BuilderIO/agent-native @agent-native/core@0.228.0

on GitHub

Minor Changes

• 8656de2: ask-question takes up to four questions at once in questions, shown one at a time and answered together in one message; question and options still ask one. Its guidance now asks for each option as one line that says what the agent would do, with shared context in the question. A Slack thread lists every question of a multi-question ask.
• 8175f2d: Feature flag changes now say which rule they change. A flag can have a rule for every organization and an organization's own rule, which replaces it; set-feature-flag takes scope: "org" | "global", only emails on the app's feature flag admin list can change the rule for every organization (from inside any organization), and list-feature-flags reports both rules, which one is in effect, and any rule that couldn't be read. A stored rule that can't be read now evaluates off everywhere, including when it is an organization's own rule over a global rule that is on, and evaluateFeatureFlagStrict throws on it. Enabling a flag for yourself adds to the rule in effect: it fails with a 409 on a rule that can't be read, and on an organization that follows the global rule, instead of starting that organization's own rule; turning a flag off or replacing its rules writes the whole rule either way. A rule the caller can't change is listed as withheld, with its mode, percentage, and how many emails and organizations it targets, but not which (FeatureFlagRuleSummary). The flag editor names where a change applies, shows when an organization's own rule overrides the rule for all organizations, and disables "Enable for me" where the server would refuse it. Breaking for TypeScript consumers: FeatureFlagMetadata.rules is now optional, absent when the rule in effect couldn't be read or is withheld, and FeatureFlagStoredRule has a new withheld state.
• 60a7b14: Add server-only agent.promptSkills.includeSupportingFiles (default true) to control generated supporting-file listings in the shared system-prompt loader without changing authored skill text or reference read access. Refill resource-backed skill listings in bounded batches so excluded and duplicate candidates do not consume available slots, with an inspection-limit notice when candidates remain uninspected.
• b84ba17: Comments & Review Kit: each comment now records the surface it sits on, a typed and versioned anchor, and a revision that refuses stale edits. Apps can set who may comment and where an unmentioned thread goes, run a hook inside every comment write, link comments to IDs in other systems, and page comment lists past 500.
• 78738f3: People can switch skills on or off for themselves, and organization admins can choose how each shared skill starts for people. Every skill in Settings → Skills has a switch that changes only the agent of the person who flips it. Admins mark each organization or Dispatch skill Recommended (on until someone switches it off, the default), Optional (off until someone switches it on) or Required (on for everyone, with a confirmation first). A Required skill wins over a same-named skill of anyone's own: their version is kept but unused, in the prompt and in explicit references. Admins see how many people switched each skill and how many keep their own version, never who. Switching or marking a Dispatch skill changes this app only. Nothing changes until someone acts. The new actions are get-skill-choices, set-skill-switch, set-skill-mark and get-skill-choice-counts; the client hook is useSkillChoices from @agent-native/core/client/resources/use-skill-choices.

Patch Changes

• 993b03f: Allow an action invocation to declare completed work so a clean empty model final does not repeat it.

• ade88da: An app can now draw the agent chat inside its own panel, and the Share button can show as plain text.

• b8a2878: Run a new automation on the scheduler's next tick. When the scheduler last found no automations, it stopped looking for up to five minutes, and creating one on another server instance didn't end that wait.

• b078cde: Send Builder gateway tools for GPT models with strict: false, so the model can leave optional action arguments out instead of filling each one.

• d471558: Allow callers to cancel signed S3 requests while retaining existing storage safety checks and timeouts.

• bcedcd7: Stop the recurring-job sweep from failing forever on a reaped run whose thread has no messages.

• 2a944bc: pnpm action, agent-native agent and SQL queries through the dev server now act in the same org the app uses for the signed-in user (their active org, else their first membership) when AGENT_ORG_ID is not set. Before, they ran with no org and saw only the user's personal rows, so the agent reported empty lists for rows the UI showed. An explicit AGENT_ORG_ID still wins, and a command the agent runs for a personal request stays personal (AGENT_ORG_SCOPE=personal).

• 356f01b: Allow apps to configure the percentage of new signup visitors offered automatic Builder setup.

• c6a683e: Keep a conditional automation's event queued when its credential check hits a passing failure, and save the condition check's model usage under the automation.

• 0242915: Prompt boxes can attach a Content page as a reference: content is a composer source, and reads go to the Content app. App-relative links a peer app returns now resolve against that app's URL. composerWebsiteUrlSchema is exported from @agent-native/core/shared.

• 93d563d: Point the docs AGENTS.md reading table at the .mdx doc files that exist.

• 62a11a7: Data programs: the read that finalizes a background run serves its rows instead of queueing another run, a failed background run answers reads with its failure until its refresh window lapses instead of running the program again on each read, get-data-program reports the newest finished run (and the newest successful one when that run failed) instead of an empty queued row, and a program that throws reports its own message under a new program_error code instead of emit_missing.

• 8656de2: A chat keeps its delegations after a reload: the saved AgentKit history now stores delegated agents, their interactions, their activities (with the agent they belong to and a bounded text summary, never the raw snapshot) and their tasks, so a reloaded chat shows the same Subagent steps.

• fdc453e: Record browser-translation fingerprints on the first removeChild/insertBefore NotFoundError of a page load to help diagnose DOM-mutation crashes.

• 1e3f234: Guard saved MCP and automation credentials at their approved request origins, and restore canonical provider key destinations.

• 5df9bf2: Local and self-hosted databases that core 0.210 to 0.220 booted now get the agent_harness_sessions columns approval_resolution_id and expiry_cleanup_id on their next boot. Before, the harness recovery sweeps logged column "approval_resolution_id" does not exist every 20 seconds and every harness session save failed, because those columns came only from release-only legacy migrations and a baseline these databases had already recorded.

• 5ad4cb1: Server analytics sends on serverless now outlive the response: a send started when an event is tracked is handed to the host's waitUntil, and the end-of-request flush waits for every send still under way.

• bb5924c: Stop Vite from serving inline identity maps for prebundled dependencies, launch production builds without a shell on Windows, preserve provider token-budget errors, and report the credential keys used by decide().

• d95423d: On an invite-only workspace, someone without an invitation who opens a magic link now sees a page saying the workspace is invite-only, with a link back to sign in, instead of a raw JSON error. A magic link started from the desktop app tells the app the same thing instead of leaving it waiting.

• Release all public npm packages with a patch version bump.

• 04ea3a8: MCP tool calls by a signed-in user now read and write tab-scoped app state (navigation, navigate commands, selection) for the tab of the app they used last, instead of account-wide rows no tab keeps current. When no tab was used in the last 12 hours, navigation reads come back empty and the tool result says so. Apps with their own navigation sync can record tab use with useBrowserTabUse.

• 1e3f234: Preserve replayable MCP request bodies through redirects and OAuth refresh without limiting normal request size.

• 1db1e6e: Record which MCP client made a review suggestion. A suggestion now keeps whether it came over MCP, from another app's agent or from the app's own agent, and the connect host its client named, such as Claude Code or Codex. The host comes from the client's clientInfo name, or else its User-Agent, and is only a label: the client's own claim, never used to grant access.

• 7750ead: Make /_agent-native/open links focus what they point to again. The route wrote its navigate command to the account-wide row, which no tab has read since tabs got their own rows, so a Calendar link opened on today's week instead of the event's. The route now picks the new tab's ID, writes navigate:<tabId>, and passes the ID on the redirect for the page to adopt.

• c141e72: The actions skill in new apps now tells agents that a call must mean the same with padded null, [] and false fields as without them, so an optional switch acts only when true. The emptyListsEraseNothing option's docs say the same for empty lists.

• 6d10a7d: /_agent-native/ping?configuration=1 now reports environment variables an app declares under runtime.environment.required when they are missing, as the docs say it does. A deployed server has no agent-native.config.ts to read, so the build now embeds the declared names in the server bundle, the same way it embeds the hosted harness setting. A dev server reads them from the app's config. The probe still never takes variable names from the request.

• 90992b0: Report a queued "Run now" as running while its worker's claim lease is live. The read path measured liveness from the queue insertion time, so a run claimed after waiting past the 15-minute ceiling looked interrupted while it was starting; dispatch-pending rows now measure from claimed_at, matching the claim lease the scheduler already uses.

• 0fe0d51: getSession and getOrgContext can now reject when session or organization membership lookup fails, instead of resolving to no session or Personal scope. Code that calls them, including template and app server code, should let the error reach the HTTP layer (retryable outages become 503 with Retry-After) rather than catching it as a missing session or Personal workspace.

  Reject unavailable organization scope instead of treating failed membership reads as Personal access during credential resolution, MCP identity setup, or background task creation. Generic credential reads also reject non-transient membership failures before returning a stored Personal credential whose organization priority could not be checked. Preserve the narrow first-boot missing-membership-table exception for action dispatch.

  Keep revoked or mismatched delegated organization access a definitive authorization refusal, including MCP authentication and credential lookup wrappers. Resolve generic credentials' organization scope before provider policy checks and report failed policy or role reads as credential-store unavailability with the original cause.

  Keep failed non-transient credential lookups distinct from missing credentials in the secret and secret-pair wrappers, preserving the original failure. Propagate unavailable membership reads through event-based organization resolution and session backfill for ordinary and delegated requests instead of returning Personal scope. Keep authorization error classification independent of sharing database initialization.

  Keep the engine catalog available when current-engine discovery cannot read a provider credential, reporting an unavailable current selection with its error alongside per-provider diagnostics. Runtime engine detection and definitive authorization refusals still reject.

  Record a scoped failed background automation attempt when creator-membership or organization-admin alert lookup is unreadable. Preserve the typed failure and original cause, stop before credential or agent execution, and keep a proven former creator's same-organization admin fallback.

  Preserve session membership failures through core HTTP consumers, distinguishing retryable outages from permanent lookup errors, keeping missing sessions and definitive delegated access refusals distinct. Key-save route wrappers preserve those HTTP failures instead of replacing them with a generic server error. Framework route errors preserve retry and authentication metadata only for the corresponding declared statuses, and redact unclassified server failures. Keep recipient lookup failures fatal when recording their failed automation history also fails, preserving both causes while retaining execution during history-only outages.

  Fail closed at the shared integration organization lookup boundary when membership cannot be read, returning typed failures before config mutations or scope-dependent operations. Preserve definitive authorization refusals and healthy Personal, owner, admin, and member policy.

  Expose known credential-store unavailability through framework HTTP routes as 503 with its typed code and retry headers, preserving the original cause while keeping unexpected errors redacted and Forbidden responses distinct.

  Reject unavailable integration organization contexts before admin operations, including ordinary-session and delegated transient membership failures. Distinguish credential-store availability failures from permanent or unexpected lookup failures: availability failures carry the retryable availability code and retry headers; permanent failures preserve their cause behind a safe nonretryable lookup error. Definitive authorization refusals remain Forbidden.

  Keep secret scope selection and mutation gates closed when membership is unreadable, including cached unavailable contexts. Preserve transient-vs-permanent session, integration, MCP identity, and automation-recipient lookup failures. Saved credential decryption failures remain nonretryable and retain their cause; unclassified error responses cannot forward cookies, framing headers, or private diagnostics.

  Do not provision a default workspace when its creation-claim, invitation, or matching-domain checks fail. Retain the original failure in cached organization context so protected consumers can distinguish retryable outages from permanent failures.

  Keep recipient lookup diagnostics out of persisted automation history and returned error messages. Preserve the original server-side cause, failure code, retry classification, and failed-run record, including simultaneous history-write failures.

  Return organization roles only after membership verification; unreadable membership or default-workspace preparation rejects with its classified cause instead of returning cached authority or Personal scope. Pending invitations and matching domains remain normal no-organization outcomes. A lost creation claim waits for the winning request's workspace and then rejects as retryable, and a failed closed-organization bootstrap rejects instead of returning Personal scope. Redact declared server-error messages unless an explicit safe error type supplies public text, while retaining HTTP status, safe error codes, retry headers, and private server-side causes.

  Preserve session and organization lookup failures through MCP OAuth and workspace-provider OAuth start and callback paths instead of reporting missing authentication, invalid OAuth state, or denied organization access. Keep the MCP callback flow cookie until organization resolution succeeds so a temporary lookup failure does not discard the in-progress authorization flow.

  Propagate verified organization lookup failures through realtime tokens, extensions and slots, collaboration, voice configuration and transcription, credential status, agent-loop settings, and Builder connection authorization. Do not restore stale session organization claims after a verified Personal result, and refuse integration and secret requests whose organization scope is forbidden instead of treating them as Personal. First-party MCP tokens without an organization claim retain Personal scope regardless of their token scope.

  Preserve embedded-host organization authority from the server callback that authenticated the selected session in that request. Bind scope to the normalized identity and organization, validate organization roles, preserve explicit Personal selection, and keep delegated membership and resource-share checks intact without requiring hosts to mirror their roster.

  Keep deliberately untracked creator accounts distinct from failed account or membership reads when choosing automation alert recipients. Use a verified organization admin fallback only after membership lookup succeeds. Preserve original lookup causes, retry transient identity failures, and stop scheduled retries for permanent identity lookup failures through the existing configuration-error policy; unverified creators remain unable to execute organization automations.

  Recognize network outages at known automation database lookup boundaries without requiring driver stack frames, while leaving unrelated provider failures and permanent lookup errors nonretryable.

  Preserve database transport retryability through known session, organization, MCP identity and credential lookup boundaries without treating mixed host or provider callbacks as database failures.

  Reject unresolved organization lookups before starting an agent run instead of producing an ambiguous orgless context. Preserve classified lookup failures and allow only confirmed Personal scope or a successful organization lookup.

  Compose organization membership ordering and optional identity columns with typed SQL fragments and bound values.

• 03fa669: The resources list action and resource-list now page their results, so the agent can reach every entry in large directories such as skills/. Text lists show 50 entries per page sorted by path, put the next offset in the header, and end with the exact call for the next page. limit (1-100) and offset pick the page, and out-of-range values return an error instead of being ignored. The agent tool also pages JSON, as { total, offset, limit, hasMore, nextOffset, resources }. CLI JSON stays one array unless limit or offset is set.

• 8656de2: run-code output is cleaner: it no longer includes Node's --allow-net ExperimentalWarning in stderr on every run, and stdout and stderr are separated by one blank line instead of three. A program that exits nonzero or times out now shows as a failed call in the AgentKit transcript, named by its error, while the agent still receives the output as an ordinary result.

• 03f5217: S3 upload failures now throw S3RequestError, which carries the bucket's HTTP status and provider: "s3", so an app can tell a refused bucket (wrong keys, a denying policy, a missing bucket) from an outage and point people at storage settings.

• b199a27: Save agent replies whose code mentions a data: URL prefix with no payload, and log why a stale run's thread projection failed.

• 3815f47: Indexed search reads each document's search vector only for rows the app's query keeps, and tests all of a query's plain words at once, so a common word no longer reads every user's documents.

• bea9322: Require verified organization identity, scope background reads to the current organization, restrict shared MCP identity hints and recap agent tools, protect logout from cross-origin requests, confirm extension-submitted agent turns in the host UI, and let users approve exact outbound origins for custom keys without replacing their values.

• bea9322: Constrain key-substituted proxy, agent, and workspace MCP requests to approved origins; preserve secret destination policies on rotation and fail closed when DNS or connection-time SSRF protection is unavailable.

• aca9f1a: A session navigation's stall timer no longer throws when it fires after window is gone, as it can in a test environment that has been torn down.

• 638152f: A healthy /_agent-native/ping?configuration=1 report now has an empty prompt instead of a "Fix this Agent-Native deployment configuration issue" prompt with no issues in it. The "Create an App with an AI Agent" prompt now ends by reading that probe and running pnpm action hello, instead of only checking that the page answers curl -I.

• b6222c2: Use compact split controls for resource sharing, and support link-only viewer surfaces and resource-specific general access controls.

• 99619f8: Shorten the resources tool's path, mime, and includeAgentScratch parameter descriptions so the pagination parameters fit apps' first-request token budgets.

• 5978d74: Review suggestion actions now name the resource they changed, so their change events reach everyone who can read it. An open page shows a new, amended or decided suggestion within seconds instead of at its idle poll, and a collaborator hears about it at all.

• 44c685e: Adding a suggestion to a proposal with one of its suggestion IDs in place of the proposal ID now fails with an error that names the proposal ID to pass, instead of "Proposal not found".

• 4ca54a4: Keep each predicate a sync invalidation asked in sync's invalidation log, so a syncInvalidationsAfter reader can ask it of the query it holds instead of taking it as reaching every query.

• bdefc2e: Refresh MCP client setup instructions and align MCP settings with the existing Settings hierarchy, using branded client rows, focused detail pages with named setup stages using the same shared numbered-steps renderer as Docs with borderless secondary circles for MCP and copyable connection details, connection actions and immediately copyable test prompts within setup steps, OAuth details where required, a compact setup-guide footer, Figma-matched spacing and setup copy, local-address guidance, copy feedback, accessible destination indicators, manual configuration on demand, shared shadcn surfaces, input groups, and error feedback, and server-backed connection badges and activity in the client list and details.

• da0d6d2: The turn-into-app skill now hands the app over when it finishes. On a local build, when you are at that machine, it restarts the app with --open after the final build, which opens it in your own browser and, on a new app, signs you in. The final report starts with "Your app is open at " when it opened the app (otherwise where the app is and how to open it, or what Dispatch returned on the Builder route), then how to change the app, what each control does, and what the app comes with; PIDs, screenshots and evidence labels follow under Details. The plan it shows before building is in plain words, without archetype codes or the direction tie-break.

• ef8ad16: Dispatch no longer keeps a plaintext copy of vault keys. A saved key is written only as the encrypted app_secrets row and vault_secrets.value stays empty; the masked preview is read from the encrypted copy. The sync-vault-to-app action and the "Sync" buttons are removed, since apps read vault keys from the credential store. vault_secrets is now refused by the agent SQL tools and extension SQL, and the new guard:no-unsealed-secret-columns flags a new secret-named column that is not marked sealed.

• 4960415: Fix agent-native deploy failing on Windows with "Cannot find module" when the pnpm on PATH is pnpm 11's launcher. Workspace builds now start pnpm by its bare name, so the launcher finds its own files.

• Updated dependencies [8656de2]

• Updated dependencies

• Updated dependencies [bea9322]

  • @agent-native/agentkit@0.228.0
  • @agent-native/recap-cli@0.5.101