@agent-native/core 0.15.7 → 0.15.9

package/dist/server/core-routes-plugin.js

@@ -6,7 +6,7 @@ import { createPollHandler } from "./poll.js";
 import { createPollEventsHandler } from "./poll-events.js";
 import { upsertEnvFile } from "./create-server.js";
 import { readBody } from "./h3-helpers.js";
-import { BUILDER_CONNECT_PARAM, BUILDER_CONNECT_OWNER_COOKIE, BUILDER_ENV_KEYS, BUILDER_STATE_PARAM, appendBuilderConnectToken, buildBuilderCliAuthUrl, createBuilderBrowserCallbackErrorPage, createBuilderBrowserCallbackPage, getBuilderBrowserOriginForEvent, getBuilderBrowserStatusForEvent, resolveBuilderBranchProjectId, resolveSafePreviewUrl, runBuilderAgent, signBuilderCallbackState, verifyBuilderConnectTokenAndGetOwner, verifyBuilderCallbackStateAndGetOwner, signBuilderConnectToken, } from "./builder-browser.js";
+import { BUILDER_CONNECT_PARAM, BUILDER_CONNECT_OWNER_COOKIE, BUILDER_ENV_KEYS, BUILDER_OPENER_PARAM, BUILDER_STATE_PARAM, appendBuilderConnectToken, buildBuilderCliAuthUrl, createBuilderBrowserCallbackErrorPage, createBuilderBrowserCallbackPage, getBuilderCliAuthCallbackOriginForEvent, getBuilderBrowserOriginForEvent, getBuilderBrowserStatusForEvent, resolveBuilderBranchProjectId, resolveSafePreviewUrl, runBuilderAgent, signBuilderCallbackState, verifyBuilderConnectTokenAndGetOwner, verifyBuilderCallbackStateAndGetOwner, signBuilderConnectToken, } from "./builder-browser.js";
 import { getState, putState, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, } from "../application-state/handlers.js";
 import { getSetting, putSetting, deleteSetting } from "../settings/store.js";
 import { getUserSetting, putUserSetting, deleteUserSetting, } from "../settings/user-settings.js";
@@ -413,8 +413,9 @@ export function createCoreRoutesPlugin(options = {}) {
                 // instead of bouncing through the gateway. getOrigin(event) falls
                 // back to the gateway on Builder preview hosts, which defeats the
                 // whole preview-aware isolation goal of this PR.
-                const callbackOrigin = getBuilderBrowserOriginForEvent(event);
-                const cliAuthUrl = buildBuilderCliAuthUrl(callbackOrigin, signBuilderCallbackState(userEmail));
+                const previewOrigin = getBuilderBrowserOriginForEvent(event);
+                const callbackOrigin = getBuilderCliAuthCallbackOriginForEvent(event);
+                const cliAuthUrl = buildBuilderCliAuthUrl(callbackOrigin, signBuilderCallbackState(userEmail), { previewOrigin });
                 return {
                     ...status,
                     connectUrl: appendBuilderConnectToken(status.connectUrl, userEmail),
@@ -480,12 +481,32 @@ export function createCoreRoutesPlugin(options = {}) {
                 // the fallback. This keeps a root/local BUILDER_PRIVATE_KEY from
                 // blocking a user from connecting their own Builder account.
                 try {
-                    const { resolveBuilderCredentials, resolveBuilderCredentialSource, } = await import("./credential-provider.js");
+                    const { resolveBuilderCredentials, resolveBuilderCredentialSource, getBuilderCredentialAuthFailure, } = await import("./credential-provider.js");
                     const [creds, credentialSource] = await Promise.all([
                         resolveBuilderCredentials(),
                         resolveBuilderCredentialSource(),
                     ]);
-                    if (creds.privateKey) {
+                    const authFailure = await getBuilderCredentialAuthFailure(creds);
+                    if (authFailure) {
+                        return withConnectToken({
+                            ...requestStatus,
+                            configured: false,
+                            privateKeyConfigured: false,
+                            publicKeyConfigured: false,
+                            userId: undefined,
+                            orgName: undefined,
+                            orgKind: undefined,
+                            credentialSource: credentialSource ?? undefined,
+                            // Surface the failure message so the UI can explain why the
+                            // connection is broken instead of silently showing "Connect
+                            // Builder" with no context.
+                            connectError: {
+                                message: authFailure.message,
+                                at: authFailure.at,
+                            },
+                        });
+                    }
+                    if (creds.privateKey && creds.publicKey) {
                         return withConnectToken({
                             ...requestStatus,
                             configured: true,
@@ -641,6 +662,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     title: "Couldn't start Builder connection",
                     body: "The connect popup did not include a valid signed link for this app.",
                     closeHint: "Close this popup, refresh the app, and try Connect account again.",
+                    parentOrigin: getBuilderBrowserOriginForEvent(event),
                 });
             }
             // Clear any prior failure row from a previous attempt — otherwise
@@ -676,7 +698,9 @@ export function createCoreRoutesPlugin(options = {}) {
                 }).catch(() => { });
                 setResponseStatus(event, 503);
                 setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
-                return createBuilderBrowserCallbackErrorPage(msg);
+                return createBuilderBrowserCallbackErrorPage(msg, {
+                    parentOrigin: getBuilderBrowserOriginForEvent(event),
+                });
             }
             await trackBuilderLifecycle(event, "builder connect started", ownerEmail, {
                 stage: "connect",
@@ -687,7 +711,7 @@ export function createCoreRoutesPlugin(options = {}) {
             // from /builder/status. Keep this legacy trampoline working for older
             // clients, but still send it to Builder immediately and include signed
             // callback state so the callback does not depend on popup cookies.
-            const cliAuthUrl = buildBuilderCliAuthUrl(getBuilderBrowserOriginForEvent(event), signBuilderCallbackState(ownerEmail));
+            const cliAuthUrl = buildBuilderCliAuthUrl(getBuilderCliAuthCallbackOriginForEvent(event), signBuilderCallbackState(ownerEmail), { previewOrigin: getBuilderBrowserOriginForEvent(event) });
             setResponseStatus(event, 302);
             setResponseHeader(event, "Location", cliAuthUrl);
             return "";
@@ -793,6 +817,23 @@ export function createCoreRoutesPlugin(options = {}) {
             }
             clearBuilderConnectOwnerCookie(event);
             const requestUrl = new URL(`${event.url?.pathname || "/"}${event.url?.search || ""}`, getOrigin(event));
+            // postMessage from the callback success/error pages must target the
+            // original preview opener, not the callback server. On the fallback
+            // path the callback is served from the env-configured gateway while
+            // the opener lives on the preview origin. Three sources of opener
+            // origin, in priority order:
+            //   1. `_an_opener` — written into the callback URL's query by
+            //      buildBuilderCliAuthUrl when cli-auth's allow-list forced
+            //      preview_url onto the gateway. Survives Builder's redirect
+            //      verbatim (Builder preserves redirect_url's query string).
+            //   2. `preview-url` — Builder echoes the top-level preview_url back
+            //      as a query param on the callback. Reflects the gateway on
+            //      the fallback path, but matches the opener on the happy path.
+            //   3. The event's own origin — last-resort fallback.
+            const openerOriginFromQuery = requestUrl.searchParams.get(BUILDER_OPENER_PARAM);
+            const callbackParentOrigin = resolveSafePreviewUrl(openerOriginFromQuery, event) ||
+                resolveSafePreviewUrl(requestUrl.searchParams.get("preview-url"), event) ||
+                getBuilderBrowserOriginForEvent(event);
             const callbackStateOwner = verifyBuilderCallbackStateAndGetOwner(requestUrl.searchParams.get(BUILDER_STATE_PARAM));
             const hasValidCallbackState = callbackStateOwner === ownerEmail;
             // Verify either:
@@ -844,7 +885,9 @@ export function createCoreRoutesPlugin(options = {}) {
                 }).catch(() => { });
                 setResponseStatus(event, 503);
                 setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
-                return createBuilderBrowserCallbackErrorPage(pendingError);
+                return createBuilderBrowserCallbackErrorPage(pendingError, {
+                    parentOrigin: callbackParentOrigin,
+                });
             }
             if (!pendingValid) {
                 await trackBuilderLifecycle(event, "builder connect failed", ownerEmail, {
@@ -868,7 +911,9 @@ export function createCoreRoutesPlugin(options = {}) {
                 }
                 setResponseStatus(event, 403);
                 setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
-                return createBuilderBrowserCallbackErrorPage(msg);
+                return createBuilderBrowserCallbackErrorPage(msg, {
+                    parentOrigin: callbackParentOrigin,
+                });
             }
             const privateKey = requestUrl.searchParams.get("p-key");
             const publicKey = requestUrl.searchParams.get("api-key");
@@ -888,7 +933,9 @@ export function createCoreRoutesPlugin(options = {}) {
                 }).catch(() => { });
                 setResponseStatus(event, 400);
                 setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
-                return createBuilderBrowserCallbackErrorPage(msg);
+                return createBuilderBrowserCallbackErrorPage(msg, {
+                    parentOrigin: callbackParentOrigin,
+                });
             }
             const userId = requestUrl.searchParams.get("user-id");
             const orgName = requestUrl.searchParams.get("org-name");
@@ -952,7 +999,9 @@ export function createCoreRoutesPlugin(options = {}) {
                 }
                 setResponseStatus(event, 500);
                 setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
-                return createBuilderBrowserCallbackErrorPage(writeError);
+                return createBuilderBrowserCallbackErrorPage(writeError, {
+                    parentOrigin: callbackParentOrigin,
+                });
             }
             // Clear any legacy disconnect flag and any prior connect-error row
             // (so a successful retry doesn't surface the previous failure).
@@ -975,7 +1024,17 @@ export function createCoreRoutesPlugin(options = {}) {
                 org_kind: orgKind || undefined,
             });
             setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
-            return createBuilderBrowserCallbackPage(previewUrl);
+            // The parent (opener) is the original preview surface that started the
+            // connect flow, NOT the callback server's own origin — when the
+            // env-configured gateway is used as the callback fallback (because
+            // Builder rejects the preview host), the callback server and the
+            // opener live on different origins, and postMessage to the gateway
+            // origin would be dropped by the preview opener. callbackParentOrigin
+            // is the precomputed best-available opener origin (`_an_opener` →
+            // `preview-url` → event origin).
+            return createBuilderBrowserCallbackPage(previewUrl, {
+                parentOrigin: callbackParentOrigin,
+            });
         }));
         // POST /_agent-native/builder/disconnect — revoke the user's per-user
         // or org-scoped Builder credentials in app_secrets. Deploy-level env
@@ -1051,7 +1110,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     setResponseStatus(event, 400);
                     return { error: "userMessage is required" };
                 }
-                const apiHost = process.env.BUILDER_API_HOST || "https://ai-services.builder.io";
+                const apiHost = process.env.BUILDER_API_HOST || "https://api.builder.io";
                 try {
                     const res = await fetch(`${apiHost}/agents/run?apiKey=${encodeURIComponent(creds.publicKey)}`, {
                         method: "POST",