@agent-native/core 0.149.1 → 0.149.2

package/dist/server/auth.js

@@ -63,7 +63,7 @@ import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
 import { readDesktopSso, writeDesktopSso, clearDesktopSso, } from "./desktop-sso.js";
 import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
-import { isElectron as isElectronRequest, getAppBasePath, getAppUrl, getOrigin, encodeOAuthState, decodeOAuthState, createOAuthSession, oauthCallbackResponse, oauthErrorPage, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, } from "./google-oauth.js";
+import { isElectron as isElectronRequest, getAppBasePath, getAppUrl, getOrigin, encodeOAuthState, decodeOAuthState, createOAuthSession, oauthCallbackResponse, oauthDesktopExchangePage, oauthErrorPage, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, } from "./google-oauth.js";
 // Pure env-read feature switch from a leaf module (no dependency back on
 // auth.ts), so the guard and the SSO route handler share one validator and
 // can never disagree about whether federated SSO is enabled.
@@ -1025,6 +1025,8 @@ function areGenericGoogleOAuthRoutesEnabled(app) {
 }
 const _desktopExchanges = new Map();
 const DESKTOP_EXCHANGE_ERROR_PREFIX = "__error__::";
+const DESKTOP_MAGIC_LINK_CHALLENGE_PREFIX = "__magic-link-challenge__::";
+const DESKTOP_MAGIC_LINK_EXCHANGE_PREFIX = "__magic-link-exchange__::";
 const DESKTOP_AUTH_TOKEN_BODY_ORIGINS = new Set([
     "tauri://localhost",
     "http://tauri.localhost",
@@ -1033,6 +1035,90 @@ const DESKTOP_AUTH_TOKEN_BODY_ORIGINS = new Set([
 ]);
 // 5-minute TTL for exchange entries (short — single-use tokens).
 const DESKTOP_EXCHANGE_TTL_MS = 5 * 60 * 1000;
+function normalizeDesktopFlowId(value) {
+    if (typeof value !== "string")
+        return null;
+    const flowId = value.trim();
+    return /^[A-Za-z0-9_-]{1,128}$/.test(flowId) ? flowId : null;
+}
+function normalizeDesktopFlowVerifier(value) {
+    if (typeof value !== "string")
+        return null;
+    const verifier = value.trim();
+    return /^[A-Za-z0-9_-]{32,128}$/.test(verifier) ? verifier : null;
+}
+function desktopFlowVerifierHash(verifier) {
+    return crypto.createHash("sha256").update(verifier).digest("base64url");
+}
+function matchesDesktopFlowVerifier(verifier, expectedHash) {
+    const actual = Buffer.from(desktopFlowVerifierHash(verifier));
+    const expected = Buffer.from(expectedHash);
+    return (actual.length === expected.length &&
+        crypto.timingSafeEqual(actual, expected));
+}
+function parseDesktopExchangeStoredEntry(packed) {
+    if (packed.startsWith(DESKTOP_MAGIC_LINK_CHALLENGE_PREFIX)) {
+        const verifierHash = packed.slice(DESKTOP_MAGIC_LINK_CHALLENGE_PREFIX.length);
+        return verifierHash ? { challenge: true, verifierHash } : null;
+    }
+    if (packed.startsWith(DESKTOP_EXCHANGE_ERROR_PREFIX)) {
+        const raw = packed.slice(DESKTOP_EXCHANGE_ERROR_PREFIX.length);
+        return {
+            error: JSON.parse(Buffer.from(raw, "base64url").toString()),
+        };
+    }
+    const isMagicLinkExchange = packed.startsWith(DESKTOP_MAGIC_LINK_EXCHANGE_PREFIX);
+    const encoded = isMagicLinkExchange
+        ? packed.slice(DESKTOP_MAGIC_LINK_EXCHANGE_PREFIX.length)
+        : packed;
+    const verifierSeparator = isMagicLinkExchange ? encoded.indexOf("::") : -1;
+    const verifierHash = verifierSeparator >= 0 ? encoded.slice(0, verifierSeparator) : undefined;
+    const tokenAndEmail = verifierSeparator >= 0 ? encoded.slice(verifierSeparator + 2) : encoded;
+    const sepIdx = tokenAndEmail.indexOf("::");
+    if (sepIdx === -1)
+        return null;
+    return {
+        token: tokenAndEmail.slice(0, sepIdx),
+        email: tokenAndEmail.slice(sepIdx + 2),
+        ...(verifierHash ? { verifierHash } : {}),
+    };
+}
+function isDesktopMagicLinkCallbackPath(value) {
+    try {
+        return new URL(value, "http://agent-native.invalid").pathname.endsWith("/_agent-native/auth/magic-link/desktop-callback");
+    }
+    catch {
+        // coercion-ok: malformed callback URLs are treated as non-desktop callbacks.
+        return false;
+    }
+}
+function withDesktopMagicLinkFlow(callbackURL, flow) {
+    const url = new URL(callbackURL, "http://agent-native.invalid");
+    url.searchParams.set("flow_id", flow.flowId);
+    url.searchParams.set("verifier", flow.verifier);
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+async function persistDesktopMagicLinkChallenge(flowId, verifierHash) {
+    await addSession(`dex:${flowId}`, `${DESKTOP_MAGIC_LINK_CHALLENGE_PREFIX}${verifierHash}`);
+}
+async function issueDesktopMagicLinkFlow() {
+    const flowId = crypto.randomBytes(32).toString("base64url");
+    const verifier = crypto.randomBytes(32).toString("base64url");
+    const verifierHash = desktopFlowVerifierHash(verifier);
+    _desktopExchanges.set(flowId, {
+        challenge: true,
+        verifierHash,
+        expiresAt: Date.now() + DESKTOP_EXCHANGE_TTL_MS,
+    });
+    try {
+        await persistDesktopMagicLinkChallenge(flowId, verifierHash);
+    }
+    catch (error) {
+        _desktopExchanges.delete(flowId);
+        throw error;
+    }
+    return { flowId, verifier };
+}
 export function setDesktopExchange(flowId, token, email) {
     _desktopExchanges.set(flowId, {
         token,
@@ -1059,9 +1145,12 @@ export function setDesktopExchangeError(flowId, error) {
  * Non-fatal — if the DB isn't ready yet the in-memory Map still works for
  * same-instance requests.
  */
-async function persistDesktopExchangeToDB(flowId, token, email) {
+async function persistDesktopExchangeToDB(flowId, token, email, verifierHash) {
     try {
-        await addSession(`dex:${flowId}`, `${token}::${email}`);
+        const packed = verifierHash
+            ? `${DESKTOP_MAGIC_LINK_EXCHANGE_PREFIX}${verifierHash}::${token}::${email}`
+            : `${token}::${email}`;
+        await addSession(`dex:${flowId}`, packed);
     }
     catch {
         // non-fatal — in-memory Map is the primary path
@@ -1090,8 +1179,12 @@ async function consumeDesktopExchangeFromDB(flowId) {
         // redeemed with the session table's default 30-day TTL.
         const client = getDbExec();
         const { rows } = await client.execute({
-            sql: `DELETE FROM sessions WHERE token = ? AND created_at > ? RETURNING email`,
-            args: [`dex:${flowId}`, Date.now() - DESKTOP_EXCHANGE_TTL_MS],
+            sql: `DELETE FROM sessions WHERE token = ? AND created_at > ? AND email NOT LIKE ? RETURNING email`,
+            args: [
+                `dex:${flowId}`,
+                Date.now() - DESKTOP_EXCHANGE_TTL_MS,
+                `${DESKTOP_MAGIC_LINK_CHALLENGE_PREFIX}%`,
+            ],
         });
         forgetCachedSessionEmail(`dex:${flowId}`);
         if (rows.length === 0)
@@ -1099,21 +1192,72 @@ async function consumeDesktopExchangeFromDB(flowId) {
         const packed = (rows[0].email ?? rows[0][0]);
         if (!packed)
             return null;
-        if (packed.startsWith(DESKTOP_EXCHANGE_ERROR_PREFIX)) {
-            const raw = packed.slice(DESKTOP_EXCHANGE_ERROR_PREFIX.length);
-            return {
-                error: JSON.parse(Buffer.from(raw, "base64url").toString()),
-            };
-        }
-        const sepIdx = packed.indexOf("::");
-        if (sepIdx === -1)
+        return parseDesktopExchangeStoredEntry(packed);
+    }
+    catch {
+        // coercion-ok: a DB fallback outage leaves the exchange pending so polling can retry without consuming a token.
+        return null;
+    }
+}
+async function readDesktopMagicLinkChallengeFromDB(flowId) {
+    try {
+        const client = getDbExec();
+        const { rows } = await client.execute({
+            sql: `SELECT email FROM sessions WHERE token = ? AND created_at > ? LIMIT 1`,
+            args: [`dex:${flowId}`, Date.now() - DESKTOP_EXCHANGE_TTL_MS],
+        });
+        if (rows.length === 0)
+            return null;
+        const packed = (rows[0].email ?? rows[0][0]);
+        if (!packed)
             return null;
-        return { token: packed.slice(0, sepIdx), email: packed.slice(sepIdx + 2) };
+        const entry = parseDesktopExchangeStoredEntry(packed);
+        return entry && "challenge" in entry
+            ? { verifierHash: entry.verifierHash }
+            : null;
     }
     catch {
         return null;
     }
 }
+async function claimDesktopMagicLinkFlow(flowId, verifier, token, email) {
+    const verifierHash = desktopFlowVerifierHash(verifier);
+    const entry = _desktopExchanges.get(flowId);
+    if (entry) {
+        if (!("challenge" in entry) ||
+            entry.expiresAt < Date.now() ||
+            !matchesDesktopFlowVerifier(verifier, entry.verifierHash)) {
+            return false;
+        }
+        _desktopExchanges.set(flowId, {
+            token,
+            email,
+            verifierHash,
+            expiresAt: Date.now() + DESKTOP_EXCHANGE_TTL_MS,
+        });
+        await persistDesktopExchangeToDB(flowId, token, email, verifierHash);
+        return true;
+    }
+    try {
+        const client = getDbExec();
+        const packed = `${DESKTOP_MAGIC_LINK_EXCHANGE_PREFIX}${verifierHash}::${token}::${email}`;
+        const { rows } = await client.execute({
+            sql: `UPDATE sessions SET email = ?, created_at = ? WHERE token = ? AND created_at > ? AND email = ? RETURNING email`,
+            args: [
+                packed,
+                Date.now(),
+                `dex:${flowId}`,
+                Date.now() - DESKTOP_EXCHANGE_TTL_MS,
+                `${DESKTOP_MAGIC_LINK_CHALLENGE_PREFIX}${verifierHash}`,
+            ],
+        });
+        return rows.length > 0;
+    }
+    catch {
+        // coercion-ok: a failed DB claim must not issue a native session token.
+        return false;
+    }
+}
 setInterval(() => {
     const now = Date.now();
     for (const [k, v] of _desktopExchanges) {
@@ -2640,15 +2784,7 @@ async function mountBetterAuthRoutes(app, options) {
                     emailDomain: email.split("@")[1] || "",
                 });
                 if (flowId && sessionToken) {
-                    _desktopExchanges.set(flowId, {
-                        token: sessionToken,
-                        email,
-                        expiresAt: Date.now() + DESKTOP_EXCHANGE_TTL_MS,
-                    });
-                    // Also persist to DB for cross-instance durability (Cloudflare
-                    // Workers, multi-region). Fire-and-forget — in-memory Map is
-                    // still the primary fast path for same-instance requests.
-                    void persistDesktopExchangeToDB(flowId, sessionToken, email);
+                    setDesktopExchange(flowId, sessionToken, email);
                     logGoogleOAuthDebug(event, "callback-exchange-stored", {
                         flowId,
                         desktop,
@@ -2687,13 +2823,23 @@ async function mountBetterAuthRoutes(app, options) {
             return { error: "Method not allowed" };
         }
         const query = getQuery(event);
-        const flowId = query.flow_id;
+        const flowId = normalizeDesktopFlowId(query.flow_id);
         if (!flowId) {
             setResponseStatus(event, 400);
             return { error: "Missing flow_id" };
         }
+        const verifier = normalizeDesktopFlowVerifier(getQuery(event).verifier);
         let entry = _desktopExchanges.get(flowId);
         if (!entry || entry.expiresAt < Date.now()) {
+            const challenge = await readDesktopMagicLinkChallengeFromDB(flowId);
+            if (challenge) {
+                if (!verifier ||
+                    !matchesDesktopFlowVerifier(verifier, challenge.verifierHash)) {
+                    setResponseStatus(event, 403);
+                    return { error: "Invalid desktop exchange verifier." };
+                }
+                return { pending: true, flow: oauthDebugFlowId(flowId) };
+            }
             // In-memory miss — fall back to the DB-persisted entry. This handles
             // cross-instance routing (Cloudflare Workers, multi-region) where the
             // OAuth callback and the polling request may hit different isolates.
@@ -2709,11 +2855,35 @@ async function mountBetterAuthRoutes(app, options) {
             entry =
                 "error" in fromDb
                     ? { error: fromDb.error, expiresAt: Date.now() + 1 }
-                    : {
-                        token: fromDb.token,
-                        email: fromDb.email,
-                        expiresAt: Date.now() + 1,
-                    };
+                    : "challenge" in fromDb
+                        ? {
+                            challenge: true,
+                            verifierHash: fromDb.verifierHash,
+                            expiresAt: Date.now() + 1,
+                        }
+                        : {
+                            token: fromDb.token,
+                            email: fromDb.email,
+                            ...(fromDb.verifierHash
+                                ? { verifierHash: fromDb.verifierHash }
+                                : {}),
+                            expiresAt: Date.now() + 1,
+                        };
+        }
+        if ("challenge" in entry) {
+            if (!verifier ||
+                !matchesDesktopFlowVerifier(verifier, entry.verifierHash)) {
+                setResponseStatus(event, 403);
+                return { error: "Invalid desktop exchange verifier." };
+            }
+            return { pending: true, flow: oauthDebugFlowId(flowId) };
+        }
+        if ("token" in entry && entry.verifierHash) {
+            if (!verifier ||
+                !matchesDesktopFlowVerifier(verifier, entry.verifierHash)) {
+                setResponseStatus(event, 403);
+                return { error: "Invalid desktop exchange verifier." };
+            }
         }
         _desktopExchanges.delete(flowId);
         // Also wipe the DB-persisted entry so it cannot be replayed via the
@@ -2735,6 +2905,13 @@ async function mountBetterAuthRoutes(app, options) {
         // still make a follow-up /auth/session?_session=... request, but the
         // OAuth handoff should not depend on that second request succeeding.
         setFrameworkSessionCookie(event, entry.token);
+        if (isElectronRequest(event)) {
+            await writeDesktopSso({
+                email: entry.email,
+                token: entry.token,
+                expiresAt: Date.now() + sessionMaxAge * 1000,
+            });
+        }
         setResponseHeader(event, "Referrer-Policy", "no-referrer");
         logGoogleOAuthDebug(event, "exchange-success", {
             flowId,
@@ -2742,6 +2919,52 @@ async function mountBetterAuthRoutes(app, options) {
         });
         return { token: entry.token, email: entry.email };
     }));
+    // Magic-link verification happens in the system browser, so native shells
+    // need the verified browser session copied into the same one-time exchange
+    // used by Google OAuth before they can establish their own WebView session.
+    app.use("/_agent-native/auth/magic-link/desktop-callback", defineEventHandler(async (event) => {
+        if (!isReadMethod(event)) {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const flowId = normalizeDesktopFlowId(getQuery(event).flow_id);
+        const verifier = normalizeDesktopFlowVerifier(getQuery(event).verifier);
+        if (!flowId) {
+            setResponseStatus(event, 400);
+            return { error: "Missing flow_id" };
+        }
+        if (!verifier) {
+            return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
+        }
+        const session = await getSession(event);
+        if (!session?.email || !session.token) {
+            setDesktopExchangeError(flowId, {
+                message: AUTH_MAGIC_LINK_FALLBACK,
+                code: "callback_error",
+            });
+            return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
+        }
+        try {
+            // Better Auth owns the browser cookie, while native clients resolve
+            // the exchanged token through the framework session table.
+            await addSession(session.token, session.email);
+        }
+        catch (error) {
+            captureAuthError(error, {
+                route: "magic-link",
+                email: session.email,
+            });
+            setDesktopExchangeError(flowId, {
+                message: AUTH_MAGIC_LINK_FALLBACK,
+                code: "callback_error",
+            });
+            return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
+        }
+        if (!(await claimDesktopMagicLinkFlow(flowId, verifier, session.token, session.email))) {
+            return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
+        }
+        return oauthDesktopExchangePage("Sign-in complete. You can return to the app.");
+    }));
     // Initialize Better Auth. Forward `googleScopes` into the BetterAuthConfig
     // so the social provider requests the broader product scopes (Gmail,
     // Calendar, etc.) up front during the primary sign-in — eliminating the
@@ -3050,9 +3273,10 @@ async function mountBetterAuthRoutes(app, options) {
         const body = await readBody(event);
         const rawEmail = typeof body?.email === "string" ? body.email : "";
         const email = normalizeAuthEmail(rawEmail);
-        const callbackURL = typeof body?.callbackURL === "string"
+        let callbackURL = typeof body?.callbackURL === "string"
             ? safeReturnPath(body.callbackURL)
             : "/";
+        let desktopFlow;
         if (!email) {
             setResponseStatus(event, 400);
             return { error: VALID_AUTH_EMAIL_MESSAGE };
@@ -3062,6 +3286,10 @@ async function mountBetterAuthRoutes(app, options) {
             return { error: GOOGLE_AUTH_REQUIRED_MESSAGE };
         }
         try {
+            if (isDesktopMagicLinkCallbackPath(callbackURL)) {
+                desktopFlow = await issueDesktopMagicLinkFlow();
+                callbackURL = withDesktopMagicLinkFlow(callbackURL, desktopFlow);
+            }
             await auth.api.signInMagicLink({
                 body: {
                     email,
@@ -3070,7 +3298,10 @@ async function mountBetterAuthRoutes(app, options) {
                 },
                 headers: event.headers,
             });
-            return { ok: true };
+            return {
+                ok: true,
+                ...(desktopFlow ?? {}),
+            };
         }
         catch (e) {
             if (!isExpectedAuthFailure(e)) {

package/dist/server/onboarding-html.js

@@ -2965,6 +2965,7 @@ ${signInJourneyInlineScript()}
     }
     function __anFinishOAuthExchange(ret, flowId, sessionToken) {
       __anGoogleSignInInFlight = false;
+      __anMagicLinkInFlight = false;
       if (__anIsBuilderPreview()) {
         if (sessionToken) {
           __anSetOAuthDebug('OAuth exchange redeemed; applying session bridge to embedded app', flowId);
@@ -3220,6 +3221,7 @@ ${identitySsoScript}
     var __anOAuthPollTimer = null;
     var __anOAuthPollCount = 0;
     var __anGoogleSignInInFlight = false;
+    var __anMagicLinkInFlight = false;
     var __anGoogleRecoverBound = false;
     function __anNewOAuthFlowId() {
       try {
@@ -3253,15 +3255,26 @@ ${identitySsoScript}
         if (showDebugOverlay) debug.classList.add('show');
       }
     }
-    function __anShowOAuthError(err, btn, message) {
+    function __anStopOAuthExchangePolling() {
       if (__anOAuthPollTimer) {
         clearInterval(__anOAuthPollTimer);
         __anOAuthPollTimer = null;
       }
+    }
+    function __anShowAuthExchangeError(err, btn, message, kind) {
+      __anStopOAuthExchangePolling();
       err.textContent = message;
-      err.classList.add('show');
+      err.classList.add('show', 'error');
       btn.disabled = false;
-      __anGoogleSignInInFlight = false;
+      if (kind === 'magic-link') {
+        __anMagicLinkInFlight = false;
+        showMagicLinkForm();
+      } else {
+        __anGoogleSignInInFlight = false;
+      }
+    }
+    function __anShowOAuthError(err, btn, message) {
+      __anShowAuthExchangeError(err, btn, message, 'google');
     }
     function __anRecoverGoogleSignInAfterReturn() {
       // The user left for the Google sign-in window and came back. If the flow
@@ -3311,14 +3324,17 @@ ${identitySsoScript}
         __anShowOAuthError(err, btn, __anT('failedToConnect'));
       }
     }
-    function __anWaitForOAuthExchange(flowId, ret, btn, err) {
+    function __anWaitForOAuthExchange(flowId, ret, btn, err, kind, verifier) {
       var started = Date.now();
       var timeoutMs = 5 * 60 * 1000;
+      var isMagicLink = kind === 'magic-link';
       __anOAuthPollCount = 0;
       async function check() {
         __anOAuthPollCount++;
         try {
-          var res = await fetch(__anPath('/_agent-native/auth/desktop-exchange') + '?flow_id=' + encodeURIComponent(flowId), { credentials: 'include' });
+          var exchangeParams = '?flow_id=' + encodeURIComponent(flowId);
+          if (verifier) exchangeParams += '&verifier=' + encodeURIComponent(verifier);
+          var res = await fetch(__anPath('/_agent-native/auth/desktop-exchange') + exchangeParams, { credentials: 'include' });
           var data = await res.json().catch(function() { return {}; });
           if (data && (data.email || data.token)) {
             if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);
@@ -3328,7 +3344,12 @@ ${identitySsoScript}
           }
           if (data && data.error) {
             __anSetOAuthDebug('OAuth exchange returned an error: ' + (data.message || data.error), flowId);
-            __anShowOAuthError(err, btn, __anAuthErrorText(data, __anT('googleNotConfigured')));
+            __anShowAuthExchangeError(
+              err,
+              btn,
+              __anAuthErrorText(data, isMagicLink ? __anT('magicLinkFailed') : __anT('googleNotConfigured')),
+              isMagicLink ? 'magic-link' : 'google',
+            );
             return;
           }
           if (data && data.pending && (__anOAuthPollCount === 1 || __anOAuthPollCount % 5 === 0)) {
@@ -3340,10 +3361,17 @@ ${identitySsoScript}
           }
         }
         if (Date.now() - started > timeoutMs) {
-          __anShowOAuthError(err, btn, __anT('googleNeverFinished') + ' Flow ' + __anFlowDebugId(flowId) + '.');
+          __anShowAuthExchangeError(
+            err,
+            btn,
+            isMagicLink
+              ? __anT('magicLinkFailed')
+              : __anT('googleNeverFinished') + ' Flow ' + __anFlowDebugId(flowId) + '.',
+            isMagicLink ? 'magic-link' : 'google',
+          );
         }
       }
-      if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);
+      __anStopOAuthExchangePolling();
       __anOAuthPollTimer = setInterval(check, 1000);
       setTimeout(check, 500);
     }
@@ -3479,6 +3507,8 @@ ${googleOnly
       __anSetAuthView('magicLinkSent');
     }
     function showMagicLinkForm() {
+      __anStopOAuthExchangePolling();
+      __anMagicLinkInFlight = false;
       var form = document.getElementById('magic-link-form');
       if (!form) return;
       hideMagicLinkSuccess();
@@ -3851,6 +3881,7 @@ ${googleOnly
     var msg = document.getElementById('m-msg');
     var emailInput = document.getElementById('m-email');
     var email = __anNormalizeAuthEmail(emailInput && emailInput.value);
+    var isDesktopMagicLink = __anIsAgentNativeDesktop();
     msg.classList.remove('show', 'error', 'success');
     if (!__anIsValidAuthEmail(email)) {
       __anShowEmailValidationError(emailInput, msg);
@@ -3858,12 +3889,18 @@ ${googleOnly
     }
     var originalLabel = btn.textContent;
     btn.disabled = true;
+    __anMagicLinkInFlight = isDesktopMagicLink;
     btn.textContent = __anT('sending');
     try {
       var res = await fetch(__anPath('/_agent-native/auth/magic-link'), {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ email: email, callbackURL: __anResumeHref() }),
+        body: JSON.stringify({
+          email: email,
+          callbackURL: isDesktopMagicLink
+            ? __anPath('/_agent-native/auth/magic-link/desktop-callback')
+            : __anResumeHref(),
+        }),
       });
       var data = await res.json().catch(function(error) {
         console.warn('[auth] Could not parse magic-link response', error);
@@ -3873,13 +3910,23 @@ ${googleOnly
         btn.disabled = false;
         btn.textContent = originalLabel;
         showMagicLinkSuccess(email);
+        if (isDesktopMagicLink) {
+          var magicFlowId = data && typeof data.flowId === 'string' ? data.flowId : '';
+          var magicVerifier = data && typeof data.verifier === 'string' ? data.verifier : '';
+          if (!magicFlowId || !magicVerifier) {
+            throw new Error('The sign-in flow was not initialized.');
+          }
+          __anWaitForOAuthExchange(magicFlowId, __anResumeHref(), btn, msg, 'magic-link', magicVerifier);
+        }
         return;
       }
+      __anMagicLinkInFlight = false;
       msg.textContent = __anAuthErrorText(data, __anT('magicLinkFailed'));
       msg.classList.add('show', 'error');
       btn.disabled = false;
       btn.textContent = originalLabel;
     } catch (err) {
+      __anMagicLinkInFlight = false;
       msg.textContent = __anT('networkErrorDashRetry');
       msg.classList.add('show', 'error');
       btn.disabled = false;

package/dist/shared/reasoning-effort.d.ts

@@ -1,9 +1,9 @@
 export declare const REASONING_EFFORTS: readonly ["auto", "none", "minimal", "low", "medium", "high", "xhigh", "max"];
 export type ReasoningEffort = (typeof REASONING_EFFORTS)[number];
 /**
- * Shared chat always chooses an explicit reasoning tier. Keep `auto` in the
+ * Shared chat always chooses an explicit effort tier. Keep `auto` in the
  * accepted type only so older persisted selections and external callers can
- * migrate cleanly; new UI and engine defaults resolve it to Medium.
+ * migrate cleanly; new UI and engine defaults resolve it to High.
  */
 export declare const DEFAULT_REASONING_EFFORT: ReasoningEffort;
 export declare const REASONING_EFFORT_LABELS: Record<ReasoningEffort, string>;
@@ -19,22 +19,22 @@ export declare function normalizeReasoningEffortForRequest(model: string | undef
 export declare function reasoningEffortLabel(effort: ReasoningEffort | undefined): string;
 /**
  * Resolve a user-facing selection for a model. Legacy `auto`, missing values,
- * and tiers unsupported by the newly selected model all become Medium.
- * Non-reasoning models still retain Medium in persisted chat state so moving
- * back to a reasoning model has a predictable default; their engines omit the
- * effort through `normalizeReasoningEffortForModel`.
+ * and tiers unsupported by the newly selected model all become High.
+ * Models without effort controls still retain High in persisted chat state so
+ * moving back to an effort-capable model has a predictable default; their
+ * engines omit the effort through `normalizeReasoningEffortForModel`.
  */
 export declare function resolveReasoningEffortSelection(model: string | undefined, effort: ReasoningEffort | undefined): ReasoningEffort;
 export declare function stepDownReasoningEffort(effort: ReasoningEffort | undefined): ReasoningEffort | undefined;
 export declare function isGPTReasoningModel(model: string): boolean;
 /**
  * Anthropic's adaptive-thinking API is only available on the newer Claude
- * model families. Claude Haiku 4.5 is reasoning-capable, but it still
+ * model families. Claude Haiku 4.5 supports effort, but it still
  * requires the legacy manual `budget_tokens` configuration.
  */
 export declare function supportsClaudeAdaptiveThinking(model: string | undefined): boolean;
 /**
- * Map the shared reasoning ladder to Anthropic's manual thinking budgets for
+ * Map the shared effort ladder to Anthropic's manual thinking budgets for
  * models that do not support adaptive thinking (currently Claude Haiku 4.5).
  */
 export declare function anthropicManualThinkingBudget(effort: ReasoningEffort): 1024 | 4096 | 8000 | 16000 | 32000;

package/dist/shared/reasoning-effort.js

@@ -9,11 +9,11 @@ export const REASONING_EFFORTS = [
     "max",
 ];
 /**
- * Shared chat always chooses an explicit reasoning tier. Keep `auto` in the
+ * Shared chat always chooses an explicit effort tier. Keep `auto` in the
  * accepted type only so older persisted selections and external callers can
- * migrate cleanly; new UI and engine defaults resolve it to Medium.
+ * migrate cleanly; new UI and engine defaults resolve it to High.
  */
-export const DEFAULT_REASONING_EFFORT = "medium";
+export const DEFAULT_REASONING_EFFORT = "high";
 export const REASONING_EFFORT_LABELS = {
     auto: "Auto",
     none: "None",
@@ -91,10 +91,10 @@ export function reasoningEffortLabel(effort) {
 }
 /**
  * Resolve a user-facing selection for a model. Legacy `auto`, missing values,
- * and tiers unsupported by the newly selected model all become Medium.
- * Non-reasoning models still retain Medium in persisted chat state so moving
- * back to a reasoning model has a predictable default; their engines omit the
- * effort through `normalizeReasoningEffortForModel`.
+ * and tiers unsupported by the newly selected model all become High.
+ * Models without effort controls still retain High in persisted chat state so
+ * moving back to an effort-capable model has a predictable default; their
+ * engines omit the effort through `normalizeReasoningEffortForModel`.
  */
 export function resolveReasoningEffortSelection(model, effort) {
     const requested = !effort || effort === "auto" ? DEFAULT_REASONING_EFFORT : effort;
@@ -107,7 +107,7 @@ export function resolveReasoningEffortSelection(model, effort) {
  * One tier down from each effort, stopping at "minimal" — legacy `auto`,
  * "none", and "minimal" itself are left unchanged. Used by the
  * empty-final-response retry so a retried turn asks for meaningfully less
- * reasoning instead of repeating the exact request that came back empty.
+ * effort instead of repeating the exact request that came back empty.
  */
 const REASONING_EFFORT_STEP_DOWN = {
     max: "xhigh",
@@ -138,7 +138,7 @@ function isClaudeReasoningModel(model) {
 }
 /**
  * Anthropic's adaptive-thinking API is only available on the newer Claude
- * model families. Claude Haiku 4.5 is reasoning-capable, but it still
+ * model families. Claude Haiku 4.5 supports effort, but it still
  * requires the legacy manual `budget_tokens` configuration.
  */
 export function supportsClaudeAdaptiveThinking(model) {
@@ -153,7 +153,7 @@ export function supportsClaudeAdaptiveThinking(model) {
     return opusMatch ? parseInt(opusMatch[1], 10) >= 6 : false;
 }
 /**
- * Map the shared reasoning ladder to Anthropic's manual thinking budgets for
+ * Map the shared effort ladder to Anthropic's manual thinking budgets for
  * models that do not support adaptive thinking (currently Claude Haiku 4.5).
  */
 export function anthropicManualThinkingBudget(effort) {