@agent-native/dispatch 0.24.0 → 0.24.2

package/src/routes/pages/workspace.tsx

@@ -67,7 +67,7 @@ import {
 } from "../../components/workspace-resource-impact-preview";
 
 export function meta() {
-  return [{ title: "Agent Resources — Dispatch" }];
+  return [{ title: "Resources — Dispatch" }];
 }
 
 const KIND_CONFIG = {
@@ -600,7 +600,11 @@ function EffectiveContextPreview({ resource }: { resource: any }) {
             organization/app override, then personal override.
           </p>
         </div>
-        <Badge variant="outline">{availabilityLabel(availability)}</Badge>
+        {isLoading ? (
+          <Skeleton className="h-6 w-24 rounded-full" />
+        ) : (
+          <Badge variant="outline">{availabilityLabel(availability)}</Badge>
+        )}
       </div>
 
       <div className="mt-3 grid gap-3 md:grid-cols-2">
@@ -881,14 +885,13 @@ function ResourceRow({ resource, grants }: { resource: any; grants: any[] }) {
   );
 }
 
-function GlobalContextSection({ resources }: { resources: any[] }) {
-  const byPath = new Map(
-    resources.map((resource) => [resource.path, resource]),
-  );
-  const missingPaths = STARTER_GLOBAL_CONTEXT.filter(
-    (item) => !byPath.has(item.path),
-  ).map((item) => item.path);
-  const presentCount = STARTER_GLOBAL_CONTEXT.length - missingPaths.length;
+function GlobalContextSection({
+  resources,
+  isLoading,
+}: {
+  resources: any[];
+  isLoading: boolean;
+}) {
   const restoreStarter = useActionMutation(
     "restore-starter-workspace-resources",
     {
@@ -905,6 +908,44 @@ function GlobalContextSection({ resources }: { resources: any[] }) {
     },
   );
 
+  if (isLoading && resources.length === 0) {
+    return (
+      <section className="space-y-3">
+        <div>
+          <Skeleton className="h-4 w-28" />
+          <Skeleton className="mt-2 h-3 w-full max-w-xl" />
+          <Skeleton className="mt-1.5 h-3 w-2/3 max-w-lg" />
+        </div>
+        <div className="overflow-hidden rounded-lg bg-card">
+          {Array.from({ length: STARTER_GLOBAL_CONTEXT.length }).map(
+            (_, index) => (
+              <div
+                key={index}
+                className="flex items-center gap-3 border-t px-4 py-3 first:border-t-0"
+              >
+                <Skeleton className="size-4 rounded-full" />
+                <div className="min-w-0 flex-1 space-y-1.5">
+                  <Skeleton className="h-4 w-28" />
+                  <Skeleton className="h-3 w-64 max-w-full" />
+                  <Skeleton className="h-3 w-40 max-w-full" />
+                </div>
+                <Skeleton className="h-6 w-16 rounded-full" />
+              </div>
+            ),
+          )}
+        </div>
+      </section>
+    );
+  }
+
+  const byPath = new Map(
+    resources.map((resource) => [resource.path, resource]),
+  );
+  const missingPaths = STARTER_GLOBAL_CONTEXT.filter(
+    (item) => !byPath.has(item.path),
+  ).map((item) => item.path);
+  const presentCount = STARTER_GLOBAL_CONTEXT.length - missingPaths.length;
+
   return (
     <section className="space-y-3">
       <div className="flex items-center justify-between gap-3">
@@ -938,35 +979,44 @@ function GlobalContextSection({ resources }: { resources: any[] }) {
           </Badge>
         </div>
       </div>
-      <div className="grid gap-3 md:grid-cols-2 xl:grid-cols-5">
+      <div className="overflow-hidden rounded-lg bg-card">
         {STARTER_GLOBAL_CONTEXT.map((item) => {
           const resource = byPath.get(item.path);
           const exists = !!resource;
           const global = resource?.scope === "all";
           return (
-            <div key={item.path} className="rounded-lg bg-card p-4">
-              <div className="flex items-start justify-between gap-3">
-                <div className="min-w-0">
-                  <div className="flex items-center gap-2">
-                    {exists ? (
-                      <IconCircleCheck
-                        size={15}
-                        className="shrink-0 text-green-600 dark:text-green-400"
-                      />
-                    ) : (
-                      <IconAlertCircle
-                        size={15}
-                        className="shrink-0 text-amber-600 dark:text-amber-400"
-                      />
-                    )}
-                    <h3 className="truncate text-sm font-medium text-foreground">
-                      {item.label}
-                    </h3>
-                  </div>
-                  <p className="mt-1 line-clamp-2 text-xs text-muted-foreground">
-                    {item.description}
-                  </p>
+            <div
+              key={item.path}
+              className="flex flex-wrap items-center gap-3 border-t px-4 py-3 first:border-t-0"
+            >
+              {exists ? (
+                <IconCircleCheck size={16} className="shrink-0 text-primary" />
+              ) : (
+                <IconAlertCircle
+                  size={16}
+                  className="shrink-0 text-amber-600 dark:text-amber-400"
+                />
+              )}
+              <div className="min-w-0 flex-1">
+                <div className="truncate text-sm font-medium text-foreground">
+                  {item.label}
+                </div>
+                <div className="mt-0.5 truncate text-xs text-muted-foreground">
+                  {item.description}
+                </div>
+                <div className="mt-1 truncate font-mono text-[11px] text-muted-foreground/80">
+                  {item.path}
                 </div>
+              </div>
+              <div className="flex items-center gap-1.5">
+                {exists ? (
+                  <Badge variant="outline">
+                    {global ? "All apps" : "Selected"}
+                  </Badge>
+                ) : null}
+                {resource && isAutoLoadedInstruction(resource) ? (
+                  <Badge variant="outline">Auto-loaded</Badge>
+                ) : null}
                 {resource ? (
                   <EditResourceDialog
                     resource={resource}
@@ -992,24 +1042,6 @@ function GlobalContextSection({ resources }: { resources: any[] }) {
                   </Button>
                 )}
               </div>
-              <div className="mt-3 space-y-2">
-                <div className="truncate font-mono text-[11px] text-muted-foreground">
-                  {item.path}
-                </div>
-                <div className="flex flex-wrap gap-1.5">
-                  <Badge variant={exists ? "secondary" : "outline"}>
-                    {exists ? "Present" : "Missing"}
-                  </Badge>
-                  {exists ? (
-                    <Badge variant="outline">
-                      {global ? "All apps" : "Selected"}
-                    </Badge>
-                  ) : null}
-                  {resource && isAutoLoadedInstruction(resource) ? (
-                    <Badge variant="outline">Auto-loaded</Badge>
-                  ) : null}
-                </div>
-              </div>
             </div>
           );
         })}
@@ -1086,7 +1118,7 @@ export default function WorkspaceRoute() {
 
   return (
     <DispatchShell
-      title="Agent Resources"
+      title="Resources"
       description="Manage inherited skills, guardrail instructions, agent profiles, reference resources, and MCP servers. All-app resources are available to every app without syncing."
     >
       {resourcesQuery.isError || grantsQuery.isError ? (
@@ -1111,13 +1143,10 @@ export default function WorkspaceRoute() {
         </div>
       </div>
 
-      {!resourcesQuery.isError ? (
-        <GlobalContextSection resources={resources || []} />
-      ) : null}
-
       {!resourcesQuery.isError && !grantsQuery.isError ? (
         <Tabs defaultValue="skills">
           <TabsList>
+            <TabsTrigger value="context">Global context</TabsTrigger>
             <TabsTrigger value="skills">
               Skills {skills.length > 0 && `(${skills.length})`}
             </TabsTrigger>
@@ -1136,6 +1165,13 @@ export default function WorkspaceRoute() {
             </TabsTrigger>
           </TabsList>
 
+          <TabsContent value="context" className="mt-4">
+            <GlobalContextSection
+              resources={resources || []}
+              isLoading={isLoading}
+            />
+          </TabsContent>
+
           <TabsContent value="skills" className="mt-4">
             <ResourceList
               items={skills}

package/src/server/index.ts

@@ -1,3 +1,4 @@
+import { defineAppRoles } from "@agent-native/core/org";
 import {
   registerPackageActions,
   type NitroPluginDef,
@@ -5,6 +6,9 @@ import {
 
 import { dispatchActions } from "../actions/index.js";
 import type { DispatchConfig } from "../config.js";
+import { dispatchAccessDescriptor } from "../shared/app-roles.js";
+
+defineAppRoles(dispatchAccessDescriptor);
 
 /**
  * Register dispatch's package-contributed actions on import. The framework's

package/src/server/lib/app-creation-store.spec.ts

@@ -3,6 +3,7 @@ import { afterEach, describe, expect, it, vi } from "vitest";
 
 import {
   generateWorkspaceAppDescription,
+  getAppCreationSettings,
   listAvailableWorkspaceTemplates,
   listWorkspaceApps,
   setAppCreationSettings,
@@ -46,7 +47,6 @@ const mocks = vi.hoisted(() => {
     })),
     ensureBuilderProject: vi.fn(),
     runBuilderAgent: vi.fn(),
-    resolveBuilderBranchProjectId: vi.fn(async () => ""),
     getBuilderBranchProjectId: vi.fn(() => ""),
     writeAppSecret: vi.fn(async () => "secret-id"),
     deleteAppSecret: vi.fn(async () => true),
@@ -86,8 +86,6 @@ vi.mock("@agent-native/core/server", async (importOriginal) => {
     ensureBuilderProject: (...args: any[]) =>
       mocks.ensureBuilderProject(...args),
     runBuilderAgent: (...args: any[]) => mocks.runBuilderAgent(...args),
-    resolveBuilderBranchProjectId: (...args: any[]) =>
-      mocks.resolveBuilderBranchProjectId(...args),
     getBuilderBranchProjectId: (...args: any[]) =>
       mocks.getBuilderBranchProjectId(...args),
   };
@@ -121,12 +119,50 @@ afterEach(() => {
     source: null,
     lookupFailed: false,
   });
-  mocks.resolveBuilderBranchProjectId.mockResolvedValue("");
   mocks.getBuilderBranchProjectId.mockReturnValue("");
   mocks.ensureBuilderProject.mockReset();
   globalThis.fetch = originalFetch;
 });
 
+describe("getAppCreationSettings", () => {
+  it("treats the Dispatch project as authoritative over the environment", async () => {
+    mocks.settings.set("dispatch-app-creation-settings:org:builder_io", {
+      builderProjectId: "dispatch-project",
+    });
+    vi.stubEnv("DISPATCH_BUILDER_PROJECT_ID", "stale-env-project");
+
+    const result = await runWithRequestContext(
+      { userEmail: "dev@example.test", orgId: "builder_io" },
+      () => getAppCreationSettings(),
+    );
+
+    expect(result).toMatchObject({
+      builderProjectId: "dispatch-project",
+      builderProjectIdSource: "dispatch",
+      envBuilderProjectId: "stale-env-project",
+    });
+  });
+
+  it("treats an explicit Dispatch null as disabled over the environment", async () => {
+    mocks.settings.set("dispatch-app-creation-settings:org:builder_io", {
+      builderProjectId: null,
+    });
+    vi.stubEnv("DISPATCH_BUILDER_PROJECT_ID", "stale-env-project");
+
+    const result = await runWithRequestContext(
+      { userEmail: "dev@example.test", orgId: "builder_io" },
+      () => getAppCreationSettings(),
+    );
+
+    expect(result).toMatchObject({
+      builderProjectId: null,
+      builderProjectIdSource: "dispatch",
+      envBuilderProjectId: "stale-env-project",
+      builderBranchingEnabled: false,
+    });
+  });
+});
+
 describe("listWorkspaceApps", () => {
   function stubNoPendingContext() {
     for (const key of [
@@ -399,9 +435,11 @@ describe("listWorkspaceApps", () => {
             name: "Todo Board",
           }),
       ),
-    ).rejects.toThrow(
-      "Only organization owners and admins can update app creation settings.",
-    );
+    ).rejects.toMatchObject({
+      message:
+        "Only organization owners and admins can update app creation settings.",
+      statusCode: 403,
+    });
     expect(
       mocks.settings.get("workspace-app-metadata:org:org-123"),
     ).toBeUndefined();
@@ -603,12 +641,11 @@ describe("startWorkspaceAppCreation", () => {
     expect(mocks.runBuilderAgent).toHaveBeenCalledWith(
       expect.objectContaining({ projectId: "project-provisioned" }),
     );
-    expect(mocks.writeAppSecret).toHaveBeenCalledWith(
-      expect.objectContaining({
-        key: "BUILDER_BRANCH_PROJECT_ID",
-        value: "project-provisioned",
-      }),
-    );
+    expect(mocks.settings.get(settingsKey)).toMatchObject({
+      builderProjectId: "project-provisioned",
+    });
+    expect(mocks.writeAppSecret).not.toHaveBeenCalled();
+    expect(mocks.deleteAppSecret).not.toHaveBeenCalled();
   });
 
   it("does not let an organization member persist an auto-provisioned project", async () => {
@@ -653,58 +690,68 @@ describe("setAppCreationSettings", () => {
     );
   }
 
-  it("stores the project id as an org-scoped credential so member apps resolve it", async () => {
+  it("stores the project id in the org-scoped Dispatch settings row", async () => {
     await save(projectId);
 
-    expect(mocks.writeAppSecret).toHaveBeenCalledWith(
-      expect.objectContaining({
-        key: "BUILDER_BRANCH_PROJECT_ID",
-        value: projectId,
-        scope: "org",
-        scopeId: orgId,
-      }),
+    expect(
+      mocks.settings.get("dispatch-app-creation-settings:org:builder_io"),
+    ).toEqual({ builderProjectId: projectId });
+    expect(mocks.putSetting).toHaveBeenCalledWith(
+      "dispatch-app-creation-settings:org:builder_io",
+      { builderProjectId: projectId },
     );
     expect(mocks.deleteAppSecret).not.toHaveBeenCalled();
+    expect(mocks.writeAppSecret).not.toHaveBeenCalled();
   });
 
-  it("scopes the credential to one organization rather than every tenant", async () => {
+  it("scopes the settings row to one organization rather than every tenant", async () => {
     await save(projectId);
 
-    const [args] = mocks.writeAppSecret.mock.calls.at(-1) as [
-      { scope: string; scopeId: string },
-    ];
-    expect(args.scope).not.toBe("user");
-    expect(args.scopeId).toBe(orgId);
+    expect(mocks.putSetting.mock.calls.at(-1)?.[0]).toBe(
+      "dispatch-app-creation-settings:org:builder_io",
+    );
+    expect(mocks.putSetting.mock.calls.at(-1)?.[0]).not.toContain(":user:");
+    expect(mocks.writeAppSecret).not.toHaveBeenCalled();
   });
 
-  it("falls back to a solo workspace scope when there is no active org", async () => {
+  it("uses a user-scoped settings row when there is no active org", async () => {
     await save(projectId, { userEmail: "dev@example.test" });
 
-    expect(mocks.writeAppSecret).toHaveBeenCalledWith(
-      expect.objectContaining({
-        scope: "workspace",
-        scopeId: "solo:dev@example.test",
-      }),
-    );
+    expect(mocks.settings.get(settingsKey)).toEqual({
+      builderProjectId: projectId,
+    });
+    expect(mocks.putSetting).toHaveBeenCalledWith(settingsKey, {
+      builderProjectId: projectId,
+    });
+    expect(mocks.writeAppSecret).not.toHaveBeenCalled();
   });
 
-  it("removes the credential when the project id is cleared", async () => {
+  it("persists an explicit null when the project id is cleared", async () => {
     await save(null);
 
-    expect(mocks.deleteAppSecret).toHaveBeenCalledWith({
-      key: "BUILDER_BRANCH_PROJECT_ID",
-      scope: "org",
-      scopeId: orgId,
-    });
+    expect(
+      mocks.settings.get("dispatch-app-creation-settings:org:builder_io"),
+    ).toEqual({ builderProjectId: null });
+    expect(mocks.putSetting).toHaveBeenCalledWith(
+      "dispatch-app-creation-settings:org:builder_io",
+      { builderProjectId: null },
+    );
+    expect(mocks.deleteAppSecret).not.toHaveBeenCalled();
     expect(mocks.writeAppSecret).not.toHaveBeenCalled();
   });
 
-  it("does not save the setting when the credential write fails", async () => {
+  it("never consults the project secret store when saving settings", async () => {
     mocks.writeAppSecret.mockRejectedValueOnce(
       new Error("credential store down"),
     );
 
-    await expect(save(projectId)).rejects.toThrow("credential store down");
-    expect(mocks.putSetting).not.toHaveBeenCalled();
+    await expect(save(projectId)).resolves.toMatchObject({
+      builderProjectId: projectId,
+    });
+    expect(
+      mocks.settings.get("dispatch-app-creation-settings:org:builder_io"),
+    ).toEqual({ builderProjectId: projectId });
+    expect(mocks.writeAppSecret).not.toHaveBeenCalled();
+    expect(mocks.deleteAppSecret).not.toHaveBeenCalled();
   });
 });

package/src/server/lib/app-creation-store.ts

@@ -4,17 +4,11 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { getDbExec } from "@agent-native/core/db";
-import {
-  deleteAppSecret,
-  writeAppSecret,
-  type SecretScope,
-} from "@agent-native/core/secrets";
 import {
   ensureBuilderProject,
   getBuilderBranchProjectId,
   getRequestContext,
   isIntegrationCallerRequest,
-  resolveBuilderBranchProjectId,
   resolveBuilderCredentialsDetailed,
   runBuilderAgent,
 } from "@agent-native/core/server";
@@ -36,9 +30,6 @@ import {
 } from "./workspace-resources-store.js";
 
 const SETTINGS_KEY = "dispatch-app-creation-settings";
-const BUILDER_BRANCH_PROJECT_SECRET_KEY = "BUILDER_BRANCH_PROJECT_ID";
-const BUILDER_BRANCH_PROJECT_SECRET_DESCRIPTION =
-  "Builder project for cloud code-change branches (set in Dispatch)";
 const BUILDER_WORKSPACE_REPO_URL_ENV = "AGENT_NATIVE_WORKSPACE_REPO_URL";
 const DEFAULT_BUILDER_WORKSPACE_REPO_URL =
   "https://github.com/BuilderIO/builder-agent-native-workspace";
@@ -61,6 +52,7 @@ const AUTONOMOUS_WORKSPACE_APP_CREATION_CONTRACT = [
   "Autonomous Builder handoff contract:",
   "- This is a background implementation run launched by the turn-into-app workflow. Treat the source brief and latest user request as authorization to build the app now; do not return a proposal or wait for another turn.",
   "- Do not ask the user questions during the initial build and do not invoke a clarification, guided-question, or choice flow for a non-blocking decision.",
+  "- If the confirmed source brief describes a spreadsheet source-review or input/output confirmation surface, implement that review UI as part of the first-run app experience and seed it with the bounded candidates and mapping; keep the background build autonomous and do not send a question back from the Builder run.",
   "- When the source or a tool presents a recommended option, choose it and continue. When no recommendation is present, choose the most direct, conservative default supported by the source and normal Agent-Native conventions.",
   "- Resolve product, visual, copy, layout, route, data-model, dependency, and integration choices yourself. If an input is missing, use an empty state or clearly labeled representative sample so the workflow is demonstrable; never invent private facts or credentials.",
   "- Treat the source brief's unknowns and follow-up items as assumptions to record in the app README or a visible Assumptions / Review section, not as questions to send back to the user.",
@@ -74,6 +66,8 @@ const pendingBuilderProjectProvisioning = new Map<
 >();
 
 class AppCreationSettingsAuthorizationError extends Error {
+  statusCode = 403;
+
   constructor() {
     super(APP_CREATION_SETTINGS_AUTHORIZATION_MESSAGE);
     this.name = "AppCreationSettingsAuthorizationError";
@@ -254,16 +248,6 @@ function scopedSettingsKey(): string {
   return `${SETTINGS_KEY}:user:${currentOwnerEmail()}`;
 }
 
-function builderProjectSecretTarget(): {
-  scope: Extract<SecretScope, "org" | "workspace">;
-  scopeId: string;
-} | null {
-  const orgId = currentOrgId();
-  if (orgId) return { scope: "org", scopeId: orgId };
-  const email = currentOwnerEmail();
-  return email ? { scope: "workspace", scopeId: `solo:${email}` } : null;
-}
-
 function workspaceAppMetadataSettingsKey(): string {
   const orgId = currentOrgId();
   if (orgId) return `${WORKSPACE_APP_METADATA_SETTINGS_KEY}:org:${orgId}`;
@@ -1607,26 +1591,28 @@ function runScaffoldCli(input: {
 
 export async function getAppCreationSettings(): Promise<AppCreationSettings> {
   const envBuilderProjectId = getEnvBuilderProjectId();
-  const resolvedBuilderProjectId = await resolveBuilderBranchProjectId();
   const raw = await readSettingsRecord();
+  const hasSavedBuilderProjectId = Object.prototype.hasOwnProperty.call(
+    raw,
+    "builderProjectId",
+  );
   const savedBuilderProjectId =
     typeof raw?.builderProjectId === "string" && raw.builderProjectId.trim()
       ? raw.builderProjectId.trim()
       : null;
-  const builderProjectId = envBuilderProjectId || savedBuilderProjectId;
   const enableBuilder =
     process.env.ENABLE_BUILDER === "true" || process.env.ENABLE_BUILDER === "1";
-  const effectiveBuilderProjectId =
-    builderProjectId ||
-    resolvedBuilderProjectId ||
-    (enableBuilder ? getBuilderBranchProjectId() : null);
+  const effectiveBuilderProjectId = hasSavedBuilderProjectId
+    ? savedBuilderProjectId
+    : envBuilderProjectId ||
+      (enableBuilder ? getBuilderBranchProjectId() : null);
 
   return {
     builderProjectId: effectiveBuilderProjectId,
-    builderProjectIdSource: envBuilderProjectId
-      ? "env"
-      : savedBuilderProjectId
-        ? "dispatch"
+    builderProjectIdSource: hasSavedBuilderProjectId
+      ? "dispatch"
+      : envBuilderProjectId
+        ? "env"
         : effectiveBuilderProjectId
           ? "default"
           : "unset",
@@ -1647,20 +1633,10 @@ async function persistProvisionedBuilderProjectId(
   builderProjectId: string,
 ): Promise<void> {
   const raw = await readSettingsRecord();
-  const secretTarget = builderProjectSecretTarget();
 
   // This is an internal consequence of an authorized app-creation request,
   // not a user-controlled settings update. Persist the project before the
   // branch run so later members reuse the same Builder project.
-  if (secretTarget) {
-    await writeAppSecret({
-      key: BUILDER_BRANCH_PROJECT_SECRET_KEY,
-      scope: secretTarget.scope,
-      scopeId: secretTarget.scopeId,
-      value: builderProjectId,
-      description: BUILDER_BRANCH_PROJECT_SECRET_DESCRIPTION,
-    });
-  }
   await putSetting(scopedSettingsKey(), { ...raw, builderProjectId });
   await recordAudit({
     action: "settings.updated",
@@ -1712,28 +1688,6 @@ export async function setAppCreationSettings(input: {
   const builderProjectId = input.builderProjectId?.trim() || null;
   const raw = await readSettingsRecord();
 
-  // The credential store, not this settings row, is what
-  // `resolveBuilderBranchProjectId()` reads. Write it first: a saved setting
-  // whose secret never landed reports the project as configured while cloud
-  // code changes stay silently disabled.
-  const secretTarget = builderProjectSecretTarget();
-  if (secretTarget) {
-    const ref = {
-      key: BUILDER_BRANCH_PROJECT_SECRET_KEY,
-      scope: secretTarget.scope,
-      scopeId: secretTarget.scopeId,
-    };
-    if (builderProjectId) {
-      await writeAppSecret({
-        ...ref,
-        value: builderProjectId,
-        description: BUILDER_BRANCH_PROJECT_SECRET_DESCRIPTION,
-      });
-    } else {
-      await deleteAppSecret(ref);
-    }
-  }
-
   await putSetting(scopedSettingsKey(), { ...raw, builderProjectId });
   await recordAudit({
     action: "settings.updated",

package/src/shared/app-roles.ts

@@ -0,0 +1,8 @@
+import type { AppRolesDescriptor } from "@agent-native/core/client/org";
+
+export const dispatchAccessDescriptor = {
+  appId: "dispatch",
+  roles: ["admin"] as const,
+  roleLabels: { admin: "Dispatch admin" },
+  label: "Dispatch access",
+} satisfies AppRolesDescriptor<"admin">;