@agent-native/core 0.149.0 → 0.149.2

package/corpus/templates/slides/server/lib/image-proxy-url.ts

@@ -0,0 +1,192 @@
+import net from "node:net";
+
+/**
+ * Hostnames that never belong to a legitimate slide image but are classic
+ * SSRF targets. Cloud metadata endpoints resolve to a link-local address
+ * that `isPrivateAddress` already rejects; they are listed here so the
+ * request is refused before a DNS query is issued.
+ */
+const BLOCKED_HOSTNAMES = new Set([
+  "localhost",
+  "metadata.google.internal",
+  "metadata",
+]);
+
+const BLOCKED_SUFFIXES = [".localhost", ".local", ".internal", ".home.arpa"];
+
+/** Largest image we are willing to buffer and hand back to the browser. */
+export const MAX_PROXIED_IMAGE_BYTES = 15 * 1024 * 1024;
+
+/** Redirect hops to follow. Each hop is re-validated before it is fetched. */
+export const MAX_PROXY_REDIRECTS = 3;
+
+/**
+ * Whether an IP literal points somewhere inside our own infrastructure.
+ * Anything unroutable, loopback, link-local, or RFC1918 is refused, as is
+ * any address we cannot parse — unknown means unsafe here.
+ */
+export function isPrivateAddress(address: string): boolean {
+  const version = net.isIP(address);
+
+  if (version === 4) {
+    const parts = address.split(".").map((part) => Number(part));
+    if (parts.length !== 4 || parts.some((part) => Number.isNaN(part))) {
+      return true;
+    }
+    const [a, b] = parts;
+    if (a === 0 || a === 10 || a === 127) return true;
+    if (a === 169 && b === 254) return true;
+    if (a === 172 && b >= 16 && b <= 31) return true;
+    if (a === 192 && b === 168) return true;
+    if (a === 100 && b >= 64 && b <= 127) return true;
+    if (a >= 224) return true;
+    return false;
+  }
+
+  if (version === 6) {
+    // Classify on the expanded hextets, never on the text. `::ffff:127.0.0.1`
+    // and `::ffff:7f00:1` are the same address, and a prefix-matching check
+    // sees only the first.
+    const hextets = expandIpv6(address);
+    if (!hextets) return true;
+
+    const embedsIpv4 =
+      hextets.slice(0, 5).every((part) => part === 0) &&
+      (hextets[5] === 0xffff || hextets[5] === 0);
+    if (embedsIpv4 && (hextets[6] !== 0 || hextets[7] !== 0)) {
+      const ipv4 = [
+        hextets[6] >> 8,
+        hextets[6] & 0xff,
+        hextets[7] >> 8,
+        hextets[7] & 0xff,
+      ].join(".");
+      return isPrivateAddress(ipv4);
+    }
+
+    // Unspecified (::) and loopback (::1).
+    if (hextets.every((part) => part === 0)) return true;
+    if (hextets.slice(0, 7).every((part) => part === 0) && hextets[7] === 1) {
+      return true;
+    }
+    // Unique-local fc00::/7, link-local fe80::/10, multicast ff00::/8.
+    if ((hextets[0] & 0xfe00) === 0xfc00) return true;
+    if ((hextets[0] & 0xffc0) === 0xfe80) return true;
+    if ((hextets[0] & 0xff00) === 0xff00) return true;
+    // NAT64 well-known prefix 64:ff9b::/96 tunnels an IPv4 destination.
+    if (hextets[0] === 0x0064 && hextets[1] === 0xff9b) {
+      const ipv4 = [
+        hextets[6] >> 8,
+        hextets[6] & 0xff,
+        hextets[7] >> 8,
+        hextets[7] & 0xff,
+      ].join(".");
+      return isPrivateAddress(ipv4);
+    }
+    return false;
+  }
+
+  return true;
+}
+
+/**
+ * Expand any textual IPv6 form into its 8 hextets, including `::` elision and
+ * a dotted IPv4 tail. Returns null when the input is not parseable.
+ */
+export function expandIpv6(address: string): number[] | null {
+  // Zone indices ("fe80::1%eth0") are routing hints, not part of the address.
+  const bare = address.toLowerCase().split("%")[0];
+  if (!bare) return null;
+
+  let head = bare;
+  let tail = "";
+  const elision = bare.indexOf("::");
+  if (elision !== -1) {
+    head = bare.slice(0, elision);
+    tail = bare.slice(elision + 2);
+  }
+
+  const parseGroups = (segment: string): string[] =>
+    segment.length === 0 ? [] : segment.split(":");
+
+  const headGroups = parseGroups(head);
+  const tailGroups = parseGroups(tail);
+  const all = [...headGroups, ...tailGroups];
+
+  // A dotted IPv4 tail occupies the final two hextets.
+  const last = all[all.length - 1];
+  let ipv4Tail: number[] | null = null;
+  if (last?.includes(".")) {
+    if (net.isIP(last) !== 4) return null;
+    const octets = last.split(".").map((part) => Number(part));
+    if (
+      octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)
+    )
+      return null;
+    ipv4Tail = [(octets[0] << 8) | octets[1], (octets[2] << 8) | octets[3]];
+    if (tailGroups.length > 0) tailGroups.pop();
+    else headGroups.pop();
+  }
+
+  const toHextets = (groups: string[]): number[] | null => {
+    const out: number[] = [];
+    for (const group of groups) {
+      if (!/^[0-9a-f]{1,4}$/.test(group)) return null;
+      out.push(parseInt(group, 16));
+    }
+    return out;
+  };
+
+  const headParts = toHextets(headGroups);
+  const tailParts = toHextets(tailGroups);
+  if (!headParts || !tailParts) return null;
+
+  const explicit = [...headParts, ...tailParts, ...(ipv4Tail ? ipv4Tail : [])]
+    .length;
+  if (explicit > 8) return null;
+
+  if (elision === -1) {
+    if (explicit !== 8) return null;
+    return [...headParts, ...(ipv4Tail ?? [])];
+  }
+
+  const fill = new Array(8 - explicit).fill(0) as number[];
+  return [...headParts, ...fill, ...tailParts, ...(ipv4Tail ?? [])];
+}
+
+/**
+ * Parse a caller-supplied image URL, refusing anything that is not a plain
+ * public http(s) resource. Returns null rather than throwing so callers can
+ * answer with a single 400.
+ */
+export function parseProxyableImageUrl(raw: string): URL | null {
+  if (!raw) return null;
+
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    // coercion-ok: null is this function's documented "refused" result and
+    // the caller answers 400; an unparseable URL carries no other detail.
+    return null;
+  }
+
+  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+  // Credentials in the URL would be replayed by the server on the user's
+  // behalf against a host they may not control.
+  if (url.username || url.password) return null;
+
+  const host = url.hostname.toLowerCase().replace(/\.$/, "");
+  if (!host) return null;
+  if (BLOCKED_HOSTNAMES.has(host)) return null;
+  if (BLOCKED_SUFFIXES.some((suffix) => host.endsWith(suffix))) return null;
+
+  const literal = host.startsWith("[") ? host.slice(1, -1) : host;
+  if (net.isIP(literal) && isPrivateAddress(literal)) return null;
+
+  return url;
+}
+
+// A hostname is no longer validated here before fetching. Resolving once for
+// the check and again for the connection let a DNS-rebinding host answer
+// differently each time, so the address check now lives in the socket's
+// `lookup` — see `publicOnlyLookup` in fetch-remote-image.ts.

package/corpus/templates/slides/server/plugins/agent-chat.ts

@@ -52,9 +52,11 @@ export default createAgentChatPlugin({
   prepareRequest: prepareSlidesChatAttachments,
   systemPrompt: `You are an AI deck assistant. You create, edit, import, export, style, share, and navigate decks through actions and shared application state. For a newly created presentation, use create-deck with slides: [] only when you are creating the deck yourself, then add-slide sequentially with full rendered HTML. The legacy generate-slides-ai action returns Markdown drafts and is not part of the persisted presentation workflow.
 
-When the user asks to improve, beautify, restyle, or make an uploaded/existing deck on-brand, treat it as an in-place source-preserving edit unless the user explicitly asks to rewrite the story or change slide count. First call view-screen when the active deck is unclear, then get-deck. If get-deck.sourceImport exists, preserve its slide count, order, IDs, factual copy, notes, images, charts, tables, diagrams, freeform objects, and source aspect ratio. Use update-slide on existing slide IDs. Do not use add-slide, delete, reorder, or replace source imagery with generic cards for this workflow. Verify the same slide IDs and count with get-deck after editing. If sourceImport.fidelity is partial or imagesSkipped is nonzero, stop and report the exact fidelity warning instead of claiming a reliable improvement.
+When the user asks to improve, beautify, restyle, or make an uploaded/existing deck on-brand, treat it as an in-place source-preserving edit unless the user explicitly asks to rewrite the story or change slide count. First call view-screen when the active deck is unclear, then get-deck. If get-deck.sourceImport exists, preserve its slide count, order, IDs, factual copy, notes, images, charts, tables, diagrams, freeform objects, and source aspect ratio. For a deck-wide restyle, use one patch-deck call with requireAllSourceSlides=true and one patch-slide operation with fields.content for every source slide ID; the action rejects partial coverage. Do not split a full-deck restyle into arbitrary batches or use one-by-one update-slide calls - reserve update-slide for targeted one-slide edits. After the patch succeeds, verify with get-deck using compact=true so the verification does not retransmit every slide's HTML. Do not claim a partial or initial pass. Do not use add-slide, delete, reorder, or replace source imagery with generic cards for this workflow. If sourceImport.fidelity is partial or imagesSkipped is nonzero, stop and report the exact fidelity warning instead of claiming a reliable improvement.
 
-For source-faithful PDF slides, keep the original full-page image and style around it with restrained design-system chrome such as a frame, edge treatment, caption, or safe overlay that does not obscure source content; never OCR-reconstruct the page from extracted text. For PPTX slides, preserve the imported positioned HTML and every uploaded source image. The update-slide action enforces these preservation rules by default; pass preserveSource=false only when the user explicitly requests a rewrite of that slide.
+When the active Slides editor is already showing the deck you just changed, do not include an "Open the updated deck" or similar link in the final response. The deck is already open and the action updated it in place; say that plainly instead. Only provide an open-deck link when the user is elsewhere, the active deck is different, or the user explicitly asks for a link.
+
+For source-faithful PDF slides, keep the original full-page image and style around it with restrained design-system chrome such as a frame, edge treatment, caption, or safe overlay that does not obscure source content; never OCR-reconstruct the page from extracted text. For PPTX slides, preserve the imported positioned HTML and every uploaded source image. The patch-deck and update-slide actions enforce these preservation rules by default; pass preserveSource=false only when the user explicitly requests a rewrite of that slide.
 
 If the deck has designSystemId, call get-design-system before writing and follow its exact agentContext tokens, assets, and custom instructions. If the user asks for on-brand styling and no design system is linked, call get-workspace-defaults, link its usable design system with patch-deck, then call get-design-system. Do not improvise a generic Builder-like palette when configured Builder.io design-system context is available.
 
@@ -68,7 +70,7 @@ Provider-specific Slides actions are shortcuts, not limits. If a first-class act
 
 Slides' Google Drive provider API uses the user's connected Google Docs OAuth account. Picker imports keep the per-file drive.file path, while pasted Google Slides links use Drive export access and may ask the user to reconnect Google. For large Drive file lists or metadata sweeps, pass stageAs and pagination options to provider-api-request, then use query-staged-dataset to count, filter, group, or project the staged rows.
 
-When a Google Drive or Google Slides request needs authentication, tell the user to use the Connect Google button shown in Slides. Do not expose internal routes, API endpoints, OAuth setup instructions, client IDs, or keys in the response, and do not ask the user to configure an API manually.`,
+When a Google Drive or Google Slides request needs authentication, tell the user to use the Connect Google button in the Google Slides import step. Do not expose internal routes, API endpoints, OAuth setup instructions, client IDs, or keys in the response, and do not ask the user to configure an API manually.`,
   mentionProviders: async () => {
     const { getDb } = await import("../db/index.js");
     const { decks, deckShares } = await import("../db/schema.js");

package/corpus/templates/slides/server/routes/api/image-proxy.get.ts

@@ -0,0 +1,65 @@
+import { getSession } from "@agent-native/core/server";
+import { defineEventHandler, getQuery, setResponseStatus } from "h3";
+
+import {
+  fetchRemoteImage,
+  type RemoteImageFailure,
+} from "../../lib/fetch-remote-image.js";
+
+/**
+ * Re-serve a remote image from our own origin.
+ *
+ * PDF/PPTX export rasterizes the slide DOM through a canvas, and the browser
+ * blanks out any image whose host does not send `Access-Control-Allow-Origin`.
+ * No client-side flag can override that, so images on hosts without CORS have
+ * to come back through us to be same-origin.
+ *
+ * This is an authenticated, image-only, size-capped fetcher — not a general
+ * proxy. See `fetch-remote-image.ts` for the address pinning that keeps it
+ * from being turned into an SSRF primitive.
+ */
+const FAILURE_STATUS: Record<RemoteImageFailure, number> = {
+  "unsupported-url": 400,
+  "blocked-address": 400,
+  "fetch-failed": 502,
+  "too-many-redirects": 502,
+  "not-an-image": 415,
+  "too-large": 413,
+};
+
+const FAILURE_MESSAGE: Record<RemoteImageFailure, string> = {
+  "unsupported-url": "Unsupported image URL",
+  "blocked-address": "Unsupported image URL",
+  "fetch-failed": "Could not fetch image",
+  "too-many-redirects": "Too many redirects",
+  "not-an-image": "Not an image",
+  "too-large": "Image too large",
+};
+
+export default defineEventHandler(async (event) => {
+  const session = await getSession(event);
+  if (!session?.email) {
+    setResponseStatus(event, 401);
+    return { error: "Unauthorized" };
+  }
+
+  const raw = getQuery(event).url;
+  if (typeof raw !== "string") {
+    setResponseStatus(event, 400);
+    return { error: "Missing url" };
+  }
+
+  const result = await fetchRemoteImage(raw);
+  if (!result.ok) {
+    setResponseStatus(event, FAILURE_STATUS[result.reason]);
+    return { error: FAILURE_MESSAGE[result.reason] };
+  }
+
+  event.node?.res?.setHeader("Content-Type", result.contentType);
+  event.node?.res?.setHeader("Content-Length", String(result.body.byteLength));
+  event.node?.res?.setHeader("Cache-Control", "private, max-age=3600");
+  // The canvas reads these pixels back, so the response must be explicitly
+  // usable cross-origin even though it is served from our own host.
+  event.node?.res?.setHeader("Access-Control-Allow-Origin", "*");
+  return result.body;
+});

package/corpus/templates/slides/shared/api.ts

@@ -137,7 +137,7 @@ function normalizeString(value: unknown, fallback: string): string {
 }
 
 function normalizeElementPath(value: unknown): number[] | undefined {
-  if (!Array.isArray(value)) return undefined;
+  if (!Array.isArray(value) || value.length === 0) return undefined;
   const path = value.filter(
     (part): part is number =>
       typeof part === "number" &&
@@ -155,6 +155,7 @@ function normalizeSlideAnimation(
   if (!isRecord(value)) return null;
 
   const elementPath = normalizeElementPath(value.elementPath);
+  if (value.elementPath !== undefined && !elementPath) return null;
   const rawElementIndex = value.elementIndex;
   const hasElementIndex =
     typeof rawElementIndex === "number" &&

package/corpus/templates/slides/shared/deck-title.ts

@@ -0,0 +1,135 @@
+const GENERATED_TITLE_PLACEHOLDERS = new Set([
+  "deck",
+  "date",
+  "image slide title",
+  "presentation title",
+  "section",
+  "section title",
+  "slide title",
+  "untitled",
+  "untitled deck",
+  "your name",
+]);
+
+/**
+ * Generated deck ids should never become user-facing titles. Keep this
+ * deliberately narrow so normal titles with spaces and punctuation remain
+ * valid, while catching opaque mixed-case tokens such as H3sVsnns-TEVUOpz9w.
+ */
+const OPAQUE_DECK_TITLE_PATTERN =
+  /^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[A-Za-z0-9_-]{12,64}$/;
+
+export const DEFAULT_DECK_TITLE = "Untitled Deck";
+
+export function isOpaqueDeckTitle(value: unknown): value is string {
+  return (
+    typeof value === "string" && OPAQUE_DECK_TITLE_PATTERN.test(value.trim())
+  );
+}
+
+export function isGeneratedDeckTitle(value: unknown): value is string {
+  if (typeof value !== "string") return false;
+  const title = value.trim();
+  return (
+    GENERATED_TITLE_PLACEHOLDERS.has(title.toLowerCase()) ||
+    isOpaqueDeckTitle(title)
+  );
+}
+
+function decodeHtmlEntities(value: string): string {
+  const decodeCodePoint = (raw: string, radix: number): string => {
+    const codePoint = Number.parseInt(raw, radix);
+    return Number.isNaN(codePoint) || codePoint > 0x10ffff
+      ? ""
+      : String.fromCodePoint(codePoint);
+  };
+
+  return value
+    .replace(/ /gi, " ")
+    .replace(/&/gi, "&")
+    .replace(/&lt;/gi, "<")
+    .replace(/&gt;/gi, ">")
+    .replace(/&quot;/gi, '"')
+    .replace(/(?:&#39;|&apos;)/gi, "'")
+    .replace(/&#x([0-9a-f]+);?/gi, (_, hex: string) => decodeCodePoint(hex, 16))
+    .replace(/&#(\d+);?/g, (_, digits: string) => decodeCodePoint(digits, 10));
+}
+
+function plainText(value: string): string {
+  return decodeHtmlEntities(
+    value.replace(/<br\s*\/?>/gi, " ").replace(/<[^>]+>/g, " "),
+  )
+    .replace(/\s+/g, " ")
+    .trim();
+}
+
+function usableCandidate(value: string): string | null {
+  const candidate = plainText(value).replace(/^[•●▪‣\-\s]+/, "");
+  if (!candidate || candidate.length > 140) return null;
+  if (GENERATED_TITLE_PLACEHOLDERS.has(candidate.toLowerCase())) return null;
+  return candidate;
+}
+
+/**
+ * Recover a deck title from the largest title-like text in its first slide.
+ * This is intentionally HTML-string based because the action runs on the
+ * server without a browser DOM.
+ */
+export function deriveDeckTitleFromSlideContent(
+  content: unknown,
+): string | null {
+  if (typeof content !== "string" || !content.trim()) return null;
+
+  const candidates: Array<{ score: number; text: string }> = [];
+  const headingPattern = /<(h[1-6])\b[^>]*>([\s\S]*?)<\/\1>/gi;
+  for (const match of content.matchAll(headingPattern)) {
+    const text = usableCandidate(match[2] ?? "");
+    if (text) {
+      const level = Number.parseInt(match[1].slice(1), 10);
+      candidates.push({ score: 1000 - level * 10, text });
+    }
+  }
+
+  const styledTextPattern =
+    /<([a-z][\w:-]*)\b[^>]*\bstyle\s*=\s*(["'])([\s\S]*?)\2[^>]*>([\s\S]*?)<\/\1>/gi;
+  for (const match of content.matchAll(styledTextPattern)) {
+    const fontSize = Number.parseFloat(
+      match[3]?.match(/(?:^|;)\s*font-size\s*:\s*([\d.]+)px/i)?.[1] ?? "0",
+    );
+    if (fontSize < 28) continue;
+    const text = usableCandidate(match[4] ?? "");
+    if (text) candidates.push({ score: fontSize, text });
+  }
+
+  return candidates.sort((a, b) => b.score - a.score)[0]?.text ?? null;
+}
+
+/**
+ * Return a human-readable replacement only when the requested title is a
+ * generated placeholder or opaque id. A meaningful existing title wins when
+ * a stale full-payload save tries to replace it with a generated value.
+ */
+export function repairGeneratedDeckTitle(
+  requestedTitle: unknown,
+  firstSlideContent: unknown,
+  existingTitle?: unknown,
+): string | null {
+  if (!isGeneratedDeckTitle(requestedTitle)) return null;
+
+  return (
+    deriveDeckTitleFromSlideContent(firstSlideContent) ??
+    (typeof existingTitle === "string" &&
+    existingTitle.trim() &&
+    !isGeneratedDeckTitle(existingTitle)
+      ? existingTitle
+      : null)
+  );
+}
+
+export function assertHumanReadableDeckTitle(title: string): void {
+  if (isOpaqueDeckTitle(title)) {
+    throw new Error(
+      "Deck title must be a concise, human-readable title; generated ids are not valid titles.",
+    );
+  }
+}

package/corpus/templates/tasks/app/components/tasks/TaskListRow.tsx

@@ -89,7 +89,10 @@ export function TaskListRow({
       onAnimationEnd={completion.handleRowAnimationEnd}
       dataAttributes={{ "data-task-id": item.id }}
       className={cn(
-        "will-change-[opacity,transform]",
+        // Scoped to the phases that actually animate. Applied unconditionally
+        // it promoted a layer for every row in the list and never retired any
+        // of them, for an animation that only runs while a row completes.
+        completionPhase !== "idle" && "will-change-[opacity,transform]",
         displayDone && completionPhase === "idle" && !selected && "opacity-60",
         completionPhase === "completing" &&
           hideAfterComplete &&

package/dist/agent/engine/ai-sdk-engine.js

@@ -138,7 +138,7 @@ function googleThinkingBudget(effort) {
     return -1;
 }
 /**
- * Map a reasoning effort level to Gemini 3.x thinkingLevel string.
+ * Map an effort level to Gemini 3.x thinkingLevel string.
  * Gemini 3 models (gemini-3.*) reject thinkingBudget and require thinkingLevel
  * with values 'low' | 'medium' | 'high'. Gemini 3.0 only supports 'low'/'high';
  * Gemini 3.1+ adds 'medium'. We always emit 'medium' for medium effort since it

package/dist/agent/production-agent.d.ts

@@ -266,7 +266,7 @@ export interface ProductionAgentOptions {
     model?: string;
     /** App/template id used for org-scoped per-app model defaults. */
     appId?: string;
-    /** Default reasoning effort for requests that do not supply an override. */
+    /** Default effort for requests that do not supply an override. */
     reasoningEffort?: ReasoningEffort;
     /** Provider-specific options passed through to the engine */
     providerOptions?: EngineMessage extends never ? never : any;
@@ -632,8 +632,16 @@ export interface ExecuteAgentToolCallOptions {
     threadId?: string;
     turnId?: string;
     approvedToolCalls?: string[];
+    onApprovalRequired?: (binding: AgentApprovalBinding) => Promise<void>;
+    consumeApproval?: (binding: AgentApprovalBinding) => Promise<boolean>;
     send?: (event: AgentChatEvent) => void;
 }
+export interface AgentApprovalBinding {
+    toolName: string;
+    input: unknown;
+    callId: string;
+    approvalKey: string;
+}
 /**
  * Execute one externally-selected tool through the exact same guarded runtime
  * as a normal model-selected tool call. Realtime voice and other duplex
@@ -658,6 +666,11 @@ export declare function buildFirstRequestPayloadDetail(input: {
     availableToolCount: number;
 }): string;
 export declare function toolCallCacheKey(toolName: string, input: unknown): string;
+export declare function findApprovedStructuredToolCall(history: AgentChatStructuredMessage[] | undefined, approvedToolCalls: readonly string[] | undefined): {
+    name: string;
+    input: unknown;
+    callId: string;
+} | undefined;
 export declare function repeatedSourceSweepGuardMessage(opts: {
     toolName: string;
     priorCalls: number;
@@ -769,6 +782,13 @@ export declare function runAgentLoop(opts: {
      * `approval_required`. See `AgentChatRequest.approvedToolCalls`.
      */
     approvedToolCalls?: string[];
+    /**
+     * Server-side approval persistence hooks. The HTTP transport supplies these
+     * so client-supplied history is never the authorization source; direct loop
+     * callers may omit them when they own the surrounding approval boundary.
+     */
+    onApprovalRequired?: (binding: AgentApprovalBinding) => Promise<void>;
+    consumeApproval?: (binding: AgentApprovalBinding) => Promise<boolean>;
     /**
      * In-loop processor seam (see `processors.ts`). Each processor can observe
      * streamed chunks, observe model responses around tool execution, and