@agent-native/core 0.14.8 → 0.15.1

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAsChE,KAAK,KAAK,GAAG,SAAS,CAAC;AAQvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAMlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAyB5D;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;OAGG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAwCD;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAKpD;AAID,eAAO,MAAM,WAAW,QAMJ,CAAC;AAErB;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAGvD;AAqFD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAUrE;AA8ND;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW7E;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB3E;AA8CD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAmBD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,QAWd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,2BAA2B,QAOnC;AAmGD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;AAwUD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CA6E5E;AA0CD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAQ7E;AAuyCD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAqKlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAEzE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAsChE,KAAK,KAAK,GAAG,SAAS,CAAC;AAQvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAMlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAwB5D,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAE7C;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;OAGG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAwCD;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAKpD;AAID,eAAO,MAAM,WAAW,QAMJ,CAAC;AAErB;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAGvD;AA2JD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAUrE;AA8ND;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW7E;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB3E;AAsED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAmBD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,QAWd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,2BAA2B,QAOnC;AAmGD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;AAsbD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAqE5E;AA0CD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAS7E;AAu2CD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAmMlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAEzE"}

package/dist/server/auth.js

@@ -45,6 +45,7 @@ import { safeOAuthReturnUrl } from "./oauth-return-url.js";
 import { captureAuthError } from "./sentry.js";
 import { extractOAuthStateAppId } from "../shared/oauth-state.js";
 import { isValidWorkspaceAppIdFormat } from "../shared/workspace-app-id.js";
+import { normalizeWorkspaceAppAudience, workspaceAppAudienceFromEnv, workspaceAppRouteAccessFromEnv, } from "../shared/workspace-app-audience.js";
 /**
  * Get the configured session max age. Desktop SSO broker writes from
  * OAuth flows read this so expiration stays consistent with the cookie.
@@ -117,6 +118,72 @@ export function cookieDomainAttrs() {
     const domain = getCookieDomain();
     return domain ? { domain } : {};
 }
+function getCookieValues(event, name) {
+    const values = [];
+    const raw = getHeader(event, "cookie");
+    if (raw) {
+        for (const part of String(raw).split(";")) {
+            const trimmed = part.trim();
+            if (!trimmed)
+                continue;
+            const eq = trimmed.indexOf("=");
+            if (eq <= 0)
+                continue;
+            if (trimmed.slice(0, eq).trim() !== name)
+                continue;
+            let value = trimmed.slice(eq + 1).trim();
+            if (value.startsWith('"') && value.endsWith('"')) {
+                value = value.slice(1, -1);
+            }
+            try {
+                value = decodeURIComponent(value);
+            }
+            catch {
+                // Keep the raw cookie value if it was not percent-encoded.
+            }
+            if (value && !values.includes(value))
+                values.push(value);
+        }
+    }
+    // H3's cookie parser keeps only the first duplicate name. Preserve it as a
+    // fallback for mock/runtime shapes that do not expose the raw Cookie header.
+    const parsed = getCookie(event, name);
+    if (parsed && !values.includes(parsed))
+        values.push(parsed);
+    return values;
+}
+function getFrameworkSessionCookieValues(event) {
+    return getCookieValues(event, COOKIE_NAME);
+}
+function frameworkSessionCookieNamesToClear() {
+    const names = new Set([COOKIE_NAME]);
+    if (APP_NAME_SLUG)
+        names.add(`an_session_${APP_NAME_SLUG}`);
+    return [...names];
+}
+function deleteCookieFromEveryScope(event, name) {
+    // Clear host-only cookies first. When COOKIE_DOMAIN was introduced, stale
+    // host-only `an_session` cookies could shadow the new domain cookie because
+    // browsers send older same-path duplicates first.
+    deleteCookie(event, name, { path: "/" });
+    const domainAttrs = cookieDomainAttrs();
+    if (domainAttrs.domain) {
+        deleteCookie(event, name, { path: "/", ...domainAttrs });
+    }
+}
+function clearFrameworkSessionCookies(event) {
+    for (const name of frameworkSessionCookieNamesToClear()) {
+        deleteCookieFromEveryScope(event, name);
+    }
+}
+async function getLegacyCookieSession(event) {
+    for (const cookie of getFrameworkSessionCookieValues(event)) {
+        const email = await getSessionEmail(cookie);
+        if (email)
+            return { email, token: cookie };
+    }
+    return null;
+}
 function getOAuthStateAppId() {
     const raw = process.env.APP_NAME || process.env.npm_package_name;
     if (!raw)
@@ -478,6 +545,16 @@ export async function getSessionEmail(token) {
 let customGetSession = null;
 let _authGuardConfig = null;
 const _genericGoogleOAuthRoutesEnabled = new WeakMap();
+function resolveWorkspaceAppAudience(options = {}) {
+    return normalizeWorkspaceAppAudience(options.workspaceAppAudience ?? workspaceAppAudienceFromEnv());
+}
+function resolveWorkspaceAppRouteAccess(options = {}) {
+    const env = workspaceAppRouteAccessFromEnv();
+    return {
+        publicPaths: options.workspaceAppPublicPaths ?? env.publicPaths,
+        protectedPaths: options.workspaceAppProtectedPaths ?? env.protectedPaths,
+    };
+}
 function setGenericGoogleOAuthRoutesEnabled(app, enabled) {
     if (app && typeof app === "object") {
         _genericGoogleOAuthRoutesEnabled.set(app, enabled);
@@ -850,6 +927,9 @@ function createAuthGuardFn() {
             return;
         if (isPublicPath(normalizedUrl, publicPaths))
             return;
+        if (isPublicWorkspacePageRequest(event, p, config)) {
+            return;
+        }
         const session = await getSession(event);
         if (session)
             return;
@@ -857,12 +937,116 @@ function createAuthGuardFn() {
             setResponseStatus(event, 401);
             return { error: "Unauthorized" };
         }
+        // Local-dev convenience: on the first page GET of a freshly-scaffolded
+        // app, transparently create + sign in `dev@local` instead of showing the
+        // sign-up form. Gated on NODE_ENV=development AND no real users in the
+        // DB, so production and any app that has ever had a real signup are
+        // unaffected. See maybeAutoCreateDevSession for full conditions.
+        if (getMethod(event) === "GET") {
+            const autoSession = await maybeAutoCreateDevSession(event, url);
+            if (autoSession)
+                return autoSession;
+        }
         return new Response(loginHtml, {
             status: 200,
             headers: { "Content-Type": "text/html; charset=utf-8" },
         });
     };
 }
+const AUTO_DEV_ACCOUNT_EMAIL = "dev@local";
+const AUTO_DEV_ACCOUNT_PASSWORD = "local-dev-account";
+/**
+ * Local-dev convenience: skip the sign-up wall on first run.
+ *
+ * When NODE_ENV=development AND the `user` table has no rows for any
+ * email other than `dev@local`, transparently sign up (or sign back in
+ * to) the auto-managed dev account and return a 302 to the original URL
+ * with a session cookie set. A developer who just ran `pnpm dev` lands
+ * in the app immediately instead of being asked to fill in name + email
+ * + password to try the framework.
+ *
+ * Auto-create fires exactly once per local DB: as soon as `dev@local`
+ * (or any real user) exists in the `user` table, the helper returns
+ * null and the normal login flow takes over. Signing out then leaves
+ * the user on the regular sign-in form; without this guard the
+ * post-logout reload would silently re-create the session.
+ *
+ * The fixed password is intentional: it means a developer who signs
+ * out can sign back in with `dev@local` / `local-dev-account` from
+ * the regular login form. To get the auto-flow back, drop the user
+ * row or wipe the local DB. Set
+ * `AGENT_NATIVE_DISABLE_AUTO_DEV_ACCOUNT=1` to opt out entirely
+ * (useful for tests that exercise the unauthenticated branch). This
+ * is local-only — the helper is gated on NODE_ENV.
+ */
+async function maybeAutoCreateDevSession(event, redirectTo) {
+    if (!isDevEnvironment())
+        return null;
+    if (process.env.AGENT_NATIVE_DISABLE_AUTO_DEV_ACCOUNT === "1")
+        return null;
+    try {
+        const db = getDbExec();
+        const { rows: realUsers } = await db.execute({
+            sql: 'SELECT 1 FROM "user" WHERE email != ? LIMIT 1',
+            args: [AUTO_DEV_ACCOUNT_EMAIL],
+        });
+        if (realUsers.length > 0)
+            return null;
+        // If `dev@local` already exists, this is not a freshly-scaffolded
+        // app — the user has been through the auto-create flow at least
+        // once. Skip auto-create so signing out actually works: without
+        // this guard, the post-logout reload immediately re-creates the
+        // session and the user is stuck in dev@local forever (or has to
+        // set AGENT_NATIVE_DISABLE_AUTO_DEV_ACCOUNT=1). To get the demo
+        // experience back, drop the row or wipe the local DB.
+        const { rows: devUsers } = await db.execute({
+            sql: 'SELECT 1 FROM "user" WHERE email = ? LIMIT 1',
+            args: [AUTO_DEV_ACCOUNT_EMAIL],
+        });
+        if (devUsers.length > 0)
+            return null;
+        const auth = await getBetterAuth();
+        if (!auth)
+            return null;
+        // Idempotent sign-up: succeeds on first run, throws an "already exists"
+        // failure on subsequent runs (which we swallow before falling through
+        // to the sign-in path below).
+        try {
+            await auth.api.signUpEmail({
+                body: {
+                    email: AUTO_DEV_ACCOUNT_EMAIL,
+                    password: AUTO_DEV_ACCOUNT_PASSWORD,
+                    name: "Dev",
+                },
+            });
+        }
+        catch (e) {
+            if (!isExpectedAuthFailure(e))
+                throw e;
+        }
+        const result = await auth.api.signInEmail({
+            body: {
+                email: AUTO_DEV_ACCOUNT_EMAIL,
+                password: AUTO_DEV_ACCOUNT_PASSWORD,
+            },
+        });
+        if (!result?.token)
+            return null;
+        setFrameworkSessionCookie(event, result.token);
+        await addSession(result.token, AUTO_DEV_ACCOUNT_EMAIL);
+        return new Response("", {
+            status: 302,
+            headers: { Location: redirectTo },
+        });
+    }
+    catch (e) {
+        // Local-dev only — log to console for debugging, but don't surface
+        // through Sentry. Falling back to the regular login form is the
+        // correct user-facing behavior when this path fails.
+        console.warn("[agent-native] auto dev account skipped:", e);
+        return null;
+    }
+}
 /**
  * Map a Better Auth session to our AuthSession type.
  */
@@ -896,12 +1080,9 @@ export async function getSession(event) {
     // 1. ACCESS_TOKEN check (programmatic/agent access)
     const accessTokens = getAccessTokens();
     if (accessTokens.length > 0) {
-        const cookie = getCookie(event, COOKIE_NAME);
-        if (cookie) {
-            const email = await getSessionEmail(cookie);
-            if (email)
-                return { email, token: cookie };
-        }
+        const cookieSession = await getLegacyCookieSession(event);
+        if (cookieSession)
+            return cookieSession;
     }
     // 2. BYOA custom getSession
     if (customGetSession) {
@@ -943,13 +1124,9 @@ export async function getSession(event) {
             console.error("[auth] ba.api.getSession error:", e);
         }
         // 5. Legacy cookie fallback (for sessions created before migration)
-        const cookie = getCookie(event, COOKIE_NAME);
-        if (cookie) {
-            const email = await getSessionEmail(cookie);
-            if (email) {
-                return { email, token: cookie };
-            }
-        }
+        const cookieSession = await getLegacyCookieSession(event);
+        if (cookieSession)
+            return cookieSession;
         // 6. Desktop SSO broker fallback.
         // Each template in the Electron desktop app has its own database, so
         // a session token created by one template doesn't resolve in another.
@@ -1004,6 +1181,7 @@ function crossSiteCookieAttrs(event) {
         : { sameSite: "lax", secure: false };
 }
 export function setFrameworkSessionCookie(event, token) {
+    clearFrameworkSessionCookies(event);
     setCookie(event, COOKIE_NAME, token, {
         httpOnly: true,
         ...crossSiteCookieAttrs(event),
@@ -1036,7 +1214,32 @@ function isHttpsRequest(event) {
 // ---------------------------------------------------------------------------
 function isPublicPath(url, publicPaths) {
     const p = url.split("?")[0];
-    return publicPaths.some((pp) => p === pp || p.startsWith(pp + "/"));
+    return matchesPathList(p, publicPaths);
+}
+function matchesPathList(path, paths) {
+    return paths.some((candidate) => {
+        const normalized = candidate.length > 1 && candidate.endsWith("/")
+            ? candidate.slice(0, -1)
+            : candidate;
+        return path === normalized || path.startsWith(normalized + "/");
+    });
+}
+function isPublicWorkspacePageRequest(event, path, config) {
+    if (!isReadMethod(event))
+        return false;
+    if (path === "/_agent-native" ||
+        path.startsWith("/_agent-native/") ||
+        path === "/api" ||
+        path.startsWith("/api/") ||
+        path === "/.well-known" ||
+        path.startsWith("/.well-known/")) {
+        return false;
+    }
+    if (matchesPathList(path, config.workspaceAppProtectedPaths))
+        return false;
+    if (matchesPathList(path, config.workspaceAppPublicPaths))
+        return true;
+    return config.workspaceAppAudience === "public";
 }
 function stripAppBasePath(pathname) {
     const basePath = getAppBasePath();
@@ -1384,6 +1587,8 @@ function getTokenLoginHtml(options = {}) {
 // ---------------------------------------------------------------------------
 async function mountBetterAuthRoutes(app, options) {
     const publicPaths = [...(options.publicPaths ?? [])];
+    const workspaceAppAudience = resolveWorkspaceAppAudience(options);
+    const workspaceAppRouteAccess = resolveWorkspaceAppRouteAccess(options);
     // The A2A agent card is part of an open protocol — other agents must be
     // able to discover it without auth. Same for favicons and similar probes.
     for (const pp of ["/.well-known", "/favicon.ico", "/favicon.png"]) {
@@ -1488,10 +1693,6 @@ async function mountBetterAuthRoutes(app, options) {
             try {
                 const query = getQuery(event);
                 const code = query.code;
-                if (!code) {
-                    setResponseStatus(event, 400);
-                    return { error: "Missing authorization code" };
-                }
                 const { redirectUri, desktop, returnUrl, flowId } = decodeOAuthState(query.state, getAppUrl(event, "/_agent-native/google/callback"));
                 callbackFlowId = flowId;
                 callbackDesktop = desktop;
@@ -1502,14 +1703,50 @@ async function mountBetterAuthRoutes(app, options) {
                     hasCode: !!code,
                     returnUrl,
                 });
+                if (!code) {
+                    const providerError = typeof query.error === "string" && query.error
+                        ? query.error
+                        : undefined;
+                    const providerDescription = typeof query.error_description === "string" &&
+                        query.error_description
+                        ? query.error_description
+                        : undefined;
+                    const msg = providerDescription ||
+                        providerError ||
+                        "Missing authorization code";
+                    if (flowId) {
+                        setDesktopExchangeError(flowId, {
+                            message: `Google sign-in failed: ${msg}`,
+                            code: providerError || "missing_authorization_code",
+                        });
+                    }
+                    logGoogleOAuthDebug(event, "callback-error", {
+                        flowId,
+                        desktop,
+                        message: msg,
+                        code: providerError,
+                    });
+                    return oauthErrorPage(`Connection failed: ${msg}`);
+                }
                 // Defence in depth: the state is HMAC-signed, but if the signing
                 // key ever leaked an attacker could mint state with their own
                 // redirect_uri. Re-validate against the same allowlist used at
                 // auth-url time so the token exchange is always sent to a URI we
                 // own.
                 if (!isAllowedOAuthRedirectUri(redirectUri, event)) {
-                    setResponseStatus(event, 400);
-                    return { error: "Invalid redirect_uri in state" };
+                    const msg = "Invalid Google OAuth redirect URI in state. Restart sign-in from this app.";
+                    if (flowId) {
+                        setDesktopExchangeError(flowId, {
+                            message: msg,
+                            code: "invalid_redirect_uri",
+                        });
+                    }
+                    logGoogleOAuthDebug(event, "callback-error", {
+                        flowId,
+                        desktop,
+                        message: msg,
+                    });
+                    return oauthErrorPage(`Connection failed: ${msg}`);
                 }
                 const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
                     method: "POST",
@@ -1580,6 +1817,12 @@ async function mountBetterAuthRoutes(app, options) {
             }
             catch (error) {
                 const msg = error.message || "Unknown error";
+                if (callbackFlowId) {
+                    setDesktopExchangeError(callbackFlowId, {
+                        message: `Google sign-in failed: ${msg}`,
+                        code: "callback_error",
+                    });
+                }
                 logGoogleOAuthDebug(event, "callback-error", {
                     flowId: callbackFlowId,
                     desktop: callbackDesktop,
@@ -1821,13 +2064,7 @@ async function mountBetterAuthRoutes(app, options) {
             }
             const sessionToken = crypto.randomBytes(32).toString("hex");
             await addSession(sessionToken, "user");
-            setCookie(event, COOKIE_NAME, sessionToken, {
-                httpOnly: true,
-                ...crossSiteCookieAttrs(event),
-                ...cookieDomainAttrs(),
-                path: "/",
-                maxAge: sessionMaxAge,
-            });
+            setFrameworkSessionCookie(event, sessionToken);
             return authLoginResponse(event, sessionToken, "user");
         }
         // Email/password login via Better Auth
@@ -1842,13 +2079,7 @@ async function mountBetterAuthRoutes(app, options) {
                 body: { email, password },
             });
             if (result?.token) {
-                setCookie(event, COOKIE_NAME, result.token, {
-                    httpOnly: true,
-                    ...crossSiteCookieAttrs(event),
-                    ...cookieDomainAttrs(),
-                    path: "/",
-                    maxAge: sessionMaxAge,
-                });
+                setFrameworkSessionCookie(event, result.token);
                 await addSession(result.token, email);
                 if (isElectronRequest(event)) {
                     await writeDesktopSso({
@@ -1911,13 +2142,13 @@ async function mountBetterAuthRoutes(app, options) {
     }));
     // Backward-compat: POST /_agent-native/auth/logout
     app.use("/_agent-native/auth/logout", defineEventHandler(async (event) => {
-        const cookie = getCookie(event, COOKIE_NAME);
-        if (cookie)
+        for (const cookie of getFrameworkSessionCookieValues(event)) {
             await removeSession(cookie);
+        }
         const bearerToken = getBearerSessionToken(event);
         if (bearerToken)
             await removeSession(bearerToken);
-        deleteCookie(event, COOKIE_NAME, { path: "/", ...cookieDomainAttrs() });
+        clearFrameworkSessionCookies(event);
         try {
             await auth.api.signOut({ headers: event.headers });
         }
@@ -1980,7 +2211,7 @@ async function mountBetterAuthRoutes(app, options) {
             }
             // 3. Drop the current request's cookie and best-effort sign out
             // of Better Auth (so the response sets the proper expiry header).
-            deleteCookie(event, COOKIE_NAME, { path: "/", ...cookieDomainAttrs() });
+            clearFrameworkSessionCookies(event);
             try {
                 await auth.api.signOut({ headers: event.headers });
             }
@@ -2026,7 +2257,13 @@ async function mountBetterAuthRoutes(app, options) {
             googleSignInNotice: options.googleSignInNotice,
             googleAuthMode: options.googleAuthMode,
         });
-    _authGuardConfig = { loginHtml, publicPaths };
+    _authGuardConfig = {
+        loginHtml,
+        publicPaths,
+        workspaceAppAudience,
+        workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
+        workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
+    };
     const guardFn = createAuthGuardFn();
     _authGuardFn = guardFn;
     app.use(defineEventHandler(guardFn));
@@ -2034,7 +2271,7 @@ async function mountBetterAuthRoutes(app, options) {
 // ---------------------------------------------------------------------------
 // mountTokenOnlyRoutes — ACCESS_TOKEN-only auth (no Better Auth)
 // ---------------------------------------------------------------------------
-function mountTokenOnlyRoutes(app, accessTokens, publicPaths = []) {
+function mountTokenOnlyRoutes(app, accessTokens, publicPaths = [], workspaceAppAudience = resolveWorkspaceAppAudience(), workspaceAppRouteAccess = resolveWorkspaceAppRouteAccess()) {
     app.use("/_agent-native/auth/login", defineEventHandler(async (event) => {
         if (getMethod(event) !== "POST") {
             setResponseStatus(event, 405);
@@ -2049,23 +2286,17 @@ function mountTokenOnlyRoutes(app, accessTokens, publicPaths = []) {
         }
         const sessionToken = crypto.randomBytes(32).toString("hex");
         await addSession(sessionToken, "user");
-        setCookie(event, COOKIE_NAME, sessionToken, {
-            httpOnly: true,
-            ...crossSiteCookieAttrs(event),
-            ...cookieDomainAttrs(),
-            path: "/",
-            maxAge: sessionMaxAge,
-        });
+        setFrameworkSessionCookie(event, sessionToken);
         return authLoginResponse(event, sessionToken, "user");
     }));
     app.use("/_agent-native/auth/logout", defineEventHandler(async (event) => {
-        const cookie = getCookie(event, COOKIE_NAME);
-        if (cookie)
+        for (const cookie of getFrameworkSessionCookieValues(event)) {
             await removeSession(cookie);
+        }
         const bearerToken = getBearerSessionToken(event);
         if (bearerToken)
             await removeSession(bearerToken);
-        deleteCookie(event, COOKIE_NAME, { path: "/", ...cookieDomainAttrs() });
+        clearFrameworkSessionCookies(event);
         if (isElectronRequest(event))
             await clearDesktopSso();
         return { ok: true };
@@ -2082,6 +2313,9 @@ function mountTokenOnlyRoutes(app, accessTokens, publicPaths = []) {
         loginHtml: getTokenLoginHtml(),
         getLoginHtml: (_event, rawPath) => getTokenLoginHtml({ requestPath: rawPath }),
         publicPaths,
+        workspaceAppAudience,
+        workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
+        workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
     };
     const guardFn = createAuthGuardFn();
     _authGuardFn = guardFn;
@@ -2109,13 +2343,7 @@ function mountAuthFallbackRoutes(app) {
                 body: { email, password },
             });
             if (result?.token) {
-                setCookie(event, COOKIE_NAME, result.token, {
-                    httpOnly: true,
-                    ...crossSiteCookieAttrs(event),
-                    ...cookieDomainAttrs(),
-                    path: "/",
-                    maxAge: sessionMaxAge,
-                });
+                setFrameworkSessionCookie(event, result.token);
                 await addSession(result.token, email);
                 if (isElectronRequest(event)) {
                     await writeDesktopSso({
@@ -2171,13 +2399,13 @@ function mountAuthFallbackRoutes(app) {
         }
     }));
     app.use("/_agent-native/auth/logout", defineEventHandler(async (event) => {
-        const cookie = getCookie(event, COOKIE_NAME);
-        if (cookie)
+        for (const cookie of getFrameworkSessionCookieValues(event)) {
             await removeSession(cookie);
+        }
         const bearerToken = getBearerSessionToken(event);
         if (bearerToken)
             await removeSession(bearerToken);
-        deleteCookie(event, COOKIE_NAME, { path: "/", ...cookieDomainAttrs() });
+        clearFrameworkSessionCookies(event);
         try {
             const auth = await getBetterAuth();
             await auth.api.signOut({ headers: event.headers });
@@ -2257,6 +2485,18 @@ export async function autoMountAuth(app, options = {}) {
                     ...options.publicPaths,
                 ];
             }
+            if (options.workspaceAppAudience) {
+                _authGuardConfig.workspaceAppAudience =
+                    resolveWorkspaceAppAudience(options);
+            }
+            if (options.workspaceAppPublicPaths) {
+                _authGuardConfig.workspaceAppPublicPaths =
+                    options.workspaceAppPublicPaths;
+            }
+            if (options.workspaceAppProtectedPaths) {
+                _authGuardConfig.workspaceAppProtectedPaths =
+                    options.workspaceAppProtectedPaths;
+            }
         }
         return true;
     }
@@ -2276,6 +2516,8 @@ export async function autoMountAuth(app, options = {}) {
     customGetSession = null;
     sessionMaxAge = options.maxAge ?? DEFAULT_MAX_AGE;
     const publicPaths = options.publicPaths ?? [];
+    const workspaceAppAudience = resolveWorkspaceAppAudience(options);
+    const workspaceAppRouteAccess = resolveWorkspaceAppRouteAccess(options);
     mountAuthCorsMiddleware(app);
     if (options.getSession) {
         customGetSession = options.getSession;
@@ -2292,13 +2534,13 @@ export async function autoMountAuth(app, options = {}) {
         }));
         app.use("/_agent-native/auth/login", defineEventHandler(() => ({ ok: true })));
         app.use("/_agent-native/auth/logout", defineEventHandler(async (event) => {
-            const cookie = getCookie(event, COOKIE_NAME);
-            if (cookie)
+            for (const cookie of getFrameworkSessionCookieValues(event)) {
                 await removeSession(cookie);
+            }
             const bearerToken = getBearerSessionToken(event);
             if (bearerToken)
                 await removeSession(bearerToken);
-            deleteCookie(event, COOKIE_NAME, { path: "/", ...cookieDomainAttrs() });
+            clearFrameworkSessionCookies(event);
             if (isElectronRequest(event))
                 await clearDesktopSso();
             return { ok: true };
@@ -2312,6 +2554,9 @@ export async function autoMountAuth(app, options = {}) {
                     getLoginHtml: (_event, rawPath) => getTokenLoginHtml({ requestPath: rawPath }),
                 }),
             publicPaths,
+            workspaceAppAudience,
+            workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
+            workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
         };
         const guardFn = createAuthGuardFn();
         _authGuardFn = guardFn;
@@ -2323,7 +2568,7 @@ export async function autoMountAuth(app, options = {}) {
     // ACCESS_TOKEN-only mode
     const tokens = getAccessTokens();
     if (tokens.length > 0) {
-        mountTokenOnlyRoutes(app, tokens, publicPaths);
+        mountTokenOnlyRoutes(app, tokens, publicPaths, workspaceAppAudience, workspaceAppRouteAccess);
         if (process.env.DEBUG)
             console.log(`[agent-native] Auth enabled — ${tokens.length} access token(s) configured.`);
         return true;
@@ -2347,7 +2592,13 @@ export async function autoMountAuth(app, options = {}) {
                 googleSignInNotice: options.googleSignInNotice,
                 googleAuthMode: options.googleAuthMode,
             });
-        _authGuardConfig = { loginHtml, publicPaths };
+        _authGuardConfig = {
+            loginHtml,
+            publicPaths,
+            workspaceAppAudience,
+            workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
+            workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
+        };
         const guardFn = createAuthGuardFn();
         _authGuardFn = guardFn;
         app.use(defineEventHandler(guardFn));