@agent-native/dispatch 0.20.4 → 0.22.0

package/src/server/lib/app-creation-store.spec.ts

@@ -555,6 +555,19 @@ describe("startWorkspaceAppCreation", () => {
     expect(mocks.runBuilderAgent).toHaveBeenCalledWith(
       expect.objectContaining({ userId: "builder-user-42" }),
     );
+    const builderPrompt = String(
+      mocks.runBuilderAgent.mock.calls.at(-1)?.[0]?.prompt ?? "",
+    );
+    expect(builderPrompt).toContain("Autonomous Builder handoff contract:");
+    expect(builderPrompt).toContain(
+      "do not invoke a clarification, guided-question, or choice flow",
+    );
+    expect(builderPrompt).toContain(
+      "choose the most direct, conservative default",
+    );
+    expect(builderPrompt).toContain(
+      "Treat the source brief's unknowns and follow-up items as assumptions",
+    );
   });
 
   it("provisions and remembers the workspace Builder project when none is configured", async () => {

package/src/server/lib/app-creation-store.ts

@@ -57,6 +57,17 @@ const PENDING_WORKSPACE_APP_TTL_MS = 7 * 24 * 60 * 60 * 1_000;
 const AGENT_CARD_PATH = "/.well-known/agent-card.json";
 const AGENT_CARD_FETCH_TIMEOUT_MS = 1_500;
 const DEFAULT_WORKSPACE_APP_AUDIENCE = "internal";
+const AUTONOMOUS_WORKSPACE_APP_CREATION_CONTRACT = [
+  "Autonomous Builder handoff contract:",
+  "- This is a background implementation run launched by the turn-into-app workflow. Treat the source brief and latest user request as authorization to build the app now; do not return a proposal or wait for another turn.",
+  "- Do not ask the user questions during the initial build and do not invoke a clarification, guided-question, or choice flow for a non-blocking decision.",
+  "- When the source or a tool presents a recommended option, choose it and continue. When no recommendation is present, choose the most direct, conservative default supported by the source and normal Agent-Native conventions.",
+  "- Resolve product, visual, copy, layout, route, data-model, dependency, and integration choices yourself. If an input is missing, use an empty state or clearly labeled representative sample so the workflow is demonstrable; never invent private facts or credentials.",
+  "- Treat the source brief's unknowns and follow-up items as assumptions to record in the app README or a visible Assumptions / Review section, not as questions to send back to the user.",
+  "- If a nonessential integration or provider is unavailable, build the supported boundary and leave a precise setup note; do not stop to ask which equivalent to use.",
+  "- Pause only for a true hard blocker: missing authorization required to create or access the branch, a destructive or irreversible external action, an ambiguous target workspace/project, or the absence of any identifiable repeatable workflow. Otherwise make the best grounded choice and proceed.",
+  "- Complete the UI, actions, instructions, application state, representative happy path, and verification in this run. Do not stop after planning, scaffolding, or a question.",
+].join("\n");
 const pendingBuilderProjectProvisioning = new Map<
   string,
   Promise<{ projectId: string }>
@@ -1931,6 +1942,8 @@ function buildWorkspaceAppPrompt(input: {
     prompt: [
       "Create a new agent-native app in this workspace.",
       "",
+      AUTONOMOUS_WORKSPACE_APP_CREATION_CONTRACT,
+      "",
       `App name: ${appId}`,
       `App description: ${appDescription}`,
       `Template to start from: ${input.template || "starter"}`,

package/src/server/lib/mcp-gateway.spec.ts

@@ -880,6 +880,24 @@ describe("createGrantedDispatchMcpEmbedSession", () => {
     ).rejects.toThrow(/safe app-relative route/);
   });
 
+  it("rejects a URL that does not belong to the explicitly named app", async () => {
+    await expect(
+      runWithRequestContext(
+        {
+          userEmail: "owner@example.test",
+          requestOrigin: "http://localhost:8092",
+        },
+        () =>
+          createGrantedDispatchMcpEmbedSession({
+            app: "analytics",
+            url: "https://mail.example.com/inbox",
+          }),
+      ),
+    ).rejects.toThrow(
+      /Embed URL must belong to an app granted through Dispatch/,
+    );
+  });
+
   it("routes same-origin mounted app embed URLs to the mounted app", async () => {
     mocks.discoverAgents.mockResolvedValue([
       {

package/src/server/lib/thread-debug-store.spec.ts

@@ -52,6 +52,8 @@ const run = {
   worker_stage: "model",
   diag_stage: '{"stage":"model"}',
   peak_rss_mb: 321,
+  in_flight_since: 8,
+  dispatch_payload: '{"request":"retained"}',
 };
 
 function rowsForThreadLookup(sql: string, args: unknown[]) {
@@ -117,6 +119,19 @@ describe("thread-debug-store", () => {
     expect(result.threads[0]?.id).toBe(thread.id);
   });
 
+  it("matches owner email from the main search query", async () => {
+    const result = await searchAgentThreads({ query: "owner@example.com" });
+
+    expect(result.threads).toHaveLength(1);
+    const searchRequest = mocks.currentExecute.mock.calls.find(
+      ([request]) =>
+        typeof request?.sql === "string" &&
+        request.sql.includes("LOWER(owner_email) LIKE"),
+    )?.[0];
+    expect(searchRequest?.sql).toContain("LOWER(owner_email) LIKE");
+    expect(searchRequest?.args).toContain("%owner@example.com%");
+  });
+
   it("resolves a run id and returns rich run diagnostics", async () => {
     const result = await getAgentThreadDebug({ runId: run.id });
 
@@ -137,6 +152,8 @@ describe("thread-debug-store", () => {
       workerStage: "model",
       diagStage: '{"stage":"model"}',
       peakRssMb: 321,
+      inFlightSince: 8,
+      hasDispatchPayload: true,
     });
     expect(
       mocks.currentExecute.mock.calls.some(([request]) =>

package/src/server/lib/thread-debug-store.ts

@@ -79,6 +79,8 @@ interface AgentRunRow {
   worker_stage?: string | null;
   diag_stage?: string | null;
   peak_rss_mb?: number | string | null;
+  in_flight_since?: number | string | null;
+  dispatch_payload?: string | null;
 }
 
 const execCache = new Map<string, Promise<DbExec>>();
@@ -586,6 +588,11 @@ function serializeRun(row: AgentRunRow, events: any[] = []) {
     workerStage: row.worker_stage ? String(row.worker_stage) : null,
     diagStage: row.diag_stage ? String(row.diag_stage) : null,
     peakRssMb: nullableNumberField(row.peak_rss_mb),
+    inFlightSince: nullableNumberField(row.in_flight_since),
+    hasDispatchPayload:
+      row.dispatch_payload !== null &&
+      row.dispatch_payload !== undefined &&
+      String(row.dispatch_payload).length > 0,
     events,
   };
 }
@@ -906,11 +913,11 @@ export async function searchAgentThreads(input: {
         ? " OR id IN (" + runThreadIds.map(() => "?").join(", ") + ")"
         : "";
     where.push(
-      "(LOWER(title) LIKE ? ESCAPE '\\' OR LOWER(preview) LIKE ? ESCAPE '\\' OR LOWER(thread_data) LIKE ? ESCAPE '\\'" +
+      "(LOWER(title) LIKE ? ESCAPE '\\' OR LOWER(preview) LIKE ? ESCAPE '\\' OR LOWER(owner_email) LIKE ? ESCAPE '\\' OR LOWER(thread_data) LIKE ? ESCAPE '\\'" +
         runIdClause +
         ")",
     );
-    args.push(pattern, pattern, pattern);
+    args.push(pattern, pattern, pattern, pattern);
     args.push(...runThreadIds);
   }
   args.push(limit);

package/src/server/plugins/agent-chat.ts

@@ -65,6 +65,7 @@ Use the standard workspace primitives:
 - Hosted/connected A2A neighbors such as Analytics and Content come from the available-apps context or list-connected-agents. list-workspace-apps only inventories apps mounted inside this workspace deployment; never use a missing row there to conclude that a connected agent is unavailable.
 - When answering whether a mounted workspace app exposes an agent card or A2A endpoint, call list-workspace-apps with includeAgentCards=true. If you have not requested that probe, absence of agent-card fields means unchecked, not unavailable.
 - When creating a new workspace app, create a separate app under apps/<app-id> with apps/<app-id>/package.json including a concise generated description, mount it at /<app-id>, use relative /<app-id> links, never hardcode localhost or dev ports, use shadcn/ui with @tabler/icons-react rather than lucide-react, and ensure the React Router client entry preserves APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath(). There is no separate workspace app registry to edit.
+- When an explicit app-creation request already includes a source brief or a concrete repeatable workflow, call start-workspace-app-creation without asking non-blocking product or UX questions. Choose recommended defaults, let the Builder handoff record assumptions, and ask only for authorization, credentials, a destructive action, an ambiguous target workspace, or a genuinely missing workflow.
 - If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible "Chat", "Starter", "Blank app", or "New app" UI behind.
 - Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.
 - Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.

package/src/server/plugins/integrations.ts

@@ -42,7 +42,7 @@ When a user asks for something:
 - If the user asks to create, build, make, scaffold, or generate an "agent" from Dispatch chat or by tagging @agent-native in Slack, email, or Telegram, first classify the ask. If it is a simple Dispatch-native behavior like a reminder, digest, monitor, routing rule, saved instruction, or recurring workflow, create or update the recurring job/resource/destination in Dispatch. If it is a robust unique product or teammate that needs its own UI, data model, actions, integrations, or domain workflow, treat it as a new workspace app and call start-workspace-app-creation.
 - If a new-app prompt asks for access to Mail, Calendar, Analytics, Brain, Assets, or similar first-party app data/agents, keep using the existing hosted/connected app and A2A path. Do not ask Builder to scaffold those apps as children of the new app unless the user explicitly asks for a customized app from that template.
 - If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible "Chat", "Starter", "Blank app", or "New app" UI behind.
-- If the user explicitly asks for a new app or workspace app, call start-workspace-app-creation with their prompt and include a concise generated description by default. Do not satisfy a new-app request by adding a route, page, component, or file inside apps/chat or another existing app unless the user explicitly asks to modify that existing app. If the request is too vague to classify, ask one concise follow-up. If the action returns mode "builder", reply with the Builder branch URL; Builder is responsible for creating the separate workspace app under apps/<app-id>, mounting it at /<app-id>, ensuring apps/<app-id>/package.json exists with name/displayName and description so Dispatch discovers it, using relative /<app-id> links instead of hardcoded localhost/dev ports, and preserving APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath() in the React Router client entry. The new app lives at the workspace root /<app-id>, NOT under /dispatch/<app-id>, /apps/<app-id>, or any other Dispatch tab — when telling the user where to find it, link to /<app-id> only. There is no separate workspace app registry to edit. If it returns mode "local-agent", tell the user it is ready for the local code agent and include the returned app path/prompt summary. Dispatch reuses the connected workspace Builder project or provisions it through the Builder Projects API when an organization owner/admin starts the first app; members need an owner/admin to configure the project first. Do not ask the user to use Builder org/beta settings. If it returns mode "builder-unavailable", the action also returns a \`reason\` code plus a user-facing \`message\` and (for some reasons) an operator-facing \`detail\`. Relay the \`message\` to the user as-is; only surface \`detail\` when the user is clearly an operator debugging the deployment (e.g. troubleshooting a broken Builder connection for the workspace), never as routine detail for an end user.
+- If the user explicitly asks for a new app or workspace app, call start-workspace-app-creation with their prompt and include a concise generated description by default. Do not satisfy a new-app request by adding a route, page, component, or file inside apps/chat or another existing app unless the user explicitly asks to modify that existing app. When the prompt contains a source brief or concrete repeatable workflow, choose recommended defaults and do not ask non-blocking product or UX questions; ask only for authorization, credentials, a destructive action, an ambiguous target workspace, or a genuinely missing workflow. If the request is too vague to classify, ask one concise follow-up. If the action returns mode "builder", reply with the Builder branch URL; Builder is responsible for creating the separate workspace app under apps/<app-id>, mounting it at /<app-id>, ensuring apps/<app-id>/package.json exists with name/displayName and description so Dispatch discovers it, using relative /<app-id> links instead of hardcoded localhost/dev ports, and preserving APP_BASE_PATH/VITE_APP_BASE_PATH in the React Router client entry. The new app lives at the workspace root /<app-id>, NOT under /dispatch/<app-id>, /apps/<app-id>, or any other Dispatch tab — when telling the user where to find it, link to /<app-id> only. There is no separate workspace app registry to edit. If it returns mode "local-agent", tell the user it is ready for the local code agent and include the returned app path/prompt summary. Dispatch reuses the connected workspace Builder project or provisions it through the Builder Projects API when an organization owner/admin starts the first app; members need an owner/admin to configure the project first. Do not ask the user to use Builder org/beta settings. If it returns mode "builder-unavailable", the action also returns a \`reason\` code plus a user-facing \`message\` and (for some reasons) an operator-facing \`detail\`. Relay the \`message\` to the user as-is; only surface \`detail\` when the user is clearly an operator debugging the deployment (e.g. troubleshooting a broken Builder connection for the workspace), never as routine detail for an end user.
 - For digests, reminders, or saved behavior, prefer recurring jobs, resources, or destinations over chat replies.
 - Keep responses concise and operational — messaging platforms have character limits.
 - Use markdown sparingly (bold and lists are fine, avoid complex formatting).

package/src/styles/dispatch.css

@@ -7,6 +7,35 @@
 @source "../components/**/*.{js,mjs,ts,tsx}";
 @source "../hooks/**/*.{js,mjs,ts,tsx}";
 @source "../routes/**/*.{js,mjs,ts,tsx}";
+@source "../../../core/src/client/chat-first/**/*.{ts,tsx}";
+
+.dispatch-chat-first-chats .an-chat-history-rail__new-chat {
+  display: none;
+}
+
+.dispatch-chat-first-notice {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  border-bottom: 1px solid hsl(var(--border));
+  background: hsl(var(--muted) / 0.35);
+  padding: 0.5rem 0.75rem;
+  color: hsl(var(--muted-foreground));
+  font-size: 0.75rem;
+}
+
+.dispatch-chat-first-notice button {
+  flex: none;
+  color: hsl(var(--foreground));
+  font-weight: 600;
+}
+
+@media (max-width: 767px) {
+  .dispatch-chat-first-surface {
+    position: relative;
+  }
+}
 
 .dispatch-chat-panel [data-agent-empty-state="centered"] {
   justify-content: center;