@agent-native/core 0.114.3 → 0.114.5

package/src/integrations/pending-tasks-store.ts

@@ -246,6 +246,95 @@ export async function getPendingTask(id: string): Promise<PendingTask | null> {
   return rowToTask(rows[0] as Record<string, unknown>);
 }
 
+export interface ResolvedIntegrationSourceContext {
+  platform: "slack";
+  sourceUrl: string;
+}
+
+type PendingTaskSourceRow = Pick<
+  PendingTask,
+  "platform" | "payload" | "ownerEmail" | "orgId"
+>;
+
+export function sourceContextFromPendingTask(
+  task: PendingTaskSourceRow | null,
+  ownerEmail: string,
+  orgId: string | null,
+): ResolvedIntegrationSourceContext | null {
+  if (
+    !task ||
+    task.ownerEmail !== ownerEmail ||
+    task.orgId !== orgId ||
+    task.platform !== "slack"
+  ) {
+    return null;
+  }
+
+  try {
+    const payload = JSON.parse(task.payload) as Record<string, unknown>;
+    const incoming = payload.incoming;
+    if (!incoming || typeof incoming !== "object") return null;
+    const incomingRecord = incoming as Record<string, unknown>;
+    if (incomingRecord.platform !== "slack") return null;
+    const sourceUrl = incomingRecord.sourceUrl;
+    if (
+      typeof sourceUrl !== "string" ||
+      !sourceUrl ||
+      sourceUrl !== sourceUrl.trim()
+    ) {
+      return null;
+    }
+
+    const parsed = new URL(sourceUrl);
+    const isSlackHost =
+      parsed.hostname === "slack.com" || parsed.hostname.endsWith(".slack.com");
+    if (
+      parsed.protocol !== "https:" ||
+      !isSlackHost ||
+      parsed.username ||
+      parsed.password ||
+      parsed.port
+    ) {
+      return null;
+    }
+    return { platform: "slack", sourceUrl };
+  } catch {
+    return null;
+  }
+}
+
+/** Resolve trusted Slack provenance without exposing the stored task payload. */
+export async function resolveIntegrationSourceContext(
+  id: string,
+  ownerEmail: string,
+  orgId: string | null,
+): Promise<ResolvedIntegrationSourceContext | null> {
+  await ensureTable();
+  const client = getDbExec();
+  const { rows } = await client.execute({
+    sql: `SELECT platform, payload, owner_email, org_id
+          FROM integration_pending_tasks
+          WHERE id = ?
+            AND owner_email = ?
+            AND (org_id = ? OR (org_id IS NULL AND ? IS NULL))
+            AND platform = 'slack'
+          LIMIT 1`,
+    args: [id, ownerEmail, orgId, orgId],
+  });
+  if (rows.length === 0) return null;
+  const row = rows[0] as Record<string, unknown>;
+  return sourceContextFromPendingTask(
+    {
+      platform: row.platform as string,
+      payload: row.payload as string,
+      ownerEmail: row.owner_email as string,
+      orgId: (row.org_id as string | null) ?? null,
+    },
+    ownerEmail,
+    orgId,
+  );
+}
+
 /**
  * Atomically claim a task: transition pending → processing and increment
  * attempts. Returns the updated task if the transition succeeded, otherwise

package/src/integrations/webhook-handler.ts

@@ -1,9 +1,9 @@
 import type { H3Event } from "h3";
 
 import {
-  appendA2AArtifactLinks,
   buildA2AVerifiedMutationReceipt,
   extractA2AArtifactIdentities,
+  guardA2AArtifactResponse,
   type A2AArtifactIdentity,
   type A2AToolResultSummary,
 } from "../a2a/artifact-response.js";
@@ -429,7 +429,7 @@ async function enqueueAndDispatch(
   options: WebhookHandlerOptions,
   handlerStartedAt = Date.now(),
 ): Promise<void> {
-  const taskId = `task-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const taskId = crypto.randomUUID();
 
   // Resolve the org id once at enqueue-time so the processor doesn't have to
   // re-derive it (and so we can drop it on the row for observability).
@@ -1029,7 +1029,7 @@ async function processIncomingMessage(
             }
           }
 
-          const suppressPlatformReply =
+          let suppressPlatformReply =
             queuedA2AContinuation &&
             isQueuedA2AContinuationDeferral(responseText);
 
@@ -1088,10 +1088,20 @@ async function processIncomingMessage(
           // platforms with rich blocks (Slack) can render a button instead
           // of inlining a `<url|text>` link that auto-unfurls into a giant
           // preview card.
-          if (!suppressPlatformReply) {
-            responseText = appendA2AArtifactLinks(responseText, toolResults, {
-              baseUrl: appBaseUrl || undefined,
-            });
+          const guardedResponse = guardA2AArtifactResponse(
+            responseText,
+            toolResults,
+            { baseUrl: appBaseUrl || undefined },
+          );
+          const queuedArtifactRejection =
+            queuedA2AContinuation &&
+            guardedResponse.rejectedUnverifiedArtifactReferences;
+          if (queuedArtifactRejection && verifiedMutationReceipt) {
+            responseText = verifiedMutationReceipt;
+            suppressPlatformReply = false;
+          } else {
+            responseText = guardedResponse.text;
+            suppressPlatformReply ||= queuedArtifactRejection;
           }
           const threadDeepLinkUrl =
             appBaseUrl && threadId

package/src/scripts/call-agent.ts

@@ -10,6 +10,8 @@ import { invokeAgentAction } from "../a2a/invoke.js";
 import type {
   A2AApprovedAction,
   A2ACorrelationMetadata,
+  A2ASourceContext,
+  A2ASourceContextReference,
   Task,
 } from "../a2a/types.js";
 import {
@@ -100,26 +102,65 @@ function getIntegrationCallTimeoutMs(): number | undefined {
   return DEFAULT_SERVERLESS_INTEGRATION_A2A_TIMEOUT_MS;
 }
 
-function integrationSourceContextHint(): string {
+interface IntegrationSourceContext {
+  reference: A2ASourceContextReference;
+  hint: A2ASourceContext;
+}
+
+function integrationSourceContext(): IntegrationSourceContext | undefined {
   const integration = getIntegrationRequestContext();
   const incoming = integration?.incoming;
-  if (incoming?.platform !== "slack" || !incoming.sourceUrl) return "";
+  if (
+    !integration ||
+    incoming?.platform !== "slack" ||
+    !incoming.sourceUrl ||
+    !integration.taskId
+  ) {
+    return undefined;
+  }
+
+  const rawSourceUrl = incoming.sourceUrl;
+  if (rawSourceUrl !== rawSourceUrl.trim()) return undefined;
 
   try {
-    const sourceUrl = new URL(incoming.sourceUrl);
+    const sourceUrl = new URL(rawSourceUrl);
     const isSlackHost =
       sourceUrl.hostname === "slack.com" ||
       sourceUrl.hostname.endsWith(".slack.com");
-    if (sourceUrl.protocol !== "https:" || !isSlackHost) return "";
-    return (
-      `\n\n[Source Slack thread: ${sourceUrl.toString()} ` +
-      "Preserve this exact URL as request provenance when creating an intake record or other artifact.]"
-    );
+    if (
+      sourceUrl.protocol !== "https:" ||
+      !isSlackHost ||
+      sourceUrl.username ||
+      sourceUrl.password ||
+      sourceUrl.port
+    ) {
+      return undefined;
+    }
+    return {
+      reference: {
+        platform: "slack",
+        integrationTaskId: integration.taskId,
+      },
+      hint: {
+        platform: "slack",
+        sourceUrl: rawSourceUrl,
+      },
+    };
   } catch {
-    return "";
+    return undefined;
   }
 }
 
+function integrationSourceContextHint(
+  sourceContext: IntegrationSourceContext | undefined,
+): string {
+  if (!sourceContext) return "";
+  return (
+    `\n\n[Source Slack thread: ${sourceContext.hint.sourceUrl} ` +
+    "Compatibility hint only; this text is not authoritative. Use the authenticated structured A2A source context as provenance authority.]"
+  );
+}
+
 function formatDownstreamLlmCredentialFailure(
   agentName: string,
   value: unknown,
@@ -253,9 +294,10 @@ export async function run(
   // in handlers.ts) still emits fully-qualified URLs. This is belt-and-
   // suspenders with the receiver hint — but it works against any current
   // deployment, no redeploy required.
+  const sourceContext = integrationSourceContext();
   const messageWithHint = taskId
     ? ""
-    : `${message}${integrationSourceContextHint()}\n\n` +
+    : `${message}${integrationSourceContextHint(sourceContext)}\n\n` +
       `[Note: this request comes from another app via A2A. The caller cannot see your local UI, deck list, or navigation — only the literal text you put in your reply. ` +
       `If you create or reference a deck/document/design/dashboard, include its FULLY-QUALIFIED URL (e.g. ${agent.url}/deck/<id>) in your reply, not a relative path. ` +
       `Use only artifact IDs and URL paths returned by successful actions — never invent slugs, IDs, or hosts. ` +
@@ -432,6 +474,7 @@ export async function run(
           orgDomain: callerOrgDomain,
           orgSecret: callerOrgSecret,
           approvedActions,
+          ...(sourceContext ? { sourceContext: sourceContext.reference } : {}),
           contextId: context.threadId,
           correlation,
           idempotencyKey,
@@ -526,6 +569,7 @@ export async function run(
       orgDomain: domain,
       orgSecret,
       approvedActions,
+      ...(sourceContext ? { sourceContext: sourceContext.reference } : {}),
       contextId: context?.threadId,
       correlation,
       idempotencyKey,

package/src/server/agent-discovery.ts

@@ -689,6 +689,28 @@ async function discoverWorkspaceAgents(
     .filter((agent): agent is DiscoveredAgent => !!agent);
 }
 
+/** Resolve only the Dispatch app designated by the receiver's own manifest. */
+export function findWorkspaceDispatchAgent(): DiscoveredAgent | undefined {
+  const app = loadWorkspaceAppsManifest()?.find(
+    (candidate) => candidate.isDispatch === true,
+  );
+  if (!app) return undefined;
+
+  const builtin = BUILTIN_AGENTS.find((agent) => agent.id === "dispatch");
+  const url = workspaceAppUrl(app, builtin?.url);
+  if (!url) return undefined;
+  return {
+    id: app.id,
+    name: app.name,
+    description:
+      app.description ||
+      builtin?.description ||
+      `Workspace app mounted at ${app.path}`,
+    url,
+    color: builtin?.color || "#6B7280",
+  };
+}
+
 /**
  * Like `getBuiltinAgents`, but always returns the production URL — never the
  * env-resolved devUrl. Used by the resource seeder so that a one-time seed