@agent-native/core 0.101.7 → 0.101.10

package/dist/server/core-routes-plugin.js

@@ -1,4 +1,4 @@
-import { defineEventHandler, setResponseStatus, setResponseHeader, getMethod, getHeader, getCookie, setCookie, deleteCookie, getRequestURL, getRequestIP, } from "h3";
+import { assertBodySize, defineEventHandler, setResponseStatus, setResponseHeader, getMethod, getHeader, getCookie, setCookie, deleteCookie, getRequestURL, getRequestIP, readRawBody, } from "h3";
 import { readMultipartFormData } from "h3";
 import { DEFAULT_MODEL } from "../agent/default-model.js";
 import { registerBuiltinEngines } from "../agent/engine/builtin.js";
@@ -10,6 +10,7 @@ import { mountBrowserSessionRoutes } from "../browser-sessions/routes.js";
 import { mountDbAdminRoutes } from "../db-admin/routes.js";
 import { getDbExec } from "../db/client.js";
 import { getDatabaseRuntimeFingerprint, getRuntimeDebugFingerprint, runDatabaseSchemaHealthCheck, } from "../db/runtime-diagnostics.js";
+import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import { uploadFile, getActiveFileUploadProviderForRequest, listFileUploadProviders, } from "../file-upload/index.js";
 import { handleMcpConnect } from "../mcp/connect-route.js";
 import { handleMcpOAuth, handleMcpOAuthAuthorizationServerMetadata, handleMcpOAuthProtectedResourceMetadata, } from "../mcp/oauth-route.js";
@@ -34,7 +35,7 @@ import { createAgentEngineApiKeyHandler } from "./agent-engine-api-key-route.js"
 import { getConfiguredAppBasePath, stripAppBasePath } from "./app-base-path.js";
 import { getAppName } from "./app-name.js";
 import { getSession } from "./auth.js";
-import { BUILDER_CONNECT_PARAM, BUILDER_CONNECT_OWNER_COOKIE, BUILDER_ENV_KEYS, BUILDER_OPENER_PARAM, BUILDER_STATE_PARAM, appendBuilderConnectToken, builderConnectTrackingProperties, buildBuilderCliAuthUrl, createBuilderBrowserCallbackErrorPage, createBuilderBrowserCallbackPage, getBuilderConnectTrackingParams, getBuilderCliAuthCallbackOriginForEvent, getBuilderBrowserOriginForEvent, resolveBuilderCallbackReturnUrl, getBuilderBrowserStatusForEvent, resolveBuilderBranchProjectId, resolveSafePreviewUrl, runBuilderAgent, signBuilderCallbackState, verifyBuilderConnectTokenAndGetOwner, verifyBuilderCallbackStateAndGetOwner, signBuilderConnectToken, } from "./builder-browser.js";
+import { BUILDER_CONNECT_PARAM, BUILDER_CONNECT_OWNER_COOKIE, BUILDER_ENV_KEYS, BUILDER_OPENER_PARAM, BUILDER_RELAY_FLOW_HEADER, BUILDER_RELAY_SIGNATURE_HEADER, BUILDER_RELAY_STATE_PARAM, BUILDER_RELAY_TIMESTAMP_HEADER, BUILDER_STATE_PARAM, appendBuilderConnectToken, builderConnectTrackingProperties, buildBuilderCliAuthUrl, createBuilderBrowserCallbackErrorPage, createBuilderBrowserCallbackPage, createBuilderRelayRequest, getBuilderConnectTrackingParams, getBuilderCliAuthCallbackOriginForEvent, getBuilderBrowserOriginForEvent, resolveBuilderCallbackReturnUrl, getBuilderBrowserStatusForEvent, resolveBuilderBranchProjectId, resolveSafePreviewUrl, runBuilderAgent, signBuilderCallbackState, signBuilderPreviewRelayState, verifyBuilderRelayRequest, verifyBuilderPreviewRelayStateForCallback, verifyBuilderConnectTokenAndGetOwner, verifyBuilderCallbackStateAndGetOwner, signBuilderConnectToken, } from "./builder-browser.js";
 import { captureError } from "./capture-error.js";
 import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
 import { canUseDeployCredentialFallbackForRequest, readDeployCredentialEnv, resolveSecret, } from "./credential-provider.js";
@@ -161,6 +162,15 @@ export function resolveFrameworkSseRoutes(sseRoute) {
         LEGACY_FRAMEWORK_EVENTS_ROUTE,
     ]));
 }
+export const BUILDER_STATUS_ROUTE_SUFFIXES = [
+    "/builder/status",
+    "/connection-status/builder",
+];
+export function mountBuilderStatusRouteAliases(mount, prefix, handler) {
+    for (const routeSuffix of BUILDER_STATUS_ROUTE_SUFFIXES) {
+        mount(`${prefix}${routeSuffix}`, handler);
+    }
+}
 registerBuiltinEngines();
 function cleanBuilderWaitlistText(value, maxLength = BUILDER_WAITLIST_TEXT_LIMIT) {
     if (typeof value !== "string")
@@ -532,6 +542,90 @@ export function getFrameworkRouteRequestUrl(event) {
     url.search = rawUrl.slice(queryStart);
     return url;
 }
+function builderRelayPendingKey(flowId) {
+    return `builder-pending-relay:${flowId}`;
+}
+function parseBuilderRelayPendingRecord(value) {
+    if (!value ||
+        typeof value.ownerEmail !== "string" ||
+        typeof value.targetOrigin !== "string" ||
+        typeof value.basePath !== "string" ||
+        typeof value.expiresAt !== "number") {
+        return null;
+    }
+    return {
+        ownerEmail: value.ownerEmail,
+        orgId: typeof value.orgId === "string" ? value.orgId : null,
+        role: typeof value.role === "string" ? value.role : null,
+        targetOrigin: value.targetOrigin,
+        basePath: value.basePath,
+        expiresAt: value.expiresAt,
+        tracking: value.tracking && typeof value.tracking === "object"
+            ? value.tracking
+            : undefined,
+    };
+}
+/**
+ * Authenticated one-shot receiver for the second hop of Builder preview auth.
+ * Owner and org scope always come from the preview's pending record; the
+ * corporate callback cannot choose them in its POST body.
+ */
+export async function consumeBuilderRelayRequest(input, dependencies) {
+    if (input.rawBody.length > 64 * 1024) {
+        return {
+            ok: false,
+            status: 413,
+            error: "Builder relay request is too large",
+        };
+    }
+    let verified;
+    try {
+        verified = verifyBuilderRelayRequest({
+            body: input.rawBody,
+            timestamp: input.timestamp,
+            flowId: input.flowId,
+            signature: input.signature,
+            requestOrigin: input.requestOrigin,
+            requestBasePath: input.requestBasePath,
+            now: input.now,
+        });
+    }
+    catch {
+        return { ok: false, status: 503, error: "Builder relay is not configured" };
+    }
+    if (!verified) {
+        return { ok: false, status: 401, error: "Invalid Builder relay request" };
+    }
+    const pendingKey = builderRelayPendingKey(verified.payload.flowId);
+    const pending = parseBuilderRelayPendingRecord(await dependencies.getPending(pendingKey).catch(() => null));
+    const now = input.now ?? Date.now();
+    if (!pending ||
+        pending.expiresAt < now ||
+        pending.ownerEmail !== verified.payload.ownerEmail ||
+        pending.targetOrigin !== verified.payload.targetOrigin ||
+        pending.basePath !== verified.payload.basePath) {
+        return { ok: false, status: 403, error: "No active Builder relay flow" };
+    }
+    // A successful delete, not merely a resolved promise, is the one-shot gate.
+    // It happens before credential persistence so replay is impossible even if
+    // the downstream write fails and the human has to start a fresh flow.
+    const consumed = await dependencies
+        .deletePending(pendingKey)
+        .catch(() => false);
+    if (consumed !== true) {
+        return {
+            ok: false,
+            status: 409,
+            error: "Builder relay flow was already consumed",
+        };
+    }
+    await dependencies.writeCredentials(pending.ownerEmail, verified.body.credentials, { orgId: pending.orgId, role: pending.role });
+    return { ok: true };
+}
+export async function readBuilderRelayRequestBody(event) {
+    await assertBodySize(event, 64 * 1024);
+    return (await readRawBody(event, "utf8")) ?? "";
+}
 function redactValues(text, values) {
     let out = text;
     for (const value of values) {
@@ -943,7 +1037,7 @@ export function createCoreRoutesPlugin(options = {}) {
             // db-admin/routes.ts), so on a deployed / production app it always 403s.
             mountDbAdminRoutes(nitroApp, { routePrefix: P });
             const resolveBuilderOwnerContext = async (event, mode) => resolveBuilderOwnerContextForRequest(event, { anonymousOwner: options.anonymousOwner }, mode);
-            getH3App(nitroApp).use(`${P}/builder/status`, defineEventHandler(async (event) => {
+            const builderStatusHandler = defineEventHandler(async (event) => {
                 const envStatus = getBuilderBrowserStatusForEvent(event);
                 const ownerContext = await resolveBuilderOwnerContext(event);
                 const userEmail = ownerContext.email;
@@ -1105,9 +1199,7 @@ export function createCoreRoutesPlugin(options = {}) {
                                     envStatus.subscriptionName ||
                                     undefined,
                                 isEnterprise: creds.isEnterprise ?? envStatus.isEnterprise ?? undefined,
-                                isFreeAccount: creds.isFreeAccount ??
-                                    envStatus.isFreeAccount ??
-                                    undefined,
+                                isFreeAccount: creds.isFreeAccount ?? envStatus.isFreeAccount ?? undefined,
                                 credentialSource: credentialSource ?? undefined,
                             });
                         }
@@ -1156,7 +1248,8 @@ export function createCoreRoutesPlugin(options = {}) {
                         isFreeAccount: undefined,
                     });
                 });
-            }));
+            });
+            mountBuilderStatusRouteAliases((path, handler) => getH3App(nitroApp).use(path, handler), P, builderStatusHandler);
             // How long a pending-connect row is valid. Must be long enough for
             // the user to complete the Builder CLI-auth flow, but short enough
             // that a stale row from an abandoned attempt doesn't accept a new
@@ -1279,15 +1372,65 @@ export function createCoreRoutesPlugin(options = {}) {
                 catch {
                     // No prior error row — fine
                 }
+                const previewOrigin = getBuilderBrowserOriginForEvent(event).replace(/\/+$/, "");
+                const callbackOrigin = getBuilderCliAuthCallbackOriginForEvent(event).replace(/\/+$/, "");
+                let relay;
+                if (previewOrigin !== callbackOrigin) {
+                    try {
+                        relay = signBuilderPreviewRelayState({
+                            ownerEmail,
+                            targetOrigin: previewOrigin,
+                            basePath: getAppBasePath(),
+                        });
+                    }
+                    catch (err) {
+                        const msg = err instanceof Error
+                            ? err.message
+                            : "Builder preview relay is not configured.";
+                        setResponseStatus(event, 503);
+                        setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+                        return createBuilderBrowserCallbackErrorPage(msg, {
+                            title: "Builder preview connection isn't configured",
+                            body: "This preview needs its secure Builder callback relay configured before authorization can start.",
+                            closeHint: "Close this popup and ask the preview owner to finish Builder relay setup.",
+                            parentOrigin: previewOrigin,
+                        });
+                    }
+                }
+                let pendingOrgId = null;
+                let pendingRole = null;
+                if (!ownerContext.anonymous) {
+                    try {
+                        const orgContext = await getOrgContext(event);
+                        pendingOrgId = orgContext.orgId ?? null;
+                        pendingRole = orgContext.role ?? null;
+                    }
+                    catch {
+                        // The pending owner remains user-scoped when org context is absent.
+                    }
+                }
                 // Store a short-lived pending row. If the DB is unavailable we
                 // surface a popup-renderable error page that signals the parent
                 // via BroadcastChannel, rather than letting the popup show raw
                 // JSON and the parent poll for 5 minutes.
                 try {
-                    await putSetting(`builder-pending-connect:${ownerEmail}`, {
-                        expiresAt: Date.now() + BUILDER_CONNECT_PENDING_TTL_MS,
-                        tracking: connectTracking,
-                    });
+                    if (relay) {
+                        await putSetting(builderRelayPendingKey(relay.payload.flowId), {
+                            ownerEmail,
+                            orgId: pendingOrgId,
+                            role: pendingRole,
+                            targetOrigin: relay.payload.targetOrigin,
+                            basePath: relay.payload.basePath,
+                            expiresAt: relay.payload.exp,
+                            tracking: connectTracking,
+                        });
+                    }
+                    else {
+                        await putSetting(`builder-pending-connect:${ownerEmail}`, {
+                            expiresAt: Date.now() + BUILDER_CONNECT_PENDING_TTL_MS,
+                            tracking: connectTracking,
+                        });
+                    }
                 }
                 catch (err) {
                     await trackBuilderLifecycle(event, "builder connect failed", ownerEmail, {
@@ -1319,8 +1462,9 @@ export function createCoreRoutesPlugin(options = {}) {
                 // from /builder/status. Keep this legacy trampoline working for older
                 // clients, but still send it to Builder immediately and include signed
                 // callback state so the callback does not depend on popup cookies.
-                const cliAuthUrl = buildBuilderCliAuthUrl(getBuilderCliAuthCallbackOriginForEvent(event), signBuilderCallbackState(ownerEmail), {
-                    previewOrigin: getBuilderBrowserOriginForEvent(event),
+                const cliAuthUrl = buildBuilderCliAuthUrl(callbackOrigin, signBuilderCallbackState(ownerEmail), {
+                    previewOrigin,
+                    relayState: relay?.state,
                     tracking: connectTracking,
                 });
                 setResponseStatus(event, 302);
@@ -1449,11 +1593,114 @@ export function createCoreRoutesPlugin(options = {}) {
                 });
                 return { ok: true, formSubmitted: formSubmission.submitted };
             }));
+            getH3App(nitroApp).use(`${P}/builder/relay`, defineEventHandler(async (event) => {
+                if (getMethod(event) !== "POST") {
+                    setResponseStatus(event, 405);
+                    return { error: "Method not allowed" };
+                }
+                const rawBody = await readBuilderRelayRequestBody(event);
+                const result = await consumeBuilderRelayRequest({
+                    rawBody,
+                    timestamp: getHeader(event, BUILDER_RELAY_TIMESTAMP_HEADER),
+                    flowId: getHeader(event, BUILDER_RELAY_FLOW_HEADER),
+                    signature: getHeader(event, BUILDER_RELAY_SIGNATURE_HEADER),
+                    requestOrigin: getFrameworkRouteRequestUrl(event).origin,
+                    requestBasePath: getAppBasePath(),
+                }, {
+                    getPending: getSetting,
+                    deletePending: deleteSetting,
+                    writeCredentials: async (ownerEmail, credentials, scope) => {
+                        const { writeBuilderCredentials } = await import("./credential-provider.js");
+                        await writeBuilderCredentials(ownerEmail, credentials, scope);
+                        await Promise.all([
+                            deleteSetting("builder-disconnected").catch(() => false),
+                            deleteSetting(`builder-connect-error:${ownerEmail}`).catch(() => false),
+                        ]);
+                    },
+                }).catch(() => ({
+                    ok: false,
+                    status: 500,
+                    error: "Builder relay credential persistence failed",
+                }));
+                if (!result.ok) {
+                    setResponseStatus(event, result.status);
+                    return { error: result.error };
+                }
+                return { ok: true };
+            }));
             getH3App(nitroApp).use(`${P}/builder/callback`, defineEventHandler(async (event) => {
                 if (getMethod(event) !== "GET") {
                     setResponseStatus(event, 405);
                     return { error: "Method not allowed" };
                 }
+                // Builder's provider contract puts credentials on this first-hop
+                // URL. Keep the response out of caches and suppress referrer
+                // propagation even though the second hop carries secrets only in
+                // its authenticated POST body.
+                setResponseHeader(event, "Cache-Control", "no-store");
+                setResponseHeader(event, "Referrer-Policy", "no-referrer");
+                const requestUrl = getFrameworkRouteRequestUrl(event);
+                const relayStateRaw = requestUrl.searchParams.get(BUILDER_RELAY_STATE_PARAM);
+                if (relayStateRaw) {
+                    let relayPayload = null;
+                    try {
+                        relayPayload =
+                            verifyBuilderPreviewRelayStateForCallback(relayStateRaw);
+                    }
+                    catch {
+                        // A preview relay must fail closed when its dedicated shared
+                        // secret is absent on the corporate callback deployment.
+                    }
+                    if (!relayPayload) {
+                        setResponseStatus(event, 403);
+                        setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+                        return createBuilderBrowserCallbackErrorPage("Builder preview relay state is invalid or expired.");
+                    }
+                    const privateKey = requestUrl.searchParams.get("p-key");
+                    const publicKey = requestUrl.searchParams.get("api-key");
+                    if (!privateKey || !publicKey) {
+                        setResponseStatus(event, 400);
+                        setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+                        return createBuilderBrowserCallbackErrorPage("Builder didn't return credentials. Restart the connect flow from settings.", { parentOrigin: relayPayload.targetOrigin });
+                    }
+                    const credentials = {
+                        privateKey,
+                        publicKey,
+                        userId: requestUrl.searchParams.get("user-id"),
+                        orgName: requestUrl.searchParams.get("org-name"),
+                        orgKind: requestUrl.searchParams.get("kind"),
+                        subscription: requestUrl.searchParams.get("subscription"),
+                        subscriptionLevel: requestUrl.searchParams.get("subscription-level"),
+                        subscriptionName: requestUrl.searchParams.get("subscription-name"),
+                        isEnterprise: parseBuilderCallbackBoolean(requestUrl.searchParams.get("is-enterprise")),
+                        isFreeAccount: parseBuilderCallbackBoolean(requestUrl.searchParams.get("is-free-account")),
+                    };
+                    try {
+                        const relayRequest = createBuilderRelayRequest(relayStateRaw, credentials);
+                        const response = await ssrfSafeFetch(relayRequest.url, {
+                            method: "POST",
+                            headers: relayRequest.headers,
+                            body: relayRequest.body,
+                        }, { maxRedirects: 0, httpsOnly: true });
+                        if (!response.ok) {
+                            throw new Error(`Preview relay rejected the callback (${response.status}).`);
+                        }
+                    }
+                    catch (err) {
+                        const message = err instanceof Error
+                            ? err.message
+                            : "Builder preview relay failed.";
+                        // Never log the first-hop URL or relay body: both contain
+                        // credentials. The popup gets a bounded, credential-free error.
+                        setResponseStatus(event, 502);
+                        setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+                        return createBuilderBrowserCallbackErrorPage(message, {
+                            parentOrigin: relayPayload.targetOrigin,
+                        });
+                    }
+                    setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
+                    return createBuilderBrowserCallbackPage(`${relayPayload.targetOrigin}${relayPayload.basePath || "/"}`, { parentOrigin: relayPayload.targetOrigin });
+                }
                 // A real session or a template-approved anonymous owner is required;
                 // the pending-row check below (combined with the same-origin gate on
                 // /builder/connect) blocks CSRF and callback replay.
@@ -1478,7 +1725,6 @@ export function createCoreRoutesPlugin(options = {}) {
                     return { error: "Authentication required" };
                 }
                 clearBuilderConnectOwnerCookie(event);
-                const requestUrl = getFrameworkRouteRequestUrl(event);
                 let connectTracking = getBuilderConnectTrackingParams(requestUrl.searchParams);
                 // postMessage from the callback success/error pages must target the
                 // original preview opener, not the callback server. On the fallback