@agent-native/dispatch 0.15.20 → 0.15.21

package/dist/server/lib/app-creation-store.js

@@ -3,7 +3,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { getDbExec } from "@agent-native/core/db";
-import { getBuilderBranchProjectId, getRequestContext, isIntegrationCallerRequest, resolveBuilderBranchProjectId, resolveBuilderCredentials, runBuilderAgent, } from "@agent-native/core/server";
+import { deleteAppSecret, writeAppSecret, } from "@agent-native/core/secrets";
+import { getBuilderBranchProjectId, getRequestContext, isIntegrationCallerRequest, resolveBuilderBranchProjectId, resolveBuilderCredentialsDetailed, runBuilderAgent, } from "@agent-native/core/server";
 import { getSetting, putSetting } from "@agent-native/core/settings";
 import { assertValidWorkspaceAppId } from "@agent-native/core/shared";
 import { identityKeyForIncoming } from "./dispatch-integrations.js";
@@ -11,6 +12,8 @@ import { currentOrgId, currentOwnerEmail, recordAudit, resolveLinkedOwner, } fro
 import { createRequest, listSecrets } from "./vault-store.js";
 import { grantWorkspaceResourcesToApp, listWorkspaceResourceOptions, } from "./workspace-resources-store.js";
 const SETTINGS_KEY = "dispatch-app-creation-settings";
+const BUILDER_BRANCH_PROJECT_SECRET_KEY = "BUILDER_BRANCH_PROJECT_ID";
+const BUILDER_BRANCH_PROJECT_SECRET_DESCRIPTION = "Builder project for cloud code-change branches (set in Dispatch)";
 const WORKSPACE_APP_METADATA_SETTINGS_KEY = "workspace-app-metadata";
 const WORKSPACE_APPS_ENV_KEY = "AGENT_NATIVE_WORKSPACE_APPS_JSON";
 const WORKSPACE_APPS_MANIFEST_FILE = "workspace-apps.json";
@@ -83,6 +86,13 @@ function scopedSettingsKey() {
         return `${SETTINGS_KEY}:org:${orgId}`;
     return `${SETTINGS_KEY}:user:${currentOwnerEmail()}`;
 }
+function builderProjectSecretTarget() {
+    const orgId = currentOrgId();
+    if (orgId)
+        return { scope: "org", scopeId: orgId };
+    const email = currentOwnerEmail();
+    return email ? { scope: "workspace", scopeId: `solo:${email}` } : null;
+}
 function workspaceAppMetadataSettingsKey() {
     const orgId = currentOrgId();
     if (orgId)
@@ -1158,6 +1168,28 @@ export async function setAppCreationSettings(input) {
     await assertCanManageAppCreationSettings();
     const builderProjectId = input.builderProjectId?.trim() || null;
     const raw = await readSettingsRecord();
+    // The credential store, not this settings row, is what
+    // `resolveBuilderBranchProjectId()` reads. Write it first: a saved setting
+    // whose secret never landed reports the project as configured while cloud
+    // code changes stay silently disabled.
+    const secretTarget = builderProjectSecretTarget();
+    if (secretTarget) {
+        const ref = {
+            key: BUILDER_BRANCH_PROJECT_SECRET_KEY,
+            scope: secretTarget.scope,
+            scopeId: secretTarget.scopeId,
+        };
+        if (builderProjectId) {
+            await writeAppSecret({
+                ...ref,
+                value: builderProjectId,
+                description: BUILDER_BRANCH_PROJECT_SECRET_DESCRIPTION,
+            });
+        }
+        else {
+            await deleteAppSecret(ref);
+        }
+    }
     await putSetting(scopedSettingsKey(), { ...raw, builderProjectId });
     await recordAudit({
         action: "settings.updated",
@@ -1292,6 +1324,7 @@ async function remoteAppCreationAuthorization() {
             return { ok: true };
         return {
             ok: false,
+            reason: "identity-not-linked",
             message: "Messaging-triggered app creation is using the deployment default Dispatch owner. " +
                 "Link the messaging identity to a Dispatch user with /link, start the app from Dispatch while signed in, or explicitly set ENABLE_BUILDER=true for this deployment.",
         };
@@ -1303,6 +1336,7 @@ async function remoteAppCreationAuthorization() {
         : "Synthetic integration";
     return {
         ok: false,
+        reason: "identity-not-linked",
         message: `${source} app creation needs a trusted Dispatch owner before Builder can start a branch. ` +
             "Link the messaging identity to a Dispatch user with /link, start the app from Dispatch while signed in, or explicitly set ENABLE_BUILDER=true for this deployment.",
     };
@@ -1405,6 +1439,7 @@ export async function startWorkspaceAppCreation(input) {
             return {
                 mode: "builder-unavailable",
                 appId: initial.appId,
+                reason: authorization.reason,
                 message: authorization.message,
             };
         }
@@ -1450,10 +1485,40 @@ export async function startWorkspaceAppCreation(input) {
             message: "This requires a code change. Edit locally or use Builder.io to edit this code in the cloud and continue customizing the app any way you like.",
         };
     }
+    let builderCreds;
+    try {
+        builderCreds = await resolveBuilderCredentialsDetailed();
+    }
+    catch {
+        return {
+            mode: "builder-unavailable",
+            appId: built.appId,
+            reason: "credential-store-unavailable",
+            projectId: settings.builderProjectId,
+            message: "Could not read your Builder connection just now. Try creating the app again in a moment.",
+        };
+    }
+    if (builderCreds.lookupFailed) {
+        return {
+            mode: "builder-unavailable",
+            appId: built.appId,
+            reason: "credential-store-unavailable",
+            projectId: settings.builderProjectId,
+            message: "Could not read your Builder connection just now. Try creating the app again in a moment.",
+        };
+    }
+    if (!builderCreds.privateKey || !builderCreds.publicKey) {
+        return {
+            mode: "builder-unavailable",
+            appId: built.appId,
+            reason: "builder-not-connected",
+            projectId: settings.builderProjectId,
+            message: "Connect your Builder account to create apps from Dispatch.",
+        };
+    }
+    const builderUserId = builderCreds.userId || undefined;
     let result;
     try {
-        const builderCreds = await resolveBuilderCredentials().catch(() => null);
-        const builderUserId = builderCreds?.userId || undefined;
         result = normalizeBuilderRunResult(await runBuilderAgent({
             prompt,
             projectId: settings.builderProjectId,
@@ -1469,10 +1534,10 @@ export async function startWorkspaceAppCreation(input) {
         return {
             mode: "builder-unavailable",
             appId: built.appId,
+            reason: "builder-error",
             projectId: settings.builderProjectId,
-            message: `Builder app creation is configured for project ${settings.builderProjectId}, ` +
-                `but it could not start yet: ${detail}. Connect Builder for this user, ` +
-                `link the messaging identity to that user, or configure deployment-managed Builder credentials for this workspace.`,
+            detail,
+            message: "Builder could not start the app branch. This is usually temporary — try again.",
         };
     }
     await recordPendingWorkspaceApp({