@agent-native/core 0.129.2 → 0.130.0

package/corpus/core/src/scripts/runner.ts

@@ -11,6 +11,7 @@
  */
 
 import fs from "fs";
+import { spawnSync } from "node:child_process";
 import path from "path";
 import { pathToFileURL } from "url";
 
@@ -29,6 +30,174 @@ import { loadEnv } from "./utils.js";
 // Load .env from cwd so DATABASE_URL and other vars are available to all actions.
 loadEnv();
 
+const CLI_HANDOFF_KEYS = new Set(["embedStartUrl", "startUrl"]);
+const CLI_HANDOFF_URL_PATTERN =
+  /\/_agent-native\/embed\/start\?[^\s"'<>)}\]]+/g;
+
+function withoutCliHandoffText(value: unknown): string {
+  return String(value).replace(
+    CLI_HANDOFF_URL_PATTERN,
+    "[redacted embed handoff]",
+  );
+}
+
+function cliHandoffUrl(result: unknown): string | undefined {
+  if (!result || typeof result !== "object") return undefined;
+  for (const key of CLI_HANDOFF_KEYS) {
+    const value = (result as Record<string, unknown>)[key];
+    if (
+      typeof value === "string" &&
+      value.includes("/_agent-native/embed/start?")
+    ) {
+      return value;
+    }
+  }
+  return undefined;
+}
+
+function withoutCliHandoffSecrets(
+  value: unknown,
+  ancestors = new WeakSet<object>(),
+): unknown {
+  if (
+    typeof value === "string" &&
+    value.includes("/_agent-native/embed/start?")
+  ) {
+    return withoutCliHandoffText(value);
+  }
+  if (!value || typeof value !== "object") return value;
+  if (ancestors.has(value)) return "[Circular]";
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return value.map((child) => withoutCliHandoffSecrets(child, ancestors));
+    }
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>)
+        .filter(([key]) => !CLI_HANDOFF_KEYS.has(key))
+        .map(([key, child]) => [
+          key,
+          withoutCliHandoffSecrets(child, ancestors),
+        ]),
+    );
+  } finally {
+    ancestors.delete(value);
+  }
+}
+
+type CliHandoffLaunchOutcome =
+  | { ok: true }
+  | {
+      ok: false;
+      reason: "disabled" | "missing-base" | "invalid-url" | "open-failed";
+      message: string;
+    };
+
+interface CliHandoffLaunchDeps {
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  spawn?: (
+    command: string,
+    args: string[],
+  ) => { status: number | null; error?: Error };
+}
+
+export function openCliHandoff(
+  urlOrPath: string,
+  deps: CliHandoffLaunchDeps = {},
+): CliHandoffLaunchOutcome {
+  const env = deps.env ?? process.env;
+  if (env.AGENT_NATIVE_NO_OPEN === "1") {
+    return {
+      ok: false,
+      reason: "disabled",
+      message:
+        "Secure browser handoff is disabled by AGENT_NATIVE_NO_OPEN. Remove it and rerun this action.",
+    };
+  }
+  let url = urlOrPath;
+  if (urlOrPath.startsWith("/")) {
+    const baseUrl =
+      env.APP_URL ||
+      env.WORKSPACE_GATEWAY_URL ||
+      env.VITE_WORKSPACE_GATEWAY_URL ||
+      env.BETTER_AUTH_URL;
+    if (!baseUrl) {
+      return {
+        ok: false,
+        reason: "missing-base",
+        message:
+          "Secure browser handoff needs APP_URL or WORKSPACE_GATEWAY_URL. Start the app locally or set its URL, then rerun this action.",
+      };
+    }
+    try {
+      url = new URL(urlOrPath, baseUrl).toString();
+    } catch {
+      return {
+        ok: false,
+        reason: "invalid-url",
+        message:
+          "Secure browser handoff found an invalid app URL. Fix APP_URL or WORKSPACE_GATEWAY_URL, then rerun this action.",
+      };
+    }
+  }
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error("unsupported protocol");
+    }
+  } catch {
+    return {
+      ok: false,
+      reason: "invalid-url",
+      message:
+        "Secure browser handoff found an invalid app URL. Fix APP_URL or WORKSPACE_GATEWAY_URL, then rerun this action.",
+    };
+  }
+
+  const platform = deps.platform ?? process.platform;
+  const command =
+    platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const launch =
+      deps.spawn?.(command, args) ??
+      spawnSync(command, args, {
+        stdio: "ignore",
+        timeout: 10_000,
+      });
+    if (launch.error || launch.status !== 0) {
+      return {
+        ok: false,
+        reason: "open-failed",
+        message:
+          "Secure browser handoff could not invoke the system URL opener. Verify local URL handling, then rerun this action.",
+      };
+    }
+  } catch {
+    return {
+      ok: false,
+      reason: "open-failed",
+      message:
+        "Secure browser handoff could not invoke the system URL opener. Verify local URL handling, then rerun this action.",
+    };
+  }
+  return { ok: true };
+}
+
+function printActionResult(result: unknown): CliHandoffLaunchOutcome | null {
+  const handoffUrl = cliHandoffUrl(result);
+  const handoff = handoffUrl ? openCliHandoff(handoffUrl) : null;
+  console.log(withoutCliHandoffSecrets(result));
+  return handoff;
+}
+
+function assertCliHandoffLaunched(
+  outcome: CliHandoffLaunchOutcome | null,
+): void {
+  if (outcome && !outcome.ok) throw new Error(outcome.message);
+}
+
 export interface RunScriptOptions {
   /**
    * Actions contributed by packages rather than the app's local `actions/`
@@ -276,7 +445,7 @@ async function dispatchAction(
         if (handler.readOnly !== true) {
           await notifyActionChange({ actionName }).catch(() => {});
         }
-        if (result) console.log(result);
+        if (result) assertCliHandoffLaunched(printActionResult(result));
       } else if (typeof handler === "function") {
         await handler(args);
       } else {
@@ -289,7 +458,10 @@ async function dispatchAction(
       process.exit(0);
     } catch (err: any) {
       await closeDbExec().catch(() => {});
-      console.error(`Action "${actionName}" failed:`, err.message || err);
+      console.error(
+        `Action "${actionName}" failed:`,
+        withoutCliHandoffText(err.message || err),
+      );
       process.exit(1);
     }
   }
@@ -307,12 +479,15 @@ async function dispatchAction(
       if (packageAction.readOnly !== true) {
         await notifyActionChange({ actionName }).catch(() => {});
       }
-      if (result) console.log(result);
+      if (result) assertCliHandoffLaunched(printActionResult(result));
       await closeDbExec().catch(() => {});
       process.exit(0);
     } catch (err: any) {
       await closeDbExec().catch(() => {});
-      console.error(`Action "${actionName}" failed:`, err.message || err);
+      console.error(
+        `Action "${actionName}" failed:`,
+        withoutCliHandoffText(err.message || err),
+      );
       process.exit(1);
     }
   }
@@ -326,7 +501,10 @@ async function dispatchAction(
       process.exit(0);
     } catch (err: any) {
       await closeDbExec().catch(() => {});
-      console.error(`Core action "${actionName}" failed:`, err.message || err);
+      console.error(
+        `Core action "${actionName}" failed:`,
+        withoutCliHandoffText(err.message || err),
+      );
       process.exit(1);
     }
   }

package/corpus/core/src/server/action-routes.ts

@@ -31,6 +31,10 @@ import {
   getAllowedCorsOrigin as resolveAllowedCorsOrigin,
   readCorsAllowedOrigins,
 } from "./cors-origins.js";
+import {
+  resolveEmbedSessionFromRequest,
+  resolvedEmbedCapabilityScope,
+} from "./embed-session.js";
 import { getHttpRequestTelemetryId } from "./http-response-telemetry.js";
 
 declare const __AGENT_NATIVE_BUILD_ID__: string | undefined;
@@ -58,10 +62,12 @@ function currentBuildId(): string {
  * Actions are exposed as POST by default. Use `http: { method: "GET" }` in
  * defineAction to expose as GET. Use `http: false` to mark as agent-only.
  */
+import { isLoopbackRequest } from "./auth.js";
 import { getH3App } from "./framework-request-handler.js";
 import { runWithRequestContext } from "./request-context.js";
 
 const ROUTE_PREFIX = "/_agent-native/actions";
+const FRONTEND_MUTATION_METHODS = new Set(["POST", "PUT", "DELETE"]);
 
 async function resolveFeatureFlagA2ACaller(event: any, actionName: string) {
   const required =
@@ -309,6 +315,19 @@ function isAuthResolutionFailure(error: unknown): boolean {
   );
 }
 
+async function resolveRequestAuthCapability(
+  event: any,
+): Promise<string | undefined> {
+  try {
+    return resolvedEmbedCapabilityScope(
+      await resolveEmbedSessionFromRequest(event),
+    );
+  } catch {
+    // Invalid or unavailable embed auth must fail closed as no capability.
+    return undefined;
+  }
+}
+
 /**
  * Mount discovered actions as HTTP endpoints.
  *
@@ -348,8 +367,14 @@ export function mountActionRoutes(
           "X-Agent-Native-Client-Mismatch,X-Agent-Native-Build-Id,X-Agent-Native-Client-Compatibility",
         );
 
-        // Allow the declared method
-        if (effectiveMethod !== method) {
+        // Browser action calls are RPCs over the framework transport. The
+        // action's HTTP method remains authoritative for direct HTTP callers,
+        // but frontend callers must not have to duplicate it in every hook.
+        const isFrontendMutation =
+          isFrontendActionRequest(event) &&
+          FRONTEND_MUTATION_METHODS.has(method) &&
+          FRONTEND_MUTATION_METHODS.has(effectiveMethod);
+        if (effectiveMethod !== method && !isFrontendMutation) {
           setResponseStatus(event, 405);
           return { error: `Method not allowed. Use ${method}.` };
         }
@@ -403,6 +428,7 @@ export function mountActionRoutes(
         // Resolve auth context for per-request scoping
         let userEmail: string | undefined;
         let userName: string | undefined;
+        const authCapability = await resolveRequestAuthCapability(event);
         // An app-supplied auth adapter runs first: it can accept caller
         // identities the framework's getSession chain doesn't understand (e.g.
         // an A2A JWT). A resolved caller is seeded onto the event context so any
@@ -493,8 +519,12 @@ export function mountActionRoutes(
             userEmail,
             userName,
             orgId,
+            authCapability,
             timezone,
             requestOrigin: getRequestURL(event).origin,
+            // Captured here because this is the last layer that still holds
+            // the h3 event; everything below reads it off the request store.
+            isLoopbackRequest: isLoopbackRequest(event),
           },
           async () => {
             // Reject oversize bodies from Content-Length before parsing, so a

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -90,8 +90,10 @@ import {
 import {
   buildAssistantMessage,
   buildUserMessage,
+  claimQueuedMessage,
   extractThreadMeta,
   foldAssistantTurn,
+  hasClaimedQueuedMessage,
   mergeThreadDataForClientSave,
   upsertUserMessage,
 } from "../agent/thread-data-builder.js";
@@ -1043,6 +1045,12 @@ export function createAgentChatPlugin(
           await import("../workspace-files/tool.js");
         workspaceFilesTool = createWorkspaceFilesTool();
       } catch {}
+      let workspaceFileActions: Record<string, ActionEntry> = {};
+      try {
+        const { createWorkspaceFileActionEntries } =
+          await import("../workspace-files/actions.js");
+        workspaceFileActions = createWorkspaceFileActionEntries();
+      } catch {}
       let toolActions: Record<string, ActionEntry> =
         createDataWidgetActionEntries();
       if (extensionToolsEnabled) {
@@ -1238,6 +1246,7 @@ export function createAgentChatPlugin(
               ...fetchTool,
               ...webSearchTool,
               ...workspaceFilesTool,
+              ...workspaceFileActions,
               ...toolActions,
               ...browserSessionTools,
               ...coreEmailTools,
@@ -1263,6 +1272,7 @@ export function createAgentChatPlugin(
               ...fetchTool,
               ...webSearchTool,
               ...workspaceFilesTool,
+              ...workspaceFileActions,
               ...toolActions,
               ...browserSessionTools,
               ...coreEmailTools,
@@ -1302,6 +1312,7 @@ export function createAgentChatPlugin(
             ...fetchTool,
             ...webSearchTool,
             ...workspaceFilesTool,
+            ...workspaceFileActions,
             ...toolActions,
             ...browserSessionTools,
             ...coreEmailTools,
@@ -1630,6 +1641,7 @@ export function createAgentChatPlugin(
                   ...fetchTool,
                   ...webSearchTool,
                   ...workspaceFilesTool,
+                  ...workspaceFileActions,
                   ...toolActions,
                   ...browserSessionTools,
                   ...coreEmailTools,
@@ -1651,6 +1663,7 @@ export function createAgentChatPlugin(
                   ...fetchTool,
                   ...webSearchTool,
                   ...workspaceFilesTool,
+                  ...workspaceFileActions,
                   ...toolActions,
                   ...browserSessionTools,
                   ...coreEmailTools,
@@ -2030,6 +2043,7 @@ export function createAgentChatPlugin(
                     ...fetchTool,
                     ...webSearchTool,
                     ...workspaceFilesTool,
+                    ...workspaceFileActions,
                     ...toolActions,
                     ...mcpActionEntries,
                     ...devScriptsForA2A,
@@ -2047,6 +2061,7 @@ export function createAgentChatPlugin(
                     ...fetchTool,
                     ...webSearchTool,
                     ...workspaceFilesTool,
+                    ...workspaceFileActions,
                     ...toolActions,
                     ...mcpActionEntries,
                     ...(resolvedProdCodeExec !== "off" ? runCodeTool : {}),
@@ -2472,6 +2487,7 @@ export function createAgentChatPlugin(
         threadId: string | undefined;
         message: string;
         attachments?: AgentChatAttachment[];
+        queuedMessageId?: string;
       }) => {
         const threadId = details.threadId;
         if (!threadId) return;
@@ -2514,12 +2530,23 @@ export function createAgentChatPlugin(
             repo = {};
           }
 
+          if (details.queuedMessageId) {
+            if (hasClaimedQueuedMessage(repo, details.queuedMessageId)) {
+              throw createError({
+                statusCode: 409,
+                statusMessage: "Queued message was already submitted",
+              });
+            }
+            repo = claimQueuedMessage(repo, details.queuedMessageId);
+          }
+
           repo = upsertUserMessage(
             repo,
             buildUserMessage({
               text: details.message,
               attachments: details.attachments,
               runId: details.runId,
+              queuedMessageId: details.queuedMessageId,
             }),
           );
 
@@ -2654,6 +2681,7 @@ export function createAgentChatPlugin(
         ...fetchTool,
         ...webSearchTool,
         ...workspaceFilesTool,
+        ...workspaceFileActions,
         ...toolActions,
         ...browserSessionTools,
         ...coreEmailTools,
@@ -3193,6 +3221,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                   ...fetchTool,
                   ...webSearchTool,
                   ...workspaceFilesTool,
+                  ...workspaceFileActions,
                   ...toolActions,
                   ...browserSessionTools,
                   ...coreEmailTools,

package/corpus/core/src/server/agent-teams.ts

@@ -1988,7 +1988,16 @@ export async function processAgentTeamRun(
               resolve();
             }
           },
-          { useHostedSoftTimeoutDefault: true, turnId },
+          {
+            useHostedSoftTimeoutDefault: true,
+            turnId,
+            // No userId here: `ownerEmail` is the only identity known at
+            // this scope and is PII (email), which the terminal event must
+            // not carry.
+            model: config.model,
+            engineName: config.engine.name,
+            attemptCount: claimedAttempts,
+          },
         );
       });
 

package/corpus/core/src/server/auth.ts

@@ -23,8 +23,9 @@ import {
   shouldAllowMcpEmbedCredentials,
 } from "../shared/mcp-embed-headers.js";
 import {
-  resolveEmbedSessionFromRequest,
+  isEmbedCapabilityScope,
   requestHasEmbedAuthMarker,
+  resolveEmbedSessionFromRequest,
 } from "./embed-session.js";
 import type { H3AppShim } from "./framework-request-handler.js";
 
@@ -351,6 +352,7 @@ export function getCookieDomain(): string | undefined {
 export const COOKIE_NAME = AUTH_COOKIE_NAMESPACE.frameworkCookieName;
 export const BETTER_AUTH_COOKIE_PREFIX =
   AUTH_COOKIE_NAMESPACE.betterAuthCookiePrefix;
+const AUTH_DISABLED_OPT_OUT_COOKIE = `${COOKIE_NAME}_auth_disabled_opt_out`;
 
 /**
  * Cookie domain attribute spread into every `setCookie`/`deleteCookie`.
@@ -2047,8 +2049,11 @@ function isAuthDisabled(): boolean {
   return value === "1" || value === "true";
 }
 
-function getAuthDisabledSession(): AuthSession | null {
+function getAuthDisabledSession(event: H3Event): AuthSession | null {
   if (!isAuthDisabled()) return null;
+  if (getCookieValues(event, AUTH_DISABLED_OPT_OUT_COOKIE).includes("1")) {
+    return null;
+  }
   if (!authDisabledWarningLogged) {
     authDisabledWarningLogged = true;
     console.warn(
@@ -2058,6 +2063,17 @@ function getAuthDisabledSession(): AuthSession | null {
   return { email: AUTO_DEV_ACCOUNT_EMAIL };
 }
 
+function optOutOfAuthDisabledSession(event: H3Event): void {
+  if (!isAuthDisabled()) return;
+  setCookie(event, AUTH_DISABLED_OPT_OUT_COOKIE, "1", {
+    httpOnly: true,
+    ...crossSiteCookieAttrs(event),
+    ...cookieDomainAttrs(),
+    path: "/",
+    maxAge: sessionMaxAge,
+  });
+}
+
 async function hasAutoDevAccountUser(
   db: ReturnType<typeof getDbExec>,
 ): Promise<boolean> {
@@ -2314,7 +2330,7 @@ async function resolveSessionUncached(
   // an_session cookie prevents a stale cookie (common when an ACCESS_TOKEN is
   // configured) from shadowing the embed identity.
   const embedSession = await resolveEmbedSessionFromRequest(event);
-  if (embedSession) {
+  if (embedSession && !isEmbedCapabilityScope(embedSession.scope)) {
     return {
       email: embedSession.email,
       token: embedSession.token,
@@ -2394,7 +2410,7 @@ async function resolveSessionUncached(
   // 9. AUTH_DISABLED fallback — only when no session resolved above.
   // Must run after BYOA customGetSession so infrastructure/custom auth keeps
   // caller identity instead of collapsing to the shared preview user.
-  const authDisabledSession = getAuthDisabledSession();
+  const authDisabledSession = getAuthDisabledSession(event);
   if (authDisabledSession) return authDisabledSession;
 
   return null;
@@ -2452,8 +2468,9 @@ export function setFrameworkSessionCookie(event: H3Event, token: string): void {
 }
 
 /**
- * Build a redirect `Response` that carries whatever `Set-Cookie` headers were
- * just staged on the event (e.g. by `setFrameworkSessionCookie`).
+ * Build a redirect `Response` that carries the security-sensitive headers just
+ * staged on the event (e.g. by `setFrameworkSessionCookie` or query-session
+ * promotion).
  *
  * h3 v2's `setCookie` appends the cookie onto `event.res.headers`. When a
  * handler returns a plain object/string, h3's `prepareResponse` merges those
@@ -2471,7 +2488,7 @@ export function setFrameworkSessionCookie(event: H3Event, token: string): void {
  * any non-Response continuation path; h3 only skips the merge for the
  * Response branch, so there's no double-emit.)
  */
-function redirectWithStagedCookies(
+export function redirectWithStagedCookies(
   event: H3Event,
   location: string,
   status = 302,
@@ -2479,6 +2496,8 @@ function redirectWithStagedCookies(
   const headers = new Headers({ Location: location });
   const staged = event.res?.headers?.getSetCookie?.() ?? [];
   for (const cookie of staged) headers.append("set-cookie", cookie);
+  const referrerPolicy = event.res?.headers?.get?.("Referrer-Policy");
+  if (referrerPolicy) headers.set("Referrer-Policy", referrerPolicy);
   return new Response("", { status, headers });
 }
 
@@ -3045,6 +3064,9 @@ async function mountBetterAuthRoutes(
       const isSendVerificationEmail =
         reqPath.includes("send-verification-email") &&
         getMethod(event) === "POST";
+      const isSignOut =
+        reqPath.includes("sign-out") && getMethod(event) === "POST";
+      if (isSignOut) optOutOfAuthDisabledSession(event);
       const authRequest = toWebRequest(event);
       let requestForAuth = authRequest;
 
@@ -3354,6 +3376,7 @@ async function mountBetterAuthRoutes(
       const bearerToken = getBearerSessionToken(event);
       if (bearerToken) await removeSession(bearerToken);
       clearFrameworkSessionCookies(event);
+      optOutOfAuthDisabledSession(event);
 
       try {
         await auth.api.signOut({ headers: event.headers });
@@ -3421,6 +3444,7 @@ async function mountBetterAuthRoutes(
         // 3. Drop the current request's cookie and best-effort sign out
         // of Better Auth (so the response sets the proper expiry header).
         clearFrameworkSessionCookies(event);
+        optOutOfAuthDisabledSession(event);
         try {
           await auth.api.signOut({ headers: event.headers });
         } catch {
@@ -3589,6 +3613,7 @@ function mountAuthFallbackRoutes(app: H3App): void {
       const bearerToken = getBearerSessionToken(event);
       if (bearerToken) await removeSession(bearerToken);
       clearFrameworkSessionCookies(event);
+      optOutOfAuthDisabledSession(event);
 
       try {
         const auth = await getBetterAuth();
@@ -3746,6 +3771,7 @@ export async function autoMountAuth(
         const bearerToken = getBearerSessionToken(event);
         if (bearerToken) await removeSession(bearerToken);
         clearFrameworkSessionCookies(event);
+        optOutOfAuthDisabledSession(event);
         if (isElectronRequest(event)) await clearDesktopSso();
         return { ok: true };
       }),

package/corpus/core/src/server/embed-route.ts

@@ -22,6 +22,7 @@ import { getConfiguredAppBasePath } from "./app-base-path.js";
 import type { AuthSession } from "./auth.js";
 import {
   consumeEmbedSessionTicket,
+  isEmbedCapabilityScope,
   normalizeEmbedTargetPath,
   setEmbedSessionCookie,
   signEmbedSessionToken,
@@ -263,6 +264,14 @@ export function createEmbedStartRouteHandler(
       orgId: consumed.orgId,
       targetPath: target,
       scope: consumed.scope,
+      ...(isEmbedCapabilityScope(consumed.scope)
+        ? {
+            ttlSeconds: Math.max(
+              1,
+              Math.floor((consumed.expiresAt - Date.now()) / 1000),
+            ),
+          }
+        : {}),
     });
     setEmbedSessionCookie(event, token);
     setResponseHeader(event, "Referrer-Policy", "no-referrer");