app")?.visibility).toBe("org");
+    expect(mocks.getOrgSetting).not.toHaveBeenCalled();
     const inserts = execute.mock.calls.filter(([statement]) =>
       String((statement as { sql?: unknown })?.sql ?? "").includes(
         "INSERT INTO workspace_apps",
@@ -461,7 +499,7 @@ describe("listWorkspaceApps", () => {
     );
     expect(inserts.map(([statement]) => (statement as any).args?.[3])).toEqual([
       "org",
-      "private",
+      "org",
     ]);
   });
 
@@ -592,6 +630,61 @@ describe("listWorkspaceApps", () => {
     expect(apps.map((app) => app.id)).toEqual(["dispatch", "legacy"]);
   });
 
+  it("hides private pending apps from non-creators", async () => {
+    stubNoPendingContext();
+    stubManifest();
+    mocks.settings.set(settingsKey, {
+      pendingApps: [
+        pendingApp("private-pending", {
+          visibility: "private",
+          createdBy: "creator@example.test",
+          owner: "creator@example.test",
+        }),
+      ],
+    });
+
+    const apps = await runWithRequestContext(
+      { userEmail: "viewer@example.test", orgId: "org-123" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(apps.map((app) => app.id)).toEqual(["dispatch"]);
+  });
+
+  it("fails closed when a private app access record cannot be inserted", async () => {
+    stubNoPendingContext();
+    stubManifest([
+      { id: "scaffolded", name: "Scaffolded", path: "/scaffolded" },
+    ]);
+    mocks.settings.set("workspace-app-metadata:org:org-123", {
+      apps: {
+        scaffolded: {
+          visibility: "private",
+          createdBy: "creator@example.test",
+        },
+      },
+    });
+    const execute = vi.fn(async (statement: unknown) => {
+      const sql =
+        typeof statement === "string"
+          ? statement
+          : String((statement as { sql?: unknown })?.sql ?? "");
+      if (sql.includes("SELECT id, owner_email, org_id, visibility")) {
+        return { rows: [], rowsAffected: 0 };
+      }
+      throw new Error("workspace app access insert failed");
+    });
+    mocks.getDbExec.mockReturnValue({ execute });
+    mocks.resolveAccess.mockResolvedValue(null);
+
+    const apps = await runWithRequestContext(
+      { userEmail: "viewer@example.test", orgId: "org-123" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(apps).toEqual([]);
+  });
+
   it("hides expired pending Builder app rows", async () => {
     stubManifest();
     vi.stubEnv("BRANCH", "feature-a");
@@ -783,6 +876,179 @@ describe("startWorkspaceAppCreation", () => {
     );
   }
 
+  it("persists the private default for local-agent app creation", async () => {
+    mocks.getOrgSetting.mockResolvedValueOnce({ visibility: "private" });
+
+    const result = (await create("onboarding", {
+      userEmail: "dev@example.test",
+      orgId: "org-123",
+    })) as any;
+
+    expect(result.mode).toBe("local-agent");
+    expect(
+      mocks.settings.get("workspace-app-metadata:org:org-123"),
+    ).toMatchObject({
+      apps: {
+        onboarding: { visibility: "private" },
+      },
+    });
+  });
+
+  it("rejects a cross-member collision with an active pending app id", async () => {
+    stubHostedRuntime();
+    stubBuilderProjectConfigured();
+    mocks.getOrgSetting.mockResolvedValueOnce({ visibility: "private" });
+    mocks.settings.set("dispatch-app-creation-settings:org:org-123", {
+      pendingApps: [
+        {
+          id: "onboarding",
+          name: "Onboarding",
+          description: "Already being created",
+          path: "/onboarding",
+          builderUrl:
+            "https://builder.io/app/projects/project-1/branch/onboarding",
+          branchName: "onboarding",
+          projectId: "project-1",
+          createdBy: "creator@example.test",
+          owner: "creator@example.test",
+          createdAt: "2026-08-19T21:00:00.000Z",
+          updatedAt: "2026-08-19T21:00:00.000Z",
+          expiresAt: "2999-01-01T00:00:00.000Z",
+        },
+      ],
+    });
+
+    await expect(
+      create("onboarding", {
+        userEmail: "other@example.test",
+        orgId: "org-123",
+      }),
+    ).rejects.toThrow("already being created by another member");
+    expect(mocks.runBuilderAgent).not.toHaveBeenCalled();
+    expect(
+      mocks.settings.get("dispatch-app-creation-settings:org:org-123"),
+    ).toMatchObject({
+      pendingApps: [
+        expect.objectContaining({ createdBy: "creator@example.test" }),
+      ],
+    });
+  });
+
+  it("rejects a collision from another deployment context", async () => {
+    stubHostedRuntime();
+    stubBuilderProjectConfigured();
+    mocks.settings.set("dispatch-app-creation-settings:org:org-123", {
+      pendingApps: [
+        {
+          id: "onboarding",
+          name: "Onboarding",
+          description: "Already being created",
+          path: "/onboarding",
+          contextId: "branch:other-context",
+          createdBy: "creator@example.test",
+          owner: "creator@example.test",
+          createdAt: "2026-08-19T21:00:00.000Z",
+          updatedAt: "2026-08-19T21:00:00.000Z",
+          expiresAt: "2999-01-01T00:00:00.000Z",
+        },
+      ],
+    });
+
+    await expect(
+      create("onboarding", {
+        userEmail: "other@example.test",
+        orgId: "org-123",
+      }),
+    ).rejects.toThrow("already being created by another member");
+    expect(mocks.runBuilderAgent).not.toHaveBeenCalled();
+  });
+
+  it("atomically reserves an app id before starting Builder", async () => {
+    stubHostedRuntime();
+    stubBuilderProjectConfigured();
+    mocks.resolveBuilderCredentialsDetailed.mockResolvedValue(
+      credentials({
+        privateKey: "priv",
+        publicKey: "pub",
+        userId: "builder-user-42",
+      }),
+    );
+    mocks.runBuilderAgent.mockImplementation(async () => {
+      expect(
+        mocks.settings.get("dispatch-app-creation-settings:org:org-123"),
+      ).toMatchObject({
+        pendingApps: [
+          expect.objectContaining({
+            id: "onboarding",
+            createdBy: "dev@example.test",
+          }),
+        ],
+      });
+      return {
+        branchName: "onboarding1",
+        url: "https://builder.io/app/projects/project-1/branch/onboarding1",
+        status: "processing",
+      };
+    });
+
+    const result = (await create("onboarding", {
+      userEmail: "dev@example.test",
+      orgId: "org-123",
+    })) as any;
+
+    expect(result.mode).toBe("builder");
+    expect(mocks.mutateSetting).toHaveBeenCalled();
+  });
+
+  it("releases the reservation when Builder handoff fails", async () => {
+    stubHostedRuntime();
+    stubBuilderProjectConfigured();
+    mocks.resolveBuilderCredentialsDetailed.mockResolvedValue(
+      credentials({
+        privateKey: "priv",
+        publicKey: "pub",
+        userId: "builder-user-42",
+      }),
+    );
+    mocks.runBuilderAgent.mockRejectedValue(new Error("Builder unavailable"));
+
+    const result = (await create("onboarding", {
+      userEmail: "dev@example.test",
+      orgId: "org-123",
+    })) as any;
+
+    expect(result).toMatchObject({ mode: "builder-unavailable" });
+    expect(
+      mocks.settings.get("dispatch-app-creation-settings:org:org-123"),
+    ).toMatchObject({ pendingApps: [] });
+    expect(mocks.settings.get("workspace-app-metadata:org:org-123")).toBe(
+      undefined,
+    );
+  });
+
+  it("rejects a scaffold id already registered in the shared app registry", async () => {
+    mocks.getDbExec.mockReturnValue({
+      execute: vi.fn(async (statement: unknown) => {
+        const sql = String((statement as { sql?: unknown })?.sql ?? "");
+        if (sql.includes("SELECT id FROM workspace_apps")) {
+          return { rows: [{ id: "mail" }], rowsAffected: 0 };
+        }
+        return { rows: [], rowsAffected: 0 };
+      }),
+    });
+
+    await expect(
+      runWithRequestContext(
+        { userEmail: "dev@example.test", orgId: "org-123" },
+        () =>
+          scaffoldWorkspaceAppFromTemplate({
+            template: "mail",
+            appId: "mail",
+          }),
+      ),
+    ).rejects.toThrow("already registered");
+  });
+
   it("returns builder-not-connected without leaking the project id when no Builder credentials are configured", async () => {
     stubHostedRuntime();
     stubBuilderProjectConfigured();
@@ -835,6 +1101,7 @@ describe("startWorkspaceAppCreation", () => {
   it("starts the Builder branch and passes the resolved userId through", async () => {
     stubHostedRuntime();
     stubBuilderProjectConfigured();
+    mocks.getOrgSetting.mockResolvedValueOnce({ visibility: "private" });
     mocks.resolveBuilderCredentialsDetailed.mockResolvedValue(
       credentials({
         privateKey: "priv",
@@ -848,7 +1115,10 @@ describe("startWorkspaceAppCreation", () => {
       status: "processing",
     });
 
-    const result = (await create()) as any;
+    const result = (await create("onboarding", {
+      userEmail: "dev@example.test",
+      orgId: "org-123",
+    })) as any;
 
     expect(result.mode).toBe("builder");
     expect(mocks.runBuilderAgent).toHaveBeenCalledWith(
@@ -867,6 +1137,13 @@ describe("startWorkspaceAppCreation", () => {
     expect(builderPrompt).toContain(
       "Treat the source brief's unknowns and follow-up items as assumptions",
     );
+    expect(
+      mocks.settings.get("workspace-app-metadata:org:org-123"),
+    ).toMatchObject({
+      apps: {
+        onboarding: { visibility: "private" },
+      },
+    });
   });
 
   it("provisions and remembers the workspace Builder project when none is configured", async () => {