@agent-native/core 0.157.20 → 0.157.22

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     ok: boolean;
-    error?: undefined;
 }>>;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/embed-route.js

@@ -83,6 +83,53 @@ function textResponse(event, message, status) {
         }),
     });
 }
+function embedTargetOrigin(event) {
+    const host = getHeader(event, "host")?.trim();
+    if (!host)
+        return null;
+    const forwardedProto = getHeader(event, "x-forwarded-proto")
+        ?.split(",", 1)[0]
+        ?.trim()
+        .toLowerCase();
+    const protocol = forwardedProto === "http" || forwardedProto === "https"
+        ? forwardedProto
+        : "https";
+    return `${protocol}://${host}`;
+}
+function embedTargetAppId(origin) {
+    if (origin) {
+        try {
+            const hostname = new URL(origin).hostname;
+            const suffix = ".agent-native.com";
+            if (hostname.endsWith(suffix) && hostname.length > suffix.length) {
+                return hostname.slice(0, -suffix.length);
+            }
+            // coercion-ok: diagnostic host parsing must never change the auth response.
+        }
+        catch {
+            // The host is diagnostic context only; keep the response path independent.
+        }
+    }
+    const configured = [process.env.AGENT_NATIVE_APP_ID, process.env.APP_ID].find((value) => /^[a-z0-9][a-z0-9._-]{0,63}$/i.test(value?.trim() ?? ""));
+    if (configured)
+        return configured.trim();
+    return "unknown";
+}
+function logEmbedConsumeResult(event, diagnostic, responseStatus) {
+    const targetOrigin = embedTargetOrigin(event);
+    console.info("[agent-native] workspace embed consume", {
+        targetAppId: embedTargetAppId(targetOrigin),
+        targetOrigin,
+        ticketKey: diagnostic.ticketKey,
+        outcome: diagnostic.outcome,
+        ticketRowFound: diagnostic.ticketRowFound,
+        consumed: diagnostic.consumed,
+        expired: diagnostic.expired,
+        expectedOrgKey: diagnostic.expectedOrgKey,
+        ticketOrgKey: diagnostic.ticketOrgKey,
+        responseStatus,
+    });
+}
 function expiredEmbedSessionResponse(event) {
     setEmbedStartResponseHeaders(event);
     return new Response(`<!doctype html>
@@ -204,14 +251,24 @@ export function createEmbedStartRouteHandler(options = {}) {
         const existingSession = await options
             .getExistingSession?.(event)
             .catch(() => null);
+        let consumeDiagnostic = null;
         const consumed = await consumeEmbedSessionTicket(ticket, {
             expectedOrgId: existingSession?.orgId ?? null,
+            onResult: (diagnostic) => {
+                consumeDiagnostic = diagnostic;
+            },
         });
         if (!consumed) {
+            if (consumeDiagnostic) {
+                logEmbedConsumeResult(event, consumeDiagnostic, 401);
+            }
             return expiredEmbedSessionResponse(event);
         }
         const target = normalizeEmbedTargetPath(consumed.targetPath);
         if (!target) {
+            if (consumeDiagnostic) {
+                logEmbedConsumeResult(event, consumeDiagnostic, 400);
+            }
             return textResponse(event, "Invalid embed target.", 400);
         }
         const token = signEmbedSessionToken({
@@ -230,7 +287,11 @@ export function createEmbedStartRouteHandler(options = {}) {
         const chatBridgeActive = firstQueryValue(query[MCP_APP_CHAT_BRIDGE_QUERY_PARAM]) === "1" ||
             firstQueryValue(query[MCP_APP_CHAT_BRIDGE_QUERY_PARAM]) === "true";
         const location = withConfiguredBasePath(withCollapsedAgentSidebarParam(appendEmbedParams(target, token, chatBridgeActive)));
-        if (wantsTransplantLocationResponse(event)) {
+        const transplant = wantsTransplantLocationResponse(event);
+        if (consumeDiagnostic) {
+            logEmbedConsumeResult(event, consumeDiagnostic, transplant ? 200 : 302);
+        }
+        if (transplant) {
             return transplantLocationResponse(event, location);
         }
         return redirectWithStagedCookies(event, location);

package/dist/server/embed-session.d.ts

@@ -12,8 +12,19 @@ export interface EmbedSessionTicket {
     ticketHash: string;
     expiresAt: number;
 }
+export type EmbedSessionTicketConsumeOutcome = "missing-ticket" | "not-found" | "already-consumed" | "expired" | "org-mismatch" | "consumption-race" | "invalid-row" | "consumed";
+export interface EmbedSessionTicketConsumeDiagnostic {
+    outcome: EmbedSessionTicketConsumeOutcome;
+    ticketKey: string | null;
+    ticketRowFound: boolean;
+    consumed: boolean;
+    expired: boolean;
+    expectedOrgKey: string | null;
+    ticketOrgKey: string | null;
+}
 export interface ConsumeEmbedSessionTicketOptions {
     expectedOrgId?: string | null;
+    onResult?: (result: EmbedSessionTicketConsumeDiagnostic) => void;
 }
 export interface ConsumedEmbedSessionTicket {
     ownerEmail: string;

package/dist/server/embed-session.js

@@ -133,6 +133,11 @@ function signPayload(payload) {
 function hashTicket(ticket) {
     return crypto.createHash("sha256").update(ticket).digest("hex");
 }
+function redactedIdentifier(value) {
+    if (!value)
+        return null;
+    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 12);
+}
 function numberOrNull(value) {
     if (value == null)
         return null;
@@ -458,27 +463,79 @@ export async function createEmbedSessionTicket(input) {
     return { ticket, ticketHash, expiresAt };
 }
 export async function consumeEmbedSessionTicket(ticket, options = {}) {
-    if (!ticket)
+    const expectedOrgKey = redactedIdentifier(options.expectedOrgId);
+    if (!ticket) {
+        options.onResult?.({
+            outcome: "missing-ticket",
+            ticketKey: null,
+            ticketRowFound: false,
+            consumed: false,
+            expired: false,
+            expectedOrgKey,
+            ticketOrgKey: null,
+        });
         return null;
+    }
     await ensureTable();
     const ticketHash = hashTicket(ticket);
+    const ticketKey = ticketHash.slice(0, 12);
     const now = Date.now();
     const { rows } = await getDbExec().execute({
         sql: "SELECT ticket_hash, owner_email, org_id, target_path, scope, expires_at, consumed_at " +
             "FROM agent_native_embed_tickets WHERE ticket_hash = ?",
         args: [ticketHash],
     });
-    if (rows.length === 0)
+    if (rows.length === 0) {
+        options.onResult?.({
+            outcome: "not-found",
+            ticketKey,
+            ticketRowFound: false,
+            consumed: false,
+            expired: false,
+            expectedOrgKey,
+            ticketOrgKey: null,
+        });
         return null;
+    }
     const row = rows[0];
     const expiresAt = numberOrNull(row.expires_at ?? row.expiresAt);
     const consumedAt = numberOrNull(row.consumed_at ?? row.consumedAt);
     const orgId = stringOrUndefined(row.org_id ?? row.orgId);
-    if (consumedAt != null)
+    const ticketOrgKey = redactedIdentifier(orgId);
+    if (consumedAt != null) {
+        options.onResult?.({
+            outcome: "already-consumed",
+            ticketKey,
+            ticketRowFound: true,
+            consumed: true,
+            expired: false,
+            expectedOrgKey,
+            ticketOrgKey,
+        });
         return null;
-    if (expiresAt != null && expiresAt < now)
+    }
+    if (expiresAt != null && expiresAt < now) {
+        options.onResult?.({
+            outcome: "expired",
+            ticketKey,
+            ticketRowFound: true,
+            consumed: false,
+            expired: true,
+            expectedOrgKey,
+            ticketOrgKey,
+        });
         return null;
+    }
     if (options.expectedOrgId && orgId && orgId !== options.expectedOrgId) {
+        options.onResult?.({
+            outcome: "org-mismatch",
+            ticketKey,
+            ticketRowFound: true,
+            consumed: false,
+            expired: false,
+            expectedOrgKey,
+            ticketOrgKey,
+        });
         return null;
     }
     const result = await getDbExec().execute({
@@ -486,12 +543,41 @@ export async function consumeEmbedSessionTicket(ticket, options = {}) {
             "WHERE ticket_hash = ? AND consumed_at IS NULL",
         args: [now, ticketHash],
     });
-    if (result.rowsAffected === 0)
+    if (result.rowsAffected === 0) {
+        options.onResult?.({
+            outcome: "consumption-race",
+            ticketKey,
+            ticketRowFound: true,
+            consumed: false,
+            expired: false,
+            expectedOrgKey,
+            ticketOrgKey,
+        });
         return null;
+    }
     const targetPath = normalizeEmbedTargetPath(stringOrUndefined(row.target_path ?? row.targetPath));
     const ownerEmail = stringOrUndefined(row.owner_email ?? row.ownerEmail);
-    if (!targetPath || !ownerEmail || expiresAt == null)
+    if (!targetPath || !ownerEmail || expiresAt == null) {
+        options.onResult?.({
+            outcome: "invalid-row",
+            ticketKey,
+            ticketRowFound: true,
+            consumed: true,
+            expired: false,
+            expectedOrgKey,
+            ticketOrgKey,
+        });
         return null;
+    }
+    options.onResult?.({
+        outcome: "consumed",
+        ticketKey,
+        ticketRowFound: true,
+        consumed: true,
+        expired: false,
+        expectedOrgKey,
+        ticketOrgKey,
+    });
     return {
         ownerEmail,
         ...(orgId ? { orgId } : {}),

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/templates/chat/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/dist/templates/default/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/dist/templates/headless/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/dist/templates/workspace-core/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.157.20",
+  "version": "0.157.22",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/src/templates/chat/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/src/templates/default/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one

package/src/templates/headless/.agents/skills/security/SKILL.md

@@ -149,6 +149,35 @@ export default defineEventHandler(async (event) => {
 
 - Never create unprotected routes that modify data.
 
+## Same-Origin Workspace Apps
+
+Path-mounted workspace apps share the Dispatch gateway origin. Because the
+framework's session cookie is scoped to `/`, a mounted pane receives the
+ambient Dispatch session and can act as the signed-in user through same-origin
+requests. This is an intentional trusted-code model, not an isolation
+boundary; removing a mounted app from SSO fanout does not revoke that ambient
+access.
+
+Only trusted, workspace-owner-authored code belongs on that origin. Treat each
+of these as a trust-boundary change that requires an explicit origin, sandbox,
+or capability design before shipping:
+
+- non-owners can create or edit mounted app code;
+- mounted apps render or execute untrusted external content or remote code;
+- apps are publicly shareable, anonymously reachable, or installable by users
+  outside the owning workspace;
+- app source, dependencies, or deployment artifacts can be replaced by a
+  third party without the workspace owner's authorization;
+- a mounted app can be registered across workspaces or can change its mount
+  path/origin without an ownership check; or
+- cookie scope, proxying, iframe policy, or navigation changes make this
+  ambient-session behavior broader than the owning workspace.
+
+Do not describe canonical-only SSO eligibility as origin isolation. Canonical
+apps and explicitly registered custom origins remain eligible; path-mounted
+apps are deliberately excluded as SSO targets while retaining their existing
+same-origin session behavior.
+
 **Exception — the SSR HTML/`.data` catch-all is deliberately session-blind.**
 The rule above is for routes that read or mutate user data. The SSR page
 render and React Router `.data` route are different: they serve one