@agent-native/core 0.151.2 → 0.152.0

package/dist/server/agent-chat-plugin.js

@@ -2269,15 +2269,19 @@ export function createAgentChatPlugin(options) {
             catch { }
             // Lean mode: only template actions + essential framework tools. Drop
             // web-request, browser tools, teams, jobs, automations, notifications,
-            // progress, call-agent, and MCP entries to keep the tool list tight and
-            // prevent the LLM from reaching for web-request instead of the
-            // template's native actions (e.g. log-meal).
+            // progress, and MCP entries to keep the tool list tight and prevent the
+            // LLM from reaching for web-request instead of the template's native
+            // actions (e.g. log-meal). Cross-app delegation is the exception: when
+            // it is enabled, keep its two discovery/delegation tools available even
+            // in lean mode because the framework prompt and default starter surface
+            // still promise sibling-app routing.
             const leanActionEntries = {
                 ...templateScripts,
                 ...resourceScripts,
                 ...refreshScreenTool,
                 ...urlTools,
                 ...chatScripts,
+                ...(a2aAgentDelegationEnabled ? callAgentScript : {}),
                 ...toolActions,
             };
             const anonymousReadOnlyActions = attachToolSearch(filterReadOnlyActions(templateScripts));
@@ -2387,7 +2391,11 @@ export function createAgentChatPlugin(options) {
             // Lean mode: use only the template's systemPrompt + actions list.
             // Skip resource loading and schema block — those add DB round-trips
             // and tokens that minimal/voice apps don't need.
-            const leanBasePrompt = (options?.systemPrompt ?? "") + prodActionsPrompt;
+            const leanActionsPrompt = prodActionsPrompt +
+                (a2aAgentDelegationEnabled
+                    ? generateActionsPrompt(callAgentScript, "tool")
+                    : "");
+            const leanBasePrompt = (options?.systemPrompt ?? "") + leanActionsPrompt;
             const anonymousReadOnlyPrompt = (options?.systemPrompt ?? PROD_FRAMEWORK_PROMPT_COMPACT) +
                 generateActionsPrompt(filterReadOnlyActions(templateScripts), "tool", lazyContext ? effectiveInitialToolNames : undefined) +
                 "\n\nYou are answering from a public shared page. Treat the visible resource as read-only: do not create, edit, delete, comment on, share, or otherwise mutate app data. If the user asks for a change, describe what you would change or suggest signing in to edit.";
@@ -2584,8 +2592,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     if (leanPrompt) {
                         const leanRunPolicyPrompt = buildLeanRunPolicyPrompt(codeEditingSurfaceRestriction, prodCodeExecPromptNote);
                         await emitContextXraySystemSections(event, {
-                            frameworkPrompt: leanBasePrompt.slice(0, Math.max(0, leanBasePrompt.length - prodActionsPrompt.length)),
-                            actionsPrompt: prodActionsPrompt,
+                            frameworkPrompt: leanBasePrompt.slice(0, Math.max(0, leanBasePrompt.length - leanActionsPrompt.length)),
+                            actionsPrompt: leanActionsPrompt,
                             additionalFramework: leanRunPolicyPrompt,
                             extra,
                             modelOverlay,
@@ -2823,8 +2831,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         // for the same pattern.
                         if (leanPrompt) {
                             await emitContextXraySystemSections(event, {
-                                frameworkPrompt: leanBasePrompt.slice(0, Math.max(0, leanBasePrompt.length - prodActionsPrompt.length)),
-                                actionsPrompt: prodActionsPrompt,
+                                frameworkPrompt: leanBasePrompt.slice(0, Math.max(0, leanBasePrompt.length - leanActionsPrompt.length)),
+                                actionsPrompt: leanActionsPrompt,
                                 extra,
                                 modelOverlay,
                                 runtimeContext,

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.d.ts

@@ -112,17 +112,6 @@ export interface AuthOptions {
         features?: string[];
         runLocalCommand?: string;
     };
-    /**
-     * Optional host-scoped notice shown before the built-in Google sign-in
-     * redirects to Google.
-     */
-    googleSignInNotice?: {
-        host?: string;
-        title: string;
-        body: string | string[];
-        continueLabel?: string;
-        cancelLabel?: string;
-    };
     /**
      * Optional email signup legal copy for the built-in login page.
      * Leave unset to use Agent Native links only on `*.agent-native.com` hosts,

package/dist/server/auth.js

@@ -999,7 +999,6 @@ function getOnboardingHtmlOptions(options, event, rawPath, authMode) {
         authMode,
         googleOnly: options.googleOnly,
         marketing: options.marketing,
-        googleSignInNotice: options.googleSignInNotice,
         signupLegalNotice: options.signupLegalNotice,
         googleAuthMode: options.googleAuthMode,
         requestHost: event ? getRequestHost(event) : undefined,
@@ -1922,6 +1921,13 @@ async function hasAutoDevAccountUser(db) {
     });
     return rows.length > 0;
 }
+async function hasRealUser(db) {
+    const { rows } = await db.execute({
+        sql: 'SELECT 1 FROM "user" WHERE email NOT IN (?, ?) LIMIT 1',
+        args: [AUTO_DEV_ACCOUNT_EMAIL, LEGACY_AUTO_DEV_ACCOUNT_EMAIL],
+    });
+    return rows.length > 0;
+}
 const autoDevAccountCreationPromises = new Map();
 function getAutoDevAccountCreationKey() {
     return `${process.cwd()}:${process.env.APP_BASE_PATH ?? ""}`;
@@ -2012,11 +2018,7 @@ async function createOrReuseAutoDevSession(auth, config) {
     if (session)
         return { email: session.email, token: session.token };
     const db = getDbExec();
-    const { rows: realUsers } = await db.execute({
-        sql: 'SELECT 1 FROM "user" WHERE email NOT IN (?, ?) LIMIT 1',
-        args: [AUTO_DEV_ACCOUNT_EMAIL, LEGACY_AUTO_DEV_ACCOUNT_EMAIL],
-    });
-    if (realUsers.length > 0)
+    if (await hasRealUser(db))
         return null;
     const devPassword = await createAutoDevAccountForSession(auth, db);
     if (!devPassword && !(await hasAutoDevAccountUser(db)))
@@ -2027,8 +2029,30 @@ async function createOrReuseAutoDevSession(auth, config) {
     }
     return session ? { email: session.email, token: session.token } : null;
 }
+async function getLocalDevAuthAvailability(event, config) {
+    if (!isLocalDevAuthAllowed(event)) {
+        return { available: false, reason: "not-allowed" };
+    }
+    try {
+        const db = getDbExec();
+        await getBetterAuth(config);
+        if (await hasAutoDevAccountUser(db))
+            return { available: true };
+        if (await hasRealUser(db)) {
+            return { available: false, reason: "existing-user" };
+        }
+        return { available: true };
+    }
+    catch {
+        return { available: false, reason: "unreadable" };
+    }
+}
 function createLocalDevAuthHandler(config) {
     return defineEventHandler(async (event) => {
+        if (getMethod(event) === "GET") {
+            setResponseHeader(event, "Cache-Control", "no-store");
+            return getLocalDevAuthAvailability(event, config);
+        }
         if (getMethod(event) !== "POST") {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };
@@ -2105,11 +2129,7 @@ async function maybeAutoCreateDevSession(event, redirectTo) {
         // pre-fix local DB that still holds a `dev@local` row isn't treated
         // as having a "real user" (which would permanently disable
         // auto-create on that DB).
-        const { rows: realUsers } = await db.execute({
-            sql: 'SELECT 1 FROM "user" WHERE email NOT IN (?, ?) LIMIT 1',
-            args: [AUTO_DEV_ACCOUNT_EMAIL, LEGACY_AUTO_DEV_ACCOUNT_EMAIL],
-        });
-        if (realUsers.length > 0)
+        if (await hasRealUser(db))
             return null;
         // If the dev account already exists, this is not a freshly-scaffolded
         // app — the user has been through the auto-create flow at least
@@ -3086,7 +3106,7 @@ async function mountBetterAuthRoutes(app, options) {
                     for (const key of callbackKeys) {
                         if (typeof body[key] !== "string")
                             continue;
-                        const callbackURL = betterAuthCallbackURL(body[key], false, event);
+                        const callbackURL = betterAuthCallbackURL(body[key], true, event);
                         if (callbackURL !== body[key]) {
                             sanitizedBody[key] = callbackURL;
                             changed = true;
@@ -3312,13 +3332,13 @@ async function mountBetterAuthRoutes(app, options) {
                 desktopFlow = await issueDesktopMagicLinkFlow();
                 callbackPath = withDesktopMagicLinkFlow(callbackPath, desktopFlow);
             }
-            const callbackURL = betterAuthCallbackURL(callbackPath, false, event);
+            const callbackURL = betterAuthCallbackURL(callbackPath, true, event);
             const newUserCallbackPath = `${getAppBasePath()}/_agent-native/auth/magic-link/new-user?return=${encodeURIComponent(callbackPath)}`;
             await auth.api.signInMagicLink({
                 body: {
                     email,
                     callbackURL,
-                    newUserCallbackURL: betterAuthCallbackURL(newUserCallbackPath, callbackURL !== callbackPath, event),
+                    newUserCallbackURL: betterAuthCallbackURL(newUserCallbackPath, true, event),
                 },
                 headers: event.headers,
             });
@@ -3347,8 +3367,8 @@ async function mountBetterAuthRoutes(app, options) {
         const email = normalizeAuthEmail(rawEmail);
         const password = body?.password;
         const callbackURL = typeof body?.callbackURL === "string"
-            ? betterAuthCallbackURL(body.callbackURL, false, event)
-            : "/";
+            ? betterAuthCallbackURL(body.callbackURL, true, event)
+            : betterAuthCallbackURL("/", true, event);
         if (!email) {
             setResponseStatus(event, 400);
             return { error: VALID_AUTH_EMAIL_MESSAGE };
@@ -3715,10 +3735,7 @@ export async function autoMountAuth(app, options = {}) {
             customGetSession = options.getSession;
         }
         if (_authGuardConfig) {
-            if (options.googleOnly ||
-                options.loginHtml ||
-                options.marketing ||
-                options.googleSignInNotice) {
+            if (options.googleOnly || options.loginHtml || options.marketing) {
                 const loginHtmlConfig = getOnboardingLoginHtmlConfig(options, _authGuardConfig.authMode);
                 _authGuardConfig.loginHtml = loginHtmlConfig.loginHtml;
                 _authGuardConfig.getLoginHtml = loginHtmlConfig.getLoginHtml;

package/dist/server/better-auth-migrations.js

@@ -224,6 +224,29 @@ export const BETTER_AUTH_MIGRATIONS = [
         },
         run: assertBetterAuthUserIdentityColumns,
     },
+    {
+        version: 3,
+        name: "legacy-auth-sessions-table",
+        sql: {
+            // `addSession()` is still used by the mobile/deep-link OAuth flow and
+            // the workspace callback. Provision its legacy table in the release
+            // runtime so those request paths only perform normal row writes.
+            postgres: `
+        CREATE TABLE IF NOT EXISTS sessions (
+          token TEXT PRIMARY KEY,
+          email TEXT,
+          created_at BIGINT NOT NULL
+        )
+      `,
+            sqlite: `
+        CREATE TABLE IF NOT EXISTS sessions (
+          token TEXT PRIMARY KEY,
+          email TEXT,
+          created_at INTEGER NOT NULL
+        )
+      `,
+        },
+    },
 ];
 export async function runBetterAuthMigrations(nitroApp) {
     await runMigrations(BETTER_AUTH_MIGRATIONS, {

package/dist/server/email-template.d.ts

@@ -74,6 +74,11 @@ export declare function renderEmail(args: RenderEmailArgs): RenderedEmail;
  * paragraph strings passed to `renderEmail`. Escapes the content.
  */
 export declare function emailStrong(text: string): string;
+/**
+ * Build a quoted message block for user-authored text in notification emails.
+ * The message stays escaped while preserving intentional line breaks.
+ */
+export declare function emailQuote(text: string): string;
 /**
  * Build a labelled inline link for paragraph strings passed to `renderEmail`.
  * Use this instead of rendering raw URLs in the visible email body.

package/dist/server/email-template.js

@@ -216,6 +216,15 @@ function stripTags(s) {
 export function emailStrong(text) {
     return `<strong style="color:#fafafa; font-weight:600;">${escapeHtml(text)}</strong>`;
 }
+/**
+ * Build a quoted message block for user-authored text in notification emails.
+ * The message stays escaped while preserving intentional line breaks.
+ */
+export function emailQuote(text) {
+    const content = escapeHtml(text.trim()).replace(/\r?\n/g, "<br />");
+    // guard:allow-raw-color — quoted blocks intentionally use a fixed email-safe accent
+    return `<div style="margin:0 0 16px 0; padding:12px 16px; border-left:3px solid #52525b; background:#18181b; color:#e4e4e7; font-size:16px; line-height:1.6;">${content}</div>`;
+}
 /**
  * Build a labelled inline link for paragraph strings passed to `renderEmail`.
  * Use this instead of rendering raw URLs in the visible email body.

package/dist/server/embed-route.js

@@ -91,19 +91,31 @@ function expiredEmbedSessionResponse(event) {
     main { max-width: 520px; text-align: center; }
     h1 { margin: 0 0 8px; font-size: 16px; line-height: 1.25; }
     p { margin: 0; color: color-mix(in srgb, CanvasText 64%, Canvas); font-size: 13px; line-height: 1.5; }
+    button { margin-top: 16px; border: 1px solid color-mix(in srgb, CanvasText 24%, Canvas); border-radius: 6px; padding: 7px 12px; background: Canvas; color: CanvasText; font: inherit; font-size: 12px; cursor: pointer; }
+    button:hover { background: color-mix(in srgb, CanvasText 8%, Canvas); }
   </style>
 </head>
 <body>
   <main>
     <h1>Embedded app session expired</h1>
-    <p>This chat preview is refreshing. If it does not reload, ask the chat to open the app again.</p>
+    <p>This embedded app session expired. The app will try to reconnect automatically.</p>
+    <button type="button" id="retry">Retry</button>
   </main>
   <script>
-    try {
-      if (window.parent && window.parent !== window) {
-        window.parent.postMessage({ type: "agentNative.embedSessionExpired" }, "*");
+    function notifyParent() {
+      try {
+        if (window.parent && window.parent !== window) {
+          window.parent.postMessage({
+            type: "agentNative.embedSessionExpired",
+            embedStartUrl: window.location.href
+          }, "*");
+        }
+      } catch (error) {
+        void error;
       }
-    } catch {}
+    }
+    document.getElementById("retry")?.addEventListener("click", notifyParent);
+    notifyParent();
   </script>
 </body>
 </html>`, {

package/dist/server/identity-sso-store.d.ts

@@ -1,88 +1,62 @@
 /**
- * Framework-table store for the cross-app SSO ("Sign in with Agent-Native")
- * CLIENT side. Backs two pieces of the federated login round-trip:
+ * Framework-table store for the cross-app SSO client.
  *
- *   - `identity_sso_state` — short-lived (10 min), single-use, crypto-random
- *     CSRF `state` values. Minted at `/_agent-native/identity/login`,
- *     consumed exactly once at `/_agent-native/identity/callback`. Carries an
- *     optional same-origin `return` path so the user lands back where they
- *     started after federated sign-in.
- *   - `identity_sso_jti` — replayed-token guard. The hub-issued identity JWT
- *     carries a random `jti`; the first callback that verifies a given `jti`
- *     records it here, and any later callback that presents the same `jti`
- *     is rejected. Best-effort: a DB blip never widens the trust boundary
- *     (signature + exp + scope + single-use state are still enforced), it
- *     only relaxes the extra replay gate.
+ * The current protocol uses a fresh flow-state table instead of extending the
+ * original `identity_sso_state` table. That keeps the migration additive for
+ * deployments that already have the merged PR's schema:
  *
- * Mirrors `mcp/connect-store.ts`: lazy `ensureTable()`, `getDbExec()`,
- * dialect-agnostic SQL via `intType()`, `isConnectionError()` swallow so a
- * transient Neon WS drop never 500s. `CREATE TABLE IF NOT EXISTS` only —
- * strictly additive, never DROP / ALTER (shared prod DB rule).
+ *   - `identity_sso_flow_state` binds state to the exact app, client,
+ *     authority, callback, and PKCE challenge. State is single-use.
+ *   - `identity_sso_jti` remains a defence-in-depth replay guard for the
+ *     server-to-server assertion. The assertion is never sent through the
+ *     browser; the one-time authorization code is the only browser credential.
  *
- * Node-only (crypto), bundled alongside the other framework auth modules.
- */
-/**
- * Read + normalise `AGENT_NATIVE_IDENTITY_HUB_URL`. Returns `undefined`
- * (feature OFF) unless it is set to a syntactically valid http(s) URL. A
- * malformed value is treated as OFF rather than throwing, so a typo can
- * never brick an app's login — it just behaves as if SSO were unconfigured.
+ * Uses the same portable raw-SQL pattern as the other framework stores. DDL is
+ * additive and lazy, and PostgreSQL creation goes through the DDL guard.
  */
+export declare const SSO_STATE_TTL_MS: number;
+export declare const SSO_LOGIN_MAX = 60;
+export declare const SSO_LOGIN_WINDOW_MS = 60000;
 export declare function getIdentityHubUrl(): string | undefined;
-/**
- * Whether the federated-SSO client is active. When false, NOTHING in the
- * SSO module has any effect: the route 404s, the guard bypass is inert, the
- * login button is not rendered. This is the single switch the
- * env-unset-no-op invariant is asserted against.
- */
 export declare function isIdentitySsoEnabled(): boolean;
 export declare function isDesktopSsoCanaryUserAgent(userAgent: string | undefined): boolean;
 export declare function isCanonicalAgentNativeAppOrigin(origin: string | undefined): boolean;
 export declare function isCanonicalAgentNativeAppRequest(host: string | undefined, forwardedProtocol: string | undefined): boolean;
 /**
- * The conditional "Sign in with Agent-Native" entry injected into the login
- * page — ONLY when the feature is enabled. Returns an empty string when
- * disabled so the login HTML is byte-for-byte identical to today's output
- * with the env unset (asserted by the env-unset-no-op regression test). Pure
- * string builder, no I/O — safe to call during HTML render. Lives in this
- * leaf module so `onboarding-html.ts` can import it without creating an
- * `auth.ts` ↔ `identity-sso.ts` import cycle.
+ * The conditional login entry is the only browser UI this feature adds. It
+ * stays byte-for-byte absent when the direct web federation env is unset.
  */
 export declare function identitySsoLoginButtonHtml(): string;
-/** CSRF state values are valid for 10 minutes. */
-export declare const SSO_STATE_TTL_MS: number;
-/**
- * Rate limit for `identity/login`: at most this many state rows may be
- * created within `SSO_LOGIN_WINDOW_MS`. The endpoint is reachable without a
- * session (it's the entry point), so keep a coarse global cap to stop table
- * flooding without per-IP plumbing.
- */
-export declare const SSO_LOGIN_MAX = 60;
-export declare const SSO_LOGIN_WINDOW_MS = 60000;
-/**
- * Mint a fresh crypto-random `state` value, persist it with an optional
- * same-origin return path, and return it. Rate-limited at creation: at most
- * `SSO_LOGIN_MAX` rows within `SSO_LOGIN_WINDOW_MS`. Throws `RATE_LIMITED`
- * when the cap is exceeded so the route can map it to a 429.
- */
-export declare function createSsoState(returnPath: string | null): Promise<string>;
+export interface CreateSsoStateInput {
+    returnPath: string | null;
+    appId: string;
+    clientId: string;
+    redirectUri: string;
+    authority: string;
+    codeChallenge: string;
+}
+export interface SsoStateBinding {
+    appId: string;
+    clientId: string;
+    redirectUri: string;
+    authority: string;
+    codeChallenge: string;
+}
 export interface SsoStateConsumeResult {
     ok: boolean;
     returnPath: string | null;
 }
+/** Mint and persist a bound, crypto-random state value. */
+export declare function createSsoState(input: CreateSsoStateInput): Promise<string>;
 /**
- * Atomically consume a `state` value. Returns `{ ok: true, returnPath }` only
- * when the state existed, had not expired, and had not been consumed before —
- * and this call is the one that transitioned it to consumed (single-use,
- * enforced via a conditional UPDATE so a double callback can't both pass).
- * Any other condition returns `{ ok: false }`.
+ * Atomically consume state only when every security binding still matches.
+ * A missing or mismatched binding is indistinguishable from an unknown state.
  */
-export declare function consumeSsoState(state: string): Promise<SsoStateConsumeResult>;
+export declare function consumeSsoState(state: string, expected: SsoStateBinding): Promise<SsoStateConsumeResult>;
 /**
- * Returns true when the given identity-token `jti` has already been seen
- * (i.e. this is a replay). On the first sighting, records the `jti` and
- * returns false. Best-effort: a store/DB error returns `false` (not a
- * replay) so a transient Neon WS drop never blocks a legitimate first-time
- * sign-in — signature + exp + scope + single-use CSRF state remain the hard
- * gates; this only adds defence in depth against token replay.
+ * Strict replay defense for the server-to-server assertion. A database error
+ * fails closed here: code exchange already provides the primary single-use
+ * guarantee, and refusing a login is safer than accepting an unverifiable
+ * replay boundary.
  */
 export declare function isJtiReplayed(jti: string | undefined): Promise<boolean>;