@agent-native/core 0.129.1 → 0.130.0

package/src/scripts/runner.ts

@@ -11,6 +11,7 @@
  */
 
 import fs from "fs";
+import { spawnSync } from "node:child_process";
 import path from "path";
 import { pathToFileURL } from "url";
 
@@ -29,6 +30,174 @@ import { loadEnv } from "./utils.js";
 // Load .env from cwd so DATABASE_URL and other vars are available to all actions.
 loadEnv();
 
+const CLI_HANDOFF_KEYS = new Set(["embedStartUrl", "startUrl"]);
+const CLI_HANDOFF_URL_PATTERN =
+  /\/_agent-native\/embed\/start\?[^\s"'<>)}\]]+/g;
+
+function withoutCliHandoffText(value: unknown): string {
+  return String(value).replace(
+    CLI_HANDOFF_URL_PATTERN,
+    "[redacted embed handoff]",
+  );
+}
+
+function cliHandoffUrl(result: unknown): string | undefined {
+  if (!result || typeof result !== "object") return undefined;
+  for (const key of CLI_HANDOFF_KEYS) {
+    const value = (result as Record<string, unknown>)[key];
+    if (
+      typeof value === "string" &&
+      value.includes("/_agent-native/embed/start?")
+    ) {
+      return value;
+    }
+  }
+  return undefined;
+}
+
+function withoutCliHandoffSecrets(
+  value: unknown,
+  ancestors = new WeakSet<object>(),
+): unknown {
+  if (
+    typeof value === "string" &&
+    value.includes("/_agent-native/embed/start?")
+  ) {
+    return withoutCliHandoffText(value);
+  }
+  if (!value || typeof value !== "object") return value;
+  if (ancestors.has(value)) return "[Circular]";
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return value.map((child) => withoutCliHandoffSecrets(child, ancestors));
+    }
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>)
+        .filter(([key]) => !CLI_HANDOFF_KEYS.has(key))
+        .map(([key, child]) => [
+          key,
+          withoutCliHandoffSecrets(child, ancestors),
+        ]),
+    );
+  } finally {
+    ancestors.delete(value);
+  }
+}
+
+type CliHandoffLaunchOutcome =
+  | { ok: true }
+  | {
+      ok: false;
+      reason: "disabled" | "missing-base" | "invalid-url" | "open-failed";
+      message: string;
+    };
+
+interface CliHandoffLaunchDeps {
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  spawn?: (
+    command: string,
+    args: string[],
+  ) => { status: number | null; error?: Error };
+}
+
+export function openCliHandoff(
+  urlOrPath: string,
+  deps: CliHandoffLaunchDeps = {},
+): CliHandoffLaunchOutcome {
+  const env = deps.env ?? process.env;
+  if (env.AGENT_NATIVE_NO_OPEN === "1") {
+    return {
+      ok: false,
+      reason: "disabled",
+      message:
+        "Secure browser handoff is disabled by AGENT_NATIVE_NO_OPEN. Remove it and rerun this action.",
+    };
+  }
+  let url = urlOrPath;
+  if (urlOrPath.startsWith("/")) {
+    const baseUrl =
+      env.APP_URL ||
+      env.WORKSPACE_GATEWAY_URL ||
+      env.VITE_WORKSPACE_GATEWAY_URL ||
+      env.BETTER_AUTH_URL;
+    if (!baseUrl) {
+      return {
+        ok: false,
+        reason: "missing-base",
+        message:
+          "Secure browser handoff needs APP_URL or WORKSPACE_GATEWAY_URL. Start the app locally or set its URL, then rerun this action.",
+      };
+    }
+    try {
+      url = new URL(urlOrPath, baseUrl).toString();
+    } catch {
+      return {
+        ok: false,
+        reason: "invalid-url",
+        message:
+          "Secure browser handoff found an invalid app URL. Fix APP_URL or WORKSPACE_GATEWAY_URL, then rerun this action.",
+      };
+    }
+  }
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error("unsupported protocol");
+    }
+  } catch {
+    return {
+      ok: false,
+      reason: "invalid-url",
+      message:
+        "Secure browser handoff found an invalid app URL. Fix APP_URL or WORKSPACE_GATEWAY_URL, then rerun this action.",
+    };
+  }
+
+  const platform = deps.platform ?? process.platform;
+  const command =
+    platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const launch =
+      deps.spawn?.(command, args) ??
+      spawnSync(command, args, {
+        stdio: "ignore",
+        timeout: 10_000,
+      });
+    if (launch.error || launch.status !== 0) {
+      return {
+        ok: false,
+        reason: "open-failed",
+        message:
+          "Secure browser handoff could not invoke the system URL opener. Verify local URL handling, then rerun this action.",
+      };
+    }
+  } catch {
+    return {
+      ok: false,
+      reason: "open-failed",
+      message:
+        "Secure browser handoff could not invoke the system URL opener. Verify local URL handling, then rerun this action.",
+    };
+  }
+  return { ok: true };
+}
+
+function printActionResult(result: unknown): CliHandoffLaunchOutcome | null {
+  const handoffUrl = cliHandoffUrl(result);
+  const handoff = handoffUrl ? openCliHandoff(handoffUrl) : null;
+  console.log(withoutCliHandoffSecrets(result));
+  return handoff;
+}
+
+function assertCliHandoffLaunched(
+  outcome: CliHandoffLaunchOutcome | null,
+): void {
+  if (outcome && !outcome.ok) throw new Error(outcome.message);
+}
+
 export interface RunScriptOptions {
   /**
    * Actions contributed by packages rather than the app's local `actions/`
@@ -276,7 +445,7 @@ async function dispatchAction(
         if (handler.readOnly !== true) {
           await notifyActionChange({ actionName }).catch(() => {});
         }
-        if (result) console.log(result);
+        if (result) assertCliHandoffLaunched(printActionResult(result));
       } else if (typeof handler === "function") {
         await handler(args);
       } else {
@@ -289,7 +458,10 @@ async function dispatchAction(
       process.exit(0);
     } catch (err: any) {
       await closeDbExec().catch(() => {});
-      console.error(`Action "${actionName}" failed:`, err.message || err);
+      console.error(
+        `Action "${actionName}" failed:`,
+        withoutCliHandoffText(err.message || err),
+      );
       process.exit(1);
     }
   }
@@ -307,12 +479,15 @@ async function dispatchAction(
       if (packageAction.readOnly !== true) {
         await notifyActionChange({ actionName }).catch(() => {});
       }
-      if (result) console.log(result);
+      if (result) assertCliHandoffLaunched(printActionResult(result));
       await closeDbExec().catch(() => {});
       process.exit(0);
     } catch (err: any) {
       await closeDbExec().catch(() => {});
-      console.error(`Action "${actionName}" failed:`, err.message || err);
+      console.error(
+        `Action "${actionName}" failed:`,
+        withoutCliHandoffText(err.message || err),
+      );
       process.exit(1);
     }
   }
@@ -326,7 +501,10 @@ async function dispatchAction(
       process.exit(0);
     } catch (err: any) {
       await closeDbExec().catch(() => {});
-      console.error(`Core action "${actionName}" failed:`, err.message || err);
+      console.error(
+        `Core action "${actionName}" failed:`,
+        withoutCliHandoffText(err.message || err),
+      );
       process.exit(1);
     }
   }

package/src/server/__snapshots__/agent-chat-plugin.surface.spec.ts.snap

@@ -26,7 +26,7 @@ Bring a senior engineer's judgment, arrived at through attention not premature c
    - **Never fabricate factual claims or records** — do not invent numbers, metrics, records, query results, URLs, citations, source attributions, customer names, dates, or success rates. This applies inside generated artifacts too: decks, documents, reports, dashboards, Slack/email replies, and charts. Only state factual numbers/claims the user provided or you retrieved with an action/tool. If a data source is unavailable, returns no rows, is missing credentials, or has a connection error, say so clearly; do not create placeholder rows or fetch unrelated providers to look complete unless the user explicitly asked you to import/sync/backfill. Prefer qualitative wording, placeholders like \`[metric TBD]\`, or clearly labeled draft assumptions over plausible-looking facts — presenting made-up data as real is worse than admitting the limitation.
    - **Never fabricate success from tool errors** — when a tool call returns an error (marked \`isError: true\`, contains "Command failed", "Error:", or non-zero exit output), the operation FAILED; do not synthesize a success narrative or describe what it "would have" produced. Report the failure verbatim (this applies especially to \`bash(command="pnpm action ...")\` calls). Before telling the user a mutating action (create/update/delete/send/publish) is done, confirm it actually landed — check the tool result, or read the refreshed \`<current-screen>\` / re-query the data; having *called* an action is not proof it worked. If a result is ambiguous, check rather than assume.
    - **Recover instead of giving up** — treat a failure or ambiguous result as a signal to retry the obvious fix, try an alternate tool or approach, or clearly hand the blocker back with what you tried; never silently give up, and never paper over a failure by claiming success.
-**Native widgets** — For table/chart/graph/report requests, prefer actions labeled \`Native chat widget\`; use \`render-data-widget\` for already-summarized data (≤50 rows) instead of markdown tables. Above that, give the total plus the top rows — never retype a full result set as widget arguments.
+**Native widgets** — For table/chart/graph/report requests, prefer actions labeled \`Native chat widget\`; use \`render-data-widget\` for already-summarized data (≤50 rows) instead of markdown tables. Above that, give the total plus the top rows — never retype a full result set as widget arguments. Deliver files in chat, never just a path.
 10. **Your tool list is not the whole surface** — Most app actions and connected MCP tools load on demand, so search the live registry with \`tool-search\` before concluding a capability doesn't exist.
 11. **Relative dates use runtime context** — The \`<runtime-context>\` block gives the authoritative current date/time. Resolve "today", "yesterday", "last week", and similar phrases to explicit calendar dates before querying data or creating artifacts.
 12. **Plan and track multi-step work** — When a task spans several real steps the user would want to watch, open a \`manage-progress\` run so the work is visible while it's still in flight, and keep it updated as you go rather than after the fact; the tool's own description carries the full discipline. Skip it for single-action lookups, simple reads, and anything that finishes in one tool call — never create single-step plans.
@@ -88,6 +88,7 @@ Write like a sharp, warm product teammate: concise, direct, and human. Lead with
    - **Never fabricate success from tool errors** — when a tool call returns an error (marked \`isError: true\`, contains "Command failed", "Error:", or non-zero exit output), the operation FAILED; do not synthesize a success narrative or describe what it "would have" produced. Report the failure verbatim (this applies especially to \`bash(command="pnpm action ...")\` calls). Before telling the user a mutating action (create/update/delete/send/publish) is done, confirm it actually landed — check the tool result, or read the refreshed \`<current-screen>\` / re-query the data; having *called* an action is not proof it worked. If a result is ambiguous, check rather than assume.
    - **Recover instead of giving up** — treat a failure or ambiguous result as a signal to retry the obvious fix, try an alternate tool or approach, or clearly hand the blocker back with what you tried; never silently give up, and never paper over a failure by claiming success.
 **Native chat widgets** — When an available action says it renders a native widget such as \`data-table\`, \`data-chart\`, or \`data-insights\`, call that action for user requests asking for a table, chart, graph, trend, report, or inline data view. If no domain action exists and you already have compact real data, call \`render-data-widget\`. Let the chat renderer show the action result; do not recreate the same rows as a markdown table or invent chart data in prose. Add only a short human summary or next-step link around the widget. Widget rows are tool arguments you emit one token at a time, so this path is for already-summarized data only — at most 50 table rows and 200 chart points. When the result set is larger, aggregate it first or report the total and show only the top rows; never re-serialize a full query result into widget arguments.
+**Downloadable files** — When the user asks you to create or export a file, deliver it in the same chat turn. For compact tabular results, prefer \`render-data-widget\` so the user gets the native Download CSV action without a second stored copy. For a complete or durable file written through \`workspaceWrite\`, use a normal non-\`scratch/\` path and then call \`show-workspace-file\` with that path so chat renders a direct download card. Never finish by giving filesystem paths or telling the user to navigate elsewhere to find the file.
 10. **Your tool list is not the whole surface** — Most app actions and connected MCP tools load on demand, so search the live registry with \`tool-search\` before concluding a capability doesn't exist.
 11. **Relative dates use runtime context** — The \`<runtime-context>\` block gives the authoritative current date/time. Resolve "today", "yesterday", "last week", and similar phrases to explicit calendar dates before querying data or creating artifacts. When answering factual questions, include the exact date or date range you used.
 12. **Plan and track multi-step work** — When a task spans several real steps the user would want to watch, open a \`manage-progress\` run so the work is visible while it's still in flight, and keep it updated as you go rather than after the fact; the tool's own description carries the full discipline. Skip it for single-action lookups, simple reads, and anything that finishes in one tool call — never create single-step plans.

package/src/server/action-routes.ts

@@ -31,6 +31,10 @@ import {
   getAllowedCorsOrigin as resolveAllowedCorsOrigin,
   readCorsAllowedOrigins,
 } from "./cors-origins.js";
+import {
+  resolveEmbedSessionFromRequest,
+  resolvedEmbedCapabilityScope,
+} from "./embed-session.js";
 import { getHttpRequestTelemetryId } from "./http-response-telemetry.js";
 
 declare const __AGENT_NATIVE_BUILD_ID__: string | undefined;
@@ -58,10 +62,12 @@ function currentBuildId(): string {
  * Actions are exposed as POST by default. Use `http: { method: "GET" }` in
  * defineAction to expose as GET. Use `http: false` to mark as agent-only.
  */
+import { isLoopbackRequest } from "./auth.js";
 import { getH3App } from "./framework-request-handler.js";
 import { runWithRequestContext } from "./request-context.js";
 
 const ROUTE_PREFIX = "/_agent-native/actions";
+const FRONTEND_MUTATION_METHODS = new Set(["POST", "PUT", "DELETE"]);
 
 async function resolveFeatureFlagA2ACaller(event: any, actionName: string) {
   const required =
@@ -309,6 +315,19 @@ function isAuthResolutionFailure(error: unknown): boolean {
   );
 }
 
+async function resolveRequestAuthCapability(
+  event: any,
+): Promise<string | undefined> {
+  try {
+    return resolvedEmbedCapabilityScope(
+      await resolveEmbedSessionFromRequest(event),
+    );
+  } catch {
+    // Invalid or unavailable embed auth must fail closed as no capability.
+    return undefined;
+  }
+}
+
 /**
  * Mount discovered actions as HTTP endpoints.
  *
@@ -348,8 +367,14 @@ export function mountActionRoutes(
           "X-Agent-Native-Client-Mismatch,X-Agent-Native-Build-Id,X-Agent-Native-Client-Compatibility",
         );
 
-        // Allow the declared method
-        if (effectiveMethod !== method) {
+        // Browser action calls are RPCs over the framework transport. The
+        // action's HTTP method remains authoritative for direct HTTP callers,
+        // but frontend callers must not have to duplicate it in every hook.
+        const isFrontendMutation =
+          isFrontendActionRequest(event) &&
+          FRONTEND_MUTATION_METHODS.has(method) &&
+          FRONTEND_MUTATION_METHODS.has(effectiveMethod);
+        if (effectiveMethod !== method && !isFrontendMutation) {
           setResponseStatus(event, 405);
           return { error: `Method not allowed. Use ${method}.` };
         }
@@ -403,6 +428,7 @@ export function mountActionRoutes(
         // Resolve auth context for per-request scoping
         let userEmail: string | undefined;
         let userName: string | undefined;
+        const authCapability = await resolveRequestAuthCapability(event);
         // An app-supplied auth adapter runs first: it can accept caller
         // identities the framework's getSession chain doesn't understand (e.g.
         // an A2A JWT). A resolved caller is seeded onto the event context so any
@@ -493,8 +519,12 @@ export function mountActionRoutes(
             userEmail,
             userName,
             orgId,
+            authCapability,
             timezone,
             requestOrigin: getRequestURL(event).origin,
+            // Captured here because this is the last layer that still holds
+            // the h3 event; everything below reads it off the request store.
+            isLoopbackRequest: isLoopbackRequest(event),
           },
           async () => {
             // Reject oversize bodies from Content-Length before parsing, so a

package/src/server/agent-chat-plugin.ts

@@ -90,8 +90,10 @@ import {
 import {
   buildAssistantMessage,
   buildUserMessage,
+  claimQueuedMessage,
   extractThreadMeta,
   foldAssistantTurn,
+  hasClaimedQueuedMessage,
   mergeThreadDataForClientSave,
   upsertUserMessage,
 } from "../agent/thread-data-builder.js";
@@ -1043,6 +1045,12 @@ export function createAgentChatPlugin(
           await import("../workspace-files/tool.js");
         workspaceFilesTool = createWorkspaceFilesTool();
       } catch {}
+      let workspaceFileActions: Record<string, ActionEntry> = {};
+      try {
+        const { createWorkspaceFileActionEntries } =
+          await import("../workspace-files/actions.js");
+        workspaceFileActions = createWorkspaceFileActionEntries();
+      } catch {}
       let toolActions: Record<string, ActionEntry> =
         createDataWidgetActionEntries();
       if (extensionToolsEnabled) {
@@ -1238,6 +1246,7 @@ export function createAgentChatPlugin(
               ...fetchTool,
               ...webSearchTool,
               ...workspaceFilesTool,
+              ...workspaceFileActions,
               ...toolActions,
               ...browserSessionTools,
               ...coreEmailTools,
@@ -1263,6 +1272,7 @@ export function createAgentChatPlugin(
               ...fetchTool,
               ...webSearchTool,
               ...workspaceFilesTool,
+              ...workspaceFileActions,
               ...toolActions,
               ...browserSessionTools,
               ...coreEmailTools,
@@ -1302,6 +1312,7 @@ export function createAgentChatPlugin(
             ...fetchTool,
             ...webSearchTool,
             ...workspaceFilesTool,
+            ...workspaceFileActions,
             ...toolActions,
             ...browserSessionTools,
             ...coreEmailTools,
@@ -1630,6 +1641,7 @@ export function createAgentChatPlugin(
                   ...fetchTool,
                   ...webSearchTool,
                   ...workspaceFilesTool,
+                  ...workspaceFileActions,
                   ...toolActions,
                   ...browserSessionTools,
                   ...coreEmailTools,
@@ -1651,6 +1663,7 @@ export function createAgentChatPlugin(
                   ...fetchTool,
                   ...webSearchTool,
                   ...workspaceFilesTool,
+                  ...workspaceFileActions,
                   ...toolActions,
                   ...browserSessionTools,
                   ...coreEmailTools,
@@ -2030,6 +2043,7 @@ export function createAgentChatPlugin(
                     ...fetchTool,
                     ...webSearchTool,
                     ...workspaceFilesTool,
+                    ...workspaceFileActions,
                     ...toolActions,
                     ...mcpActionEntries,
                     ...devScriptsForA2A,
@@ -2047,6 +2061,7 @@ export function createAgentChatPlugin(
                     ...fetchTool,
                     ...webSearchTool,
                     ...workspaceFilesTool,
+                    ...workspaceFileActions,
                     ...toolActions,
                     ...mcpActionEntries,
                     ...(resolvedProdCodeExec !== "off" ? runCodeTool : {}),
@@ -2472,6 +2487,7 @@ export function createAgentChatPlugin(
         threadId: string | undefined;
         message: string;
         attachments?: AgentChatAttachment[];
+        queuedMessageId?: string;
       }) => {
         const threadId = details.threadId;
         if (!threadId) return;
@@ -2514,12 +2530,23 @@ export function createAgentChatPlugin(
             repo = {};
           }
 
+          if (details.queuedMessageId) {
+            if (hasClaimedQueuedMessage(repo, details.queuedMessageId)) {
+              throw createError({
+                statusCode: 409,
+                statusMessage: "Queued message was already submitted",
+              });
+            }
+            repo = claimQueuedMessage(repo, details.queuedMessageId);
+          }
+
           repo = upsertUserMessage(
             repo,
             buildUserMessage({
               text: details.message,
               attachments: details.attachments,
               runId: details.runId,
+              queuedMessageId: details.queuedMessageId,
             }),
           );
 
@@ -2654,6 +2681,7 @@ export function createAgentChatPlugin(
         ...fetchTool,
         ...webSearchTool,
         ...workspaceFilesTool,
+        ...workspaceFileActions,
         ...toolActions,
         ...browserSessionTools,
         ...coreEmailTools,
@@ -3193,6 +3221,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                   ...fetchTool,
                   ...webSearchTool,
                   ...workspaceFilesTool,
+                  ...workspaceFileActions,
                   ...toolActions,
                   ...browserSessionTools,
                   ...coreEmailTools,

package/src/server/agent-teams.ts

@@ -1988,7 +1988,16 @@ export async function processAgentTeamRun(
               resolve();
             }
           },
-          { useHostedSoftTimeoutDefault: true, turnId },
+          {
+            useHostedSoftTimeoutDefault: true,
+            turnId,
+            // No userId here: `ownerEmail` is the only identity known at
+            // this scope and is PII (email), which the terminal event must
+            // not carry.
+            model: config.model,
+            engineName: config.engine.name,
+            attemptCount: claimedAttempts,
+          },
         );
       });
 

package/src/server/auth.ts

@@ -23,8 +23,9 @@ import {
   shouldAllowMcpEmbedCredentials,
 } from "../shared/mcp-embed-headers.js";
 import {
-  resolveEmbedSessionFromRequest,
+  isEmbedCapabilityScope,
   requestHasEmbedAuthMarker,
+  resolveEmbedSessionFromRequest,
 } from "./embed-session.js";
 import type { H3AppShim } from "./framework-request-handler.js";
 
@@ -351,6 +352,7 @@ export function getCookieDomain(): string | undefined {
 export const COOKIE_NAME = AUTH_COOKIE_NAMESPACE.frameworkCookieName;
 export const BETTER_AUTH_COOKIE_PREFIX =
   AUTH_COOKIE_NAMESPACE.betterAuthCookiePrefix;
+const AUTH_DISABLED_OPT_OUT_COOKIE = `${COOKIE_NAME}_auth_disabled_opt_out`;
 
 /**
  * Cookie domain attribute spread into every `setCookie`/`deleteCookie`.
@@ -2047,8 +2049,11 @@ function isAuthDisabled(): boolean {
   return value === "1" || value === "true";
 }
 
-function getAuthDisabledSession(): AuthSession | null {
+function getAuthDisabledSession(event: H3Event): AuthSession | null {
   if (!isAuthDisabled()) return null;
+  if (getCookieValues(event, AUTH_DISABLED_OPT_OUT_COOKIE).includes("1")) {
+    return null;
+  }
   if (!authDisabledWarningLogged) {
     authDisabledWarningLogged = true;
     console.warn(
@@ -2058,6 +2063,17 @@ function getAuthDisabledSession(): AuthSession | null {
   return { email: AUTO_DEV_ACCOUNT_EMAIL };
 }
 
+function optOutOfAuthDisabledSession(event: H3Event): void {
+  if (!isAuthDisabled()) return;
+  setCookie(event, AUTH_DISABLED_OPT_OUT_COOKIE, "1", {
+    httpOnly: true,
+    ...crossSiteCookieAttrs(event),
+    ...cookieDomainAttrs(),
+    path: "/",
+    maxAge: sessionMaxAge,
+  });
+}
+
 async function hasAutoDevAccountUser(
   db: ReturnType<typeof getDbExec>,
 ): Promise<boolean> {
@@ -2314,7 +2330,7 @@ async function resolveSessionUncached(
   // an_session cookie prevents a stale cookie (common when an ACCESS_TOKEN is
   // configured) from shadowing the embed identity.
   const embedSession = await resolveEmbedSessionFromRequest(event);
-  if (embedSession) {
+  if (embedSession && !isEmbedCapabilityScope(embedSession.scope)) {
     return {
       email: embedSession.email,
       token: embedSession.token,
@@ -2394,7 +2410,7 @@ async function resolveSessionUncached(
   // 9. AUTH_DISABLED fallback — only when no session resolved above.
   // Must run after BYOA customGetSession so infrastructure/custom auth keeps
   // caller identity instead of collapsing to the shared preview user.
-  const authDisabledSession = getAuthDisabledSession();
+  const authDisabledSession = getAuthDisabledSession(event);
   if (authDisabledSession) return authDisabledSession;
 
   return null;
@@ -2452,8 +2468,9 @@ export function setFrameworkSessionCookie(event: H3Event, token: string): void {
 }
 
 /**
- * Build a redirect `Response` that carries whatever `Set-Cookie` headers were
- * just staged on the event (e.g. by `setFrameworkSessionCookie`).
+ * Build a redirect `Response` that carries the security-sensitive headers just
+ * staged on the event (e.g. by `setFrameworkSessionCookie` or query-session
+ * promotion).
  *
  * h3 v2's `setCookie` appends the cookie onto `event.res.headers`. When a
  * handler returns a plain object/string, h3's `prepareResponse` merges those
@@ -2471,7 +2488,7 @@ export function setFrameworkSessionCookie(event: H3Event, token: string): void {
  * any non-Response continuation path; h3 only skips the merge for the
  * Response branch, so there's no double-emit.)
  */
-function redirectWithStagedCookies(
+export function redirectWithStagedCookies(
   event: H3Event,
   location: string,
   status = 302,
@@ -2479,6 +2496,8 @@ function redirectWithStagedCookies(
   const headers = new Headers({ Location: location });
   const staged = event.res?.headers?.getSetCookie?.() ?? [];
   for (const cookie of staged) headers.append("set-cookie", cookie);
+  const referrerPolicy = event.res?.headers?.get?.("Referrer-Policy");
+  if (referrerPolicy) headers.set("Referrer-Policy", referrerPolicy);
   return new Response("", { status, headers });
 }
 
@@ -3045,6 +3064,9 @@ async function mountBetterAuthRoutes(
       const isSendVerificationEmail =
         reqPath.includes("send-verification-email") &&
         getMethod(event) === "POST";
+      const isSignOut =
+        reqPath.includes("sign-out") && getMethod(event) === "POST";
+      if (isSignOut) optOutOfAuthDisabledSession(event);
       const authRequest = toWebRequest(event);
       let requestForAuth = authRequest;
 
@@ -3354,6 +3376,7 @@ async function mountBetterAuthRoutes(
       const bearerToken = getBearerSessionToken(event);
       if (bearerToken) await removeSession(bearerToken);
       clearFrameworkSessionCookies(event);
+      optOutOfAuthDisabledSession(event);
 
       try {
         await auth.api.signOut({ headers: event.headers });
@@ -3421,6 +3444,7 @@ async function mountBetterAuthRoutes(
         // 3. Drop the current request's cookie and best-effort sign out
         // of Better Auth (so the response sets the proper expiry header).
         clearFrameworkSessionCookies(event);
+        optOutOfAuthDisabledSession(event);
         try {
           await auth.api.signOut({ headers: event.headers });
         } catch {
@@ -3589,6 +3613,7 @@ function mountAuthFallbackRoutes(app: H3App): void {
       const bearerToken = getBearerSessionToken(event);
       if (bearerToken) await removeSession(bearerToken);
       clearFrameworkSessionCookies(event);
+      optOutOfAuthDisabledSession(event);
 
       try {
         const auth = await getBetterAuth();
@@ -3746,6 +3771,7 @@ export async function autoMountAuth(
         const bearerToken = getBearerSessionToken(event);
         if (bearerToken) await removeSession(bearerToken);
         clearFrameworkSessionCookies(event);
+        optOutOfAuthDisabledSession(event);
         if (isElectronRequest(event)) await clearDesktopSso();
         return { ok: true };
       }),

package/src/server/embed-route.ts

@@ -22,6 +22,7 @@ import { getConfiguredAppBasePath } from "./app-base-path.js";
 import type { AuthSession } from "./auth.js";
 import {
   consumeEmbedSessionTicket,
+  isEmbedCapabilityScope,
   normalizeEmbedTargetPath,
   setEmbedSessionCookie,
   signEmbedSessionToken,
@@ -263,6 +264,14 @@ export function createEmbedStartRouteHandler(
       orgId: consumed.orgId,
       targetPath: target,
       scope: consumed.scope,
+      ...(isEmbedCapabilityScope(consumed.scope)
+        ? {
+            ttlSeconds: Math.max(
+              1,
+              Math.floor((consumed.expiresAt - Date.now()) / 1000),
+            ),
+          }
+        : {}),
     });
     setEmbedSessionCookie(event, token);
     setResponseHeader(event, "Referrer-Policy", "no-referrer");