@agent-native/dispatch 0.1.1

package/src/server/lib/workspace-resources-store.ts

@@ -0,0 +1,445 @@
+import crypto from "node:crypto";
+import { and, desc, eq, isNull, or } from "drizzle-orm";
+import { discoverAgents } from "@agent-native/core/server/agent-discovery";
+import { getDb, schema } from "../../db/index.js";
+import {
+  currentOwnerEmail,
+  currentOrgId,
+  recordAudit,
+} from "./dispatch-store.js";
+import { recordVaultAudit } from "./vault-store.js";
+
+/**
+ * Caller-supplied access context for workspace-resource operations.
+ * Same shape and semantics as VaultCtx — looking up a row by id alone is
+ * unsafe because UUIDs are not authorization. A row matches the ctx if
+ * either the caller owns it or it lives in the caller's active org.
+ */
+export interface WorkspaceResourceCtx {
+  ownerEmail: string;
+  orgId: string | null;
+}
+
+export function requireWorkspaceResourceCtx(): WorkspaceResourceCtx {
+  const ownerEmail = currentOwnerEmail();
+  return { ownerEmail, orgId: currentOrgId() };
+}
+
+/** WHERE clause that limits a workspace-resource row to the caller's scope. */
+function ctxScope<T extends { ownerEmail: any; orgId: any }>(
+  table: T,
+  ctx: WorkspaceResourceCtx,
+) {
+  if (!ctx.orgId) {
+    return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));
+  }
+  return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));
+}
+
+function id() {
+  return crypto.randomUUID();
+}
+
+function now() {
+  return Date.now();
+}
+
+function orgFilter<T extends { ownerEmail: any; orgId: any }>(table: T) {
+  const orgId = currentOrgId();
+  return and(
+    eq(table.ownerEmail, currentOwnerEmail()),
+    orgId ? eq(table.orgId, orgId) : isNull(table.orgId),
+  );
+}
+
+// ─── Workspace Resources CRUD ──────────────────────────────────
+
+export type WorkspaceResourceKind = "skill" | "instruction" | "agent";
+export type WorkspaceResourceScope = "all" | "selected";
+
+export interface WorkspaceResourceInput {
+  kind: WorkspaceResourceKind;
+  name: string;
+  description?: string | null;
+  path: string;
+  content: string;
+  scope: WorkspaceResourceScope;
+}
+
+export async function listWorkspaceResources(filter?: { kind?: string }) {
+  const db = getDb();
+  const conditions = [orgFilter(schema.workspaceResources)];
+  if (filter?.kind) {
+    conditions.push(eq(schema.workspaceResources.kind, filter.kind) as any);
+  }
+  return db
+    .select()
+    .from(schema.workspaceResources)
+    .where(and(...conditions))
+    .orderBy(desc(schema.workspaceResources.updatedAt));
+}
+
+export async function getWorkspaceResource(
+  resourceId: string,
+  ctx: WorkspaceResourceCtx = requireWorkspaceResourceCtx(),
+) {
+  const db = getDb();
+  const [row] = await db
+    .select()
+    .from(schema.workspaceResources)
+    .where(
+      and(
+        eq(schema.workspaceResources.id, resourceId),
+        ctxScope(schema.workspaceResources, ctx),
+      ),
+    )
+    .limit(1);
+  return row ?? null;
+}
+
+export async function createWorkspaceResource(input: WorkspaceResourceInput) {
+  const db = getDb();
+  const timestamp = now();
+  const resourceId = id();
+  const actor = currentOwnerEmail();
+
+  await db.insert(schema.workspaceResources).values({
+    id: resourceId,
+    ownerEmail: actor,
+    orgId: currentOrgId(),
+    kind: input.kind,
+    name: input.name,
+    description: input.description || null,
+    path: input.path,
+    content: input.content,
+    scope: input.scope,
+    createdBy: actor,
+    createdAt: timestamp,
+    updatedAt: timestamp,
+  });
+
+  await recordAudit({
+    action: `workspace.${input.kind}.created`,
+    targetType: `workspace-${input.kind}`,
+    targetId: resourceId,
+    summary: `Created workspace ${input.kind} "${input.name}" (${input.path})`,
+  });
+
+  return getWorkspaceResource(resourceId);
+}
+
+export async function updateWorkspaceResource(
+  resourceId: string,
+  input: Partial<
+    Pick<WorkspaceResourceInput, "name" | "description" | "content" | "scope">
+  >,
+) {
+  const db = getDb();
+  const ctx = requireWorkspaceResourceCtx();
+  const existing = await getWorkspaceResource(resourceId, ctx);
+  if (!existing) throw new Error("Workspace resource not found");
+
+  const updates: Record<string, unknown> = { updatedAt: now() };
+  if (input.name !== undefined) updates.name = input.name;
+  if (input.description !== undefined)
+    updates.description = input.description || null;
+  if (input.content !== undefined) updates.content = input.content;
+  if (input.scope !== undefined) updates.scope = input.scope;
+
+  await db
+    .update(schema.workspaceResources)
+    .set(updates)
+    .where(
+      and(
+        eq(schema.workspaceResources.id, resourceId),
+        ctxScope(schema.workspaceResources, ctx),
+      ),
+    );
+
+  await recordAudit({
+    action: `workspace.${existing.kind}.updated`,
+    targetType: `workspace-${existing.kind}`,
+    targetId: resourceId,
+    summary: `Updated workspace ${existing.kind} "${input.name || existing.name}"`,
+  });
+
+  return getWorkspaceResource(resourceId, ctx);
+}
+
+export async function deleteWorkspaceResource(resourceId: string) {
+  const db = getDb();
+  const ctx = requireWorkspaceResourceCtx();
+  const existing = await getWorkspaceResource(resourceId, ctx);
+  if (!existing) throw new Error("Workspace resource not found");
+
+  // Revoke all grants
+  const grants = await listResourceGrants({ resourceId });
+  for (const grant of grants) {
+    if (grant.status === "active") {
+      await revokeResourceGrant(grant.id);
+    }
+  }
+
+  await db
+    .delete(schema.workspaceResources)
+    .where(
+      and(
+        eq(schema.workspaceResources.id, resourceId),
+        ctxScope(schema.workspaceResources, ctx),
+      ),
+    );
+
+  await recordAudit({
+    action: `workspace.${existing.kind}.deleted`,
+    targetType: `workspace-${existing.kind}`,
+    targetId: resourceId,
+    summary: `Deleted workspace ${existing.kind} "${existing.name}" (${existing.path})`,
+  });
+
+  return existing;
+}
+
+// ─── Grants ──────────────────────────────────────────────────────
+
+export async function listResourceGrants(filter?: {
+  resourceId?: string;
+  appId?: string;
+}) {
+  const db = getDb();
+  const conditions = [orgFilter(schema.workspaceResourceGrants)];
+  if (filter?.resourceId) {
+    conditions.push(
+      eq(schema.workspaceResourceGrants.resourceId, filter.resourceId) as any,
+    );
+  }
+  if (filter?.appId) {
+    conditions.push(
+      eq(schema.workspaceResourceGrants.appId, filter.appId) as any,
+    );
+  }
+  return db
+    .select()
+    .from(schema.workspaceResourceGrants)
+    .where(and(...conditions))
+    .orderBy(desc(schema.workspaceResourceGrants.updatedAt));
+}
+
+export async function getResourceGrant(
+  grantId: string,
+  ctx: WorkspaceResourceCtx = requireWorkspaceResourceCtx(),
+) {
+  const db = getDb();
+  const [row] = await db
+    .select()
+    .from(schema.workspaceResourceGrants)
+    .where(
+      and(
+        eq(schema.workspaceResourceGrants.id, grantId),
+        ctxScope(schema.workspaceResourceGrants, ctx),
+      ),
+    )
+    .limit(1);
+  return row ?? null;
+}
+
+export async function createResourceGrant(resourceId: string, appId: string) {
+  const db = getDb();
+  const ctx = requireWorkspaceResourceCtx();
+  const resource = await getWorkspaceResource(resourceId, ctx);
+  if (!resource) throw new Error("Workspace resource not found");
+
+  const timestamp = now();
+  const grantId = id();
+  const actor = currentOwnerEmail();
+
+  await db.insert(schema.workspaceResourceGrants).values({
+    id: grantId,
+    ownerEmail: actor,
+    orgId: currentOrgId(),
+    resourceId,
+    appId,
+    status: "active",
+    syncedAt: null,
+    createdAt: timestamp,
+    updatedAt: timestamp,
+  });
+
+  await recordAudit({
+    action: `workspace.${resource.kind}.granted`,
+    targetType: `workspace-${resource.kind}-grant`,
+    targetId: grantId,
+    summary: `Granted workspace ${resource.kind} "${resource.name}" to ${appId}`,
+  });
+
+  return getResourceGrant(grantId);
+}
+
+export async function revokeResourceGrant(
+  grantId: string,
+  ctx: WorkspaceResourceCtx = requireWorkspaceResourceCtx(),
+) {
+  const db = getDb();
+  const grant = await getResourceGrant(grantId, ctx);
+  if (!grant) throw new Error("Grant not found");
+
+  const resource = await getWorkspaceResource(grant.resourceId);
+
+  await db
+    .update(schema.workspaceResourceGrants)
+    .set({ status: "revoked", updatedAt: now() })
+    .where(
+      and(
+        eq(schema.workspaceResourceGrants.id, grantId),
+        ctxScope(schema.workspaceResourceGrants, ctx),
+      ),
+    );
+
+  await recordAudit({
+    action: `workspace.${resource?.kind || "resource"}.grant-revoked`,
+    targetType: "workspace-resource-grant",
+    targetId: grantId,
+    summary: `Revoked workspace ${resource?.kind || "resource"} "${resource?.name || grant.resourceId}" from ${grant.appId}`,
+  });
+
+  return getResourceGrant(grantId, ctx);
+}
+
+// ─── Sync ──────────────────────────────────────────────────────
+
+/**
+ * Push workspace resources to an app via its /_agent-native/resources endpoint.
+ * Resources with scope="all" are always pushed. Resources with scope="selected"
+ * are only pushed if there's an active grant for that app.
+ */
+export async function syncResourcesToApp(appId: string) {
+  const agents = await discoverAgents("dispatch");
+  const agent = agents.find((a) => a.id === appId);
+  if (!agent) throw new Error(`App "${appId}" not found in agent registry`);
+
+  const allResources = await listWorkspaceResources();
+  const grants = await listResourceGrants({ appId });
+  const activeGrantResourceIds = new Set(
+    grants.filter((g) => g.status === "active").map((g) => g.resourceId),
+  );
+
+  // Determine which resources to push
+  const toPush = allResources.filter(
+    (r) =>
+      r.scope === "all" ||
+      (r.scope === "selected" && activeGrantResourceIds.has(r.id)),
+  );
+
+  if (toPush.length === 0) {
+    return { appId, synced: 0, resources: [] };
+  }
+
+  const syncedPaths: string[] = [];
+  const db = getDb();
+  const timestamp = now();
+
+  for (const resource of toPush) {
+    try {
+      // Push via the resources API — create as shared resource
+      const res = await fetch(`${agent.url}/_agent-native/resources`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          path: resource.path,
+          content: resource.content,
+          shared: true,
+          mimeType: "text/markdown",
+        }),
+      });
+
+      if (res.ok || res.status === 409) {
+        // 409 = already exists, try updating
+        if (res.status === 409) {
+          // Fetch existing to get ID, then update
+          const listRes = await fetch(
+            `${agent.url}/_agent-native/resources?scope=shared&path=${encodeURIComponent(resource.path)}`,
+          );
+          if (listRes.ok) {
+            const items = await listRes.json();
+            const existing = Array.isArray(items)
+              ? items.find((i: any) => i.path === resource.path)
+              : null;
+            if (existing) {
+              await fetch(
+                `${agent.url}/_agent-native/resources/${existing.id}`,
+                {
+                  method: "PUT",
+                  headers: { "Content-Type": "application/json" },
+                  body: JSON.stringify({ content: resource.content }),
+                },
+              );
+            }
+          }
+        }
+        syncedPaths.push(resource.path);
+
+        // Update grant syncedAt if applicable
+        const grant = grants.find(
+          (g) => g.resourceId === resource.id && g.status === "active",
+        );
+        if (grant) {
+          await db
+            .update(schema.workspaceResourceGrants)
+            .set({ syncedAt: timestamp, updatedAt: timestamp })
+            .where(eq(schema.workspaceResourceGrants.id, grant.id));
+        }
+      }
+    } catch {
+      // Skip unreachable — don't fail the whole sync
+    }
+  }
+
+  await recordAudit({
+    action: "workspace.resources.synced",
+    targetType: "workspace-resource-sync",
+    targetId: appId,
+    summary: `Synced ${syncedPaths.length} workspace resource(s) to ${appId}: ${syncedPaths.join(", ")}`,
+  });
+
+  return { appId, synced: syncedPaths.length, resources: syncedPaths };
+}
+
+/**
+ * Sync all workspace resources to all apps that have grants or scope="all" resources.
+ */
+export async function syncResourcesToAllApps() {
+  const agents = await discoverAgents("dispatch");
+  const results: Array<{ appId: string; synced: number }> = [];
+
+  for (const agent of agents) {
+    try {
+      const result = await syncResourcesToApp(agent.id);
+      results.push({ appId: result.appId, synced: result.synced });
+    } catch {
+      results.push({ appId: agent.id, synced: 0 });
+    }
+  }
+
+  return results;
+}
+
+// ─── Overview ──────────────────────────────────────────────────────
+
+export async function listWorkspaceResourcesOverview() {
+  const [resources, grants] = await Promise.all([
+    listWorkspaceResources(),
+    listResourceGrants(),
+  ]);
+
+  const skills = resources.filter((r) => r.kind === "skill");
+  const instructions = resources.filter((r) => r.kind === "instruction");
+  const agents = resources.filter((r) => r.kind === "agent");
+  const activeGrants = grants.filter((g) => g.status === "active");
+
+  return {
+    skillCount: skills.length,
+    instructionCount: instructions.length,
+    agentCount: agents.length,
+    totalResources: resources.length,
+    activeGrantCount: activeGrants.length,
+  };
+}

package/src/server/plugins/agent-chat.ts

@@ -0,0 +1,36 @@
+import { createAgentChatPlugin } from "@agent-native/core/server";
+import { getOrgContext } from "@agent-native/core/org";
+import { dispatchActions } from "../../actions/index.js";
+
+export default createAgentChatPlugin({
+  appId: "dispatch",
+  // Without this, AGENT_ORG_ID is never set on agent action calls and every
+  // row written through the frontend (vault secrets, destinations, workspace
+  // resources) lands with org_id=NULL — breaking data isolation across orgs.
+  resolveOrgId: async (event) => {
+    const ctx = await getOrgContext(event);
+    return ctx.orgId;
+  },
+  // Read actions directly from the package's own action map rather than from
+  // a build-time-generated `.generated/actions-registry.ts` (the latter is a
+  // template-only construct that the Vite plugin emits next to actions/).
+  actions: dispatchActions,
+  systemPrompt: `You are the central dispatch for this workspace.
+
+Default posture:
+- Treat Slack and Telegram as shared entrypoints into the workspace.
+- Heavily delegate domain work to specialized agents through A2A when another app owns the job.
+- Keep durable memory and operating instructions in resources rather than ephemeral chat.
+- Prefer replying in the current external thread unless the user explicitly asks you to send to a saved destination.
+
+Use the standard workspace primitives:
+- Read and update resources like AGENTS.md, LEARNINGS.md, jobs/*.md, agents/*.md, and remote-agents/*.json when appropriate.
+- Use recurring jobs for scheduled behavior.
+- Use custom agent profiles in agents/*.md for local spawned work and remote-agents/*.json for remote A2A apps.
+- When answering whether workspace apps expose agent cards or A2A endpoints, call list-workspace-apps with includeAgentCards=true. If you have not requested that probe, absence of agent-card fields means unchecked, not unavailable.
+
+When a user asks for something like a digest, reminder, routing rule, or saved behavior:
+- First decide whether it should be a resource, a recurring job, a destination, or a delegated task.
+- Keep responses concise and operational.
+- Avoid inventing integrations or destinations that are not configured yet.`,
+});

package/src/server/plugins/auth.ts

@@ -0,0 +1,34 @@
+import { createAuthPlugin } from "@agent-native/core/server";
+import { getDispatchConfig } from "../index.js";
+
+const DEFAULT_MARKETING = {
+  appName: "Agent-Native Dispatch",
+  tagline:
+    "Your AI agent manages secrets, orchestrates other agents, and routes messages across your workspace.",
+  features: [
+    "Centralized vault for secrets with granular per-app grants",
+    "Cross-agent orchestration and delegation to specialist apps",
+    "Slack and Telegram routing with approval workflows",
+  ],
+} as const;
+
+/**
+ * Defer config + plugin construction until the Nitro plugin actually fires.
+ * This way `setupDispatch(config)` can run after plugin module-load order
+ * (Nitro doesn't guarantee load order across plugin files) and still feed
+ * `googleOnly` / `marketing` into `createAuthPlugin`.
+ */
+const dispatchAuthPlugin = async (nitroApp: any) => {
+  const { auth: authConfig = {} } = getDispatchConfig();
+  const googleOnly = authConfig.googleOnly ?? false;
+  const marketing =
+    (authConfig.marketing as Record<string, unknown> | undefined) ??
+    DEFAULT_MARKETING;
+  const plugin = createAuthPlugin({
+    googleOnly,
+    marketing: marketing as any,
+  });
+  return plugin(nitroApp);
+};
+
+export default dispatchAuthPlugin;

package/src/server/plugins/core-routes.ts

@@ -0,0 +1,6 @@
+import { createCoreRoutesPlugin } from "@agent-native/core/server";
+import { envKeys } from "../lib/env-config.js";
+
+export default createCoreRoutesPlugin({
+  envKeys,
+});

package/src/server/plugins/db.ts

@@ -0,0 +1,6 @@
+import { runMigrations } from "@agent-native/core/db";
+import { dispatchMigrations } from "../../db/migrations.js";
+
+export default runMigrations(dispatchMigrations, {
+  table: "dispatch_migrations",
+});

package/src/server/plugins/integrations.ts

@@ -0,0 +1,59 @@
+import { createIntegrationsPlugin } from "@agent-native/core/server";
+import {
+  beforeDispatchProcess,
+  resolveDispatchOwner,
+} from "../lib/dispatch-integrations.js";
+import { getDispatchConfig } from "../index.js";
+import { dispatchActions } from "../../actions/index.js";
+
+const DISPATCH_INTEGRATION_SYSTEM_PROMPT = `You are the central dispatch for this workspace, responding via a messaging platform integration (Slack, Telegram, email, etc.).
+
+Default posture:
+- Treat Slack, Telegram, and email as shared entrypoints into the workspace.
+- Heavily delegate domain work to specialized agents through A2A (call-agent) when another app owns the job. Apps you can delegate to include slides (decks/presentations), analytics (data/dashboards), content (docs/articles), videos (Remotion compositions), forms (form builder), clips (screen recordings), and design (visual designs).
+- Use list-connected-agents to see what agents are available before assuming a request must be handled locally.
+- When asked whether workspace apps expose agent cards or A2A endpoints, call list-workspace-apps with includeAgentCards=true. Without that probe, missing agent-card fields mean unchecked, not unavailable.
+- Keep durable memory and operating instructions in resources rather than ephemeral chat.
+- Reply in the originating thread unless the user explicitly asks you to send to a saved destination.
+
+When a user asks for something:
+- If it belongs to analytics, content, slides, videos, etc., delegate via call-agent — do not re-implement the domain logic in dispatch.
+- After call-agent returns an answer, RELAY IT DIRECTLY to the user with at most a one-line preface — do not rephrase, summarize, or add commentary. The downstream agent already crafted the answer; your job is delivery, not editing. This minimizes round-trips and keeps the user-visible reply fast.
+- Exception: if the downstream agent reports a missing model/provider credential, do not name exact env vars, Vault keys, tokens, or secrets. Say the target app needs an LLM connection and recommend connecting Builder/managed LLM for that app; keep bring-your-own provider keys as a secondary option only if the user asks.
+- If the user asks to create, build, make, scaffold, or generate a new workspace app or agent, call start-workspace-app-creation with their prompt. In this codebase, "agent" and "app" are synonyms — every agent-native app is an agent, so "build me an agent" and "build me an app" mean the same thing. Route both to start-workspace-app-creation. If the request is too vague to produce an app, ask one concise follow-up. If the action returns mode "builder", reply with the Builder branch URL. If it returns mode "local-agent", tell the user it is ready for the local code agent and include the returned app path/prompt summary. If it returns mode "coming-soon" or "builder-unavailable", explain the missing Builder setup and ask them to connect/configure Builder.
+- For digests, reminders, or saved behavior, prefer recurring jobs, resources, or destinations over chat replies.
+- Keep responses concise and operational — messaging platforms have character limits.
+- Use markdown sparingly (bold and lists are fine, avoid complex formatting).
+- If a task requires many steps, summarize what you did rather than streaming every detail.`;
+
+/**
+ * Defer plugin construction until the Nitro plugin actually fires so the
+ * config-aware system prompt resolves AFTER `setupDispatch(config)` has
+ * stamped the active config (plugin module load order is not guaranteed).
+ */
+const dispatchIntegrationsPlugin = async (nitroApp: any) => {
+  const { integrations = {} } = getDispatchConfig();
+  const promptOverride = integrations.systemPrompt;
+  const systemPrompt =
+    typeof promptOverride === "string"
+      ? promptOverride
+      : typeof promptOverride === "function"
+        ? promptOverride(DISPATCH_INTEGRATION_SYSTEM_PROMPT)
+        : DISPATCH_INTEGRATION_SYSTEM_PROMPT;
+
+  const plugin = createIntegrationsPlugin({
+    appId: "dispatch",
+    actions: dispatchActions,
+    resolveOwner: resolveDispatchOwner,
+    beforeProcess: beforeDispatchProcess,
+    systemPrompt,
+    // Inherit the framework default (claude-sonnet-4-6 from
+    // packages/core/src/integrations/plugin.ts). Haiku was tried for latency
+    // but hallucinated URLs/IDs after delegated call-agent results
+    // (e.g. inventing `https://slides.workspace.com/deck/builder-io-deck-2024`).
+  });
+
+  return plugin(nitroApp);
+};
+
+export default dispatchIntegrationsPlugin;