@agent-native/core 0.157.13 → 0.157.15

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
+    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
 }>;
 export default _default;

package/dist/mcp/screen-memory-stdio.d.ts

@@ -137,13 +137,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -159,6 +159,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -174,7 +175,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -190,6 +190,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             minutes: {
                 type: string;
                 description: string;
@@ -199,7 +200,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -216,6 +216,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -234,7 +235,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -250,6 +250,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
@@ -263,7 +264,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
@@ -314,13 +314,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -349,13 +349,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;

package/dist/notifications/routes.d.ts

@@ -16,18 +16,18 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error?: undefined;
     ok?: undefined;
 } | {
+    count?: undefined;
     updated: number;
     error?: undefined;
     ok?: undefined;
-    count?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
     error: string;
     ok?: undefined;
-    count?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
     error?: undefined;
     ok: boolean;
-    count?: undefined;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,23 +41,23 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    ok?: undefined;
     error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-} | {
     ok?: undefined;
+} | {
     error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-} | {
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
+    ok?: undefined;
 } | {
     error?: undefined;
     summary?: undefined;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/secrets/routes.d.ts

@@ -34,16 +34,16 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     status: string;
     error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     removed: boolean;
@@ -54,9 +54,9 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     note?: undefined;

package/dist/server/action-routes.js

@@ -238,6 +238,7 @@ async function resolveRequestAuthCapability(event) {
  */
 export function mountActionRoutes(nitroApp, actions, options) {
     const mounted = [];
+    const app = getH3App(nitroApp);
     for (const [name, entry] of Object.entries(actions)) {
         // Skip agent-only actions
         if (entry.http === false)
@@ -250,9 +251,9 @@ export function mountActionRoutes(nitroApp, actions, options) {
         // auth guard rejects it; the action route still fails closed on invalid
         // or missing credentials.
         if (name === "list-feature-flags" || name === "set-feature-flag") {
-            registerAuthPublicPaths([routePath]);
+            registerAuthPublicPaths([routePath], app);
         }
-        getH3App(nitroApp).use(routePath, defineEventHandler(async (event) => {
+        app.use(routePath, defineEventHandler(async (event) => {
             const reqMethod = getMethod(event);
             const effectiveMethod = reqMethod === "HEAD" && method === "GET" ? "GET" : reqMethod;
             if (reqMethod === "OPTIONS") {

package/dist/server/agent-chat/plugin-options.d.ts

@@ -117,6 +117,11 @@ export interface AgentChatPluginOptions {
      * See {@link import("../action-routes.js").ActionRouteAuthAdapter}.
      */
     actionRouteAuth?: import("../action-routes.js").ActionRouteAuthAdapter;
+    /**
+     * Framework action paths that use `actionRouteAuth` instead of the browser
+     * session guard. The route handler still owns credential verification.
+     */
+    actionRoutePublicPaths?: string[];
     /**
      * Optional callback to append template-specific context to the system
      * prompt on each request. Runs after AGENTS.md / skills / memory are

package/dist/server/agent-chat-plugin.js

@@ -41,7 +41,7 @@ import { handleSharedThreadRequest, } from "./agent-chat/shared-thread.js";
 import { discoverAgents } from "./agent-discovery.js";
 import { resolveAgentRunOwnerContext, runWithAgentRunContext, seedBackgroundAgentRunOwnerContext, } from "./agent-run-context.js";
 import { AGENT_TEAM_PROCESS_RUN_PATH, getCurrentDelegationDepth, processAgentTeamRun, reconcileAgentTeamRunsForOwner, } from "./agent-teams.js";
-import { getSession } from "./auth.js";
+import { getSession, registerAuthPublicPaths } from "./auth.js";
 import { captureError } from "./capture-error.js";
 import { getH3App, markDefaultPluginProvided, trackPluginInit, } from "./framework-request-handler.js";
 import { getOrigin } from "./google-oauth.js";
@@ -2035,6 +2035,9 @@ export function createAgentChatPlugin(options) {
             }
             if (Object.keys(httpActions).length > 0) {
                 const { mountActionRoutes } = await import("./action-routes.js");
+                if (options?.actionRoutePublicPaths?.length) {
+                    registerAuthPublicPaths(options.actionRoutePublicPaths, getH3App(nitroApp));
+                }
                 mountActionRoutes(nitroApp, httpActions, {
                     getOwnerFromEvent,
                     getUserNameFromEvent,

package/dist/server/auth.d.ts

@@ -225,11 +225,12 @@ export declare function getSessionEmail(token: string): Promise<string | null>;
  * Allow framework routes with their own non-cookie authentication to reach
  * the handler. The handler remains responsible for verifying the credential.
  *
- * This is registered separately from template auth options because framework
- * routes can be mounted after the auth plugin and must also work in custom
- * workspace deployments that do not own a template auth file.
+ * Registered paths are exact matches. This is registered separately from
+ * template auth options because framework routes can be mounted after the auth
+ * plugin and must also work in custom workspace deployments that do not own a
+ * template auth file.
  */
-export declare function registerAuthPublicPaths(paths: readonly string[]): void;
+export declare function registerAuthPublicPaths(paths: readonly string[], app?: object): void;
 export interface DesktopExchangeErrorPayload {
     message: string;
     code?: string;

package/dist/server/auth.js

@@ -960,30 +960,58 @@ export async function getSessionEmail(token) {
 // ---------------------------------------------------------------------------
 let customGetSession = null;
 let _authGuardConfig = null;
-const _registeredAuthPublicPaths = new Set();
+// Pin the registry to globalThis so template plugins and framework routes that
+// load Core through different SSR bundle or pnpm peer graphs still share it.
+// Scope entries by H3 app so a route registered by one app cannot become public
+// in another app that happens to share the same Node realm.
+const AUTH_PUBLIC_PATHS_REGISTRY_KEY = Symbol.for("@agent-native/core/auth.publicPaths");
+const _registeredAuthExactPublicPaths = new Set();
+function getAuthPublicPathRegistry() {
+    const globals = globalThis;
+    return (globals[AUTH_PUBLIC_PATHS_REGISTRY_KEY] ??= {
+        exactPathsByApp: new WeakMap(),
+    });
+}
+function getRegisteredAuthExactPaths(app) {
+    if (!app)
+        return _registeredAuthExactPublicPaths;
+    const registry = getAuthPublicPathRegistry();
+    let paths = registry.exactPathsByApp.get(app);
+    if (!paths) {
+        paths = new Set();
+        registry.exactPathsByApp.set(app, paths);
+    }
+    return paths;
+}
 const _genericGoogleOAuthRoutesEnabled = new WeakMap();
 /**
  * Allow framework routes with their own non-cookie authentication to reach
  * the handler. The handler remains responsible for verifying the credential.
  *
- * This is registered separately from template auth options because framework
- * routes can be mounted after the auth plugin and must also work in custom
- * workspace deployments that do not own a template auth file.
+ * Registered paths are exact matches. This is registered separately from
+ * template auth options because framework routes can be mounted after the auth
+ * plugin and must also work in custom workspace deployments that do not own a
+ * template auth file.
  */
-export function registerAuthPublicPaths(paths) {
+export function registerAuthPublicPaths(paths, app) {
+    const registeredPaths = getRegisteredAuthExactPaths(app);
     for (const path of paths) {
         const normalized = typeof path === "string" ? path.trim() : "";
         if (!normalized.startsWith("/"))
             continue;
-        _registeredAuthPublicPaths.add(normalized);
-        if (_authGuardConfig &&
-            !_authGuardConfig.publicPaths.includes(normalized)) {
-            _authGuardConfig.publicPaths.push(normalized);
-        }
+        registeredPaths.add(normalized);
     }
 }
 function resolveAuthPublicPaths(paths) {
-    return [...new Set([...(paths ?? []), ..._registeredAuthPublicPaths])];
+    return [...new Set(paths ?? [])];
+}
+function resolveAuthExactPublicPaths(app) {
+    return [
+        ...new Set([
+            ..._registeredAuthExactPublicPaths,
+            ...(app ? getRegisteredAuthExactPaths(app) : []),
+        ]),
+    ];
 }
 function getRequestHost(event) {
     return (getHeader(event, "x-forwarded-host") ??
@@ -1564,12 +1592,15 @@ function isHtmlDocumentRequest(event, pathname) {
     const accept = getHeader(event, "accept")?.toLowerCase();
     return !accept || accept.includes("text/html") || accept.includes("*/*");
 }
-function createAuthGuardFn() {
+function createAuthGuardFn(app) {
     return async (event) => {
         const config = _authGuardConfig;
         if (!config)
             return;
-        const { publicPaths } = config;
+        // Resolve on every request because a framework route can be mounted by a
+        // different Core module instance after this auth guard is initialized.
+        const publicPaths = resolveAuthPublicPaths(config.publicPaths);
+        const exactPublicPaths = resolveAuthExactPublicPaths(app);
         const url = event.node?.req?.url ?? event.path ?? "/";
         const queryStart = url.indexOf("?");
         const rawPath = queryStart >= 0 ? url.slice(0, queryStart) : url;
@@ -1848,7 +1879,7 @@ function createAuthGuardFn() {
         if (getMethod(event) === "GET" && p.startsWith("/_agent-native/avatar/")) {
             return;
         }
-        if (isPublicPath(normalizedUrl, publicPaths))
+        if (isPublicPath(normalizedUrl, publicPaths, exactPublicPaths))
             return;
         if (shouldBypassAuthForBuilderConnect(event, p))
             return;
@@ -2467,15 +2498,19 @@ function isHttpsRequest(event) {
 // ---------------------------------------------------------------------------
 // Public path matching
 // ---------------------------------------------------------------------------
-function isPublicPath(url, publicPaths) {
+function isPublicPath(url, publicPaths, exactPublicPaths = []) {
     const p = url.split("?")[0];
+    if (exactPublicPaths.some((candidate) => normalizePath(candidate) === p)) {
+        return true;
+    }
     return matchesPathList(p, publicPaths);
 }
+function normalizePath(path) {
+    return path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+}
 function matchesPathList(path, paths) {
     return paths.some((candidate) => {
-        const normalized = candidate.length > 1 && candidate.endsWith("/")
-            ? candidate.slice(0, -1)
-            : candidate;
+        const normalized = normalizePath(candidate);
         return path === normalized || path.startsWith(normalized + "/");
     });
 }
@@ -3612,7 +3647,7 @@ async function mountBetterAuthRoutes(app, options) {
         workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
         workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
     };
-    const guardFn = createAuthGuardFn();
+    const guardFn = createAuthGuardFn(app);
     _authGuardFn = guardFn;
     app.use(defineEventHandler(guardFn));
 }
@@ -3880,7 +3915,7 @@ export async function autoMountAuth(app, options = {}) {
             workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
             workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
         };
-        const guardFn = createAuthGuardFn();
+        const guardFn = createAuthGuardFn(app);
         _authGuardFn = guardFn;
         app.use(defineEventHandler(guardFn));
         if (process.env.DEBUG)
@@ -3907,7 +3942,7 @@ export async function autoMountAuth(app, options = {}) {
             workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
             workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
         };
-        const guardFn = createAuthGuardFn();
+        const guardFn = createAuthGuardFn(app);
         _authGuardFn = guardFn;
         app.use(defineEventHandler(guardFn));
         console.log("[agent-native] Auth guard registered despite init failure — app is locked.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.157.13",
+  "version": "0.157.15",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {