@agent-native/core 0.149.6 → 0.151.1

package/corpus/templates/dispatch/changelog/2026-08-10-desktop-workspace-sign-in.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-08-10
+---
+
+Desktop workspace sign-in can now be rolled out gradually while ordinary app sign-in remains unchanged by default.

package/corpus/templates/dispatch/changelog/2026-08-11-dispatch-no-longer-shows-the-generic-chat-starter-among-defa.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-08-11
+---
+
+Dispatch no longer shows the generic Chat starter among default app launchers

package/corpus/templates/dispatch/changelog/2026-08-11-integrations-and-scheduled-work-open-as-first-class-electron-pages.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-08-11
+---
+
+Integrations and scheduled work open as first-class Electron pages without a duplicate Dispatch navigation shell.

package/corpus/templates/dispatch/changelog/2026-08-11-sidebar-text-is-slightly-easier-to-read-in-light-and-dark-mo.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-08-11
+---
+
+Sidebar text is slightly easier to read in light and dark mode.

package/corpus/templates/dispatch/server/lib/identity-sso.ts

@@ -43,26 +43,30 @@ export const IDENTITY_TOKEN_TTL = "2m";
 /** JWT `scope` claim marking this as an identity (login) token, not A2A/MCP. */
 export const IDENTITY_SCOPE = "identity";
 
-/**
- * Host suffixes that a `redirect_uri` may belong to. This is the core
- * open-redirect / token-theft guard: an attacker-supplied `redirect_uri`
- * pointing anywhere else would exfiltrate the identity token.
- *
- * `.agent-native.com` covers every first-party hosted app
- * (mail.agent-native.com, calendar.agent-native.com, …) — the shared
- * first-party prod-URL registry is exactly the `*.agent-native.com`
- * subdomain space, so a suffix check is both sufficient and the least
- * footgun-prone (no per-app list to keep in sync).
- *
- * These are matched as DOT-prefixed suffixes against the parsed URL
- * hostname, so `agent-native.com.evil.com` does NOT match
- * `.agent-native.com` (it ends in `.evil.com`), and a bare
- * `agent-native.com` apex is intentionally NOT matched (all first-party
- * apps are subdomains; the apex is the marketing site).
- */
-export const DEFAULT_ALLOWED_HOST_SUFFIXES: readonly string[] = [
-  ".agent-native.com",
-];
+/** Exact first-party clients trusted to receive identity tokens. */
+export const CANONICAL_IDENTITY_SSO_APP_ORIGINS = {
+  analytics: "https://analytics.agent-native.com",
+  assets: "https://assets.agent-native.com",
+  brain: "https://brain.agent-native.com",
+  calendar: "https://calendar.agent-native.com",
+  chat: "https://chat.agent-native.com",
+  clips: "https://clips.agent-native.com",
+  content: "https://content.agent-native.com",
+  crm: "https://crm.agent-native.com",
+  design: "https://design.agent-native.com",
+  dispatch: "https://dispatch.agent-native.com",
+  forms: "https://forms.agent-native.com",
+  macros: "https://macros.agent-native.com",
+  mail: "https://mail.agent-native.com",
+  plan: "https://plan.agent-native.com",
+  slides: "https://slides.agent-native.com",
+  tasks: "https://tasks.agent-native.com",
+} as const;
+
+export const DEFAULT_ALLOWED_ORIGINS: readonly string[] = Object.values(
+  CANONICAL_IDENTITY_SSO_APP_ORIGINS,
+);
+const IDENTITY_SSO_CALLBACK_PATH = "/_agent-native/identity/callback";
 
 /** Loopback hosts allowed for local development of the client side. */
 const LOCALHOST_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
@@ -102,14 +106,11 @@ export function getConfiguredHostSuffixes(
  *      `http:` is also allowed (TLS is not available on localhost).
  *   3. It has no embedded credentials (`user:pass@host`) — those are an
  *      open-redirect obfuscation vector.
- *   4. Its hostname is either a loopback host, OR ends in one of the
- *      allowed host suffixes (default `.agent-native.com`, plus any
- *      configured via env). The suffix is matched against the FULL parsed
- *      hostname with a leading dot, so `agent-native.com.evil.com` is
- *      rejected (ends in `.evil.com`) and substring spoofs cannot pass.
+ *   4. Its origin is an exact registered first-party app, a loopback host,
+ *      or an operator-configured extra host suffix.
  *
- * Everything else is rejected. Fragments/queries on the URI are allowed
- * (the client may have its own) — we append our params safely.
+ * Everything else is rejected. The authorize endpoint adds a second check
+ * that binds the app id to the exact origin and callback path.
  */
 export function isAllowedRedirectUri(
   rawRedirectUri: unknown,
@@ -145,10 +146,9 @@ export function isAllowedRedirectUri(
 
   if (isLoopback) return true;
 
-  const suffixes = [
-    ...DEFAULT_ALLOWED_HOST_SUFFIXES,
-    ...(options.allowedHostSuffixes ?? getConfiguredHostSuffixes()),
-  ];
+  if (DEFAULT_ALLOWED_ORIGINS.includes(url.origin)) return true;
+
+  const suffixes = options.allowedHostSuffixes ?? getConfiguredHostSuffixes();
 
   // Suffix match against the full hostname, leading-dot anchored so a
   // sibling/parent host can never satisfy a child's suffix:
@@ -158,6 +158,32 @@ export function isAllowedRedirectUri(
   return suffixes.some((suffix) => hostname.endsWith(suffix));
 }
 
+const APP_ID = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+
+export function isAllowedIdentityRedirect(
+  appId: unknown,
+  rawRedirectUri: unknown,
+  options: { allowedHostSuffixes?: readonly string[] } = {},
+): boolean {
+  if (typeof appId !== "string" || !APP_ID.test(appId)) return false;
+  if (!isAllowedRedirectUri(rawRedirectUri, options)) return false;
+
+  const url = new URL(rawRedirectUri as string);
+  if (url.pathname !== IDENTITY_SSO_CALLBACK_PATH || url.search || url.hash) {
+    return false;
+  }
+
+  if (DEFAULT_ALLOWED_ORIGINS.includes(url.origin)) {
+    return (
+      CANONICAL_IDENTITY_SSO_APP_ORIGINS[
+        appId as keyof typeof CANONICAL_IDENTITY_SSO_APP_ORIGINS
+      ] === url.origin
+    );
+  }
+
+  return true;
+}
+
 export interface IdentityClaims {
   /** Stable user identifier — the Dispatch account email. */
   sub: string;

package/corpus/templates/dispatch/server/plugins/feature-flags.ts

@@ -0,0 +1,5 @@
+import { createFeatureFlagsPlugin } from "@agent-native/core/server";
+
+import { DISPATCH_FEATURE_FLAGS } from "../../shared/feature-flags.js";
+
+export default createFeatureFlagsPlugin({ flags: DISPATCH_FEATURE_FLAGS });

package/corpus/templates/dispatch/server/plugins/identity-sso.ts

@@ -8,8 +8,8 @@
  *      unauthenticated visitor here with:
  *        ?app=<id>&redirect_uri=<https url>&state=<opaque>
  *
- *   2. We validate `redirect_uri` against the strict allowlist
- *      (`isAllowedRedirectUri`). An invalid/forbidden value is rejected
+ *   2. We bind `app` and `redirect_uri` against the strict allowlist
+ *      (`isAllowedIdentityRedirect`). An invalid/forbidden pair is rejected
  *      with 400 BEFORE any session work — an attacker-controlled
  *      `redirect_uri` must never receive a token. This is the single most
  *      important control on this endpoint.
@@ -49,42 +49,40 @@
  *   This is documented as the chosen trade-off.
  *
  * Auth-guard reachability:
- *   `/_agent-native/*` is 401'd by the core auth guard when there is no
- *   session, which would break the logged-OUT bounce. So this plugin
- *   registers the exact path `/_agent-native/identity/authorize` as a
- *   `publicPath` via a second `createAuthPlugin({ publicPaths })` call.
- *   When two `createAuthPlugin` calls run in the same server boot on the
- *   same Nitro app, the framework APPENDS publicPaths to the live guard
- *   config (it does not clobber Dispatch's googleOnly/marketing/onboarding
- *   — verified in packages/core/src/server/auth.ts). The path is matched
- *   exactly (or as a `/`-segment prefix), so ONLY the authorize endpoint
- *   becomes public; any future `/_agent-native/identity/*` route stays
- *   protected. The handler then resolves the session ITSELF (exactly the
- *   `/_agent-native/open` pattern) — public-path only means "guard does not
- *   pre-empt", not "no auth": logged-out users are still bounced to login,
- *   and a token is only minted for a real session.
+ *   Dispatch's primary auth plugin receives the exact public paths from
+ *   `setupDispatch`. These handlers still resolve the session themselves;
+ *   public-path only means the guard does not pre-empt the logged-out bounce.
  */
 
 import { signA2AToken } from "@agent-native/core/a2a";
-import { getOrgDomain } from "@agent-native/core/org";
 import {
-  createAuthPlugin,
-  getH3App,
-  getSession,
-} from "@agent-native/core/server";
+  getFeatureFlagRules,
+  isFeatureFlagEnabled,
+  normalizeFeatureFlagRules,
+} from "@agent-native/core/feature-flags";
+import { getOrgDomain } from "@agent-native/core/org";
+import { getH3App, getSession } from "@agent-native/core/server";
 import { signInJourney } from "@agent-native/core/shared";
-import { defineEventHandler, getMethod } from "h3";
+import { defineEventHandler, getHeader, getMethod } from "h3";
 import type { H3Event } from "h3";
 
+import { DESKTOP_WORKSPACE_SSO_FLAG } from "../../shared/feature-flags.js";
 import {
   IDENTITY_TOKEN_TTL,
   buildIdentityClaims,
   buildRedirectLocation,
-  isAllowedRedirectUri,
+  isAllowedIdentityRedirect,
 } from "../lib/identity-sso.js";
 
-/** Exact path. Registered as a publicPath so the guard does not 401 it. */
+const AVAILABILITY_PATH = "/_agent-native/identity/availability";
 const AUTHORIZE_PATH = "/_agent-native/identity/authorize";
+const DESKTOP_SSO_CANARY_USER_AGENT = /AgentNativeDesktopSsoCanary\//i;
+
+export function isDesktopWorkspaceSsoRequest(
+  userAgent: string | undefined,
+): boolean {
+  return DESKTOP_SSO_CANARY_USER_AGENT.test(userAgent ?? "");
+}
 
 function getRequestUrl(event: H3Event): string {
   return (event as any).node?.req?.url ?? (event as any).path ?? "/";
@@ -93,7 +91,10 @@ function getRequestUrl(event: H3Event): string {
 function jsonResponse(body: unknown, status: number): Response {
   return new Response(JSON.stringify(body), {
     status,
-    headers: { "Content-Type": "application/json" },
+    headers: {
+      "Cache-Control": "private, no-store",
+      "Content-Type": "application/json",
+    },
   });
 }
 
@@ -118,6 +119,45 @@ async function resolveOrgDomain(
   }
 }
 
+export async function canAttemptWorkspaceSso(): Promise<boolean> {
+  const stored = await getFeatureFlagRules(
+    DESKTOP_WORKSPACE_SSO_FLAG.key,
+    {},
+  ).catch(() => null);
+  if (!stored) return false;
+  const rules = normalizeFeatureFlagRules(stored);
+  if (rules.mode === "off") return false;
+  if (rules.mode === "on") return true;
+  return (
+    rules.emails.length > 0 || rules.orgIds.length > 0 || rules.percentage > 0
+  );
+}
+
+export async function isWorkspaceSsoEnabledForSession(
+  session: Awaited<ReturnType<typeof getSession>>,
+): Promise<boolean> {
+  if (!session?.email) return false;
+  return isFeatureFlagEnabled(DESKTOP_WORKSPACE_SSO_FLAG, {
+    userEmail: session.email,
+    userKey: session.email,
+    orgId: session.orgId,
+  }).catch(() => false);
+}
+
+const availabilityHandler = defineEventHandler(
+  async (event: H3Event): Promise<Response> => {
+    const method = getMethod(event);
+    if (method !== "GET" && method !== "HEAD") {
+      return jsonResponse({ error: "Method not allowed" }, 405);
+    }
+    const session = await getSession(event).catch(() => null);
+    const available = session?.email
+      ? await isWorkspaceSsoEnabledForSession(session)
+      : await canAttemptWorkspaceSso();
+    return jsonResponse({ available }, 200);
+  },
+);
+
 const authorizeHandler = defineEventHandler(
   async (event: H3Event): Promise<Response> => {
     const method = getMethod(event);
@@ -134,11 +174,15 @@ const authorizeHandler = defineEventHandler(
     }
 
     const redirectUri = search.get("redirect_uri");
+    const appId = search.get("app");
     const state = search.get("state");
+    const isDesktopRequest = isDesktopWorkspaceSsoRequest(
+      getHeader(event, "user-agent"),
+    );
 
     // ---- Control 1: redirect_uri allowlist (BEFORE any session work) ----
     // An attacker-supplied redirect_uri must never reach the mint path.
-    if (!isAllowedRedirectUri(redirectUri)) {
+    if (!isAllowedIdentityRedirect(appId, redirectUri)) {
       return jsonResponse(
         {
           error: "invalid_redirect_uri",
@@ -150,9 +194,13 @@ const authorizeHandler = defineEventHandler(
         400,
       );
     }
-    // Narrowed to string by isAllowedRedirectUri.
+    // Narrowed to string by isAllowedIdentityRedirect.
     const safeRedirectUri = redirectUri as string;
 
+    if (isDesktopRequest && !(await canAttemptWorkspaceSso())) {
+      return jsonResponse({ error: "not_found" }, 404);
+    }
+
     // ---- Resolve the EXISTING Dispatch session --------------------------
     const session = await getSession(event).catch(() => null);
 
@@ -182,6 +230,10 @@ const authorizeHandler = defineEventHandler(
       return redirect(signInHref);
     }
 
+    if (isDesktopRequest && !(await isWorkspaceSsoEnabledForSession(session))) {
+      return jsonResponse({ error: "not_found" }, 404);
+    }
+
     // ---- Mint the short-lived identity token ----------------------------
     if (!process.env.A2A_SECRET) {
       // Without a shared secret, no first-party app could verify the token.
@@ -238,13 +290,10 @@ const authorizeHandler = defineEventHandler(
 );
 
 /**
- * Dispatch identity-SSO plugin. Mounts the authorize route and registers
- * its exact path as a public path so the core auth guard does not 401 the
- * logged-out bounce. The `createAuthPlugin({ publicPaths })` call is
- * additive — it appends to the live guard config without disturbing the
- * primary Dispatch auth plugin's googleOnly/marketing/onboarding config.
+ * Dispatch identity-SSO plugin. The primary Dispatch auth plugin owns the
+ * exact public-path registration; this plugin owns only these handlers.
  */
 export default async (nitroApp: any) => {
+  getH3App(nitroApp).use(AVAILABILITY_PATH, availabilityHandler);
   getH3App(nitroApp).use(AUTHORIZE_PATH, authorizeHandler);
-  return createAuthPlugin({ publicPaths: [AUTHORIZE_PATH] })(nitroApp);
 };

package/corpus/templates/dispatch/server/plugins/org-apps-directory.ts

@@ -37,9 +37,9 @@
  * Auth-guard reachability: `/_agent-native/*` is 401'd by the core auth
  * guard when there is no session. This route is authenticated by the A2A
  * JWT, not a cookie, so — exactly like the identity-sso plugin's authorize
- * route — it registers its exact path as a `publicPath` via a second
- * additive `createAuthPlugin({ publicPaths })` call. "Public path" only
- * means "the guard does not pre-empt with a 401"; the handler still performs
+ * route — Dispatch's primary auth plugin receives its exact `publicPath`
+ * from `setupDispatch`. "Public path" only means "the guard does not pre-empt
+ * with a 401"; the handler still performs
  * the full A2A JWT + same-org check itself (defense in depth). The path is
  * matched exactly, so no other `/_agent-native/org/*` route is affected.
  *
@@ -51,11 +51,7 @@ import {
   getOrgDomain,
   resolveOrgByDomain,
 } from "@agent-native/core/org";
-import {
-  createAuthPlugin,
-  getH3App,
-  runWithRequestContext,
-} from "@agent-native/core/server";
+import { getH3App, runWithRequestContext } from "@agent-native/core/server";
 import { discoverAgents } from "@agent-native/core/server/agent-discovery";
 import { defineEventHandler, getMethod, getRequestHeader } from "h3";
 import type { H3Event } from "h3";
@@ -181,14 +177,10 @@ const orgAppsHandler = defineEventHandler(
 );
 
 /**
- * Dispatch org-app-directory plugin. Mounts the directory route and
- * registers its exact path as a public path so the core auth guard does not
- * 401 the A2A peer call before our own JWT + same-org check runs. The
- * `createAuthPlugin({ publicPaths })` call is additive — it appends to the
- * live guard config without disturbing Dispatch's primary auth plugin
- * (same mechanism the identity-sso plugin relies on).
+ * Dispatch org-app-directory plugin. The primary Dispatch auth plugin owns
+ * the exact public-path registration so this handler can perform its own JWT
+ * and same-org checks without racing a second auth initializer.
  */
 export default async (nitroApp: any) => {
   getH3App(nitroApp).use(ORG_APPS_PATH, orgAppsHandler);
-  return createAuthPlugin({ publicPaths: [ORG_APPS_PATH] })(nitroApp);
 };

package/corpus/templates/dispatch/server/plugins/setup-dispatch.ts

@@ -1,3 +1,11 @@
 import { setupDispatch } from "@agent-native/dispatch/server";
 
-export default setupDispatch();
+export default setupDispatch({
+  auth: {
+    publicPaths: [
+      "/_agent-native/identity/availability",
+      "/_agent-native/identity/authorize",
+      "/_agent-native/org/apps",
+    ],
+  },
+});

package/corpus/templates/dispatch/shared/feature-flags.ts

@@ -0,0 +1,15 @@
+import {
+  defineFeatureFlag,
+  defineFeatureFlags,
+} from "@agent-native/core/feature-flags";
+
+export const DESKTOP_WORKSPACE_SSO_FLAG = defineFeatureFlag({
+  key: "desktop.workspace-sso",
+  displayName: "Desktop workspace sign-in",
+  description:
+    "Let the signed Agent Native Desktop broker workspace identity across first-party apps.",
+});
+
+export const DISPATCH_FEATURE_FLAGS = defineFeatureFlags([
+  DESKTOP_WORKSPACE_SSO_FLAG,
+]);

package/corpus/templates/factory/.agents/skills/delegate-to-agent/SKILL.md

@@ -49,6 +49,34 @@ sendToAgentChat({
 });
 ```
 
+### Keep user text separate from injected context
+
+Treat the visible `message` as the user's request or the shortest clear
+description of an app-initiated operation. Put context the user did not type —
+IDs, URLs, filenames, current selection or screen state, serialized records,
+upload instructions, and bounded source excerpts — in the `context` field.
+`context` is model input carried through the agent turn; it is stripped from
+the rendered user message, so do not concatenate it into `message` with labels,
+blank-line sections, or `<context>` tags yourself.
+
+Use the related surface for each kind of supporting input:
+
+| Surface | Use for |
+| --- | --- |
+| `message` | User-authored intent or a concise app action description |
+| `context` | Derived metadata and bounded text needed to carry out that intent |
+| `setAgentChatContextItem` | Context staged for a later user-submitted prompt; keep it keyed so updates replace stale context |
+| `images`, `referenceImagePaths`, attachments | Binary or visual inputs; describe only the handling instructions in `context` |
+
+If an app builds a prompt from a form, selection, upload, or editor state, keep
+the visible message short and pass the assembled details as `context`. Preserve
+the user's actual freeform text in `message` when it is the request; do not
+restate it as metadata in `context` unless the agent needs a structured copy.
+
+This boundary applies to auto-submitted turns and prefills. A hidden context
+field is not a license to send unbounded records or secrets: cap excerpts,
+prefer stable IDs and URLs, and use an action or resource lookup for full data.
+
 **From the UI, in the background:**
 
 ```ts

package/corpus/templates/forms/.agents/skills/delegate-to-agent/SKILL.md

@@ -49,6 +49,34 @@ sendToAgentChat({
 });
 ```
 
+### Keep user text separate from injected context
+
+Treat the visible `message` as the user's request or the shortest clear
+description of an app-initiated operation. Put context the user did not type —
+IDs, URLs, filenames, current selection or screen state, serialized records,
+upload instructions, and bounded source excerpts — in the `context` field.
+`context` is model input carried through the agent turn; it is stripped from
+the rendered user message, so do not concatenate it into `message` with labels,
+blank-line sections, or `<context>` tags yourself.
+
+Use the related surface for each kind of supporting input:
+
+| Surface | Use for |
+| --- | --- |
+| `message` | User-authored intent or a concise app action description |
+| `context` | Derived metadata and bounded text needed to carry out that intent |
+| `setAgentChatContextItem` | Context staged for a later user-submitted prompt; keep it keyed so updates replace stale context |
+| `images`, `referenceImagePaths`, attachments | Binary or visual inputs; describe only the handling instructions in `context` |
+
+If an app builds a prompt from a form, selection, upload, or editor state, keep
+the visible message short and pass the assembled details as `context`. Preserve
+the user's actual freeform text in `message` when it is the request; do not
+restate it as metadata in `context` unless the agent needs a structured copy.
+
+This boundary applies to auto-submitted turns and prefills. A hidden context
+field is not a license to send unbounded records or secrets: cap excerpts,
+prefer stable IDs and URLs, and use an action or resource lookup for full data.
+
 **From the UI, in the background:**
 
 ```ts

package/corpus/templates/forms/.agents/skills/form-responses/SKILL.md

@@ -80,13 +80,14 @@ Each response is stored in the `responses` SQL table:
 `submitterEmail` may come from the logged-in Forms session or from trusted
 feedback clients that pass the logged-in user email as submission metadata.
 
-`pageUrl` and `clientSurface` are hidden pass-through fields: trusted embeds
-(e.g. the framework FeedbackButton) forward the URL of the page the respondent
-was on and the runtime shell they were in (`web`, `electron`, or `tauri`) as
-submission metadata, so owners can see which screen and which app feedback came
-from. Both are null for direct fills that send no context, and `clientSurface`
-is allowlisted server-side (unknown values are dropped). The responses table
-surfaces them as "Page" and "Source" columns when any response carries them.
+`pageUrl` and `clientSurface` are hidden pass-through fields. Direct public
+fills record the current form URL, while trusted embeds (e.g. the framework
+FeedbackButton) forward the respondent's source page and runtime shell (`web`,
+`electron`, or `tauri`) so owners can see which screen and app feedback came
+from. Sensitive URL query keys are scrubbed before persistence, `clientSurface`
+is allowlisted server-side (unknown values are dropped), and anonymous forms
+suppress both fields. The responses table surfaces them as "Page" and "Source"
+columns when any response carries them.
 
 The `data` JSON maps field IDs to values:
 

package/corpus/templates/forms/app/hooks/use-forms.ts

@@ -4,6 +4,7 @@ import {
   useActionMutation,
 } from "@agent-native/core/client/hooks";
 import { useT } from "@agent-native/core/client/i18n";
+import { scrubPageUrl } from "@shared/page-url";
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
 import { toast } from "sonner";
 
@@ -189,7 +190,13 @@ export function useSubmitForm() {
       fetch(appApiPath(`/api/submit/${formId}`), {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ data, captchaToken, _hp, _t }),
+        body: JSON.stringify({
+          data,
+          captchaToken,
+          _hp,
+          _t,
+          _meta: { pageUrl: scrubPageUrl(window.location.href) },
+        }),
       }).then((r) => {
         if (!r.ok) return r.json().then((e: any) => Promise.reject(e));
         return r.json();

package/corpus/templates/forms/changelog/2026-08-11-fixed-public-forms-so-conditional-questions-stay-hidden-unti.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-11
+---
+
+Fixed public forms so conditional questions stay hidden until relevant and submissions retain a safe page link.

package/corpus/templates/forms/server/handlers/submissions.ts

@@ -21,6 +21,7 @@ import {
   isConditionalFieldVisible,
   sanitizeConditionalValues as sanitizeVisibleValues,
 } from "../../shared/conditional.js";
+import { scrubPageUrl } from "../../shared/page-url.js";
 import {
   cleanSubmitterEmail,
   publicSubmitterEmail,
@@ -226,7 +227,7 @@ export const submitForm = defineEventHandler(async (event: H3Event) => {
     meta?.chatSessionIds,
   ]);
   const activeRunId = cleanMetaText(meta?.activeRunId);
-  const pageUrl = cleanMetaText(meta?.pageUrl);
+  const pageUrl = scrubPageUrl(meta?.pageUrl);
   const clientSurface = cleanClientSurface(meta?.clientSurface);
 
   await db.insert(schema.responses).values({

package/corpus/templates/forms/server/lib/public-form-ssr.ts

@@ -10,6 +10,8 @@ import {
 import { eq } from "drizzle-orm";
 import { getMethod, getRequestURL, type H3Event } from "h3";
 
+import { isConditionalFieldVisible } from "../../shared/conditional.js";
+import { SENSITIVE_QUERY_PARAMS } from "../../shared/page-url.js";
 import {
   toPublicFormSettings,
   type FormField,
@@ -200,6 +202,10 @@ function renderField(field: FormField): string {
     ? ` data-cond-field="${escapeHtml(field.conditional.fieldId)}" data-cond-op="${escapeHtml(field.conditional.operator)}" data-cond-val="${escapeHtml(field.conditional.value)}"`
     : "";
   const widthClass = field.width === "half" ? " field-half" : "";
+  const initiallyVisible = isConditionalFieldVisible(field, {});
+  const initialVisibility = initiallyVisible
+    ? ""
+    : ' style="display:none" data-hidden="1"';
 
   let input = "";
 
@@ -265,7 +271,7 @@ function renderField(field: FormField): string {
       break;
   }
 
-  return `<div class="field${widthClass}" data-field-id="${id}"${cond}>
+  return `<div class="field${widthClass}" data-field-id="${id}"${cond}${initialVisibility}>
     <label class="field-label">${escapeHtml(field.label)}${field.required ? '<span class="req">*</span>' : ""}</label>
     ${desc}${input}</div>`;
 }
@@ -435,6 +441,34 @@ function renderFormPage(
   var REDIRECT = ${JSON.stringify(safeRedirectUrl(settings.redirectUrl))};
   var TURNSTILE_KEY = ${JSON.stringify(turnstileSiteKey)};
   var FIELDS = ${JSON.stringify(fields.map((f) => ({ id: f.id, type: f.type, required: f.required, validation: f.validation, label: f.label, conditional: f.conditional })))};
+  var SENSITIVE_QUERY_PARAMS = ${JSON.stringify(SENSITIVE_QUERY_PARAMS)};
+
+  function scrubPageUrl(value) {
+    try {
+      var url = new URL(value);
+      if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+      url.username = "";
+      url.password = "";
+      scrubParams(url.searchParams);
+      if (url.hash.indexOf("=") >= 0) {
+        var hashParams = new URLSearchParams(url.hash.slice(1));
+        scrubParams(hashParams);
+        url.hash = hashParams.toString();
+      }
+      return url.toString();
+    // coercion-ok: an invalid browser URL is absent page context, not a valid submission value
+    } catch (_) {
+      return null;
+    }
+  }
+
+  function scrubParams(params) {
+    Array.from(params.keys()).forEach(function(key) {
+      if (SENSITIVE_QUERY_PARAMS.indexOf(key.toLowerCase()) >= 0) {
+        params.set(key, "<redacted>");
+      }
+    });
+  }
 
   function revalidateFormVersion() {
     fetch(PUBLIC_FORM_API, { cache: "no-store" })
@@ -631,11 +665,12 @@ function renderFormPage(
     btn.textContent = "Submitting...";
     btn.disabled = true;
     var hp = (document.getElementById("_hp") || {}).value || "";
+    var pageUrl = scrubPageUrl(window.location.href);
 
     fetch(${JSON.stringify(submitPath)} + FORM_ID, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ data: data, captchaToken: captchaToken, _hp: hp, _t: PAGE_LOAD_T }),
+      body: JSON.stringify({ data: data, captchaToken: captchaToken, _hp: hp, _t: PAGE_LOAD_T, _meta: { pageUrl: pageUrl } }),
     })
     .then(function(r) { return r.json().then(function(d) { return { ok: r.ok, data: d }; }); })
     .then(function(res) {