BuilderIO/agent-native @agent-native/toolkit@0.210.0

on GitHub

Patch Changes

• 6c7c90e: Enable Brain to query Gong with shared organization credentials, keep excluded connection requests settled, and add a bounded CRM-context account-call recipe.

• 7028ea5: A new chat no longer requests dev checkpoints before its first run has saved the thread, so local Code chats stop logging a 404 for every first message.

• 7ade653: Links in an extension that open a new tab (target="_blank", Cmd/Ctrl/Shift-click, or middle-click) are now opened by the host page, http/https only and with noopener, instead of as popups of the sandboxed iframe, so pages like HubSpot records load instead of rendering blank. The extension iframe's sandbox and window.open are unchanged.

• 4c34d33: Keep share links placed at the bottom after the people and access sections when the share panel has People and Agents tabs.

• Release all public npm packages with a patch version bump.

• 108b9d9: Keep MCP audit rows and attribute them correctly. A NUL or other control character in an MCP client's self-reported name or version, or a NUL in any other audit value, is now stored as U+FFFD instead of failing the insert and losing the row, and a failed audit write is logged and reported through captureError while the audited action still completes. Writes made through /_agent-native/actions/<action> with a verified MCP OAuth or connect token now record as mcp by the agent, with the credential's OAuth client id, even when the request also sends the frontend header. An approved A2A tool call that runs after its pause now records the paused task's run, thread, turn and network ids. The audit-log event details show the self-reported client, the OAuth client and the approval, with mcp-client-accepted labeled as unverified.

  Breaking: the signatures of recordActionAudit and recordOrgAdminAuditEvent changed. Both now require an attribution, made only by auditAttribution(ctx) inside an action or routeAuditAttribution(event) in a Nitro route, and a call without one throws AuditAttributionError instead of losing its row. To migrate, move caller, threadId, turnId and runId out of ctx (which keeps only actionName, userEmail and orgId) and pass attribution: auditAttribution(ctx) with the action's run context, or attribution: routeAuditAttribution(event) from a route. Admin changes recorded by hand, such as Restrict personal API keys and the service provider choice, now keep the MCP client, OAuth client and approval instead of storing nulls.

  An A2A call approved on its review page now records approval: "a2a-review", shown as "Approved on the agent action review page", instead of the agent-chat label. Its replay runs outside the paused task's journal again, so an earlier identical call in that task cannot stand in for it. A call's approval (agent chat, an accepted MCP elicitation or the A2A review) and the replay's task ids are held by that call's execution frame, not its run context, so they reach the approved action's own audit rows, including a row it records itself, and not another action it calls, a recursive call, or a later call with a kept context. Two limits remain: a raw (non-defineAction) entry called directly from an action's body shares that action's frame, and a wrapper around an entry's run must keep its ACTION_EXECUTION_KEY (spread the entry) for the action to keep its approval. Without async-local storage no approval is recorded. A service principal's refusal of another call, whether a child action or an agent run started inside an approved action, a dispatcher's approval pause of another call, and its refusal of a call with invalid arguments carry none of the enclosing action's approval; only an action's refusal of itself keeps it, along with that call's reported client, OAuth client, network ids and thread, turn and run ids. An action's approval ends when the promise its run returned settles, not when a stream or iterator it returned is consumed, so a timer, an unawaited write, or work done later while consuming that stream records none of it. The dev action bridge runs each call in its own frame, like the HTTP action route. The action entry exposes no frame-evidence helpers, and request input or ActionRunContext fields never become evidence. Trusted server dispatcher APIs (executeAgentToolCall, runAgentLoop) can still supply approval and attribution. The approval pause's denied row, and the agent loop's row for a call it refuses for invalid arguments, now carry the run id.

• ca67d21: Advertise MCP tool input schemas that pass the Anthropic, OpenAI and Gemini schema rules Core pins. A root anyOf, oneOf or allOf is flattened into one object, and the schema description lists the argument sets it combined. Hand-written JSON schemas get the same keyword stripping as Zod schemas. A typeless const or enum gets an explicit type taken from its values, so Codex no longer narrows { "const": 1 } to a string. A string const is advertised as a one-value enum, which Gemini honors, and maxItems moves into the description, because Gemini refuses a forced call to a large bounded array. Gemini's enum holds strings only, so an enum that lists a number, boolean or null keeps its type and lists its values in the description instead; one value becomes a const. Over MCP every rewrite only widens what the schema accepts, boolean subschemas included. The in-app copy does too, except that it admits no array directly inside an array, because the in-app Gemini adapter drops $ref, so nothing there can recurse. Actions still validate calls against their own schema.

  A schema reference that does not resolve, including one that names an inherited property such as #/$defs/__proto__, now fails with a named error instead of disappearing when its branch is flattened. References spelled as encoded pointers or $anchor names are rewritten to plain pointers first, and one into a oneOf branch or a not, which stripping rewrites or removes, is moved into root $defs so it still resolves; an $id below the root, a non-local $ref and $dynamicRef are refused. A const that its own enum does not list, a const or enum with no value of the position's type, such as { "type": "string", "enum": [1, 2] }, or an empty enum, anyOf or oneOf, is refused the same way, since that position accepts no value, and so is a root schema no object satisfies, such as an allOf with a string branch, which flattening used to advertise as an object schema. A root $ref whose target is an object schema counts as one. These checks read JSON Schema 2020-12, the dialect MCP assumes, so defineAction now asks schema libraries for 2020-12, which Zod emits with $defs and prefixItems tuples. A schema is checked when its $schema is absent or the official 2020-12 URI. One that names another dialect, such as draft-07, or an unknown URI, gets none of these checks beyond an object root. It is offered stripped and without $schema: the stripping still types a typeless const or enum and describes a non-string enum as above, but its root is not flattened, a string const stays a const, and maxItems stays. A property or definition named __proto__ or constructor keeps its own entry through every rewrite. In the in-app agent and over MCP, an app action with such a schema is left out of the tool list and logged as an error, so the other tools keep working. So is an action whose input schema is not an object, which over MCP used to fail the whole tool list, including a false schema, which the in-app agent used to take as no schema. Each converter reads an input schema once, into a plain copy that it checks and converts, and never edits the schema or a schema library's output in place. A getter, a value JSON cannot hold such as NaN or a BigInt, a cycle, an object that is not plain, or one whose reads throw leaves the action out with the position and reason, instead of being checked as one value and advertised as another. Only an action whose schema library emits no JSON Schema is still offered as taking any object; when finding or running the library's emitter, a check or the conversion throws, defineAction keeps the reason with the tool it builds, and the action is left out, also when it is copied with that tool. Another action defined with the same schema is judged by its own tool. Other surfaces that describe actions, such as A2A agent cards, the action manifest and WebMCP, tool-search summaries and the framework prompts, still list such an action with its stripped schema or any-object parameters. Over MCP the instructions do not name it either, and tools/call answers it as an unknown tool. A remote MCP tool gets the same checks, and one that fails them is held back when its server's tools are listed: the server stays connected with its other tools, and its integration status names the unusable tool and why. Reconnecting the server from Integrations lists its tools again over the same connection, so calls already running on it are not interrupted. Those lists run one at a time per server, so an older answer cannot replace a newer one. When that list fails at the transport, because the server refuses it over HTTP, as it does once an OAuth grant is revoked, or cannot be reached at all, the server is left as a failed connect leaves it: its tools are no longer offered, a call to one fails because the server is not connected, and Reconnect reports it disconnected. Choosing Reconnect again connects it from the start, which starts OAuth for a server whose OAuth grant was revoked. A list the server answers with a JSON-RPC error, or one that times out, keeps the connection and the tools listed before, and Reconnect answers with the error.

• 79545c9: Give resource icons their own color palette, readable at 4.5:1 contrast in light and dark themes.

• ff3a8dd: Support disabling an open DatePicker and controlling focus when its calendar closes.

• 0cfbd4d: Include the MIT license text in the published package.

• ed34578: Open clicked external links from sandboxed extension frames in a separate browser tab, with the frame handshake nonce kept out of the extension URL.

• 7337569: Resolve personal scope for local ChatGPT plan access and explain the requirement in settings.

• 7028ea5: Switch and Checkbox color their checked state from aria-checked, so wrapping one in a TooltipTrigger asChild no longer leaves its track transparent.

• 41e43db: Use the plain web search label in onboarding setup.

• Updated dependencies [41f86eb]

• Updated dependencies

• Updated dependencies [0cfbd4d]

• Updated dependencies [69b873f]

  • @agent-native/agentkit@0.210.0