@agent-native/core 0.114.3 → 0.114.4

package/corpus/README.md

@@ -30,4 +30,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 - core files: 1517
 - toolkit files: 137
-- template files: 6105
+- template files: 6106

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @agent-native/core
 
+## 0.114.4
+
+### Patch Changes
+
+- f3dcee3: Suppress provisional artifact warnings while delegated work is still running, and preserve verified Slack provenance for cross-app intake through an audience-scoped, fail-closed resolver.
+
 ## 0.114.3
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.114.3",
+  "version": "0.114.4",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/a2a/artifact-response.ts

@@ -14,6 +14,11 @@ export interface A2AArtifactResponseOptions {
   persistedArtifactSecret?: string;
 }
 
+export interface GuardedA2AArtifactResponse {
+  text: string;
+  rejectedUnverifiedArtifactReferences: boolean;
+}
+
 export interface A2AArtifactIdentityOptions {
   persistedArtifactSecrets?: readonly string[];
 }
@@ -1395,11 +1400,11 @@ function formatUnverifiedArtifactMessage(
     : message;
 }
 
-export function appendA2AArtifactLinks(
+export function guardA2AArtifactResponse(
   responseText: string,
   toolResults: A2AToolResultSummary[],
   options: A2AArtifactResponseOptions = {},
-): string {
+): GuardedA2AArtifactResponse {
   const baseUrl = normalizeBaseUrl(options.baseUrl);
   const includeReferencedArtifacts =
     options.includeReferencedArtifacts ?? false;
@@ -1440,7 +1445,10 @@ export function appendA2AArtifactLinks(
     ) ||
       /\b(?:done|created|ready|here(?:'s| is)|complete|finished)\b/i.test(text))
   ) {
-    return finalize(formatIncompleteDesignMessage(incompleteShells));
+    return {
+      text: finalize(formatIncompleteDesignMessage(incompleteShells)),
+      rejectedUnverifiedArtifactReferences: false,
+    };
   }
 
   const unverifiedRefs = findUnverifiedArtifactReferences(
@@ -1454,18 +1462,21 @@ export function appendA2AArtifactLinks(
     generatedDesigns,
   );
   if (unverifiedRefs.length > 0) {
-    return finalize(
-      formatUnverifiedArtifactMessage(
-        unverifiedRefs,
-        documents,
-        decks,
-        dashboards,
-        analyses,
-        images,
-        generatedDesigns,
-        baseUrl,
+    return {
+      text: finalize(
+        formatUnverifiedArtifactMessage(
+          unverifiedRefs,
+          documents,
+          decks,
+          dashboards,
+          analyses,
+          images,
+          generatedDesigns,
+          baseUrl,
+        ),
       ),
-    );
+      rejectedUnverifiedArtifactReferences: true,
+    };
   }
 
   const missingLines: string[] = [];
@@ -1541,10 +1552,25 @@ export function appendA2AArtifactLinks(
   }
 
   if (missingLines.length === 0) {
-    return finalize(text);
+    return {
+      text: finalize(text),
+      rejectedUnverifiedArtifactReferences: false,
+    };
   }
+
   const artifactBlock = `Artifacts:\n${missingLines.join("\n")}`;
-  return finalize(text ? `${text}\n\n${artifactBlock}` : artifactBlock);
+  return {
+    text: finalize(text ? `${text}\n\n${artifactBlock}` : artifactBlock),
+    rejectedUnverifiedArtifactReferences: false,
+  };
+}
+
+export function appendA2AArtifactLinks(
+  responseText: string,
+  toolResults: A2AToolResultSummary[],
+  options: A2AArtifactResponseOptions = {},
+): string {
+  return guardA2AArtifactResponse(responseText, toolResults, options).text;
 }
 
 export function buildA2ARecoverableArtifactMessage(

package/corpus/core/src/a2a/client.ts

@@ -5,6 +5,7 @@ import { sanitizeA2ACorrelationMetadata } from "./correlation.js";
 import type {
   A2AApprovedAction,
   A2ACorrelationMetadata,
+  A2ASourceContextReference,
   A2AReadOnlyActionResult,
   AgentCard,
   JsonRpcRequest,
@@ -632,6 +633,8 @@ export async function callAgent(
     requestOrigin?: string;
     /** Exact downstream actions explicitly authorized in the caller's chat. */
     approvedActions?: A2AApprovedAction[];
+    /** Opaque provenance reference resolved by the receiver through Dispatch. */
+    sourceContext?: A2ASourceContextReference;
     /** Bounded telemetry-only lineage forwarded to the receiving app. */
     correlation?: A2ACorrelationMetadata;
     /** Stable caller-generated key for one message submission. */
@@ -673,6 +676,7 @@ export async function callAgent(
   if (opts?.userEmail) metadata.userEmail = opts.userEmail;
   if (opts?.orgDomain) metadata.orgDomain = opts.orgDomain;
   if (opts?.requestOrigin) metadata.requestOrigin = opts.requestOrigin;
+  if (opts?.sourceContext) metadata.sourceContext = opts.sourceContext;
   Object.assign(metadata, sanitizeA2ACorrelationMetadata(opts?.correlation));
 
   // Default to async + poll. The receiving A2A server's `_process-task` route

package/corpus/core/src/a2a/handlers.ts

@@ -10,6 +10,8 @@ import {
   resolveAgentChatProcessRunDispatchPath,
 } from "../agent/durable-background.js";
 import { trackingIdentityProperties } from "../observability/tracking-identity.js";
+import { getA2ASecretByDomain } from "../org/context.js";
+import { findWorkspaceDispatchAgent } from "../server/agent-discovery.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
 import { getOrigin, isConfiguredAppOrigin } from "../server/google-oauth.js";
 import { fireInternalDispatch } from "../server/self-dispatch.js";
@@ -19,6 +21,7 @@ import {
   hasConfiguredA2ASecret,
   isA2AProductionRuntime,
 } from "./auth-policy.js";
+import { callAction } from "./client.js";
 import { sanitizeA2ACorrelationMetadata } from "./correlation.js";
 import {
   createTask,
@@ -39,6 +42,8 @@ import {
 } from "./task-store.js";
 import type {
   A2AApprovedAction,
+  A2ASourceContext,
+  A2ASourceContextReference,
   A2AConfig,
   A2AHandler,
   A2AHandlerContext,
@@ -84,6 +89,107 @@ function trustedApprovedActions(
   return approved.length > 0 ? approved : undefined;
 }
 
+function sourceContextReference(
+  value: unknown,
+): A2ASourceContextReference | undefined {
+  if (!value || typeof value !== "object") {
+    return undefined;
+  }
+  const candidate = value as Record<string, unknown>;
+  if (
+    candidate.platform !== "slack" ||
+    typeof candidate.integrationTaskId !== "string"
+  ) {
+    return undefined;
+  }
+  const integrationTaskId = candidate.integrationTaskId;
+  if (
+    !integrationTaskId ||
+    integrationTaskId !== integrationTaskId.trim() ||
+    integrationTaskId.length > 200
+  ) {
+    return undefined;
+  }
+  return { platform: "slack", integrationTaskId };
+}
+
+function resolvedSlackSourceContext(
+  value: unknown,
+): A2ASourceContext | undefined {
+  if (!value || typeof value !== "object") return undefined;
+  const candidate = value as Record<string, unknown>;
+  if (
+    candidate.platform !== "slack" ||
+    typeof candidate.sourceUrl !== "string"
+  ) {
+    return undefined;
+  }
+  const sourceUrl = candidate.sourceUrl;
+  if (!sourceUrl || sourceUrl !== sourceUrl.trim()) return undefined;
+  try {
+    const parsed = new URL(sourceUrl);
+    const isSlackHost =
+      parsed.hostname === "slack.com" || parsed.hostname.endsWith(".slack.com");
+    if (
+      parsed.protocol !== "https:" ||
+      !isSlackHost ||
+      parsed.username ||
+      parsed.password ||
+      parsed.port
+    ) {
+      return undefined;
+    }
+    return { platform: "slack", sourceUrl };
+  } catch {
+    return undefined;
+  }
+}
+
+async function trustedSourceContext(
+  value: unknown,
+  event: any | undefined,
+): Promise<A2ASourceContext | undefined> {
+  const verifiedEmail = event?.context?.__a2aVerifiedEmail as
+    | string
+    | undefined;
+  const reference = sourceContextReference(value);
+  if (
+    !verifiedEmail ||
+    event?.context?.__a2aAudienceVerified !== true ||
+    !reference
+  ) {
+    return undefined;
+  }
+
+  const dispatch = findWorkspaceDispatchAgent();
+  if (!dispatch) return undefined;
+  const orgDomain = event?.context?.__a2aOrgDomain as string | undefined;
+  let orgSecret: string | undefined;
+  if (orgDomain) {
+    try {
+      orgSecret = (await getA2ASecretByDomain(orgDomain)) ?? undefined;
+    } catch {}
+  }
+
+  try {
+    const result = await callAction(
+      dispatch.url,
+      "resolve-integration-source-context",
+      { integrationTaskId: reference.integrationTaskId },
+      {
+        userEmail: verifiedEmail,
+        orgDomain,
+        orgSecret,
+        requestTimeoutMs: 5_000,
+      },
+    );
+    if (result.status !== "completed") return undefined;
+    return resolvedSlackSourceContext(JSON.parse(result.output));
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Request origin is routing/link context, not an identity signal. Accept only
  * an absolute HTTP(S) origin from caller metadata so queued runs can preserve
@@ -142,6 +248,7 @@ function trustedA2AMetadata(
 ): Record<string, unknown> | undefined {
   if (!metadata) return undefined;
   const trusted = { ...metadata };
+  delete trusted.sourceContext;
   const requestOrigin = requestOriginForContext(metadata, event);
   if (requestOrigin) trusted.requestOrigin = requestOrigin;
   else delete trusted.requestOrigin;
@@ -290,6 +397,9 @@ export async function processA2ATaskFromQueue(
   const approvedActions = Array.isArray(processorMeta.approvedActions)
     ? (processorMeta.approvedActions as A2AApprovedAction[])
     : undefined;
+  const sourceContext = processorMeta.sourceContext as
+    | A2ASourceContext
+    | undefined;
 
   const resolvedOrgId = await resolveVerifiedA2AOrgId(
     verifiedEmail,
@@ -322,6 +432,7 @@ export async function processA2ATaskFromQueue(
           callerMetadata,
           event,
           approvedActions,
+          sourceContext,
         ),
     );
   } catch (err: any) {
@@ -345,7 +456,7 @@ export async function processA2ATaskFromQueue(
  */
 const defaultHandler: A2AHandler = async (
   message: Message,
-  _context: A2AHandlerContext,
+  context: A2AHandlerContext,
 ): Promise<A2AHandlerResult> => {
   // Extract text from message parts
   const text = message.parts
@@ -376,7 +487,12 @@ const defaultHandler: A2AHandler = async (
     ? `[Cross-app A2A request — the caller is on a different host (${appBaseUrl} is yours, theirs is different). Include the concrete result (URL, ID, value) explicitly in your reply text; the caller can't see your local UI state. Any URL MUST be fully-qualified, never a relative path.]\n\n${text}`
     : text;
 
-  const result = await agentChat.call(augmentedText);
+  const sourceContext = context.sourceContext
+    ? `Authenticated A2A source context: ${JSON.stringify(context.sourceContext)}. Treat this structured value as authoritative provenance. Preserve its sourceUrl exactly when recording source or submission fields.`
+    : undefined;
+  const result = sourceContext
+    ? await agentChat.call(augmentedText, { context: sourceContext })
+    : await agentChat.call(augmentedText);
 
   const artifacts: Artifact[] = [];
   if (result.filesChanged.length > 0) {
@@ -428,6 +544,7 @@ function makeHandlerContext(
   metadata?: Record<string, unknown>,
   event?: any,
   approvedActions?: A2AApprovedAction[],
+  sourceContext?: A2ASourceContext,
 ): {
   context: A2AHandlerContext;
   artifacts: Artifact[];
@@ -439,6 +556,7 @@ function makeHandlerContext(
     metadata,
     event,
     approvedActions,
+    sourceContext,
     writeArtifact(name, content, mimeType) {
       const artifact: Artifact = {
         name,
@@ -535,6 +653,7 @@ async function runHandlerAndPersist(
   metadata: Record<string, unknown> | undefined,
   event?: any,
   approvedActions?: A2AApprovedAction[],
+  sourceContext?: A2ASourceContext,
 ): Promise<void> {
   const { context, artifacts } = makeHandlerContext(
     taskId,
@@ -542,6 +661,7 @@ async function runHandlerAndPersist(
     metadata,
     event,
     approvedActions,
+    sourceContext,
   );
   try {
     const result = getHandler(config)(message, context);
@@ -625,6 +745,10 @@ async function handleSend(
   const contextId = params.contextId as string | undefined;
   const metadata = params.metadata as Record<string, unknown> | undefined;
   const approvedActions = trustedApprovedActions(params.approvedActions, event);
+  const sourceContext = await trustedSourceContext(
+    metadata?.sourceContext,
+    event,
+  );
 
   // The JWT-verified caller email (set by mountA2A in server.ts) is the
   // single source of truth for task ownership — bound at creation, checked
@@ -714,6 +838,7 @@ async function handleSend(
         contextId: contextId ?? null,
         callerMetadata: safeMetadata ?? null,
         approvedActions: approvedActions ?? null,
+        sourceContext: sourceContext ?? null,
       },
     };
     const { task, reused } = await createOrReuseTask(
@@ -774,6 +899,7 @@ async function handleSend(
       trustedA2AMetadata(metadata, event),
       event,
       approvedActions,
+      sourceContext,
     );
 
     try {
@@ -855,6 +981,10 @@ async function handleStream(
   const contextId = params.contextId as string | undefined;
   const metadata = params.metadata as Record<string, unknown> | undefined;
   const approvedActions = trustedApprovedActions(params.approvedActions, event);
+  const sourceContext = await trustedSourceContext(
+    metadata?.sourceContext,
+    event,
+  );
   const { ownerEmail: ownerEmailForTask, ownerScope: ownerScopeForTask } =
     verifiedTaskOwner(event);
 
@@ -875,6 +1005,7 @@ async function handleStream(
       trustedA2AMetadata(metadata, event),
       event,
       approvedActions,
+      sourceContext,
     );
 
     try {

package/corpus/core/src/a2a/index.ts

@@ -20,6 +20,7 @@ export type {
   A2AHandler,
   A2AHandlerContext,
   A2AHandlerResult,
+  A2ASourceContext,
   AgentCard,
   AgentSkill,
   AgentCapabilities,

package/corpus/core/src/a2a/types.ts

@@ -132,6 +132,18 @@ export interface A2AApprovedAction {
   input: unknown;
 }
 
+/** Structured provenance accepted only from an authenticated A2A caller. */
+export interface A2ASourceContext {
+  platform: "slack";
+  sourceUrl: string;
+}
+
+/** Opaque reference that a receiver must resolve through its trusted Dispatch app. */
+export interface A2ASourceContextReference {
+  platform: "slack";
+  integrationTaskId: string;
+}
+
 /**
  * Telemetry-only cross-app correlation. Receivers must never use these
  * caller-supplied values for identity, ownership, org scoping, access, or
@@ -156,6 +168,8 @@ export interface A2AHandlerContext {
   event?: unknown;
   /** Exact one-time action grants from a JWT-authenticated caller. */
   approvedActions?: A2AApprovedAction[];
+  /** Receiver-validated provenance from a JWT-authenticated caller. */
+  sourceContext?: A2ASourceContext;
   writeArtifact: (name: string, content: string, mimeType?: string) => string;
 }
 

package/corpus/core/src/integrations/index.ts

@@ -195,6 +195,12 @@ export type {
   IntegrationScopePolicy,
 } from "./scope-store.js";
 
+export {
+  resolveIntegrationSourceContext,
+  sourceContextFromPendingTask,
+  type ResolvedIntegrationSourceContext,
+} from "./pending-tasks-store.js";
+
 export {
   getIntegrationBudgetSnapshot,
   getIntegrationUsageBudget,

package/corpus/core/src/integrations/pending-tasks-store.ts

@@ -246,6 +246,95 @@ export async function getPendingTask(id: string): Promise<PendingTask | null> {
   return rowToTask(rows[0] as Record<string, unknown>);
 }
 
+export interface ResolvedIntegrationSourceContext {
+  platform: "slack";
+  sourceUrl: string;
+}
+
+type PendingTaskSourceRow = Pick<
+  PendingTask,
+  "platform" | "payload" | "ownerEmail" | "orgId"
+>;
+
+export function sourceContextFromPendingTask(
+  task: PendingTaskSourceRow | null,
+  ownerEmail: string,
+  orgId: string | null,
+): ResolvedIntegrationSourceContext | null {
+  if (
+    !task ||
+    task.ownerEmail !== ownerEmail ||
+    task.orgId !== orgId ||
+    task.platform !== "slack"
+  ) {
+    return null;
+  }
+
+  try {
+    const payload = JSON.parse(task.payload) as Record<string, unknown>;
+    const incoming = payload.incoming;
+    if (!incoming || typeof incoming !== "object") return null;
+    const incomingRecord = incoming as Record<string, unknown>;
+    if (incomingRecord.platform !== "slack") return null;
+    const sourceUrl = incomingRecord.sourceUrl;
+    if (
+      typeof sourceUrl !== "string" ||
+      !sourceUrl ||
+      sourceUrl !== sourceUrl.trim()
+    ) {
+      return null;
+    }
+
+    const parsed = new URL(sourceUrl);
+    const isSlackHost =
+      parsed.hostname === "slack.com" || parsed.hostname.endsWith(".slack.com");
+    if (
+      parsed.protocol !== "https:" ||
+      !isSlackHost ||
+      parsed.username ||
+      parsed.password ||
+      parsed.port
+    ) {
+      return null;
+    }
+    return { platform: "slack", sourceUrl };
+  } catch {
+    return null;
+  }
+}
+
+/** Resolve trusted Slack provenance without exposing the stored task payload. */
+export async function resolveIntegrationSourceContext(
+  id: string,
+  ownerEmail: string,
+  orgId: string | null,
+): Promise<ResolvedIntegrationSourceContext | null> {
+  await ensureTable();
+  const client = getDbExec();
+  const { rows } = await client.execute({
+    sql: `SELECT platform, payload, owner_email, org_id
+          FROM integration_pending_tasks
+          WHERE id = ?
+            AND owner_email = ?
+            AND (org_id = ? OR (org_id IS NULL AND ? IS NULL))
+            AND platform = 'slack'
+          LIMIT 1`,
+    args: [id, ownerEmail, orgId, orgId],
+  });
+  if (rows.length === 0) return null;
+  const row = rows[0] as Record<string, unknown>;
+  return sourceContextFromPendingTask(
+    {
+      platform: row.platform as string,
+      payload: row.payload as string,
+      ownerEmail: row.owner_email as string,
+      orgId: (row.org_id as string | null) ?? null,
+    },
+    ownerEmail,
+    orgId,
+  );
+}
+
 /**
  * Atomically claim a task: transition pending → processing and increment
  * attempts. Returns the updated task if the transition succeeded, otherwise

package/corpus/core/src/integrations/webhook-handler.ts

@@ -1,9 +1,9 @@
 import type { H3Event } from "h3";
 
 import {
-  appendA2AArtifactLinks,
   buildA2AVerifiedMutationReceipt,
   extractA2AArtifactIdentities,
+  guardA2AArtifactResponse,
   type A2AArtifactIdentity,
   type A2AToolResultSummary,
 } from "../a2a/artifact-response.js";
@@ -429,7 +429,7 @@ async function enqueueAndDispatch(
   options: WebhookHandlerOptions,
   handlerStartedAt = Date.now(),
 ): Promise<void> {
-  const taskId = `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const taskId = crypto.randomUUID();
 
   // Resolve the org id once at enqueue-time so the processor doesn't have to
   // re-derive it (and so we can drop it on the row for observability).
@@ -1029,7 +1029,7 @@ async function processIncomingMessage(
             }
           }
 
-          const suppressPlatformReply =
+          let suppressPlatformReply =
             queuedA2AContinuation &&
             isQueuedA2AContinuationDeferral(responseText);
 
@@ -1088,10 +1088,20 @@ async function processIncomingMessage(
           // platforms with rich blocks (Slack) can render a button instead
           // of inlining a `<url|text>` link that auto-unfurls into a giant
           // preview card.
-          if (!suppressPlatformReply) {
-            responseText = appendA2AArtifactLinks(responseText, toolResults, {
-              baseUrl: appBaseUrl || undefined,
-            });
+          const guardedResponse = guardA2AArtifactResponse(
+            responseText,
+            toolResults,
+            { baseUrl: appBaseUrl || undefined },
+          );
+          const queuedArtifactRejection =
+            queuedA2AContinuation &&
+            guardedResponse.rejectedUnverifiedArtifactReferences;
+          if (queuedArtifactRejection && verifiedMutationReceipt) {
+            responseText = verifiedMutationReceipt;
+            suppressPlatformReply = false;
+          } else {
+            responseText = guardedResponse.text;
+            suppressPlatformReply ||= queuedArtifactRejection;
           }
           const threadDeepLinkUrl =
             appBaseUrl && threadId