@agent-native/dispatch 0.14.8 → 0.14.10

package/src/components/layout/Layout.spec.tsx

@@ -138,6 +138,27 @@ describe("Dispatch NavContent", () => {
     );
   });
 
+  it("keeps collapsed navigation compact and preserves section spacing", async () => {
+    await act(async () => {
+      root.render(
+        <MemoryRouter initialEntries={["/overview"]}>
+          <TooltipProvider>
+            <NavContent collapsed />
+          </TooltipProvider>
+        </MemoryRouter>,
+      );
+    });
+
+    const lists = [...container.querySelectorAll("nav > ul")];
+    expect(lists).toHaveLength(3);
+    expect(lists[0].className).toContain("gap-1");
+    expect(lists[1].className).toContain("mt-5");
+    expect(lists[1].className).toContain("gap-1");
+    expect(lists[2].className).toContain("mt-3");
+    expect(lists[2].className).toContain("gap-1");
+    expect(lists[0].querySelector("a")?.className).toContain("h-8 w-8");
+  });
+
   it("uses the quieter Analytics-style chat history and retains thread actions", async () => {
     await act(async () => {
       root.render(

package/src/components/layout/Layout.tsx

@@ -648,7 +648,7 @@ export function NavContent({
                 className={({ isActive }) => {
                   const active = isActive || itemMatchesLocalPath;
                   return cn(
-                    "flex h-10 w-10 items-center justify-center rounded-md text-sm",
+                    "flex h-8 w-8 items-center justify-center rounded-md text-sm",
                     active
                       ? "bg-sidebar-accent font-medium text-sidebar-accent-foreground"
                       : "text-sidebar-foreground/70 hover:bg-sidebar-accent hover:text-sidebar-accent-foreground",
@@ -775,19 +775,21 @@ export function NavContent({
         <nav className={cn("py-3", collapsed ? "px-1" : "px-2")}>
           <ul
             className={cn(
-              "space-y-0.5",
-              collapsed && "flex flex-col items-center",
+              collapsed ? "flex flex-col items-center gap-1" : "space-y-0.5",
             )}
           >
             {primaryNavItems.map(renderNavItem)}
           </ul>
 
           {collapsed ? (
-            <ul className="mt-2 flex flex-col items-center space-y-0.5">
-              {[...operationsNavItems, ...ADVANCED_NAV_ITEMS].map(
-                renderNavItem,
-              )}
-            </ul>
+            <>
+              <ul className="mt-5 flex flex-col items-center gap-1">
+                {operationsNavItems.map(renderNavItem)}
+              </ul>
+              <ul className="mt-3 flex flex-col items-center gap-1">
+                {ADVANCED_NAV_ITEMS.map(renderNavItem)}
+              </ul>
+            </>
           ) : (
             <div className="mt-5">
               <p className="px-2 pb-1 text-[11px] font-medium uppercase tracking-wide text-sidebar-foreground/45">
@@ -838,9 +840,11 @@ export function NavContent({
 export function Layout({
   children,
   extensions,
+  agentPageHref,
 }: {
   children: ReactNode;
   extensions?: DispatchExtensionConfig;
+  agentPageHref?: string;
 }) {
   const t = useT();
   const location = useLocation();
@@ -926,6 +930,7 @@ export function Layout({
     <AgentSidebar
       position="right"
       defaultOpen={false}
+      agentPageHref={agentPageHref}
       chatViewTransition
       storageKey="dispatch"
       openOnChatRunning={chatHomeHandoffActive}
@@ -944,7 +949,7 @@ export function Layout({
           data-collapsed={sidebarCollapsed ? "true" : "false"}
           className={cn(
             "agent-layout-left-drawer hidden shrink-0 flex-col border-e bg-sidebar text-sidebar-foreground transition-[width] duration-200 ease-out lg:flex",
-            sidebarCollapsed ? "w-12" : "w-64",
+            sidebarCollapsed ? "w-14" : "w-56",
           )}
         >
           <NavContent

package/src/components/workspace-app-card.spec.tsx

@@ -51,9 +51,13 @@ describe("WorkspaceAppCard", () => {
       );
     });
 
-    expect(
-      container.querySelector('a[aria-label="Open Analytics"]')?.className,
-    ).toContain("focus-visible:ring-2");
+    const appLink = container.querySelector<HTMLAnchorElement>(
+      'a[aria-label="Open Analytics"]',
+    );
+    expect(appLink?.getAttribute("href")).toBe("/analytics");
+    expect(appLink?.getAttribute("target")).toBeNull();
+    expect(appLink?.getAttribute("rel")).toBeNull();
+    expect(appLink?.className).toContain("focus-visible:ring-2");
 
     const actions = [
       container.querySelector<HTMLButtonElement>(
@@ -77,4 +81,31 @@ describe("WorkspaceAppCard", () => {
       expect(action?.className).not.toContain("opacity-0");
     }
   });
+
+  it("opens pending Builder apps in a new tab", async () => {
+    await act(async () => {
+      root.render(
+        <TooltipProvider>
+          <WorkspaceAppCard
+            app={{
+              id: "new-app",
+              name: "New app",
+              path: "/new-app",
+              builderUrl: "https://builder.example.com/projects/new-app",
+              status: "pending",
+            }}
+          />
+        </TooltipProvider>,
+      );
+    });
+
+    const appLink = container.querySelector<HTMLAnchorElement>(
+      'a[aria-label="Open New app"]',
+    );
+    expect(appLink?.getAttribute("href")).toBe(
+      "https://builder.example.com/projects/new-app",
+    );
+    expect(appLink?.getAttribute("target")).toBe("_blank");
+    expect(appLink?.getAttribute("rel")).toBe("noreferrer");
+  });
 });

package/src/server/lib/vault-boot-resync.spec.ts

@@ -0,0 +1,68 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  resyncAllVaultSecretsToCredentialStore: vi.fn(),
+}));
+
+vi.mock("./vault-store.js", () => ({
+  resyncAllVaultSecretsToCredentialStore:
+    mocks.resyncAllVaultSecretsToCredentialStore,
+}));
+
+import {
+  __resetVaultBootResyncGuardForTests,
+  scheduleVaultBootResync,
+} from "./vault-boot-resync.js";
+
+describe("scheduleVaultBootResync", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    __resetVaultBootResyncGuardForTests();
+    mocks.resyncAllVaultSecretsToCredentialStore.mockResolvedValue({
+      groups: 0,
+      failedGroups: 0,
+      syncedKeys: 0,
+    });
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    mocks.resyncAllVaultSecretsToCredentialStore.mockReset();
+  });
+
+  it("does not run the resync synchronously — it waits for the boot delay", () => {
+    scheduleVaultBootResync();
+    expect(mocks.resyncAllVaultSecretsToCredentialStore).not.toHaveBeenCalled();
+  });
+
+  it("runs the resync exactly once after the boot delay elapses", async () => {
+    scheduleVaultBootResync();
+    await vi.runAllTimersAsync();
+    expect(mocks.resyncAllVaultSecretsToCredentialStore).toHaveBeenCalledTimes(
+      1,
+    );
+  });
+
+  it("only schedules one timer per process even if called repeatedly", async () => {
+    scheduleVaultBootResync();
+    scheduleVaultBootResync();
+    scheduleVaultBootResync();
+    await vi.runAllTimersAsync();
+    expect(mocks.resyncAllVaultSecretsToCredentialStore).toHaveBeenCalledTimes(
+      1,
+    );
+  });
+
+  it("swallows a resync failure instead of throwing", async () => {
+    mocks.resyncAllVaultSecretsToCredentialStore.mockRejectedValue(
+      new Error("boom"),
+    );
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    scheduleVaultBootResync();
+    await vi.runAllTimersAsync();
+
+    expect(warnSpy).toHaveBeenCalled();
+    warnSpy.mockRestore();
+  });
+});

package/src/server/lib/vault-boot-resync.ts

@@ -0,0 +1,50 @@
+import { resyncAllVaultSecretsToCredentialStore } from "./vault-store.js";
+
+/**
+ * Give the process a moment to finish booting (migrations, DB pool warmup,
+ * etc.) before touching every vault secret. This is a self-heal, not a
+ * hot-path dependency, so there is no urgency to run it immediately.
+ */
+const BOOT_RESYNC_DELAY_MS = 8000;
+
+/** Guards against scheduling more than one resync per process — see
+ * `scheduleVaultBootResync` below. */
+let scheduled = false;
+
+/**
+ * Schedule a one-time, best-effort re-sync of every vault secret (across
+ * every tenant) into the shared credential store, a few seconds after boot.
+ *
+ * Why this exists: `syncSecretsToCredentialStore` only runs when a vault
+ * secret is created or updated, so it only re-encrypts rows a user happens
+ * to touch. When the shared `app_secrets` encryption format changes under
+ * it — e.g. the `shared_encrypted_value` dual-write, or hosted workspaces
+ * deriving shared key material from `A2A_SECRET` — existing rows are stuck
+ * on the old format until someone manually re-saves each vault secret,
+ * which breaks sibling apps reading them. Re-running the sync for every row
+ * at boot self-heals that without any manual step.
+ *
+ * Fires at most once per process (`scheduled` guard) so calling this again
+ * — e.g. if the owning plugin module re-runs under dev's `*-plugin.ts` HMR
+ * reload — doesn't stack duplicate timers. Runs fully non-blocking: it
+ * never delays startup, and any failure is caught and logged rather than
+ * thrown, since a stale-encryption row is a degraded state, not a crash.
+ */
+export function scheduleVaultBootResync(): void {
+  if (scheduled) return;
+  scheduled = true;
+
+  setTimeout(() => {
+    void resyncAllVaultSecretsToCredentialStore().catch((error) => {
+      console.warn(
+        "[dispatch] vault boot resync failed to run",
+        error instanceof Error ? error.message : error,
+      );
+    });
+  }, BOOT_RESYNC_DELAY_MS);
+}
+
+/** Test-only: reset the once-per-process guard between spec runs. */
+export function __resetVaultBootResyncGuardForTests(): void {
+  scheduled = false;
+}

package/src/server/lib/vault-store.spec.ts

@@ -4,12 +4,14 @@ const mocks = vi.hoisted(() => ({
   deleteAppSecret: vi.fn(),
   getDb: vi.fn(),
   listAppSecretsForScope: vi.fn(),
+  readAppSecret: vi.fn(),
   writeAppSecret: vi.fn(),
 }));
 
 vi.mock("@agent-native/core/secrets", () => ({
   deleteAppSecret: mocks.deleteAppSecret,
   listAppSecretsForScope: mocks.listAppSecretsForScope,
+  readAppSecret: mocks.readAppSecret,
   writeAppSecret: mocks.writeAppSecret,
 }));
 
@@ -21,10 +23,13 @@ vi.mock("../../db/index.js", async (importOriginal) => {
   };
 });
 
+import { readAppSecret } from "@agent-native/core/secrets";
+
 import {
   cleanupSyncedCredentialKeysIfUnused,
   credentialStoreScopeForVaultCtx,
   isTrustedEnvVarSyncAgentUrl,
+  resyncAllVaultSecretsToCredentialStore,
   syncSecretsToCredentialStore,
 } from "./vault-store.js";
 
@@ -187,3 +192,130 @@ describe("cleanupSyncedCredentialKeysIfUnused", () => {
     });
   });
 });
+
+describe("resyncAllVaultSecretsToCredentialStore", () => {
+  function mockVaultSecretsRows(rows: Array<Record<string, unknown>>) {
+    mocks.getDb.mockReturnValue({
+      select: () => ({
+        from: () => Promise.resolve(rows),
+      }),
+    });
+  }
+
+  /** In-memory stand-in for the shared credential store, keyed the same way
+   * the real app_secrets table is: scope + scopeId + key. */
+  function fakeCredentialStore() {
+    const store = new Map<string, string>();
+    mocks.writeAppSecret.mockImplementation(async (args: any) => {
+      store.set(`${args.scope}:${args.scopeId}:${args.key}`, args.value);
+      return "app-secret-id";
+    });
+    mocks.readAppSecret.mockImplementation(async (ref: any) => {
+      const value = store.get(`${ref.scope}:${ref.scopeId}:${ref.key}`);
+      return value === undefined ? null : { value, updatedAt: Date.now() };
+    });
+    return store;
+  }
+
+  afterEach(() => {
+    mocks.writeAppSecret.mockReset();
+    mocks.readAppSecret.mockReset();
+  });
+
+  it("syncs vault secrets from different tenants into their own credential-store scopes", async () => {
+    fakeCredentialStore();
+    mockVaultSecretsRows([
+      {
+        id: "secret_org",
+        ownerEmail: "admin@example.test",
+        orgId: "org_123",
+        name: "OpenAI API Key",
+        credentialKey: "OPENAI_API_KEY",
+        value: "sk-org-key",
+      },
+      {
+        id: "secret_solo",
+        ownerEmail: "owner@example.test",
+        orgId: null,
+        name: "Personal API Key",
+        credentialKey: "PERSONAL_API_KEY",
+        value: "sk-personal-key",
+      },
+    ]);
+
+    const result = await resyncAllVaultSecretsToCredentialStore();
+
+    expect(result).toEqual({ groups: 2, failedGroups: 0, syncedKeys: 2 });
+
+    const orgScope = credentialStoreScopeForVaultCtx({
+      ownerEmail: "admin@example.test",
+      orgId: "org_123",
+    });
+    const soloScope = credentialStoreScopeForVaultCtx({
+      ownerEmail: "owner@example.test",
+      orgId: null,
+    });
+
+    await expect(
+      readAppSecret({ key: "OPENAI_API_KEY", ...orgScope }),
+    ).resolves.toMatchObject({ value: "sk-org-key" });
+    await expect(
+      readAppSecret({ key: "PERSONAL_API_KEY", ...soloScope }),
+    ).resolves.toMatchObject({ value: "sk-personal-key" });
+  });
+
+  it("logs and skips a group that fails without blocking the other groups", async () => {
+    const store = fakeCredentialStore();
+    const writeImpl = mocks.writeAppSecret.getMockImplementation();
+    mocks.writeAppSecret.mockImplementation(async (args: any) => {
+      if (args.key === "BROKEN_KEY") {
+        throw new Error("simulated credential-store write failure");
+      }
+      return writeImpl!(args);
+    });
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    mockVaultSecretsRows([
+      {
+        id: "secret_broken",
+        ownerEmail: "admin@broken.test",
+        orgId: "org_broken",
+        name: "Broken Key",
+        credentialKey: "BROKEN_KEY",
+        value: "sk-broken-value",
+      },
+      {
+        id: "secret_solo",
+        ownerEmail: "owner@example.test",
+        orgId: null,
+        name: "Personal API Key",
+        credentialKey: "PERSONAL_API_KEY",
+        value: "sk-personal-key",
+      },
+    ]);
+
+    const result = await resyncAllVaultSecretsToCredentialStore();
+
+    expect(result).toEqual({ groups: 2, failedGroups: 1, syncedKeys: 1 });
+
+    // The failed org's key never landed in the credential store.
+    expect(store.get("org:org_broken:BROKEN_KEY")).toBeUndefined();
+
+    // The other tenant's group still synced successfully.
+    const soloScope = credentialStoreScopeForVaultCtx({
+      ownerEmail: "owner@example.test",
+      orgId: null,
+    });
+    await expect(
+      readAppSecret({ key: "PERSONAL_API_KEY", ...soloScope }),
+    ).resolves.toMatchObject({ value: "sk-personal-key" });
+
+    // Exactly one warning, naming the key but never the plaintext value.
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const [warnMessage] = warnSpy.mock.calls[0]!;
+    expect(String(warnMessage)).toContain("BROKEN_KEY");
+    expect(String(warnMessage)).not.toContain("sk-broken-value");
+
+    warnSpy.mockRestore();
+  });
+});

package/src/server/lib/vault-store.ts

@@ -763,6 +763,64 @@ export async function syncSecretsToCredentialStore(
   return { ...target, keys: syncedKeys };
 }
 
+/**
+ * Re-sync every vault secret across every tenant into the shared credential
+ * store, regardless of which request/ctx is currently active.
+ *
+ * `syncSecretsToCredentialStore` normally only runs on `createSecret` /
+ * `updateSecret`, so it only re-encrypts the rows a user happens to touch.
+ * When the shared `app_secrets` encryption format changes underneath it
+ * (e.g. a new dual-write format, or a change to how key material is
+ * derived), existing rows are stuck on the old format until someone
+ * manually re-saves each vault secret. This walks every `vault_secrets`
+ * row directly — bypassing the ctx-scoped `listSecrets()` — groups them by
+ * their (orgId, ownerEmail) tenant, and re-runs the sync per group so every
+ * row regains fresh ciphertext.
+ *
+ * A failure syncing one tenant's group is caught and logged (key NAMES
+ * only, never values) so it can't block the rest of the resync.
+ */
+export async function resyncAllVaultSecretsToCredentialStore(): Promise<{
+  groups: number;
+  failedGroups: number;
+  syncedKeys: number;
+}> {
+  const db = getDb();
+  const rows = await db.select().from(schema.vaultSecrets);
+
+  const groups = new Map<string, { ctx: VaultCtx; rows: VaultSecretRow[] }>();
+  for (const row of rows) {
+    if (!row.credentialKey || !row.value) continue;
+    const ctx: VaultCtx = { ownerEmail: row.ownerEmail, orgId: row.orgId };
+    const groupKey = `${ctx.orgId ?? ""}${ctx.ownerEmail}`;
+    const group = groups.get(groupKey);
+    if (group) {
+      group.rows.push(row);
+    } else {
+      groups.set(groupKey, { ctx, rows: [row] });
+    }
+  }
+
+  let failedGroups = 0;
+  let syncedKeys = 0;
+
+  for (const { ctx, rows: groupRows } of groups.values()) {
+    try {
+      const result = await syncSecretsToCredentialStore(groupRows, ctx);
+      syncedKeys += result.keys.length;
+    } catch (error) {
+      failedGroups++;
+      const keyNames = groupRows.map((row) => row.credentialKey).join(", ");
+      console.warn(
+        `[dispatch] vault boot resync failed for org=${ctx.orgId ?? "(solo)"} owner=${ctx.ownerEmail}; affected keys: ${keyNames}`,
+        error instanceof Error ? error.message : error,
+      );
+    }
+  }
+
+  return { groups: groups.size, failedGroups, syncedKeys };
+}
+
 export async function cleanupSyncedCredentialKeysIfUnused(
   ctx: VaultCtx,
   candidateKeys?: string[],

package/src/server/plugins/agent-chat.ts

@@ -55,7 +55,8 @@ Use the standard workspace primitives:
 - Use recurring jobs for scheduled behavior.
 - Use custom agent profiles in agents/*.md for local spawned work and remote-agents/*.json for remote A2A apps.
 - You receive a compact available-apps block with sibling workspace app names and descriptions. Use it to pick the right A2A target, and call list-connected-agents or tool-search only when you need fresh details.
-- When answering whether workspace apps expose agent cards or A2A endpoints, call list-workspace-apps with includeAgentCards=true. If you have not requested that probe, absence of agent-card fields means unchecked, not unavailable.
+- Hosted/connected A2A neighbors such as Analytics and Content come from the available-apps context or list-connected-agents. list-workspace-apps only inventories apps mounted inside this workspace deployment; never use a missing row there to conclude that a connected agent is unavailable.
+- When answering whether a mounted workspace app exposes an agent card or A2A endpoint, call list-workspace-apps with includeAgentCards=true. If you have not requested that probe, absence of agent-card fields means unchecked, not unavailable.
 - When creating a new workspace app, create a separate app under apps/<app-id> with apps/<app-id>/package.json including a concise generated description, mount it at /<app-id>, use relative /<app-id> links, never hardcode localhost or dev ports, use shadcn/ui with @tabler/icons-react rather than lucide-react, and ensure the React Router client entry preserves APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath(). There is no separate workspace app registry to edit.
 - If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible "Chat", "Starter", "Blank app", or "New app" UI behind.
 - Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.

package/src/server/plugins/db.ts

@@ -1,7 +1,20 @@
 import { runMigrations } from "@agent-native/core/db";
 
 import { dispatchMigrations } from "../../db/migrations.js";
+import { scheduleVaultBootResync } from "../lib/vault-boot-resync.js";
 
-export default runMigrations(dispatchMigrations, {
+const runDispatchMigrations = runMigrations(dispatchMigrations, {
   table: "dispatch_migrations",
 });
+
+/**
+ * Run dispatch's own migrations first (this is what guarantees
+ * `vault_secrets` exists), then kick off the vault boot resync. The resync
+ * itself waits several more seconds before touching the DB — see
+ * vault-boot-resync.ts — so this ordering is a belt-and-suspenders
+ * guarantee, not a hard dependency.
+ */
+export default async (nitroApp: any) => {
+  await runDispatchMigrations(nitroApp);
+  scheduleVaultBootResync();
+};

package/src/server/plugins/integrations.ts

@@ -24,7 +24,8 @@ Default posture:
 - Treat Slack, Telegram, and email as shared entrypoints into the workspace.
 - Heavily delegate domain work to specialized agents through A2A (call-agent) when another app owns the job. Apps you can delegate to include slides (decks/presentations), analytics (data/dashboards), content (docs/articles), forms (form builder), clips (screen recordings), design (visual designs), and assets (brand libraries plus generated images/videos).
 - Use the available-apps prompt context first, then list-connected-agents when you need fresh details, to see what agents are available before assuming a request must be handled locally.
-- When asked whether workspace apps expose agent cards or A2A endpoints, call list-workspace-apps with includeAgentCards=true. Without that probe, missing agent-card fields mean unchecked, not unavailable.
+- Hosted/connected A2A neighbors such as Analytics and Content come from the available-apps context or list-connected-agents. list-workspace-apps only inventories apps mounted inside this workspace deployment; never use a missing row there to conclude that a connected agent is unavailable.
+- When asked whether a mounted workspace app exposes an agent card or A2A endpoint, call list-workspace-apps with includeAgentCards=true. Without that probe, missing agent-card fields mean unchecked, not unavailable.
 - Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.
 - Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.
 - Keep durable memory and operating instructions in resources rather than ephemeral chat.