@agent-native/core 0.125.0 → 0.127.1

package/dist/mcp/ask-app-task-handle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ask-app-task-handle.js","sourceRoot":"","sources":["../../src/mcp/ask-app-task-handle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAElE,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,CAAC;AACnC,MAAM,oBAAoB,GAAG,yCAAyC,CAAC;AAoBvE,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,GAAG,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,SAAS,CAAC,UAAkB;IACnC,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;SACpC,MAAM,CAAC,qCAAqC,CAAC;SAC7C,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC9C,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,KAAuC,CAAC;IACtD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,CAAC,aAAa,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACxD,OAAO,aAAa,EAAE,MAAM,KAAK,QAAQ,CAAC,MAAM,CAAC;AACnD,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAQ1C;IACC,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,IACE,CAAC,SAAS;QACV,CAAC,cAAc;QACf,CAAC,OAAO;QACR,CAAC,MAAM;QACP,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EACzB,CAAC;QACD,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,MAAM,GAA2B;QACrC,OAAO,EAAE,cAAc;QACvB,SAAS;QACT,cAAc;QACd,YAAY;QACZ,OAAO;QACP,KAAK,EAAE;YACL,GAAG,MAAM,CAAC,KAAK;YACf,GAAG,EAAE,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;SAC1C;QACD,MAAM;QACN,SAAS,EACP,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC7B,CAAC,MAAM,CAAC,gBAAgB,IAAI,kBAAkB,CAAC;KAClD,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC;SAC/B,kBAAkB,CAAC;QAClB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,kCAAkC;KACxC,CAAC;SACD,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,QAKC;IAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,kBAAkB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC;QAChE,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,cAAc,CACzD,MAAM,EACN,SAAS,CAAC,UAAU,CAAC,CACtB,CAAC;YACF,IACE,eAAe,CAAC,GAAG,KAAK,KAAK;gBAC7B,eAAe,CAAC,GAAG,KAAK,SAAS;gBACjC,eAAe,CAAC,GAAG,KAAK,kCAAkC,EAC1D,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACD,CAAC;YACrC,IACE,MAAM,CAAC,OAAO,KAAK,cAAc;gBACjC,MAAM,CAAC,SAAS,KAAK,SAAS;gBAC9B,MAAM,CAAC,cAAc,KAAK,cAAc;gBACxC,MAAM,CAAC,YAAY,KAAK,YAAY;gBACpC,MAAM,CAAC,OAAO,KAAK,OAAO;gBAC1B,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;gBACjC,CAAC,MAAM,CAAC,MAAM;gBACd,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;gBACpC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBACjD,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EACzB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;IACD,MAAM,aAAa,EAAE,CAAC;AACxB,CAAC","sourcesContent":["import { createHmac } from \"node:crypto\";\n\nimport { CompactEncrypt, compactDecrypt } from \"jose\";\n\nimport { getAuthSecret } from \"../server/better-auth-instance.js\";\n\nconst HANDLE_VERSION = 1;\nconst HANDLE_TTL_SECONDS = 60 * 60;\nconst INVALID_HANDLE_ERROR = \"Invalid or expired ask_app task handle.\";\n\nexport interface AskAppTaskHandleRoute {\n  app: string;\n  origin: string;\n  routedVia: \"local\" | \"a2a\";\n  requestOrigin?: string;\n}\n\ninterface AskAppTaskHandleClaims {\n  version: number;\n  issuerApp: string;\n  issuerAudience: string;\n  organization: string;\n  subject: string;\n  route: AskAppTaskHandleRoute;\n  taskId: string;\n  expiresAt: number;\n}\n\nfunction normalizedIdentity(value: string): string {\n  return value.trim().toLowerCase();\n}\n\nfunction normalizedAudience(value: string): string | null {\n  const url = validHttpUrl(value);\n  if (!url || url.search || url.hash) return null;\n  const pathname = url.pathname.replace(/\\/+$/, \"\");\n  return `${url.origin}${pathname}`;\n}\n\nfunction rootSecrets(): string[] {\n  const a2a = process.env.A2A_SECRET?.trim();\n  const auth = getAuthSecret();\n  return [...new Set([a2a, auth].filter((value): value is string => !!value))];\n}\n\nfunction handleKey(rootSecret: string): Uint8Array {\n  return createHmac(\"sha256\", rootSecret)\n    .update(\"agent-native:ask-app-task-handle:v1\")\n    .digest();\n}\n\nfunction validHttpUrl(value: string): URL | null {\n  try {\n    const url = new URL(value);\n    if (![\"http:\", \"https:\"].includes(url.protocol)) return null;\n    if (url.username || url.password) return null;\n    return url;\n  } catch {\n    return null;\n  }\n}\n\nfunction validRoute(value: unknown): value is AskAppTaskHandleRoute {\n  if (!value || typeof value !== \"object\") return false;\n  const route = value as Partial<AskAppTaskHandleRoute>;\n  if (typeof route.app !== \"string\" || !route.app.trim()) return false;\n  if (route.routedVia !== \"local\" && route.routedVia !== \"a2a\") return false;\n  if (typeof route.origin !== \"string\") return false;\n  const endpoint = validHttpUrl(route.origin);\n  if (!endpoint) return false;\n  if (route.requestOrigin == null) return true;\n  if (typeof route.requestOrigin !== \"string\") return false;\n  const requestOrigin = validHttpUrl(route.requestOrigin);\n  return requestOrigin?.origin === endpoint.origin;\n}\n\nfunction invalidHandle(): Error {\n  return new Error(INVALID_HANDLE_ERROR);\n}\n\nexport async function signAskAppTaskHandle(params: {\n  issuerApp: string;\n  issuerAudience: string;\n  organization: string;\n  subject: string;\n  route: AskAppTaskHandleRoute;\n  taskId: string;\n  expiresInSeconds?: number;\n}): Promise<string> {\n  const issuerApp = normalizedIdentity(params.issuerApp);\n  const issuerAudience = normalizedAudience(params.issuerAudience);\n  const organization = normalizedIdentity(params.organization);\n  const subject = normalizedIdentity(params.subject);\n  const taskId = params.taskId.trim();\n  if (\n    !issuerApp ||\n    !issuerAudience ||\n    !subject ||\n    !taskId ||\n    !validRoute(params.route)\n  ) {\n    throw invalidHandle();\n  }\n\n  const claims: AskAppTaskHandleClaims = {\n    version: HANDLE_VERSION,\n    issuerApp,\n    issuerAudience,\n    organization,\n    subject,\n    route: {\n      ...params.route,\n      app: normalizedIdentity(params.route.app),\n    },\n    taskId,\n    expiresAt:\n      Math.floor(Date.now() / 1000) +\n      (params.expiresInSeconds ?? HANDLE_TTL_SECONDS),\n  };\n  const payload = new TextEncoder().encode(JSON.stringify(claims));\n  return new CompactEncrypt(payload)\n    .setProtectedHeader({\n      alg: \"dir\",\n      enc: \"A256GCM\",\n      typ: \"agent-native-ask-app-task-handle\",\n    })\n    .encrypt(handleKey(rootSecrets()[0]));\n}\n\nexport async function verifyAskAppTaskHandle(\n  handle: string,\n  expected: {\n    issuerApp: string;\n    issuerAudience: string;\n    organization: string;\n    subject: string;\n  },\n): Promise<{ route: AskAppTaskHandleRoute; taskId: string }> {\n  const issuerApp = normalizedIdentity(expected.issuerApp);\n  const issuerAudience = normalizedAudience(expected.issuerAudience);\n  const organization = normalizedIdentity(expected.organization);\n  const subject = normalizedIdentity(expected.subject);\n  if (!handle.trim() || !issuerApp || !issuerAudience || !subject) {\n    throw invalidHandle();\n  }\n\n  for (const rootSecret of rootSecrets()) {\n    try {\n      const { plaintext, protectedHeader } = await compactDecrypt(\n        handle,\n        handleKey(rootSecret),\n      );\n      if (\n        protectedHeader.alg !== \"dir\" ||\n        protectedHeader.enc !== \"A256GCM\" ||\n        protectedHeader.typ !== \"agent-native-ask-app-task-handle\"\n      ) {\n        continue;\n      }\n      const claims = JSON.parse(\n        new TextDecoder().decode(plaintext),\n      ) as Partial<AskAppTaskHandleClaims>;\n      if (\n        claims.version !== HANDLE_VERSION ||\n        claims.issuerApp !== issuerApp ||\n        claims.issuerAudience !== issuerAudience ||\n        claims.organization !== organization ||\n        claims.subject !== subject ||\n        typeof claims.taskId !== \"string\" ||\n        !claims.taskId ||\n        typeof claims.expiresAt !== \"number\" ||\n        claims.expiresAt <= Math.floor(Date.now() / 1000) ||\n        !validRoute(claims.route)\n      ) {\n        continue;\n      }\n      return { route: claims.route, taskId: claims.taskId };\n    } catch {\n      // All handle failures are deliberately indistinguishable to callers.\n    }\n  }\n  throw invalidHandle();\n}\n"]}

package/dist/mcp/builtin-tools.d.ts

@@ -21,9 +21,9 @@
  * `open_app` / `create_workspace_app` return an **absolute** URL on the
  * *target* app's origin when it differs from this app (so a workspace link
  * lands in the right app), and a relative path for the same app / standalone.
- * `ask_app` routes to a *different* workspace app over A2A when possible and
- * reports `routedVia: "a2a"`; otherwise it answers locally
- * (`routedVia: "local"`) and never falsely claims cross-app delegation.
+ * `ask_app` routes a known *different* workspace app over A2A and reports
+ * `routedVia: "a2a"`; unknown cross-app targets fail closed instead of running
+ * on the current app. Same-app requests report `routedVia: "local"`.
  * | `list_templates`      | none         | `{ templates: [...] }` (allow-list only) |
  *
  * Node-only at call time (workspace resolution + scaffolding use `fs`), but

package/dist/mcp/builtin-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtin-tools.d.ts","sourceRoot":"","sources":["../../src/mcp/builtin-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAKhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AA6DnD,KAAK,iBAAiB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AA22ChE;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS,EACjB,WAAW,CAAC,EAAE,iBAAiB,GAC9B,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAU7B"}
+{"version":3,"file":"builtin-tools.d.ts","sourceRoot":"","sources":["../../src/mcp/builtin-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAahE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AA6DnD,KAAK,iBAAiB,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAm9ChE;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS,EACjB,WAAW,CAAC,EAAE,iBAAiB,GAC9B,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAU7B"}

package/dist/mcp/builtin-tools.js

@@ -21,9 +21,9 @@
  * `open_app` / `create_workspace_app` return an **absolute** URL on the
  * *target* app's origin when it differs from this app (so a workspace link
  * lands in the right app), and a relative path for the same app / standalone.
- * `ask_app` routes to a *different* workspace app over A2A when possible and
- * reports `routedVia: "a2a"`; otherwise it answers locally
- * (`routedVia: "local"`) and never falsely claims cross-app delegation.
+ * `ask_app` routes a known *different* workspace app over A2A and reports
+ * `routedVia: "a2a"`; unknown cross-app targets fail closed instead of running
+ * on the current app. Same-app requests report `routedVia: "local"`.
  * | `list_templates`      | none         | `{ templates: [...] }` (allow-list only) |
  *
  * Node-only at call time (workspace resolution + scaffolding use `fs`), but
@@ -32,7 +32,9 @@
  */
 import { getConfiguredAppBasePath } from "../server/app-base-path.js";
 import { buildDeepLink } from "../server/deep-link.js";
+import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
 import { MCP_APP_CHAT_BRIDGE_QUERY_PARAM } from "../shared/embed-auth.js";
+import { signAskAppTaskHandle, verifyAskAppTaskHandle, } from "./ask-app-task-handle.js";
 import { embedApp } from "./embed-app.js";
 import { fetchOrgApps } from "./org-directory.js";
 /**
@@ -145,6 +147,26 @@ function selfA2AEndpointUrl(requestMeta) {
     const basePath = requestMeta?.basePath || getConfiguredAppBasePath();
     return agentNativeA2AEndpoint(`${origin}${basePath}`);
 }
+function askAppIssuerAudience(requestMeta) {
+    const origin = requestMeta?.origin?.replace(/\/+$/, "");
+    if (!origin)
+        return null;
+    try {
+        const originUrl = new URL(origin);
+        if (!["http:", "https:"].includes(originUrl.protocol) ||
+            originUrl.username ||
+            originUrl.password) {
+            return null;
+        }
+        const basePath = requestMeta?.basePath || getConfiguredAppBasePath();
+        const audience = new URL(basePath || "/", `${originUrl.origin}/`);
+        const pathname = audience.pathname.replace(/\/+$/, "");
+        return `${audience.origin}${pathname}`;
+    }
+    catch {
+        return null;
+    }
+}
 function boundedAskAppWaitMs(raw) {
     if (raw == null || raw === "")
         return ASK_APP_DEFAULT_INLINE_WAIT_MS;
@@ -169,13 +191,14 @@ function taskText(task) {
         .join("\n")
         .trim() ?? "");
 }
-function askAppTaskResult(route, task) {
+function askAppTaskResult(route, task, taskHandle) {
     const status = taskState(task);
     const response = taskText(task);
     const base = {
         app: route.app,
         routedVia: route.routedVia,
         taskId: task.id,
+        ...(taskHandle ? { taskHandle } : {}),
         status,
         ...(route.note ? { note: route.note } : {}),
     };
@@ -206,10 +229,16 @@ function askAppTaskResult(route, task) {
         pollAfterMs: ASK_APP_POLL_INTERVAL_MS,
         poll: {
             tool: "ask_app_status",
-            arguments: { app: route.app, taskId: task.id },
+            arguments: {
+                app: route.app,
+                taskId: task.id,
+                ...(taskHandle ? { taskHandle } : {}),
+            },
         },
         message: `ask_app is still ${status}. Call ask_app_status with ` +
-            `taskId "${task.id}" to retrieve the final response.`,
+            (taskHandle
+                ? "the returned taskHandle to retrieve the final response."
+                : `taskId "${task.id}" to retrieve the final response.`),
     };
 }
 /**
@@ -311,7 +340,7 @@ async function waitForA2ATask(client, initialTask, deadline) {
     }
     return current;
 }
-async function submitAskAppA2ATask(route, message, maxWaitMs, approvedActions) {
+async function submitAskAppA2ATask(route, issuerApp, issuerAudience, message, maxWaitMs, approvedActions) {
     const deadline = maxWaitMs > 0 ? Date.now() + maxWaitMs : undefined;
     const { client, metadata } = await createA2AClientForAskApp(route.origin, route.requestOrigin, deadline);
     const task = await client.send({
@@ -323,16 +352,25 @@ async function submitAskAppA2ATask(route, message, maxWaitMs, approvedActions) {
         ...(approvedActions?.length ? { approvedActions } : {}),
     });
     const finalOrRunning = await waitForA2ATask(client, task, deadline);
-    return askAppTaskResult(route, finalOrRunning);
+    const subject = typeof metadata.userEmail === "string" ? metadata.userEmail : "anonymous";
+    const taskHandle = await signAskAppTaskHandle({
+        issuerApp,
+        issuerAudience,
+        organization: getRequestOrgId() ?? "",
+        subject,
+        route,
+        taskId: task.id,
+    });
+    return askAppTaskResult(route, finalOrRunning, taskHandle);
 }
-async function fetchAskAppA2ATask(route, taskId) {
+async function fetchAskAppA2ATask(route, taskId, taskHandle) {
     const { client } = await createA2AClientForAskApp(route.origin);
     const maxAttempts = ASK_APP_STATUS_RETRY_DELAYS_MS.length + 1;
     for (let attempt = 0; attempt <= ASK_APP_STATUS_RETRY_DELAYS_MS.length; attempt++) {
         const startedAt = Date.now();
         try {
             const task = await client.getTask(taskId);
-            return askAppTaskResult(route, task);
+            return askAppTaskResult(route, task, taskHandle);
         }
         catch (err) {
             const delayMs = ASK_APP_STATUS_RETRY_DELAYS_MS[attempt];
@@ -358,7 +396,7 @@ async function fetchAskAppA2ATask(route, taskId) {
                 throw err;
             }
             if (delayMs == null) {
-                return askAppStatusReadUnavailableResult(route, taskId, errorCategory, maxAttempts);
+                return askAppStatusReadUnavailableResult(route, taskId, errorCategory, maxAttempts, taskHandle);
             }
             await new Promise((resolve) => setTimeout(resolve, delayMs));
         }
@@ -405,11 +443,12 @@ function askAppStatusOriginHost(origin) {
         return "unknown";
     }
 }
-function askAppStatusReadUnavailableResult(route, taskId, errorCategory, attempts) {
+function askAppStatusReadUnavailableResult(route, taskId, errorCategory, attempts, taskHandle) {
     return {
         app: route.app,
         routedVia: route.routedVia,
         taskId,
+        ...(taskHandle ? { taskHandle } : {}),
         status: "unknown",
         statusRead: "unavailable",
         retryable: true,
@@ -418,11 +457,17 @@ function askAppStatusReadUnavailableResult(route, taskId, errorCategory, attempt
         pollAfterMs: ASK_APP_POLL_INTERVAL_MS,
         poll: {
             tool: "ask_app_status",
-            arguments: { app: route.app, taskId },
+            arguments: {
+                app: route.app,
+                taskId,
+                ...(taskHandle ? { taskHandle } : {}),
+            },
         },
         message: "The durable ask_app task status could not be read after bounded retries. " +
             "The task may still be running or completed. Retry ask_app_status " +
-            "with the same app and taskId; do not resubmit ask_app.",
+            (taskHandle
+                ? "with the same taskHandle; do not resubmit ask_app."
+                : "with the same app and taskId; do not resubmit ask_app."),
     };
 }
 /**
@@ -487,10 +532,13 @@ function listAppsTool(config, requestMeta) {
                     livePort = 0;
                 }
             }
-            const selfId = (config.appId ?? "").toLowerCase();
+            const selfId = currentAppId(config);
             const isSelf = (id) => !!liveOrigin &&
                 (!ws.isWorkspace || (!!selfId && id.toLowerCase() === selfId));
-            const apps = ws.apps.map((a) => isSelf(a.id)
+            const resolvedApps = ws.isWorkspace
+                ? ws.apps
+                : ws.apps.map((app) => ({ ...app, id: selfId, name: config.name }));
+            const apps = resolvedApps.map((a) => isSelf(a.id)
                 ? {
                     id: a.id,
                     url: liveOrigin,
@@ -778,12 +826,15 @@ function createEmbedSessionTool(requestMeta) {
  */
 async function routeAskOverA2A(origin, id, message, options) {
     if (options?.durable) {
+        if (!options.issuerApp || !options.issuerAudience) {
+            throw new Error("ask_app durable routing requires an issuer app id and audience.");
+        }
         return submitAskAppA2ATask({
             app: id,
             origin: agentNativeA2AEndpoint(origin),
             routedVia: "a2a",
             requestOrigin: options.requestOrigin ?? origin,
-        }, message, options.maxWaitMs ?? ASK_APP_DEFAULT_INLINE_WAIT_MS, options.approvedActions);
+        }, options.issuerApp, options.issuerAudience, message, options.maxWaitMs ?? ASK_APP_DEFAULT_INLINE_WAIT_MS, options.approvedActions);
     }
     const { callAgent } = await import("../a2a/client.js");
     const { resolveA2ACallerAuth } = await import("../a2a/caller-auth.js");
@@ -854,8 +905,8 @@ function askAppTool(config, requestMeta) {
             "param is optional (defaults to this app). When 'app' names a " +
             "different workspace app it is routed there over A2A; the result's " +
             "'routedVia' field reports whether it ran cross-app or locally. " +
-            "On hosted MCP, long tasks may return a durable taskId instead of a " +
-            "final response; call ask_app_status with that taskId until completed.", {
+            "On hosted MCP, long tasks may return a durable taskHandle instead of " +
+            "a final response; pass that handle to ask_app_status until completed.", {
             app: {
                 type: "string",
                 description: "App id to route to (optional in a single-app project)",
@@ -866,11 +917,11 @@ function askAppTool(config, requestMeta) {
             },
             async: {
                 type: "boolean",
-                description: "When true, start a durable task and return immediately with a taskId.",
+                description: "When true, start a durable task and return immediately with a taskHandle and legacy taskId.",
             },
             maxWaitMs: {
                 type: "number",
-                description: "Maximum time to wait inline before returning a taskId. Hosted MCP clamps this to 25000ms.",
+                description: "Maximum time to wait inline before returning a taskHandle. Hosted MCP clamps this to 25000ms.",
             },
             approvedActions: {
                 type: "array",
@@ -892,6 +943,10 @@ function askAppTool(config, requestMeta) {
             const requestedApp = String(args.app ?? "").trim();
             const selfId = currentAppId(config);
             const useDurableA2A = Boolean(requestMeta?.origin);
+            const issuerAudience = askAppIssuerAudience(requestMeta);
+            if (useDurableA2A && !issuerAudience) {
+                throw new Error("ask_app durable routing requires a valid HTTP(S) issuer audience.");
+            }
             const maxWaitMs = isExplicitAsyncAsk(args.async)
                 ? 0
                 : boundedAskAppWaitMs(args.maxWaitMs);
@@ -907,6 +962,8 @@ function askAppTool(config, requestMeta) {
                 try {
                     return await routeAskOverA2A(targetApp.origin, targetApp.id, message, {
                         durable: useDurableA2A,
+                        issuerApp: selfId,
+                        issuerAudience: issuerAudience ?? undefined,
                         maxWaitMs,
                         requestOrigin: targetApp.origin,
                         approvedActions,
@@ -931,6 +988,8 @@ function askAppTool(config, requestMeta) {
                     try {
                         return await routeAskOverA2A(dirMatch.a2aUrl, dirMatch.id, message, {
                             durable: useDurableA2A,
+                            issuerApp: selfId,
+                            issuerAudience: issuerAudience ?? undefined,
                             maxWaitMs,
                             requestOrigin: dirMatch.url,
                             approvedActions,
@@ -942,19 +1001,16 @@ function askAppTool(config, requestMeta) {
                     }
                 }
             }
-            // Same app (or no workspace / unknown target): answer locally with this
+            if (requestedApp && requestedApp.toLowerCase() !== selfId) {
+                throw new Error(`No reachable ask_app route for app "${requestedApp}". ` +
+                    "Call list_apps and retry with an available app id.");
+            }
+            // Same app (or no target): answer locally with this
             // app's own ask-agent handler — the same entry point the HTTP MCP mount
             // + A2A use, so there is no second agent runner.
             if (!config.askAgent) {
                 throw new Error("This app does not expose an agent (no ask-agent handler).");
             }
-            // If the caller named an app we couldn't route to (unknown id, or no
-            // workspace), say so honestly instead of claiming we reached it.
-            const unresolved = !!requestedApp && requestedApp.toLowerCase() !== selfId;
-            const note = unresolved
-                ? `Requested app "${requestedApp}" is not a reachable workspace ` +
-                    `app; answered with this app ("${selfId}") instead.`
-                : undefined;
             // Hosted MCP cannot safely keep a JSON request/response open for a full
             // agent loop: serverless gateways can return an inactivity 504 before
             // the result body exists. When we know the running app origin, submit the
@@ -967,8 +1023,7 @@ function askAppTool(config, requestMeta) {
                     origin: localA2AEndpointUrl,
                     routedVia: "local",
                     requestOrigin: requestMeta?.origin,
-                    ...(note ? { note } : {}),
-                }, message, maxWaitMs, approvedActions);
+                }, selfId, issuerAudience ?? "", message, maxWaitMs, approvedActions);
             }
             // No derivable app origin at all (e.g. stdio / no request context) —
             // there is no `/_agent-native/a2a` endpoint to submit a durable task
@@ -984,7 +1039,6 @@ function askAppTool(config, requestMeta) {
                 return {
                     app: selfId,
                     routedVia: "local",
-                    ...(note ? { note } : {}),
                     response: inline.response || "(no response)",
                 };
             }
@@ -993,7 +1047,7 @@ function askAppTool(config, requestMeta) {
                 // same way the old unbounded `await config.askAgent(message)` did.
                 throw new Error(inline.error || "ask_app task failed.");
             }
-            return askAppInlineTaskResult(selfId, inline.taskId, inline, note);
+            return askAppInlineTaskResult(selfId, inline.taskId, inline);
         },
     };
 }
@@ -1010,15 +1064,38 @@ function askAppStatusTool(config, requestMeta) {
             },
             taskId: {
                 type: "string",
-                description: "The durable task id returned by ask_app.",
+                description: "Legacy durable task id returned by ask_app. Use taskHandle when present.",
             },
-        }, ["taskId"]),
+            taskHandle: {
+                type: "string",
+                description: "Opaque task handle returned by ask_app. It preserves the original route across cold starts and discovery changes.",
+            },
+        }),
         readOnly: true,
         parallelSafe: true,
         run: async (args) => {
-            const taskId = String(args.taskId ?? "").trim();
-            if (!taskId)
-                throw new Error("ask_app_status requires 'taskId'.");
+            const suppliedTaskId = String(args.taskId ?? "").trim();
+            const taskHandle = String(args.taskHandle ?? "").trim();
+            if (!taskHandle && !suppliedTaskId) {
+                throw new Error("ask_app_status requires 'taskHandle' or 'taskId'.");
+            }
+            if (taskHandle) {
+                const verified = await verifyAskAppTaskHandle(taskHandle, {
+                    issuerApp: currentAppId(config),
+                    issuerAudience: askAppIssuerAudience(requestMeta) ?? "",
+                    organization: getRequestOrgId() ?? "",
+                    subject: getRequestUserEmail() ?? "anonymous",
+                });
+                const suppliedApp = String(args.app ?? "")
+                    .trim()
+                    .toLowerCase();
+                if ((suppliedTaskId && suppliedTaskId !== verified.taskId) ||
+                    (suppliedApp && suppliedApp !== verified.route.app.toLowerCase())) {
+                    throw new Error("Invalid or expired ask_app task handle.");
+                }
+                return fetchAskAppA2ATask(verified.route, verified.taskId, taskHandle);
+            }
+            const taskId = suppliedTaskId;
             // The no-derivable-origin ask_app fallback tracks its tasks in a
             // process-local map, not the durable A2A store. Check it FIRST —
             // before any origin requirement — so a taskId minted by that fallback