@agent-native/core 0.129.2 → 0.130.1

package/corpus/core/src/org/workspace-url.ts

@@ -0,0 +1,74 @@
+/**
+ * Parsing and comparison for `organizations.workspace_url` — the origin of an
+ * org's own workspace deployment.
+ *
+ * The value is set by an owner/admin and then rendered as a link target for
+ * every member of the org, so it is parsed at the trust boundary rather than
+ * on the way out: anything that is not an `http(s)` origin never reaches the
+ * database.
+ */
+
+export type ParsedWorkspaceUrl =
+  | { ok: true; url: string }
+  | { ok: false; reason: string };
+
+/**
+ * Normalize a workspace URL to a bare origin (`https://host[:port]`).
+ *
+ * Path, query, and hash are dropped: this points at a deployment, not a page,
+ * and keeping them would send members to a route that may not exist in the
+ * app they arrive at.
+ */
+export function parseWorkspaceUrl(raw: string): ParsedWorkspaceUrl {
+  const trimmed = raw.trim();
+  if (!trimmed) {
+    return { ok: false, reason: "Workspace URL is empty" };
+  }
+
+  // Accept a bare host ("agent-workspace.builder.io") the way a browser bar
+  // does — otherwise the most natural thing to paste is rejected.
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)
+    ? trimmed
+    : `https://${trimmed}`;
+
+  let parsed: URL;
+  try {
+    parsed = new URL(withScheme);
+  } catch {
+    return { ok: false, reason: "Not a valid URL" };
+  }
+
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    return { ok: false, reason: "Workspace URL must be http or https" };
+  }
+  if (!parsed.hostname.includes(".") && parsed.hostname !== "localhost") {
+    return { ok: false, reason: "Workspace URL must include a full hostname" };
+  }
+
+  return { ok: true, url: parsed.origin };
+}
+
+/**
+ * Whether a member currently on `currentUrl` should be pointed at the org's
+ * workspace. False when the org has no workspace, when the stored value is
+ * unusable, or when they are already on it — including any subdomain-free
+ * port/scheme difference, which `URL.origin` compares exactly.
+ */
+export function shouldOfferWorkspace(
+  currentUrl: string,
+  workspaceUrl: string | null | undefined,
+): boolean {
+  if (!workspaceUrl) return false;
+
+  const parsed = parseWorkspaceUrl(workspaceUrl);
+  if (!parsed.ok) return false;
+
+  let currentOrigin: string;
+  try {
+    currentOrigin = new URL(currentUrl).origin;
+  } catch {
+    return false;
+  }
+
+  return currentOrigin !== parsed.url;
+}

package/corpus/core/src/resources/handlers.ts

@@ -72,6 +72,28 @@ function canReadOwner(
   );
 }
 
+function resourceDownloadDisposition(path: string): string {
+  const basename = path.replaceAll("\\", "/").split("/").pop()?.trim() || "";
+  const filename = Array.from(basename)
+    .slice(0, 180)
+    .map((character) => {
+      const codePoint = character.codePointAt(0) ?? 0;
+      return codePoint <= 31 || codePoint === 127 ? "_" : character;
+    })
+    .join("");
+  const safeFilename =
+    filename && filename !== "." && filename !== ".." ? filename : "download";
+  const asciiFilename = safeFilename
+    .replace(/[^\x20-\x7e]/g, "_")
+    .replace(/["\\]/g, "_");
+  const encodedFilename = encodeURIComponent(safeFilename).replace(
+    /['()*]/g,
+    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,
+  );
+
+  return `attachment; filename="${asciiFilename}"; filename*=UTF-8''${encodedFilename}`;
+}
+
 function mergeScopedResources(
   primary: ResourceMeta[],
   inherited: ResourceMeta[],
@@ -398,9 +420,8 @@ async function enrichTreeNodes(nodes: TreeNode[]): Promise<void> {
 }
 
 /** GET /_agent-native/resources/:id — get single resource with content.
- *  If the request comes from an <img>/<video>/etc tag (Accept includes the
- *  resource's mime type, or query param `?raw` is set), return the raw binary
- *  with the correct Content-Type so the browser can render it inline. */
+ *  `?raw` returns the bytes inline; `?download=1` returns the same bytes as a
+ *  safe attachment. */
 export async function handleGetResource(event: any) {
   const id = getRouterParam(event, "id") || event.context.params?.id;
   if (!id) {
@@ -421,11 +442,11 @@ export async function handleGetResource(event: any) {
     return { error: "Resource not found" };
   }
 
-  // Serve raw binary when ?raw query param is set (used by <img> tags etc.)
   const query = getQuery(event);
   const wantsRaw = query.raw !== undefined;
+  const wantsDownload = query.download === "1";
 
-  if (wantsRaw && resource.content) {
+  if ((wantsRaw || wantsDownload) && typeof resource.content === "string") {
     const isText =
       resource.mimeType.startsWith("text/") ||
       resource.mimeType === "application/json";
@@ -435,6 +456,15 @@ export async function handleGetResource(event: any) {
 
     setResponseHeader(event, "Content-Type", resource.mimeType);
     setResponseHeader(event, "Content-Length", String(buf.length));
+    setResponseHeader(event, "Cache-Control", "private, no-store");
+    setResponseHeader(event, "X-Content-Type-Options", "nosniff");
+    if (wantsDownload) {
+      setResponseHeader(
+        event,
+        "Content-Disposition",
+        resourceDownloadDisposition(resource.path),
+      );
+    }
     return new Response(buf);
   }
 

package/corpus/core/src/scripts/runner.ts

@@ -11,6 +11,7 @@
  */
 
 import fs from "fs";
+import { spawnSync } from "node:child_process";
 import path from "path";
 import { pathToFileURL } from "url";
 
@@ -29,6 +30,174 @@ import { loadEnv } from "./utils.js";
 // Load .env from cwd so DATABASE_URL and other vars are available to all actions.
 loadEnv();
 
+const CLI_HANDOFF_KEYS = new Set(["embedStartUrl", "startUrl"]);
+const CLI_HANDOFF_URL_PATTERN =
+  /\/_agent-native\/embed\/start\?[^\s"'<>)}\]]+/g;
+
+function withoutCliHandoffText(value: unknown): string {
+  return String(value).replace(
+    CLI_HANDOFF_URL_PATTERN,
+    "[redacted embed handoff]",
+  );
+}
+
+function cliHandoffUrl(result: unknown): string | undefined {
+  if (!result || typeof result !== "object") return undefined;
+  for (const key of CLI_HANDOFF_KEYS) {
+    const value = (result as Record<string, unknown>)[key];
+    if (
+      typeof value === "string" &&
+      value.includes("/_agent-native/embed/start?")
+    ) {
+      return value;
+    }
+  }
+  return undefined;
+}
+
+function withoutCliHandoffSecrets(
+  value: unknown,
+  ancestors = new WeakSet<object>(),
+): unknown {
+  if (
+    typeof value === "string" &&
+    value.includes("/_agent-native/embed/start?")
+  ) {
+    return withoutCliHandoffText(value);
+  }
+  if (!value || typeof value !== "object") return value;
+  if (ancestors.has(value)) return "[Circular]";
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return value.map((child) => withoutCliHandoffSecrets(child, ancestors));
+    }
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>)
+        .filter(([key]) => !CLI_HANDOFF_KEYS.has(key))
+        .map(([key, child]) => [
+          key,
+          withoutCliHandoffSecrets(child, ancestors),
+        ]),
+    );
+  } finally {
+    ancestors.delete(value);
+  }
+}
+
+type CliHandoffLaunchOutcome =
+  | { ok: true }
+  | {
+      ok: false;
+      reason: "disabled" | "missing-base" | "invalid-url" | "open-failed";
+      message: string;
+    };
+
+interface CliHandoffLaunchDeps {
+  env?: NodeJS.ProcessEnv;
+  platform?: NodeJS.Platform;
+  spawn?: (
+    command: string,
+    args: string[],
+  ) => { status: number | null; error?: Error };
+}
+
+export function openCliHandoff(
+  urlOrPath: string,
+  deps: CliHandoffLaunchDeps = {},
+): CliHandoffLaunchOutcome {
+  const env = deps.env ?? process.env;
+  if (env.AGENT_NATIVE_NO_OPEN === "1") {
+    return {
+      ok: false,
+      reason: "disabled",
+      message:
+        "Secure browser handoff is disabled by AGENT_NATIVE_NO_OPEN. Remove it and rerun this action.",
+    };
+  }
+  let url = urlOrPath;
+  if (urlOrPath.startsWith("/")) {
+    const baseUrl =
+      env.APP_URL ||
+      env.WORKSPACE_GATEWAY_URL ||
+      env.VITE_WORKSPACE_GATEWAY_URL ||
+      env.BETTER_AUTH_URL;
+    if (!baseUrl) {
+      return {
+        ok: false,
+        reason: "missing-base",
+        message:
+          "Secure browser handoff needs APP_URL or WORKSPACE_GATEWAY_URL. Start the app locally or set its URL, then rerun this action.",
+      };
+    }
+    try {
+      url = new URL(urlOrPath, baseUrl).toString();
+    } catch {
+      return {
+        ok: false,
+        reason: "invalid-url",
+        message:
+          "Secure browser handoff found an invalid app URL. Fix APP_URL or WORKSPACE_GATEWAY_URL, then rerun this action.",
+      };
+    }
+  }
+  try {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error("unsupported protocol");
+    }
+  } catch {
+    return {
+      ok: false,
+      reason: "invalid-url",
+      message:
+        "Secure browser handoff found an invalid app URL. Fix APP_URL or WORKSPACE_GATEWAY_URL, then rerun this action.",
+    };
+  }
+
+  const platform = deps.platform ?? process.platform;
+  const command =
+    platform === "darwin" ? "open" : platform === "win32" ? "cmd" : "xdg-open";
+  const args = platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const launch =
+      deps.spawn?.(command, args) ??
+      spawnSync(command, args, {
+        stdio: "ignore",
+        timeout: 10_000,
+      });
+    if (launch.error || launch.status !== 0) {
+      return {
+        ok: false,
+        reason: "open-failed",
+        message:
+          "Secure browser handoff could not invoke the system URL opener. Verify local URL handling, then rerun this action.",
+      };
+    }
+  } catch {
+    return {
+      ok: false,
+      reason: "open-failed",
+      message:
+        "Secure browser handoff could not invoke the system URL opener. Verify local URL handling, then rerun this action.",
+    };
+  }
+  return { ok: true };
+}
+
+function printActionResult(result: unknown): CliHandoffLaunchOutcome | null {
+  const handoffUrl = cliHandoffUrl(result);
+  const handoff = handoffUrl ? openCliHandoff(handoffUrl) : null;
+  console.log(withoutCliHandoffSecrets(result));
+  return handoff;
+}
+
+function assertCliHandoffLaunched(
+  outcome: CliHandoffLaunchOutcome | null,
+): void {
+  if (outcome && !outcome.ok) throw new Error(outcome.message);
+}
+
 export interface RunScriptOptions {
   /**
    * Actions contributed by packages rather than the app's local `actions/`
@@ -276,7 +445,7 @@ async function dispatchAction(
         if (handler.readOnly !== true) {
           await notifyActionChange({ actionName }).catch(() => {});
         }
-        if (result) console.log(result);
+        if (result) assertCliHandoffLaunched(printActionResult(result));
       } else if (typeof handler === "function") {
         await handler(args);
       } else {
@@ -289,7 +458,10 @@ async function dispatchAction(
       process.exit(0);
     } catch (err: any) {
       await closeDbExec().catch(() => {});
-      console.error(`Action "${actionName}" failed:`, err.message || err);
+      console.error(
+        `Action "${actionName}" failed:`,
+        withoutCliHandoffText(err.message || err),
+      );
       process.exit(1);
     }
   }
@@ -307,12 +479,15 @@ async function dispatchAction(
       if (packageAction.readOnly !== true) {
         await notifyActionChange({ actionName }).catch(() => {});
       }
-      if (result) console.log(result);
+      if (result) assertCliHandoffLaunched(printActionResult(result));
       await closeDbExec().catch(() => {});
       process.exit(0);
     } catch (err: any) {
       await closeDbExec().catch(() => {});
-      console.error(`Action "${actionName}" failed:`, err.message || err);
+      console.error(
+        `Action "${actionName}" failed:`,
+        withoutCliHandoffText(err.message || err),
+      );
       process.exit(1);
     }
   }
@@ -326,7 +501,10 @@ async function dispatchAction(
       process.exit(0);
     } catch (err: any) {
       await closeDbExec().catch(() => {});
-      console.error(`Core action "${actionName}" failed:`, err.message || err);
+      console.error(
+        `Core action "${actionName}" failed:`,
+        withoutCliHandoffText(err.message || err),
+      );
       process.exit(1);
     }
   }

package/corpus/core/src/server/action-routes.ts

@@ -31,6 +31,10 @@ import {
   getAllowedCorsOrigin as resolveAllowedCorsOrigin,
   readCorsAllowedOrigins,
 } from "./cors-origins.js";
+import {
+  resolveEmbedSessionFromRequest,
+  resolvedEmbedCapabilityScope,
+} from "./embed-session.js";
 import { getHttpRequestTelemetryId } from "./http-response-telemetry.js";
 
 declare const __AGENT_NATIVE_BUILD_ID__: string | undefined;
@@ -58,10 +62,12 @@ function currentBuildId(): string {
  * Actions are exposed as POST by default. Use `http: { method: "GET" }` in
  * defineAction to expose as GET. Use `http: false` to mark as agent-only.
  */
+import { isLoopbackRequest } from "./auth.js";
 import { getH3App } from "./framework-request-handler.js";
 import { runWithRequestContext } from "./request-context.js";
 
 const ROUTE_PREFIX = "/_agent-native/actions";
+const FRONTEND_MUTATION_METHODS = new Set(["POST", "PUT", "DELETE"]);
 
 async function resolveFeatureFlagA2ACaller(event: any, actionName: string) {
   const required =
@@ -309,6 +315,19 @@ function isAuthResolutionFailure(error: unknown): boolean {
   );
 }
 
+async function resolveRequestAuthCapability(
+  event: any,
+): Promise<string | undefined> {
+  try {
+    return resolvedEmbedCapabilityScope(
+      await resolveEmbedSessionFromRequest(event),
+    );
+  } catch {
+    // Invalid or unavailable embed auth must fail closed as no capability.
+    return undefined;
+  }
+}
+
 /**
  * Mount discovered actions as HTTP endpoints.
  *
@@ -348,8 +367,14 @@ export function mountActionRoutes(
           "X-Agent-Native-Client-Mismatch,X-Agent-Native-Build-Id,X-Agent-Native-Client-Compatibility",
         );
 
-        // Allow the declared method
-        if (effectiveMethod !== method) {
+        // Browser action calls are RPCs over the framework transport. The
+        // action's HTTP method remains authoritative for direct HTTP callers,
+        // but frontend callers must not have to duplicate it in every hook.
+        const isFrontendMutation =
+          isFrontendActionRequest(event) &&
+          FRONTEND_MUTATION_METHODS.has(method) &&
+          FRONTEND_MUTATION_METHODS.has(effectiveMethod);
+        if (effectiveMethod !== method && !isFrontendMutation) {
           setResponseStatus(event, 405);
           return { error: `Method not allowed. Use ${method}.` };
         }
@@ -403,6 +428,7 @@ export function mountActionRoutes(
         // Resolve auth context for per-request scoping
         let userEmail: string | undefined;
         let userName: string | undefined;
+        const authCapability = await resolveRequestAuthCapability(event);
         // An app-supplied auth adapter runs first: it can accept caller
         // identities the framework's getSession chain doesn't understand (e.g.
         // an A2A JWT). A resolved caller is seeded onto the event context so any
@@ -493,8 +519,12 @@ export function mountActionRoutes(
             userEmail,
             userName,
             orgId,
+            authCapability,
             timezone,
             requestOrigin: getRequestURL(event).origin,
+            // Captured here because this is the last layer that still holds
+            // the h3 event; everything below reads it off the request store.
+            isLoopbackRequest: isLoopbackRequest(event),
           },
           async () => {
             // Reject oversize bodies from Content-Length before parsing, so a

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -90,8 +90,10 @@ import {
 import {
   buildAssistantMessage,
   buildUserMessage,
+  claimQueuedMessage,
   extractThreadMeta,
   foldAssistantTurn,
+  hasClaimedQueuedMessage,
   mergeThreadDataForClientSave,
   upsertUserMessage,
 } from "../agent/thread-data-builder.js";
@@ -1043,6 +1045,12 @@ export function createAgentChatPlugin(
           await import("../workspace-files/tool.js");
         workspaceFilesTool = createWorkspaceFilesTool();
       } catch {}
+      let workspaceFileActions: Record<string, ActionEntry> = {};
+      try {
+        const { createWorkspaceFileActionEntries } =
+          await import("../workspace-files/actions.js");
+        workspaceFileActions = createWorkspaceFileActionEntries();
+      } catch {}
       let toolActions: Record<string, ActionEntry> =
         createDataWidgetActionEntries();
       if (extensionToolsEnabled) {
@@ -1238,6 +1246,7 @@ export function createAgentChatPlugin(
               ...fetchTool,
               ...webSearchTool,
               ...workspaceFilesTool,
+              ...workspaceFileActions,
               ...toolActions,
               ...browserSessionTools,
               ...coreEmailTools,
@@ -1263,6 +1272,7 @@ export function createAgentChatPlugin(
               ...fetchTool,
               ...webSearchTool,
               ...workspaceFilesTool,
+              ...workspaceFileActions,
               ...toolActions,
               ...browserSessionTools,
               ...coreEmailTools,
@@ -1302,6 +1312,7 @@ export function createAgentChatPlugin(
             ...fetchTool,
             ...webSearchTool,
             ...workspaceFilesTool,
+            ...workspaceFileActions,
             ...toolActions,
             ...browserSessionTools,
             ...coreEmailTools,
@@ -1630,6 +1641,7 @@ export function createAgentChatPlugin(
                   ...fetchTool,
                   ...webSearchTool,
                   ...workspaceFilesTool,
+                  ...workspaceFileActions,
                   ...toolActions,
                   ...browserSessionTools,
                   ...coreEmailTools,
@@ -1651,6 +1663,7 @@ export function createAgentChatPlugin(
                   ...fetchTool,
                   ...webSearchTool,
                   ...workspaceFilesTool,
+                  ...workspaceFileActions,
                   ...toolActions,
                   ...browserSessionTools,
                   ...coreEmailTools,
@@ -2030,6 +2043,7 @@ export function createAgentChatPlugin(
                     ...fetchTool,
                     ...webSearchTool,
                     ...workspaceFilesTool,
+                    ...workspaceFileActions,
                     ...toolActions,
                     ...mcpActionEntries,
                     ...devScriptsForA2A,
@@ -2047,6 +2061,7 @@ export function createAgentChatPlugin(
                     ...fetchTool,
                     ...webSearchTool,
                     ...workspaceFilesTool,
+                    ...workspaceFileActions,
                     ...toolActions,
                     ...mcpActionEntries,
                     ...(resolvedProdCodeExec !== "off" ? runCodeTool : {}),
@@ -2472,6 +2487,7 @@ export function createAgentChatPlugin(
         threadId: string | undefined;
         message: string;
         attachments?: AgentChatAttachment[];
+        queuedMessageId?: string;
       }) => {
         const threadId = details.threadId;
         if (!threadId) return;
@@ -2514,12 +2530,23 @@ export function createAgentChatPlugin(
             repo = {};
           }
 
+          if (details.queuedMessageId) {
+            if (hasClaimedQueuedMessage(repo, details.queuedMessageId)) {
+              throw createError({
+                statusCode: 409,
+                statusMessage: "Queued message was already submitted",
+              });
+            }
+            repo = claimQueuedMessage(repo, details.queuedMessageId);
+          }
+
           repo = upsertUserMessage(
             repo,
             buildUserMessage({
               text: details.message,
               attachments: details.attachments,
               runId: details.runId,
+              queuedMessageId: details.queuedMessageId,
             }),
           );
 
@@ -2654,6 +2681,7 @@ export function createAgentChatPlugin(
         ...fetchTool,
         ...webSearchTool,
         ...workspaceFilesTool,
+        ...workspaceFileActions,
         ...toolActions,
         ...browserSessionTools,
         ...coreEmailTools,
@@ -3193,6 +3221,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                   ...fetchTool,
                   ...webSearchTool,
                   ...workspaceFilesTool,
+                  ...workspaceFileActions,
                   ...toolActions,
                   ...browserSessionTools,
                   ...coreEmailTools,

package/corpus/core/src/server/agent-teams.ts

@@ -1988,7 +1988,16 @@ export async function processAgentTeamRun(
               resolve();
             }
           },
-          { useHostedSoftTimeoutDefault: true, turnId },
+          {
+            useHostedSoftTimeoutDefault: true,
+            turnId,
+            // No userId here: `ownerEmail` is the only identity known at
+            // this scope and is PII (email), which the terminal event must
+            // not carry.
+            model: config.model,
+            engineName: config.engine.name,
+            attemptCount: claimedAttempts,
+          },
         );
       });