@agent-native/dispatch 0.24.6 → 0.25.1

package/dist/shared/workspace-sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-sso.js","sourceRoot":"","sources":["../../src/shared/workspace-sso.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,2BAA2B,EAAE,CAAC;AAEvC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,mCAAmC,GAAG;IACjD,SAAS,EAAE,oCAAoC;IAC/C,MAAM,EAAE,iCAAiC;IACzC,KAAK,EAAE,gCAAgC;IACvC,QAAQ,EAAE,mCAAmC;IAC7C,IAAI,EAAE,+BAA+B;IACrC,KAAK,EAAE,gCAAgC;IACvC,OAAO,EAAE,kCAAkC;IAC3C,GAAG,EAAE,8BAA8B;IACnC,MAAM,EAAE,iCAAiC;IACzC,QAAQ,EAAE,mCAAmC;IAC7C,KAAK,EAAE,gCAAgC;IACvC,MAAM,EAAE,iCAAiC;IACzC,IAAI,EAAE,+BAA+B;IACrC,IAAI,EAAE,+BAA+B;IACrC,MAAM,EAAE,iCAAiC;IACzC,KAAK,EAAE,gCAAgC;CAC/B,CAAC;AAEX,MAAM,CAAC,MAAM,2BAA2B,GACtC,kCAA2C,CAAC;AAE9C,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAC9C,MAAM,MAAM,GAAG,mCAAmC,CAAC;AACnD,MAAM,SAAS,GAAG,qCAAqC,CAAC;AACxD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAS5E,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACzB,IACE,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAChE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IACE,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ,KAAK,GAAG;YACpB,GAAG,CAAC,MAAM;YACV,GAAG,CAAC,IAAI,EACR,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAC/C,GAAY;IAEZ,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IACtD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;QAChE,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,aAAa,GAAkC,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,SAAS,GAAG,KAAgC,CAAC;QACnD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;QAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;QACpC,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzD,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YACnB,OAAO,QAAQ,KAAK,QAAQ;YAC5B,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;YACzB,CAAC,MAAM;YACP,SAAS,CAAC,YAAY,KAAK,2BAA2B;YACtD,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC;YACtC,CAAC,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YACf,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAClC,mCAAmC,EACnC,KAAK,CACN,EACD,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,aAAa,CAAC,IAAI,CAAC;YACjB,KAAK;YACL,QAAQ;YACR,MAAM;YACN,YAAY,EAAE,2BAA2B;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC","sourcesContent":["import { DISPATCH_WORKSPACE_SSO_FLAG } from \"./feature-flags.js\";\n\nexport { DISPATCH_WORKSPACE_SSO_FLAG };\n\n/** Exact first-party origins. Never replace this with a suffix or wildcard. */\nexport const CANONICAL_WORKSPACE_SSO_APP_ORIGINS = {\n  analytics: \"https://analytics.agent-native.com\",\n  assets: \"https://assets.agent-native.com\",\n  brain: \"https://brain.agent-native.com\",\n  calendar: \"https://calendar.agent-native.com\",\n  chat: \"https://chat.agent-native.com\",\n  clips: \"https://clips.agent-native.com\",\n  content: \"https://content.agent-native.com\",\n  crm: \"https://crm.agent-native.com\",\n  design: \"https://design.agent-native.com\",\n  dispatch: \"https://dispatch.agent-native.com\",\n  forms: \"https://forms.agent-native.com\",\n  macros: \"https://macros.agent-native.com\",\n  mail: \"https://mail.agent-native.com\",\n  plan: \"https://plan.agent-native.com\",\n  slides: \"https://slides.agent-native.com\",\n  tasks: \"https://tasks.agent-native.com\",\n} as const;\n\nexport const WORKSPACE_SSO_CALLBACK_PATH =\n  \"/_agent-native/identity/callback\" as const;\n\nconst CONTROL_CHARS = /[\\u0000-\\u001f\\u007f]/;\nconst APP_ID = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;\nconst CLIENT_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;\nconst LOCALHOST_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\", \"::1\"]);\n\nexport interface WorkspaceSsoAppRegistration {\n  appId: string;\n  clientId: string;\n  origin: string;\n  callbackPath: typeof WORKSPACE_SSO_CALLBACK_PATH;\n}\n\nexport function exactWorkspaceSsoOrigin(raw: unknown): string | null {\n  if (typeof raw !== \"string\" || !raw || CONTROL_CHARS.test(raw)) return null;\n  try {\n    const url = new URL(raw);\n    if (\n      url.protocol !== \"https:\" &&\n      !(url.protocol === \"http:\" && LOCALHOST_HOSTS.has(url.hostname))\n    ) {\n      return null;\n    }\n    if (\n      url.username ||\n      url.password ||\n      url.pathname !== \"/\" ||\n      url.search ||\n      url.hash\n    ) {\n      return null;\n    }\n    return url.origin;\n  } catch {\n    // coercion-ok: malformed registry origins are rejected as absent.\n    return null;\n  }\n}\n\n/**\n * Parse the same additive custom registry used by browser identity SSO. The\n * raw value is passed in so this shared module stays safe to import in the\n * browser bundle.\n */\nexport function parseWorkspaceSsoAppRegistrations(\n  raw: unknown,\n): WorkspaceSsoAppRegistration[] {\n  if (typeof raw !== \"string\" || !raw.trim()) return [];\n  let value: unknown;\n  try {\n    value = JSON.parse(raw);\n  } catch {\n    // coercion-ok: malformed custom registry data must fail closed.\n    return [];\n  }\n  if (!Array.isArray(value)) return [];\n\n  const registrations: WorkspaceSsoAppRegistration[] = [];\n  const seen = new Set<string>();\n  for (const entry of value) {\n    if (!entry || typeof entry !== \"object\") continue;\n    const candidate = entry as Record<string, unknown>;\n    const appId = candidate.appId;\n    const clientId = candidate.clientId;\n    const origin = exactWorkspaceSsoOrigin(candidate.origin);\n    if (\n      typeof appId !== \"string\" ||\n      !APP_ID.test(appId) ||\n      typeof clientId !== \"string\" ||\n      !CLIENT_ID.test(clientId) ||\n      !origin ||\n      candidate.callbackPath !== WORKSPACE_SSO_CALLBACK_PATH ||\n      !Array.isArray(candidate.capabilities) ||\n      !candidate.capabilities.includes(\"identity-sso\") ||\n      seen.has(appId) ||\n      Object.prototype.hasOwnProperty.call(\n        CANONICAL_WORKSPACE_SSO_APP_ORIGINS,\n        appId,\n      )\n    ) {\n      continue;\n    }\n    seen.add(appId);\n    registrations.push({\n      appId,\n      clientId,\n      origin,\n      callbackPath: WORKSPACE_SSO_CALLBACK_PATH,\n    });\n  }\n  return registrations;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.24.6",
+  "version": "0.25.1",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -29,6 +29,8 @@
     "./routes/pages/*": "./dist/routes/pages/*.js",
     "./server": "./dist/server/index.js",
     "./shared/app-roles": "./dist/shared/app-roles.js",
+    "./shared/feature-flags": "./dist/shared/feature-flags.js",
+    "./shared/workspace-sso": "./dist/shared/workspace-sso.js",
     "./server/lib/thread-link-preview": "./dist/server/lib/thread-link-preview.js",
     "./actions": "./dist/actions/index.js",
     "./db": "./dist/db/index.js",
@@ -85,7 +87,7 @@
     "tailwind-merge": "^3.5.0",
     "vaul": "^1.1.2",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "0.14.2"
+    "@agent-native/toolkit": "0.15.0"
   },
   "devDependencies": {
     "@react-router/dev": "^8.1.0",
@@ -99,7 +101,7 @@
     "typescript-7": "npm:typescript@^7.0.2",
     "vite": "8.1.0",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.154.0"
+    "@agent-native/core": "0.157.0"
   },
   "peerDependencies": {
     "@agent-native/core": ">=0.8.0",

package/src/actions/connect-external-agent.ts

@@ -0,0 +1,92 @@
+import { defineAction } from "@agent-native/core";
+import { getDbExec } from "@agent-native/core/db";
+import {
+  resourceGetByPath,
+  resourcePut,
+  sharedResourceOwner,
+} from "@agent-native/core/resources/store";
+import { z } from "zod";
+
+import {
+  currentOrgId,
+  currentOwnerEmail,
+} from "../server/lib/dispatch-store.js";
+
+function slugify(value: string): string {
+  return (
+    value
+      .trim()
+      .toLowerCase()
+      .replace(/[^a-z0-9]+/g, "-")
+      .replace(/^-+|-+$/g, "") || "agent"
+  );
+}
+
+async function assertCanManageSharedAgent() {
+  const orgId = currentOrgId();
+  if (!orgId) return;
+  const actor = currentOwnerEmail().trim().toLowerCase();
+  const result = await getDbExec().execute({
+    sql: "SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1",
+    args: [orgId, actor],
+  });
+  const role = result.rows[0]?.role;
+  if (role !== "owner" && role !== "admin") {
+    throw new Error(
+      "Only organization owners and admins can connect shared agents.",
+    );
+  }
+}
+
+export default defineAction({
+  description:
+    "Connect an existing HTTP/A2A agent to Dispatch. This stores only its public endpoint and metadata; authentication remains in the normal A2A/MCP connection flow.",
+  schema: z.object({
+    url: z.string().min(1).describe("HTTP or HTTPS agent endpoint"),
+    name: z.string().max(160).optional().describe("Agent name"),
+    description: z.string().max(500).optional().describe("Short description"),
+    scope: z
+      .enum(["shared", "personal"])
+      .default("shared")
+      .describe("Share with the workspace or keep the connection personal"),
+  }),
+  run: async ({ url, name, description, scope }) => {
+    const parsed = new URL(url.trim());
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+      throw new Error("Use an http:// or https:// endpoint URL.");
+    }
+    if (parsed.username || parsed.password) {
+      throw new Error("Do not include credentials in the endpoint URL.");
+    }
+
+    if (scope === "shared") await assertCanManageSharedAgent();
+    const agentName = name?.trim() || parsed.hostname.replace(/^www\./, "");
+    const id = slugify(agentName);
+    const path = `remote-agents/${id}.json`;
+    const owner =
+      scope === "shared"
+        ? sharedResourceOwner(currentOrgId())
+        : currentOwnerEmail();
+    const existing = await resourceGetByPath(owner, path);
+    if (existing) {
+      throw new Error(
+        `An external agent already exists at ${path}. Rename it before connecting again.`,
+      );
+    }
+
+    const manifest = {
+      id,
+      name: agentName,
+      ...(description?.trim() ? { description: description.trim() } : {}),
+      url: parsed.toString(),
+    };
+    const resource = await resourcePut(
+      owner,
+      path,
+      JSON.stringify(manifest, null, 2),
+      "application/json",
+    );
+
+    return { status: "created" as const, resource, agent: manifest, scope };
+  },
+});

package/src/actions/create-workspace-resource.ts

@@ -8,9 +8,16 @@ export default defineAction({
     'Create a workspace-wide skill, instruction, agent profile, reference resource, or MCP server. Set scope to "all" for runtime inheritance by every app, or "selected" to grant per-app. When Dispatch approval policy is enabled, All-app creates queue an approval request before taking effect.',
   schema: z.object({
     kind: z
-      .enum(["skill", "instruction", "agent", "knowledge", "mcp-server"])
+      .enum([
+        "skill",
+        "instruction",
+        "agent",
+        "agent-file",
+        "knowledge",
+        "mcp-server",
+      ])
       .describe(
-        "Resource kind: skill, instruction, agent, knowledge, or mcp-server",
+        "Resource kind: skill, instruction, agent, agent-file, knowledge, or mcp-server",
       ),
     name: z.string().describe("Human-readable name"),
     description: z.string().optional().describe("Short description"),

package/src/actions/create_workspace_app_embed_session.ts

@@ -0,0 +1,32 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+
+import { createWorkspaceSsoEmbedSession } from "../server/lib/mcp-gateway.js";
+
+export default defineAction({
+  description:
+    "Create a one-time app-scoped embed session for a workspace app opened inside Dispatch. This browser-only path is rollout-gated and never exposes an app's reusable session to another app.",
+  schema: z.object({
+    app: z
+      .string()
+      .optional()
+      .describe("Workspace app id when path is app-relative."),
+    url: z
+      .string()
+      .optional()
+      .describe("Absolute app URL or app-relative path."),
+    path: z
+      .string()
+      .optional()
+      .describe("App-relative path. Requires app when url is not provided."),
+    chrome: z
+      .enum(["full", "minimal"])
+      .optional()
+      .describe("Embed chrome preference. Defaults to full."),
+  }),
+  readOnly: false,
+  parallelSafe: false,
+  agentTool: false,
+  toolCallable: false,
+  run: async (args) => createWorkspaceSsoEmbedSession(args),
+});

package/src/actions/import-agent-pack.ts

@@ -0,0 +1,146 @@
+import crypto from "node:crypto";
+
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+
+import {
+  AGENT_PACK_MAX_FILE_BYTES,
+  AGENT_PACK_MAX_FILES,
+  agentPackProfileContent,
+  agentPackRoot,
+  normalizeAgentPack,
+  type AgentPackFileInput,
+} from "../lib/agent-pack.js";
+import { validateImportedAgentTools } from "../lib/simple-agent-profile.js";
+import { applyAgentPackCreate } from "../server/lib/agent-pack-store.js";
+import {
+  createApprovalRequest,
+  getApprovalPolicy,
+} from "../server/lib/dispatch-store.js";
+import {
+  listWorkspaceResources,
+  type WorkspaceResourceInput,
+} from "../server/lib/workspace-resources-store.js";
+
+const packFileSchema = z.object({
+  path: z.string().trim().min(1).max(240),
+  content: z.string().max(AGENT_PACK_MAX_FILE_BYTES),
+});
+
+const schema = z.object({
+  files: z
+    .array(packFileSchema)
+    .min(1)
+    .max(AGENT_PACK_MAX_FILES)
+    .describe("Text files from an agent folder, including its profile"),
+  scope: z
+    .enum(["all", "selected"])
+    .default("all")
+    .describe("Make the pack available to all apps or selected apps"),
+});
+
+function availableToolNames(dispatchToolNames: string[]): Set<string> {
+  return new Set([
+    ...dispatchToolNames,
+    "agent-teams",
+    "bash",
+    "call-agent",
+    "db-query",
+    "db-schema",
+    "refresh-screen",
+    "resources",
+    "set-search-params",
+    "set-url-path",
+    "tool-search",
+    "web-request",
+    "web-search",
+  ]);
+}
+
+export default defineAction({
+  description:
+    "Import a folder-backed agent pack from Claude, Cowork, or another agent tool. The pack can include a Markdown/JSON profile, context, references, and skills. Credentials, hooks, shell commands, and local environment settings are never imported.",
+  schema,
+  run: async ({ files, scope }) => {
+    const normalized = normalizeAgentPack(files as AgentPackFileInput[]);
+    const { dispatchActions } = await import("./index.js");
+    const toolValidation = validateImportedAgentTools(
+      normalized.profile.tools,
+      availableToolNames(Object.keys(dispatchActions)),
+    );
+    const warnings = [...normalized.warnings, ...toolValidation.warnings];
+    const sourceHash = crypto
+      .createHash("sha256")
+      .update(JSON.stringify(files))
+      .digest("hex");
+    const profileContent = agentPackProfileContent({
+      profile: normalized.profile,
+      tools: toolValidation.tools,
+      sourceHash,
+      importedAt: new Date().toISOString(),
+    });
+    const root = agentPackRoot(normalized.profile.slug);
+    const inputs: WorkspaceResourceInput[] = [
+      {
+        kind: "agent",
+        name: normalized.profile.name,
+        description: normalized.profile.description,
+        path: `${root}.md`,
+        content: profileContent,
+        scope,
+      },
+      ...normalized.files.map((file) => ({
+        kind: file.kind,
+        name: file.name,
+        description: file.description,
+        path: `${root}/${file.path}`,
+        content: file.content,
+        scope,
+      })),
+    ];
+    const existing = await listWorkspaceResources();
+    const existingProfile = existing.find(
+      (resource) => resource.path === `${root}.md`,
+    );
+    if (existingProfile?.content.includes(`source-hash: ${sourceHash}`)) {
+      return {
+        status: "unchanged" as const,
+        resource: existingProfile,
+        files: existing.filter((resource) =>
+          resource.path.startsWith(`${root}/`),
+        ),
+        warnings,
+      };
+    }
+    if (existingProfile) {
+      throw new Error(
+        `An agent already exists at ${root}. Rename the source before importing it.`,
+      );
+    }
+
+    const policy = await getApprovalPolicy();
+    if (scope === "all" && policy.enabled) {
+      const approval = await createApprovalRequest({
+        changeType: "workspace-agent-pack.create",
+        targetType: "workspace-agent-pack",
+        summary: `Import All-app agent pack "${normalized.profile.name}"`,
+        payload: { inputs },
+        beforeValue: null,
+        afterValue: {
+          name: normalized.profile.name,
+          path: `${root}.md`,
+          fileCount: inputs.length,
+        },
+      });
+      return { status: "pending-approval" as const, approval, warnings };
+    }
+
+    const created = await applyAgentPackCreate(inputs);
+    return {
+      status: "created" as const,
+      resource: created[0] ?? null,
+      files: created.slice(1),
+      warnings,
+    };
+  },
+});

package/src/actions/import-agent.ts

@@ -0,0 +1,102 @@
+import crypto from "node:crypto";
+
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+
+import {
+  buildSimpleAgentContent,
+  normalizeImportedAgent,
+  validateImportedAgentTools,
+} from "../lib/simple-agent-profile.js";
+import {
+  createWorkspaceResource,
+  listWorkspaceResources,
+} from "../server/lib/workspace-resources-store.js";
+
+export default defineAction({
+  description:
+    "Import a Claude-style Markdown agent or a generic JSON agent definition into a reusable Dispatch agent profile. Credentials, shell commands, hooks, and local environment settings are never imported. Use connect-external-agent for an HTTP/A2A endpoint.",
+  schema: z.object({
+    source: z
+      .string()
+      .min(1)
+      .max(200_000)
+      .describe("Pasted Markdown or JSON agent definition"),
+    fileName: z
+      .string()
+      .max(512)
+      .optional()
+      .describe("Original file name, such as .claude/agents/research.md"),
+    scope: z
+      .enum(["all", "selected"])
+      .default("all")
+      .describe("Make the profile available to all apps or selected apps"),
+  }),
+  run: async ({ source, fileName, scope }) => {
+    const normalized = normalizeImportedAgent(source, fileName);
+    const { dispatchActions } = await import("./index.js");
+    const availableToolNames = new Set([
+      ...Object.keys(dispatchActions),
+      "agent-teams",
+      "bash",
+      "call-agent",
+      "db-query",
+      "db-schema",
+      "refresh-screen",
+      "resources",
+      "set-search-params",
+      "set-url-path",
+      "tool-search",
+      "web-request",
+      "web-search",
+    ]);
+    const toolValidation = validateImportedAgentTools(
+      normalized.tools,
+      availableToolNames,
+    );
+    const warnings = [...normalized.warnings, ...toolValidation.warnings];
+    const sourceHash = crypto.createHash("sha256").update(source).digest("hex");
+    const content = buildSimpleAgentContent({
+      ...normalized,
+      tools: toolValidation.tools,
+      source: normalized.source,
+      sourcePath: normalized.sourcePath,
+      sourceHash,
+      importedAt: new Date().toISOString(),
+    });
+    const path = `agents/${normalized.slug}.md`;
+    const existing = (await listWorkspaceResources({ kind: "agent" })).find(
+      (resource) => resource.path === path,
+    );
+
+    if (existing) {
+      if (existing.content.includes(`source-hash: ${sourceHash}`)) {
+        return {
+          status: "unchanged" as const,
+          resource: existing,
+          source: normalized.source,
+          warnings,
+        };
+      }
+      throw new Error(
+        `An agent already exists at ${path}. Rename the source before importing it.`,
+      );
+    }
+
+    const resource = await createWorkspaceResource({
+      kind: "agent",
+      name: normalized.name,
+      description: normalized.description,
+      path,
+      content,
+      scope,
+    });
+
+    return {
+      status: "created" as const,
+      resource,
+      source: normalized.source,
+      warnings,
+    };
+  },
+});

package/src/actions/index.spec.ts

@@ -5,6 +5,8 @@ import { dispatchActions } from "./index.js";
 describe("dispatch action registry", () => {
   it("keeps workspace resources runtime-inherited instead of exposing sync actions", () => {
     expect(dispatchActions).toHaveProperty("list-workspace-resources-for-app");
+    expect(dispatchActions).toHaveProperty("connect-external-agent");
+    expect(dispatchActions).toHaveProperty("import-agent");
     expect(dispatchActions).toHaveProperty("list-mcp-app-access");
     expect(dispatchActions).toHaveProperty("set-mcp-app-access");
     expect(dispatchActions).toHaveProperty("list_apps");
@@ -12,6 +14,9 @@ describe("dispatch action registry", () => {
     expect(dispatchActions).toHaveProperty("ask_app_status");
     expect(dispatchActions).toHaveProperty("open_app");
     expect(dispatchActions).toHaveProperty("create_embed_session");
+    expect(dispatchActions).toHaveProperty(
+      "create-workspace-app-embed-session",
+    );
     expect(dispatchActions).toHaveProperty("read-slack-thread-context");
     expect(dispatchActions).toHaveProperty(
       "get-workspace-resource-effective-context",
@@ -32,6 +37,14 @@ describe("dispatch action registry", () => {
     ).toEqual([]);
   });
 
+  it("exposes folder-backed agent pack actions", () => {
+    expect(dispatchActions).toHaveProperty("import-agent-pack");
+    expect(dispatchActions).toHaveProperty("list-agent-pack");
+    expect(dispatchActions["import-agent-pack"].tool.description).toContain(
+      "folder-backed agent pack",
+    );
+  });
+
   it("distinguishes mounted workspace apps from connected A2A agents", () => {
     expect(dispatchActions["list-workspace-apps"].tool.description).toContain(
       "not the hosted/connected A2A agent registry",

package/src/actions/index.ts

@@ -6,6 +6,7 @@ import approveVaultRequest from "./approve-vault-request.js";
 import archiveWorkspaceApp from "./archive-workspace-app.js";
 import askApp from "./ask_app.js";
 import askAppStatus from "./ask_app_status.js";
+import connectExternalAgent from "./connect-external-agent.js";
 import createBrowserChatSession from "./create-browser-chat-session.js";
 import createDreamReport from "./create-dream-report.js";
 import createLinkToken from "./create-link-token.js";
@@ -15,6 +16,7 @@ import createVaultSecret from "./create-vault-secret.js";
 import createWorkspaceResourceGrant from "./create-workspace-resource-grant.js";
 import createWorkspaceResource from "./create-workspace-resource.js";
 import createEmbedSession from "./create_embed_session.js";
+import createWorkspaceAppEmbedSession from "./create_workspace_app_embed_session.js";
 import deleteDestination from "./delete-destination.js";
 import deleteStagedDataset from "./delete-staged-dataset.js";
 import deleteVaultSecret from "./delete-vault-secret.js";
@@ -31,6 +33,9 @@ import getWorkspaceInfo from "./get-workspace-info.js";
 import getWorkspaceResourceEffectiveContext from "./get-workspace-resource-effective-context.js";
 import grantVaultSecretsToApp from "./grant-vault-secrets-to-app.js";
 import grantWorkspaceResourcesToApp from "./grant-workspace-resources-to-app.js";
+import importAgentPack from "./import-agent-pack.js";
+import importAgent from "./import-agent.js";
+import listAgentPack from "./list-agent-pack.js";
 import listAgentRunFailures from "./list-agent-run-failures.js";
 import listAgentThreadSources from "./list-agent-thread-sources.js";
 import listAvailableWorkspaceTemplates from "./list-available-workspace-templates.js";
@@ -107,6 +112,7 @@ export const dispatchActions: Record<string, ActionEntry> = {
   "archive-workspace-app": archiveWorkspaceApp,
   ask_app: askApp,
   ask_app_status: askAppStatus,
+  "connect-external-agent": connectExternalAgent,
   "create-link-token": createLinkToken,
   "create-pylon-ticket": createPylonTicket,
   "create-vault-grant": createVaultGrant,
@@ -116,6 +122,7 @@ export const dispatchActions: Record<string, ActionEntry> = {
   "create-dream-report": createDreamReport,
   "create-browser-chat-session": createBrowserChatSession,
   create_embed_session: createEmbedSession,
+  "create-workspace-app-embed-session": createWorkspaceAppEmbedSession,
   "delete-staged-dataset": deleteStagedDataset,
   "delete-destination": deleteDestination,
   "delete-vault-secret": deleteVaultSecret,
@@ -160,6 +167,9 @@ export const dispatchActions: Record<string, ActionEntry> = {
   "list-workspace-resource-grants": listWorkspaceResourceGrants,
   "list-workspace-resources-for-app": listWorkspaceResourcesForApp,
   "list-workspace-resources": listWorkspaceResources,
+  "import-agent": importAgent,
+  "import-agent-pack": importAgentPack,
+  "list-agent-pack": listAgentPack,
   navigate: navigate,
   open_app: openApp,
   "apply-dream-proposal": applyDreamProposal,

package/src/actions/list-agent-pack.ts

@@ -0,0 +1,43 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+
+import { agentPackRoot } from "../lib/agent-pack.js";
+import { listWorkspaceResources } from "../server/lib/workspace-resources-store.js";
+
+const schema = z
+  .object({
+    agentId: z.string().trim().min(1).optional(),
+    path: z.string().trim().min(1).optional(),
+  })
+  .refine((input) => Boolean(input.agentId || input.path), {
+    message: "Provide an agentId or path.",
+  });
+
+export default defineAction({
+  description:
+    "List the files in a reusable agent pack, including its profile, reference files, context files, and agent-owned skills.",
+  schema,
+  http: { method: "GET" },
+  run: async ({ agentId, path }) => {
+    const resources = await listWorkspaceResources();
+    const profile = resources.find(
+      (resource) =>
+        resource.kind === "agent" &&
+        (agentId ? resource.id === agentId : resource.path === path),
+    );
+    if (!profile) throw new Error("Agent profile not found");
+
+    const root = agentPackRoot(
+      profile.path.replace(/^agents\//, "").replace(/\.md$/i, ""),
+    );
+    const files = resources.filter(
+      (resource) =>
+        resource.id !== profile.id && resource.path.startsWith(`${root}/`),
+    );
+    return {
+      profile,
+      root,
+      files,
+    };
+  },
+});

package/src/actions/list-workspace-resource-options.ts

@@ -8,7 +8,14 @@ export default defineAction({
     "List lightweight workspace resource options for selectors, without returning full content.",
   schema: z.object({
     kind: z
-      .enum(["skill", "instruction", "agent", "knowledge", "mcp-server"])
+      .enum([
+        "skill",
+        "instruction",
+        "agent",
+        "agent-file",
+        "knowledge",
+        "mcp-server",
+      ])
       .optional()
       .describe("Filter by resource kind"),
   }),

package/src/actions/list-workspace-resources.ts

@@ -8,7 +8,14 @@ export default defineAction({
     "List all workspace-wide resources (skills, instructions, agent profiles, reference resources, and MCP servers) that apps inherit at runtime.",
   schema: z.object({
     kind: z
-      .enum(["skill", "instruction", "agent", "knowledge", "mcp-server"])
+      .enum([
+        "skill",
+        "instruction",
+        "agent",
+        "agent-file",
+        "knowledge",
+        "mcp-server",
+      ])
       .optional()
       .describe("Filter by resource kind"),
   }),

package/src/actions/navigate.ts

@@ -27,7 +27,7 @@ export default defineAction({
       .string()
       .optional()
       .describe(
-        "Named dispatch view to navigate to. Built-in views include chat, overview, apps, operations (or monitoring, observability, database), metrics, new-app, vault, integrations, messaging, workspace, agents, destinations, identities, approvals, automations, audit, thread-debug, dreams, and team. Generated Dispatch extension tabs can also use their nav item id.",
+        "Named dispatch view to navigate to. Built-in views include chat, overview, apps, operations (or monitoring, observability, database), metrics, new-app, vault, integrations, messaging, workspace, agents, connected-agents, destinations, identities, approvals, automations, audit, thread-debug, dreams, and team. Generated Dispatch extension tabs can also use their nav item id.",
       ),
     path: z.string().optional().describe("URL path to navigate to"),
     threadId: z

package/src/actions/view-screen.spec.ts

@@ -4,6 +4,7 @@ const mocks = vi.hoisted(() => ({
   navigation: {} as Record<string, unknown>,
   listAgentRunFailures: vi.fn(),
   listThreadDebugSources: vi.fn(),
+  listWorkspaceResourceOptions: vi.fn(),
 }));
 
 vi.mock("@agent-native/core", () => ({
@@ -46,7 +47,7 @@ vi.mock("../server/lib/vault-store.js", () => ({
 }));
 
 vi.mock("../server/lib/workspace-resources-store.js", () => ({
-  listWorkspaceResourceOptions: vi.fn(),
+  listWorkspaceResourceOptions: mocks.listWorkspaceResourceOptions,
   listWorkspaceResourcesForApp: vi.fn(),
 }));
 
@@ -59,6 +60,8 @@ describe("view-screen Thread Debug summary", () => {
     mocks.listAgentRunFailures.mockResolvedValue({ failures: [] });
     mocks.listThreadDebugSources.mockReset();
     mocks.listThreadDebugSources.mockResolvedValue({ sources: [] });
+    mocks.listWorkspaceResourceOptions.mockReset();
+    mocks.listWorkspaceResourceOptions.mockResolvedValue([]);
   });
 
   it("matches the UI's default 24-hour failed-run range", async () => {
@@ -89,4 +92,29 @@ describe("view-screen Thread Debug summary", () => {
       }),
     );
   });
+
+  it("surfaces the focused simple agent on the chat screen", async () => {
+    mocks.navigation = {
+      view: "chat",
+      agentPath: "agents/research-partner.md",
+    };
+    mocks.listWorkspaceResourceOptions.mockResolvedValue([
+      {
+        id: "agent-1",
+        kind: "agent",
+        name: "Research Partner",
+        description: "Synthesizes research",
+        path: "agents/research-partner.md",
+        scope: "all",
+        updatedAt: 1,
+      },
+    ]);
+
+    const result = JSON.parse(await viewScreen.run({}));
+
+    expect(result.chatSurface).toMatchObject({
+      agentPath: "agents/research-partner.md",
+      agent: { id: "agent-1", name: "Research Partner" },
+    });
+  });
 });