@agent-native/core 0.158.2 → 0.158.4

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;

package/dist/mcp/screen-memory-stdio.d.ts

@@ -137,13 +137,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -159,7 +159,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -175,6 +174,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -190,7 +190,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             minutes: {
                 type: string;
                 description: string;
@@ -200,6 +199,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -216,7 +216,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -235,6 +234,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -250,7 +250,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
@@ -264,6 +263,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
@@ -314,13 +314,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -349,13 +349,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;

package/dist/notifications/routes.d.ts

@@ -16,18 +16,18 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error?: undefined;
     ok?: undefined;
 } | {
-    count?: undefined;
     updated: number;
     error?: undefined;
     ok?: undefined;
-} | {
     count?: undefined;
+} | {
     updated?: undefined;
     error: string;
     ok?: undefined;
-} | {
     count?: undefined;
+} | {
     updated?: undefined;
     error?: undefined;
     ok: boolean;
+    count?: undefined;
 }>>;

package/dist/observability/routes.d.ts

@@ -42,22 +42,22 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     avgEvalScore: number;
 } | {
     error?: undefined;
-    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+    ok?: undefined;
 } | {
     error?: undefined;
-    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-} | {
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
+    ok?: undefined;
 } | {
     error?: undefined;
     summary?: undefined;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/auth.js

@@ -1535,6 +1535,21 @@ function escapeHtmlAttr(value) {
         .replace(/>/g, ">")
         .replace(/"/g, """);
 }
+const DESKTOP_MAGIC_LINK_CALLBACK_PATH = "/_agent-native/auth/magic-link/desktop-callback";
+const DESKTOP_MAGIC_LINK_LANDING_PATH = "/_agent-native/auth/magic-link/desktop-landing";
+const BETTER_AUTH_MAGIC_LINK_VERIFY_PATH = "/_agent-native/auth/ba/magic-link/verify";
+function desktopMagicLinkLandingPage(verificationUrl) {
+    const safeVerificationUrl = escapeHtmlAttr(verificationUrl);
+    const html = `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Continue sign-in</title></head><body><main><h1>Continue signing in</h1><p>Click continue to finish signing in to the Agent Native desktop app.</p><form method="get" action="${safeVerificationUrl}"><button type="submit">Continue</button></form></main></body></html>`;
+    return new Response(html, {
+        status: 200,
+        headers: {
+            "cache-control": "no-store",
+            "content-type": "text/html; charset=utf-8",
+            "referrer-policy": "no-referrer",
+        },
+    });
+}
 function injectLoginSocialImageMeta(loginHtml, event) {
     const headCloseIdx = loginHtml.indexOf("</head>");
     if (headCloseIdx === -1)
@@ -3010,6 +3025,7 @@ async function mountBetterAuthRoutes(app, options) {
                 message: entry.error.message,
                 code: entry.error.code,
             });
+            setResponseStatus(event, 400);
             return { error: entry.error.message, ...entry.error };
         }
         // Make the exchange itself establish the app session. Older clients
@@ -3033,6 +3049,53 @@ async function mountBetterAuthRoutes(app, options) {
     // Magic-link verification happens in the system browser, so native shells
     // need the verified browser session copied into the same one-time exchange
     // used by Google OAuth before they can establish their own WebView session.
+    // Keep the desktop email URL itself non-consuming: mail security scanners
+    // commonly prefetch GET links, while Better Auth consumes a magic-link token
+    // on the first verification GET. The explicit form action below is the only
+    // request that reaches Better Auth's consuming verification endpoint.
+    app.use(DESKTOP_MAGIC_LINK_LANDING_PATH, defineEventHandler((event) => {
+        if (!isReadMethod(event)) {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const query = getQuery(event);
+        const token = typeof query.token === "string" ? query.token.trim() : "";
+        const callbackURL = typeof query.callbackURL === "string" ? query.callbackURL : "";
+        if (!token || !callbackURL) {
+            setResponseStatus(event, 400);
+            return { error: "Invalid desktop magic-link" };
+        }
+        let callback;
+        try {
+            callback = new URL(callbackURL, getOrigin(event));
+        }
+        catch {
+            setResponseStatus(event, 400);
+            return { error: "Invalid desktop magic-link" };
+        }
+        if (callback.origin !== new URL(getOrigin(event)).origin ||
+            !callback.pathname.endsWith(DESKTOP_MAGIC_LINK_CALLBACK_PATH) ||
+            !normalizeDesktopFlowId(callback.searchParams.get("flow_id")) ||
+            !normalizeDesktopFlowVerifier(callback.searchParams.get("verifier"))) {
+            setResponseStatus(event, 400);
+            return { error: "Invalid desktop magic-link" };
+        }
+        const verificationURL = new URL(getOrigin(event));
+        verificationURL.pathname =
+            getAppBasePath() + BETTER_AUTH_MAGIC_LINK_VERIFY_PATH;
+        verificationURL.searchParams.set("token", token);
+        for (const key of [
+            "callbackURL",
+            "newUserCallbackURL",
+            "errorCallbackURL",
+        ]) {
+            const value = query[key];
+            if (typeof value === "string" && value) {
+                verificationURL.searchParams.set(key, value);
+            }
+        }
+        return desktopMagicLinkLandingPage(verificationURL.toString());
+    }));
     app.use("/_agent-native/auth/magic-link/desktop-callback", defineEventHandler(async (event) => {
         if (!isReadMethod(event)) {
             setResponseStatus(event, 405);
@@ -3040,18 +3103,42 @@ async function mountBetterAuthRoutes(app, options) {
         }
         const flowId = normalizeDesktopFlowId(getQuery(event).flow_id);
         const verifier = normalizeDesktopFlowVerifier(getQuery(event).verifier);
+        const callbackError = getQuery(event).error;
         if (!flowId) {
             setResponseStatus(event, 400);
             return { error: "Missing flow_id" };
         }
         if (!verifier) {
+            setDesktopExchangeError(flowId, {
+                message: AUTH_MAGIC_LINK_FALLBACK,
+                code: "missing_verifier",
+            });
+            return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
+        }
+        if (typeof callbackError === "string" && callbackError.trim()) {
+            const code = callbackError
+                .trim()
+                .replace(/[^a-z0-9_-]/gi, "_")
+                .slice(0, 64);
+            setDesktopExchangeError(flowId, {
+                message: AUTH_MAGIC_LINK_FALLBACK,
+                code: code || "callback_error",
+            });
+            logGoogleOAuthDebug(event, "magic-link-callback-error", {
+                flowId,
+                message: callbackError,
+                code: code || "callback_error",
+            });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
         const session = await getSession(event);
         if (!session?.email || !session.token) {
             setDesktopExchangeError(flowId, {
                 message: AUTH_MAGIC_LINK_FALLBACK,
-                code: "callback_error",
+                code: "callback_session_missing",
+            });
+            logGoogleOAuthDebug(event, "magic-link-callback-session-missing", {
+                flowId,
             });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
@@ -3067,14 +3154,21 @@ async function mountBetterAuthRoutes(app, options) {
             });
             setDesktopExchangeError(flowId, {
                 message: AUTH_MAGIC_LINK_FALLBACK,
-                code: "callback_error",
+                code: "callback_session_persist_failed",
+            });
+            logGoogleOAuthDebug(event, "magic-link-callback-session-persist-failed", {
+                flowId,
             });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
-        if (!(await claimDesktopMagicLinkFlow(flowId, verifier, session.token, session.email))) {
+        const claimed = await claimDesktopMagicLinkFlow(flowId, verifier, session.token, session.email);
+        if (!claimed) {
+            logGoogleOAuthDebug(event, "magic-link-callback-flow-claim-failed", {
+                flowId,
+            });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
-        return oauthDesktopExchangePage("Sign-in complete. You can return to the app.");
+        return oauthDesktopExchangePage("Sign-in complete. You can return to the app.", !isElectronRequest(event));
     }));
     // Initialize Better Auth. Forward `googleScopes` into the BetterAuthConfig
     // so the social provider requests the broader product scopes (Gmail,

package/dist/server/better-auth-instance.d.ts

@@ -152,6 +152,15 @@ export declare function getBetterAuth(config?: BetterAuthConfig): Promise<Better
  * Use this in hot paths where you know init has already happened.
  */
 export declare function getBetterAuthSync(): BetterAuthInstance | undefined;
+/**
+ * Email security scanners commonly prefetch ordinary GET links. Better Auth
+ * intentionally consumes a magic-link token on that first GET, so a scanner
+ * can otherwise spend a desktop flow before the user ever clicks it. Keep the
+ * normal web link unchanged and put only desktop flows behind an explicit
+ * confirmation page that hands the original verification URL back after the
+ * user acts.
+ */
+export declare function desktopMagicLinkLandingUrl(value: string): string | undefined;
 /**
  * The subset of Better Auth's internal adapter we use for federated-SSO
  * JIT account linking. Better Auth owns these writes (id + timestamp +

package/dist/server/better-auth-instance.js

@@ -549,6 +549,53 @@ export async function getBetterAuth(config) {
 export function getBetterAuthSync() {
     return _auth;
 }
+const BETTER_AUTH_MAGIC_LINK_VERIFY_MARKER = "/_agent-native/auth/ba/magic-link/verify";
+const DESKTOP_MAGIC_LINK_CALLBACK_MARKER = "/_agent-native/auth/magic-link/desktop-callback";
+const DESKTOP_MAGIC_LINK_LANDING_MARKER = "/_agent-native/auth/magic-link/desktop-landing";
+/**
+ * Email security scanners commonly prefetch ordinary GET links. Better Auth
+ * intentionally consumes a magic-link token on that first GET, so a scanner
+ * can otherwise spend a desktop flow before the user ever clicks it. Keep the
+ * normal web link unchanged and put only desktop flows behind an explicit
+ * confirmation page that hands the original verification URL back after the
+ * user acts.
+ */
+export function desktopMagicLinkLandingUrl(value) {
+    try {
+        const verificationUrl = new URL(value);
+        const callbackValue = verificationUrl.searchParams.get("callbackURL");
+        if (!callbackValue)
+            return undefined;
+        const callbackUrl = new URL(callbackValue, verificationUrl.origin);
+        if (callbackUrl.origin !== verificationUrl.origin)
+            return undefined;
+        if (!callbackUrl.pathname.endsWith(DESKTOP_MAGIC_LINK_CALLBACK_MARKER)) {
+            return undefined;
+        }
+        const verifyMarkerIndex = verificationUrl.pathname.lastIndexOf(BETTER_AUTH_MAGIC_LINK_VERIFY_MARKER);
+        if (verifyMarkerIndex < 0)
+            return undefined;
+        const landingUrl = new URL(verificationUrl.origin);
+        landingUrl.pathname =
+            verificationUrl.pathname.slice(0, verifyMarkerIndex) +
+                DESKTOP_MAGIC_LINK_LANDING_MARKER;
+        for (const key of [
+            "token",
+            "callbackURL",
+            "newUserCallbackURL",
+            "errorCallbackURL",
+        ]) {
+            const queryValue = verificationUrl.searchParams.get(key);
+            if (queryValue)
+                landingUrl.searchParams.set(key, queryValue);
+        }
+        return landingUrl.toString();
+    }
+    catch {
+        // coercion-ok: malformed provider URLs keep the original link unchanged.
+        return undefined;
+    }
+}
 /**
  * Replace the only unverified credential account and add Google in one
  * database transaction. The read in ensureGoogleAuthIdentityWithAdapter is
@@ -1118,9 +1165,10 @@ async function createBetterAuthInstance(config) {
                     const magicLinkUrl = appBasePath
                         ? url.replace(/(\/\/[^/]+)(\/)/, `$1${appBasePath}$2`)
                         : url;
+                    const deliveredMagicLinkUrl = desktopMagicLinkLandingUrl(magicLinkUrl) ?? magicLinkUrl;
                     const { subject, html, text, appSender } = renderMagicLinkEmail({
                         email,
-                        magicLinkUrl,
+                        magicLinkUrl: deliveredMagicLinkUrl,
                     });
                     await sendEmail({ to: email, subject, html, text, appSender });
                 },

package/dist/server/google-oauth.d.ts

@@ -208,4 +208,4 @@ export declare function oauthCallbackResponse(event: H3Event, email: string, opt
  *  which can echo upstream provider strings (and historically attacker-
  *  controlled query params via the `error_description` field). */
 export declare function oauthErrorPage(message: string): Response;
-export declare function oauthDesktopExchangePage(message?: string): Response;
+export declare function oauthDesktopExchangePage(message?: string, closeWindow?: boolean): Response;

package/dist/server/google-oauth.js

@@ -693,9 +693,12 @@ export function oauthErrorPage(message) {
     const safe = escapeHtml(message);
     return htmlResponse(`<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connection failed</title></head><body style="background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;text-align:center"><svg width="44" height="44" viewBox="0 0 24 24" fill="none" stroke="#ef4444" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="margin-bottom:14px" aria-hidden="true"><circle cx="12" cy="12" r="10"/><path d="M15 9l-6 6"/><path d="M9 9l6 6"/></svg><p style="font-size:16px;margin:0 0 12px 0;color:#ddd">${safe}</p><p style="font-size:13px;color:#888;margin:0"><a href="/" style="color:#888;text-decoration:underline;text-underline-offset:3px">Back to login</a></p></body></html>`, 400);
 }
-export function oauthDesktopExchangePage(message = "Returning to the app...") {
+export function oauthDesktopExchangePage(message = "Returning to the app...", closeWindow = true) {
     const safe = escapeHtml(message);
-    return htmlResponse(`<!DOCTYPE html><html><head><meta charset="utf-8"><title>Returning</title></head><body style="background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><p style="font-size:14px">${safe}</p><script>window.close()</script></body></html>`);
+    const closeScript = closeWindow ? "<script>window.close()</script>" : "";
+    // guard:allow-raw-color - standalone callback page intentionally uses fixed dark colors.
+    const page = `<!DOCTYPE html><html><head><meta charset="utf-8"><title>Returning</title></head><body style="background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><p style="font-size:14px">${safe}</p></body></html>`;
+    return htmlResponse(page.replace("</body>", `${closeScript}</body>`));
 }
 // ─── Internal ────────────────────────────────────────────────────────────────
 function resolveOAuthAppName(explicit) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.158.2",
+  "version": "0.158.4",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {