@jami-studio/dispatch 0.13.14

package/src/server/plugins/agent-chat.ts

@@ -0,0 +1,69 @@
+import { getOrgContext } from "@agent-native/core/org";
+import { createAgentChatPlugin } from "@agent-native/core/server";
+
+import { dispatchActions } from "../../actions/index.js";
+
+const INITIAL_TOOL_NAMES = [
+  "view-screen",
+  "list-workspace-apps",
+  "list-connected-agents",
+  "ask_app",
+  "open_app",
+  "list-workspace-resources",
+  "create-workspace-resource",
+  "update-workspace-resource",
+  "list-vault-secrets",
+  "request-vault-secret",
+  "create-vault-secret",
+  "list-destinations",
+  "upsert-destination",
+  "list-dreams",
+  "start-workspace-app-creation",
+  "list-available-workspace-templates",
+  "provider-api-catalog",
+  "provider-api-docs",
+  "provider-api-request",
+  "query-staged-dataset",
+  "navigate",
+];
+
+export default createAgentChatPlugin({
+  appId: "dispatch",
+  initialToolNames: INITIAL_TOOL_NAMES,
+  // Without this, AGENT_ORG_ID is never set on agent action calls and every
+  // row written through the frontend (vault secrets, destinations, workspace
+  // resources) lands with org_id=NULL — breaking data isolation across orgs.
+  resolveOrgId: async (event) => {
+    const ctx = await getOrgContext(event);
+    return ctx.orgId;
+  },
+  // Read actions directly from the package's own action map rather than from
+  // a build-time-generated `.generated/actions-registry.ts` (the latter is a
+  // template-only construct that the Vite plugin emits next to actions/).
+  actions: dispatchActions,
+  codeExecution: { production: "sandboxed" },
+  systemPrompt: `You are the central dispatch for this workspace.
+
+Default posture:
+- Treat Slack and Telegram as shared entrypoints into the workspace.
+- Heavily delegate domain work to specialized agents through A2A when another app owns the job.
+- Keep durable memory and operating instructions in resources rather than ephemeral chat.
+- Prefer replying in the current external thread unless the user explicitly asks you to send to a saved destination.
+
+Use the standard workspace primitives:
+- Read and update resources like AGENTS.md, LEARNINGS.md, jobs/*.md, agents/*.md, and remote-agents/*.json when appropriate.
+- Use recurring jobs for scheduled behavior.
+- Use custom agent profiles in agents/*.md for local spawned work and remote-agents/*.json for remote A2A apps.
+- You receive a compact available-apps block with sibling workspace app names and descriptions. Use it to pick the right A2A target, and call list-connected-agents or tool-search only when you need fresh details.
+- When answering whether workspace apps expose agent cards or A2A endpoints, call list-workspace-apps with includeAgentCards=true. If you have not requested that probe, absence of agent-card fields means unchecked, not unavailable.
+- When creating a new workspace app, create a separate app under apps/<app-id> with apps/<app-id>/package.json including a concise generated description, mount it at /<app-id>, use relative /<app-id> links, never hardcode localhost or dev ports, use shadcn/ui with @tabler/icons-react rather than lucide-react, and ensure the React Router client entry preserves APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath(). There is no separate workspace app registry to edit.
+- If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible "Chat", "Starter", "Blank app", or "New app" UI behind.
+- Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.
+- Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.
+- For broad provider searches, joins, classification, corpus counts, or absence claims, fetch every relevant page or an explicitly bounded cohort, stage/save large responses with stageAs/saveToFile/fetchAllPages, and reduce them with query-staged-dataset or run-code. Report source, filters, row counts, pagination, truncation, failed pages, and uncovered gaps.
+
+When a user asks for something like a digest, reminder, routing rule, or saved behavior:
+- First decide whether it should be a resource, a recurring job, a destination, or a delegated task.
+- Keep responses concise and operational.
+- Avoid inventing integrations or destinations that are not configured yet.`,
+});

package/src/server/plugins/auth.ts

@@ -0,0 +1,35 @@
+import { createAuthPlugin } from "@agent-native/core/server";
+
+import { getDispatchConfig } from "../index.js";
+
+const DEFAULT_MARKETING = {
+  appName: "Agent-Native Dispatch",
+  tagline:
+    "Your AI agent manages secrets, orchestrates other agents, and routes messages across your workspace.",
+  features: [
+    "Centralized vault for secrets with granular per-app grants",
+    "Cross-agent orchestration and delegation to specialist apps",
+    "Slack and Telegram routing with approval workflows",
+  ],
+} as const;
+
+/**
+ * Defer config + plugin construction until the Nitro plugin actually fires.
+ * This way `setupDispatch(config)` can run after plugin module-load order
+ * (Nitro doesn't guarantee load order across plugin files) and still feed
+ * `googleOnly` / `marketing` into `createAuthPlugin`.
+ */
+const dispatchAuthPlugin = async (nitroApp: any) => {
+  const { auth: authConfig = {} } = getDispatchConfig();
+  const googleOnly = authConfig.googleOnly ?? false;
+  const marketing =
+    (authConfig.marketing as Record<string, unknown> | undefined) ??
+    DEFAULT_MARKETING;
+  const plugin = createAuthPlugin({
+    googleOnly,
+    marketing: marketing as any,
+  });
+  return plugin(nitroApp);
+};
+
+export default dispatchAuthPlugin;

package/src/server/plugins/core-routes.ts

@@ -0,0 +1,12 @@
+import { createCoreRoutesPlugin } from "@agent-native/core/server";
+
+import { envKeys } from "../lib/env-config.js";
+import { registerDispatchOnboardingSteps } from "../lib/onboarding-steps.js";
+
+// Register before the core plugin so "create your first app" (order 5) appears
+// above the auto-generated Slack/Telegram steps (order 60). Idempotent.
+registerDispatchOnboardingSteps();
+
+export default createCoreRoutesPlugin({
+  envKeys,
+});

package/src/server/plugins/db.ts

@@ -0,0 +1,7 @@
+import { runMigrations } from "@agent-native/core/db";
+
+import { dispatchMigrations } from "../../db/migrations.js";
+
+export default runMigrations(dispatchMigrations, {
+  table: "dispatch_migrations",
+});

package/src/server/plugins/integrations.ts

@@ -0,0 +1,77 @@
+import { createIntegrationsPlugin } from "@agent-native/core/server";
+
+import { dispatchActions } from "../../actions/index.js";
+import { getDispatchConfig } from "../index.js";
+import {
+  beforeDispatchProcess,
+  resolveDispatchOwner,
+} from "../lib/dispatch-integrations.js";
+
+const dispatchIntegrationActions = {
+  ...dispatchActions,
+  // Messaging integrations should use the core call-agent tool for cross-app
+  // delegation because it queues A2A continuations when serverless budgets are
+  // tight. The MCP-facing ask_app action is still available outside this path.
+  ask_app: {
+    ...dispatchActions.ask_app,
+    agentTool: false,
+  },
+};
+
+const DISPATCH_INTEGRATION_SYSTEM_PROMPT = `You are the central dispatch for this workspace, responding via a messaging platform integration (Slack, Telegram, email, etc.).
+
+Default posture:
+- Treat Slack, Telegram, and email as shared entrypoints into the workspace.
+- Heavily delegate domain work to specialized agents through A2A (call-agent) when another app owns the job. Apps you can delegate to include slides (decks/presentations), analytics (data/dashboards), content (docs/articles), forms (form builder), clips (screen recordings), design (visual designs), and assets (brand libraries plus generated images/videos).
+- Use the available-apps prompt context first, then list-connected-agents when you need fresh details, to see what agents are available before assuming a request must be handled locally.
+- When asked whether workspace apps expose agent cards or A2A endpoints, call list-workspace-apps with includeAgentCards=true. Without that probe, missing agent-card fields mean unchecked, not unavailable.
+- Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.
+- Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.
+- Keep durable memory and operating instructions in resources rather than ephemeral chat.
+- Reply in the originating thread unless the user explicitly asks you to send to a saved destination.
+
+When a user asks for something:
+- If it belongs to analytics, content, slides, clips, assets, etc., delegate via call-agent — do not re-implement the domain logic in dispatch.
+- In messaging integrations, use call-agent for cross-app delegation; do not use ask_app.
+- After call-agent returns an answer, RELAY IT DIRECTLY to the user with at most a one-line preface — do not rephrase, summarize, or add commentary. The downstream agent already crafted the answer; your job is delivery, not editing. This minimizes round-trips and keeps the user-visible reply fast.
+- Exception: if the downstream agent reports a missing model/provider credential, do not name exact env vars, Vault keys, tokens, or secrets. Say the target app needs an LLM connection and recommend connecting Builder/managed LLM for that app; keep bring-your-own provider keys as a secondary option only if the user asks.
+- If the user asks to create, build, make, scaffold, or generate an "agent" from Dispatch chat or by tagging @agent-native in Slack, email, or Telegram, first classify the ask. If it is a simple Dispatch-native behavior like a reminder, digest, monitor, routing rule, saved instruction, or recurring workflow, create or update the recurring job/resource/destination in Dispatch. If it is a robust unique product or teammate that needs its own UI, data model, actions, integrations, or domain workflow, treat it as a new workspace app and call start-workspace-app-creation.
+- If a new-app prompt asks for access to Mail, Calendar, Analytics, Brain, Assets, or similar first-party app data/agents, keep using the existing hosted/connected app and A2A path. Do not ask Builder to scaffold those apps as children of the new app unless the user explicitly asks for a customized fork/copy.
+- If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible "Chat", "Starter", "Blank app", or "New app" UI behind.
+- If the user explicitly asks for a new app or workspace app, call start-workspace-app-creation with their prompt and include a concise generated description by default. Do not satisfy a new-app request by adding a route, page, component, or file inside apps/chat or another existing app unless the user explicitly asks to modify that existing app. If the request is too vague to classify, ask one concise follow-up. If the action returns mode "builder", reply with the Builder branch URL; Builder is responsible for creating the separate workspace app under apps/<app-id>, mounting it at /<app-id>, ensuring apps/<app-id>/package.json exists with name/displayName and description so Dispatch discovers it, using relative /<app-id> links instead of hardcoded localhost/dev ports, and preserving APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath() in the React Router client entry. The new app lives at the workspace root /<app-id>, NOT under /dispatch/<app-id>, /apps/<app-id>, or any other Dispatch tab — when telling the user where to find it, link to /<app-id> only. There is no separate workspace app registry to edit. If it returns mode "local-agent", tell the user it is ready for the local code agent and include the returned app path/prompt summary. If it returns mode "coming-soon", say this requires a code change and they can edit locally or use Builder.io to edit this code in the cloud and continue customizing the app any way they like; do not send them to Builder org/beta settings. If it returns mode "builder-unavailable", report the action's message exactly enough to preserve the missing identity/credential detail.
+- For digests, reminders, or saved behavior, prefer recurring jobs, resources, or destinations over chat replies.
+- Keep responses concise and operational — messaging platforms have character limits.
+- Use markdown sparingly (bold and lists are fine, avoid complex formatting).
+- If a task requires many steps, summarize what you did rather than streaming every detail.`;
+
+/**
+ * Defer plugin construction until the Nitro plugin actually fires so the
+ * config-aware system prompt resolves AFTER `setupDispatch(config)` has
+ * stamped the active config (plugin module load order is not guaranteed).
+ */
+const dispatchIntegrationsPlugin = async (nitroApp: any) => {
+  const { integrations = {} } = getDispatchConfig();
+  const promptOverride = integrations.systemPrompt;
+  const systemPrompt =
+    typeof promptOverride === "string"
+      ? promptOverride
+      : typeof promptOverride === "function"
+        ? promptOverride(DISPATCH_INTEGRATION_SYSTEM_PROMPT)
+        : DISPATCH_INTEGRATION_SYSTEM_PROMPT;
+
+  const plugin = createIntegrationsPlugin({
+    appId: "dispatch",
+    actions: dispatchIntegrationActions,
+    resolveOwner: resolveDispatchOwner,
+    beforeProcess: beforeDispatchProcess,
+    systemPrompt,
+    // Inherit the framework default (claude-sonnet-4-6 from
+    // packages/core/src/integrations/plugin.ts). Haiku was tried for latency
+    // but hallucinated URLs/IDs after delegated call-agent results
+    // (e.g. inventing `https://slides.workspace.com/deck/builder-io-deck-2024`).
+  });
+
+  return plugin(nitroApp);
+};
+
+export default dispatchIntegrationsPlugin;

package/src/styles/dispatch-css.spec.ts

@@ -0,0 +1,65 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { describe, expect, it } from "vitest";
+
+const packageRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  "../..",
+);
+const repoRoot = path.resolve(packageRoot, "../..");
+
+describe("dispatch Tailwind styles", () => {
+  it("exports package source directives for consuming apps", () => {
+    const pkg = JSON.parse(
+      fs.readFileSync(path.join(packageRoot, "package.json"), "utf-8"),
+    ) as { exports?: Record<string, string> };
+    const stylesheet = fs.readFileSync(
+      path.join(packageRoot, "src/styles/dispatch.css"),
+      "utf-8",
+    );
+
+    expect(pkg.exports?.["./styles/dispatch.css"]).toBe(
+      "./src/styles/dispatch.css",
+    );
+    expect(stylesheet).toContain(
+      '@source "../components/**/*.{js,mjs,ts,tsx}"',
+    );
+    expect(stylesheet).toContain('@source "../routes/**/*.{js,mjs,ts,tsx}"');
+  });
+
+  it("imports package source directives from the Dispatch template", () => {
+    const globalCss = fs.readFileSync(
+      path.join(repoRoot, "templates/dispatch/app/global.css"),
+      "utf-8",
+    );
+
+    expect(globalCss).toContain(
+      '@import "@agent-native/dispatch/styles/dispatch.css";',
+    );
+  });
+});
+
+describe("dispatch route shells", () => {
+  it("re-exports the index route redirects from the Dispatch template", () => {
+    const indexRoute = fs.readFileSync(
+      path.join(repoRoot, "templates/dispatch/app/routes/_index.tsx"),
+      "utf-8",
+    );
+
+    expect(indexRoute).toContain("loader");
+    expect(indexRoute).toContain("clientLoader");
+    expect(indexRoute).toContain("HydrateFallback");
+    expect(indexRoute).toContain("@agent-native/dispatch/routes/pages/_index");
+  });
+
+  it("re-exports the chat route from the Dispatch template", () => {
+    const chatRoute = fs.readFileSync(
+      path.join(repoRoot, "templates/dispatch/app/routes/chat.tsx"),
+      "utf-8",
+    );
+
+    expect(chatRoute).toContain("@agent-native/dispatch/routes/pages/chat");
+  });
+});

package/src/styles/dispatch.css

@@ -0,0 +1,108 @@
+/*
+ * Tailwind v4 does not scan package sources in node_modules unless the
+ * consuming app opts in. Import this stylesheet from a Dispatch app's global
+ * CSS so Tailwind includes the utilities used by packaged Dispatch routes and
+ * components.
+ */
+@source "../components/**/*.{js,mjs,ts,tsx}";
+@source "../hooks/**/*.{js,mjs,ts,tsx}";
+@source "../routes/**/*.{js,mjs,ts,tsx}";
+
+.dispatch-chat-panel [data-agent-empty-state="centered"] {
+  justify-content: center;
+  padding-bottom: clamp(4rem, 12vh, 8rem);
+}
+
+.dispatch-chat-intro {
+  display: none;
+}
+
+.dispatch-chat-panel [data-agent-empty-state="centered"] .dispatch-chat-intro {
+  display: grid;
+  width: 100%;
+  max-width: min(760px, 90%);
+  gap: 0.5rem;
+  margin: 0 auto 1rem;
+  text-align: center;
+}
+
+.dispatch-chat-intro h1 {
+  margin: 0;
+  color: hsl(var(--foreground));
+  font-size: 2.5rem;
+  font-weight: 600;
+  letter-spacing: 0;
+  line-height: 1.12;
+}
+
+.dispatch-chat-intro p {
+  margin: 0;
+  color: hsl(var(--muted-foreground));
+  font-size: 0.9375rem;
+  line-height: 1.5;
+}
+
+.dispatch-chat-panel [data-agent-empty-state="centered"] .agent-chat-scroll {
+  flex: 0 0 auto;
+  min-height: 0;
+  overflow: visible;
+}
+
+.dispatch-chat-panel [data-agent-empty-state="centered"] .agent-composer-area {
+  width: 100%;
+  max-width: min(760px, 90%);
+  padding: 0;
+}
+
+.dispatch-chat-panel [data-agent-empty-state="centered"] .agent-composer-root {
+  min-height: 10.5rem;
+  border-color: hsl(var(--border));
+  border-radius: 1rem;
+  background: hsl(var(--card));
+  box-shadow: none;
+}
+
+.dark
+  .dispatch-chat-panel
+  [data-agent-empty-state="centered"]
+  .agent-composer-root {
+  box-shadow: none;
+}
+
+.dispatch-chat-panel
+  [data-agent-empty-state="centered"]
+  .agent-composer-prosemirror {
+  min-height: 6.75rem;
+  font-size: 1rem;
+  line-height: 1.625rem;
+}
+
+@media (max-width: 767px) {
+  .dispatch-chat-panel [data-agent-empty-state="centered"] {
+    padding: 1rem;
+    padding-bottom: 5rem;
+  }
+
+  .dispatch-chat-panel
+    [data-agent-empty-state="centered"]
+    .dispatch-chat-intro {
+    width: 100%;
+    margin-bottom: 0.875rem;
+  }
+
+  .dispatch-chat-intro h1 {
+    font-size: 1.75rem;
+  }
+
+  .dispatch-chat-panel
+    [data-agent-empty-state="centered"]
+    .agent-composer-area {
+    width: 100%;
+  }
+
+  .dispatch-chat-panel
+    [data-agent-empty-state="centered"]
+    .agent-composer-root {
+    min-height: 9rem;
+  }
+}