@agent-native/core 0.154.5 → 0.157.0

package/dist/server/identity-sso-migrations.js

@@ -0,0 +1,36 @@
+/**
+ * Cross-app SSO state belongs to every app that can receive a callback. Keep
+ * these tables in the framework release migration so production serverless
+ * requests never need to create schema before starting a login.
+ */
+export const IDENTITY_SSO_MIGRATIONS = [
+    {
+        version: 1,
+        name: "identity-sso-flow-state-and-jti",
+        sql: `
+      CREATE TABLE IF NOT EXISTS identity_sso_flow_state (
+        state TEXT PRIMARY KEY,
+        return_path TEXT,
+        app_id TEXT NOT NULL,
+        client_id TEXT NOT NULL,
+        redirect_uri TEXT NOT NULL,
+        authority TEXT NOT NULL,
+        code_challenge TEXT NOT NULL,
+        created_at INTEGER,
+        expires_at INTEGER,
+        consumed_at INTEGER
+      );
+
+      CREATE INDEX IF NOT EXISTS identity_sso_flow_state_expires_idx
+        ON identity_sso_flow_state (expires_at);
+
+      CREATE TABLE IF NOT EXISTS identity_sso_jti (
+        jti TEXT PRIMARY KEY,
+        seen_at INTEGER
+      );
+
+      CREATE INDEX IF NOT EXISTS identity_sso_jti_seen_idx
+        ON identity_sso_jti (seen_at);
+    `,
+    },
+];

package/dist/server/identity-sso-store.d.ts

@@ -11,8 +11,9 @@
  *     server-to-server assertions, including identity SSO and privileged A2A
  *     mutations.
  *
- * Uses the same portable raw-SQL pattern as the other framework stores. DDL is
- * additive and lazy, and PostgreSQL creation goes through the DDL guard.
+ * Uses the same portable raw-SQL pattern as the other framework stores. Local
+ * development may initialize these tables lazily; production release
+ * migrations own their creation before serverless requests are served.
  */
 export declare const SSO_STATE_TTL_MS: number;
 export declare const SSO_LOGIN_MAX = 60;

package/dist/server/identity-sso-store.js

@@ -11,11 +11,12 @@
  *     server-to-server assertions, including identity SSO and privileged A2A
  *     mutations.
  *
- * Uses the same portable raw-SQL pattern as the other framework stores. DDL is
- * additive and lazy, and PostgreSQL creation goes through the DDL guard.
+ * Uses the same portable raw-SQL pattern as the other framework stores. Local
+ * development may initialize these tables lazily; production release
+ * migrations own their creation before serverless requests are served.
  */
 import { randomBytes } from "node:crypto";
-import { getDbExec, intType, isConnectionError, isPostgres, } from "../db/client.js";
+import { getDbExec, intType, isConnectionError, isPostgres, isProductionServerlessFunctionRuntime, } from "../db/client.js";
 import { ensureTableExists } from "../db/ddl-guard.js";
 let _initPromise;
 const DESKTOP_SSO_CANARY_USER_AGENT = /AgentNativeDesktopSsoCanary\//i;
@@ -138,6 +139,10 @@ function buildIdentitySsoJtiCreateSql() {
       `;
 }
 async function ensureTable() {
+    // Release migrations own schema in production serverless functions. A
+    // request must not turn a missing migration into request-time DDL.
+    if (isProductionServerlessFunctionRuntime())
+        return;
     if (!_initPromise) {
         _initPromise = (async () => {
             const flowStateSql = buildIdentitySsoFlowStateCreateSql();

package/dist/server/index.d.ts

@@ -13,7 +13,7 @@ export { requireEnvKey, type MissingKeyResponse } from "./missing-key.js";
 export { assertCurrentRequestUserIsOrgAdmin, currentRequestUserIsOrgAdmin, } from "./org-admin.js";
 export { verifyCaptcha, type CaptchaVerifyResult } from "./captcha.js";
 export { getLocaleInitScript, parseAcceptLanguage, resolveLocaleFromRequest, type LocaleInitScriptOptions, type ResolveLocaleFromRequestOptions, type ResolvedRequestLocale, } from "../localization/server.js";
-export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type ProductionAgentOptions, type ActionTool, type ScriptTool, type AgentMessage, type AgentChatRequest, type AgentChatEvent, type AgentChatAttachment, type AgentChatReference, type MentionProvider, type MentionProviderItem, type AgentLoopFinalResponseGuard, type AgentLoopFinalResponseGuardContext, type AgentLoopFinalResponseGuardResult, type AgentLoopToolCallSummary, type AgentLoopToolResultSummary, } from "../agent/index.js";
+export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type ProductionAgentOptions, type AgentActionSurface, type AgentActionSurfaceDetails, type ActionTool, type ScriptTool, type AgentMessage, type AgentChatRequest, type AgentChatEvent, type AgentChatAttachment, type AgentChatReference, type MentionProvider, type MentionProviderItem, type AgentLoopFinalResponseGuard, type AgentLoopFinalResponseGuardContext, type AgentLoopFinalResponseGuardResult, type AgentLoopToolCallSummary, type AgentLoopToolResultSummary, } from "../agent/index.js";
 export { actionsToEngineTools, executeAgentToolCall, getOwnerActiveApiKey, getOwnerApiKeyForEngine, resolveOwnerEngineApiKey, runAgentLoop, type AgentToolCallExecutionResult, type ExecuteAgentToolCallOptions, type ResolvedOwnerApiKey, } from "../agent/production-agent.js";
 export { mountRealtimeVoiceRoutes, realtimeVoiceSafetyIdentifier, REALTIME_VOICE_MAX_SDP_BYTES, REALTIME_VOICE_MAX_TOOL_BODY_BYTES, REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS, REALTIME_VOICE_SESSION_PATH, REALTIME_VOICE_TOOL_PATH, type MountRealtimeVoiceRoutesOptions, type RealtimeVoiceRequestContext, type RealtimeVoiceToolExecutionRequest, type RealtimeVoiceToolExecutionResult, } from "./realtime-voice.js";
 export { getStoredModelForEngine, resolveEngine, } from "../agent/engine/index.js";

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/release-migrations.js

@@ -7,6 +7,7 @@ import { runAutomationSchedulerHealthMigrations } from "../jobs/scheduler-health
 import { OAUTH_TOKEN_MIGRATIONS, OAUTH_TOKEN_MIGRATIONS_TABLE, } from "../oauth-tokens/migrations.js";
 import { ORG_MIGRATIONS } from "../org/migrations.js";
 import { runBetterAuthMigrations } from "./better-auth-migrations.js";
+import { IDENTITY_SSO_MIGRATIONS } from "./identity-sso-migrations.js";
 /**
  * Apply framework-owned schema in one explicit release step.
  *
@@ -23,6 +24,9 @@ export async function runFrameworkReleaseMigrations(nitroApp) {
         table: OAUTH_TOKEN_MIGRATIONS_TABLE,
     })(nitroApp);
     await runMigrations(ORG_MIGRATIONS, { table: "_org_migrations" })(nitroApp);
+    await runMigrations(IDENTITY_SSO_MIGRATIONS, {
+        table: "_identity_sso_migrations",
+    })(nitroApp);
     await runMigrations(CONTEXT_XRAY_MIGRATIONS, {
         table: "_context_xray_migrations",
     })(nitroApp);

package/dist/server/request-context.d.ts

@@ -59,6 +59,8 @@ export interface RequestRunContext {
     engine?: import("../agent/engine/types.js").AgentEngine;
     /** Model name for this run (set by onEngineResolved). */
     model?: string;
+    /** Request-authorized action names exposed to this agent run. */
+    allowedActionNames?: readonly string[];
     /**
      * True when this run is executing inside the durable background-function
      * worker (the `_process-run` self-dispatch), not the synchronous foreground
@@ -175,6 +177,11 @@ export interface RequestContext {
     run?: RequestRunContext;
 }
 type RequestContextObserver = (ctx: RequestContext) => void;
+/**
+ * Authorization state must never use the shared-stack compatibility fallback:
+ * overlapping async requests are only isolated by native AsyncLocalStorage.
+ */
+export declare function assertRequestActionSurfaceIsolation(): void;
 /**
  * Register a callback fired every time `runWithRequestContext` enters a new
  * scope. The hook runs INSIDE the AsyncLocalStorage scope, so observability

package/dist/server/request-context.js

@@ -57,8 +57,10 @@ function processEnv(name) {
 const GLOBAL_KEY = "__agentNativeRequestContextAls";
 const OBSERVERS_KEY = "__agentNativeRequestContextObservers";
 const BOUNDARY_KEY = "__agentNativeRequestBoundaryInstalled";
+const CONTINUATION_LOCAL_KEY = "__agentNativeRequestContextContinuationLocal";
 const globalRef = globalThis;
 if (!globalRef[GLOBAL_KEY]) {
+    globalRef[CONTINUATION_LOCAL_KEY] = Boolean(AsyncLocalStorageCtor);
     globalRef[GLOBAL_KEY] = AsyncLocalStorageCtor
         ? new AsyncLocalStorageCtor()
         : new StackAsyncLocalStorage();
@@ -68,6 +70,16 @@ if (!globalRef[OBSERVERS_KEY]) {
 }
 const als = globalRef[GLOBAL_KEY];
 const observers = globalRef[OBSERVERS_KEY];
+/**
+ * Authorization state must never use the shared-stack compatibility fallback:
+ * overlapping async requests are only isolated by native AsyncLocalStorage.
+ */
+export function assertRequestActionSurfaceIsolation() {
+    if (globalRef[CONTINUATION_LOCAL_KEY] === true)
+        return;
+    throw new Error("Request-scoped action surfaces require continuation-local request context storage; " +
+        "this runtime only provides the non-isolated fallback.");
+}
 /**
  * Register a callback fired every time `runWithRequestContext` enters a new
  * scope. The hook runs INSIDE the AsyncLocalStorage scope, so observability
@@ -95,6 +107,9 @@ export function addRequestContextObserver(observer) {
  * isolation-scoped backends (Sentry, OpenTelemetry, etc.).
  */
 export function runWithRequestContext(ctx, fn) {
+    if (ctx.run?.allowedActionNames !== undefined) {
+        assertRequestActionSurfaceIsolation();
+    }
     return als.run(ctx, () => {
         if (observers.length > 0) {
             for (const obs of observers) {

package/dist/tracking/providers.js

@@ -257,6 +257,18 @@ function createMixpanelProvider(token) {
     };
 }
 // ─── Amplitude ─────────────────────────────────────────────────────────────
+function stripExceptionContextForAmplitude(properties) {
+    const { exceptionTags: _exceptionTags, exceptionExtra: _exceptionExtra, ...stableProperties } = properties;
+    return stableProperties;
+}
+function amplitudeEventProperties(event) {
+    const properties = event.name === "$exception" && event.properties
+        ? stripExceptionContextForAmplitude(event.properties)
+        : event.properties;
+    if (!event.sessionId)
+        return properties;
+    return { ...(properties ?? {}), session_id: event.sessionId };
+}
 function createAmplitudeProvider(apiKey) {
     return {
         name: "amplitude",
@@ -269,9 +281,7 @@ function createAmplitudeProvider(apiKey) {
                         user_id: event.userId || "anonymous",
                         // Amplitude's top-level `session_id` must be a numeric epoch, so
                         // the browser session ships as an event property instead.
-                        event_properties: event.sessionId
-                            ? { ...event.properties, session_id: event.sessionId }
-                            : event.properties,
+                        event_properties: amplitudeEventProperties(event),
                         time: event.timestamp
                             ? new Date(event.timestamp).getTime()
                             : undefined,

package/dist/workspace-files/tool.js

@@ -34,7 +34,7 @@ export function createWorkspaceFilesTool() {
                     "Use scratch/... for temporary intermediate results; scratch files are hidden from the Resources view by default and expire. Use durable folder names for files the user explicitly wants to keep/manage.",
                     "Use this to stage large intermediate results (fetched pages, per-item analysis memos, API payloads) so they don't consume context window, then read them back selectively for synthesis.",
                     "",
-                    "Typical fusion-style workflow:",
+                    "Typical staged-analysis workflow:",
                     "  1. Fan out: for each item, fetch data and `write` a per-item memo file.",
                     "  2. Synthesize: `list` files, then `read` each memo (with offset/maxChars to page large ones).",
                     "  3. Optionally `grep` across all memos to find patterns.",

package/docs/content/agent-surfaces.mdx

@@ -167,6 +167,36 @@ React widget, use [Generative UI](/docs/generative-ui): it renders sandboxed
 Alpine/Tailwind UI inline, can read app state and slot context, and can send
 selected values back to chat.
 
+### Request-scoped action surfaces
+
+Use `resolveActionSurface` when the selected agent or thread must expose only a
+server-authorized subset of native actions. The callback runs for every
+interactive chat request after `prepareRequest`. Returned names form a hard
+allowlist for that request: omitted actions are absent from provider schemas,
+the execution registry, plan-mode preloading, and `tool-search` discovery.
+
+```ts
+createAgentChatPlugin({
+  actions,
+  nativeActionsInDev: true,
+  resolveActionSurface: async ({ threadId, availableActionNames }) => ({
+    allowedActionNames: await loadAllowedActions(
+      threadId,
+      availableActionNames,
+    ),
+  }),
+});
+```
+
+An empty list exposes no native actions. Unknown names fail the request instead
+of widening access. Every allowed action is loaded directly on the first model
+request; include `tool-search` explicitly only when discovery inside the
+already-authorized catalog is wanted. The callback scopes interactive agent
+chat only—it does not change HTTP, MCP, A2A, job, or trigger exposure. Default
+framework guidance and spawned sub-agents inherit the same surface. Trusted
+shell tools are automatically reduced to the request-filtered sandbox because
+an unrestricted shell cannot enforce a hard action boundary.
+
 ## Native inline UI {#native-inline-ui}
 
 Use this when your actions return structured data — a list of records, a chart dataset, a status summary — that should render as a real UI component inside the chat thread rather than a plain text description. You define a `chatUI` renderer on the action, and Agent-Native renders it as a first-party React component: no iframes, no separate rendering path.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.154.5",
+  "version": "0.157.0",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -116,6 +116,7 @@
     "./client/automation": "./dist/client/automation/index.js",
     "./client/chat": "./dist/client/chat/index.js",
     "./client/changelog": "./dist/client/changelog/index.js",
+    "./client/markdown": "./dist/client/markdown/index.js",
     "./client/collab": "./dist/client/collab/index.js",
     "./client/composer": "./dist/client/composer/index.js",
     "./client/conversation": "./dist/client/conversation/index.js",
@@ -423,7 +424,7 @@
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
     "@agent-native/recap-cli": "0.5.4",
-    "@agent-native/toolkit": "^0.14.2"
+    "@agent-native/toolkit": "^0.15.0"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",