@agent-native/core 0.158.3 → 0.158.4

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;

package/dist/mcp/screen-memory-stdio.d.ts

@@ -137,13 +137,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -159,7 +159,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -175,6 +174,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -190,7 +190,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             minutes: {
                 type: string;
                 description: string;
@@ -200,6 +199,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -216,7 +216,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -235,6 +234,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -250,7 +250,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
@@ -264,6 +263,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
@@ -314,13 +314,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -349,13 +349,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;

package/dist/notifications/routes.d.ts

@@ -16,18 +16,18 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error?: undefined;
     ok?: undefined;
 } | {
-    count?: undefined;
     updated: number;
     error?: undefined;
     ok?: undefined;
-} | {
     count?: undefined;
+} | {
     updated?: undefined;
     error: string;
     ok?: undefined;
-} | {
     count?: undefined;
+} | {
     updated?: undefined;
     error?: undefined;
     ok: boolean;
+    count?: undefined;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,9 +59,9 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.js

@@ -1535,6 +1535,21 @@ function escapeHtmlAttr(value) {
         .replace(/>/g, ">")
         .replace(/"/g, """);
 }
+const DESKTOP_MAGIC_LINK_CALLBACK_PATH = "/_agent-native/auth/magic-link/desktop-callback";
+const DESKTOP_MAGIC_LINK_LANDING_PATH = "/_agent-native/auth/magic-link/desktop-landing";
+const BETTER_AUTH_MAGIC_LINK_VERIFY_PATH = "/_agent-native/auth/ba/magic-link/verify";
+function desktopMagicLinkLandingPage(verificationUrl) {
+    const safeVerificationUrl = escapeHtmlAttr(verificationUrl);
+    const html = `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Continue sign-in</title></head><body><main><h1>Continue signing in</h1><p>Click continue to finish signing in to the Agent Native desktop app.</p><form method="get" action="${safeVerificationUrl}"><button type="submit">Continue</button></form></main></body></html>`;
+    return new Response(html, {
+        status: 200,
+        headers: {
+            "cache-control": "no-store",
+            "content-type": "text/html; charset=utf-8",
+            "referrer-policy": "no-referrer",
+        },
+    });
+}
 function injectLoginSocialImageMeta(loginHtml, event) {
     const headCloseIdx = loginHtml.indexOf("</head>");
     if (headCloseIdx === -1)
@@ -3034,6 +3049,53 @@ async function mountBetterAuthRoutes(app, options) {
     // Magic-link verification happens in the system browser, so native shells
     // need the verified browser session copied into the same one-time exchange
     // used by Google OAuth before they can establish their own WebView session.
+    // Keep the desktop email URL itself non-consuming: mail security scanners
+    // commonly prefetch GET links, while Better Auth consumes a magic-link token
+    // on the first verification GET. The explicit form action below is the only
+    // request that reaches Better Auth's consuming verification endpoint.
+    app.use(DESKTOP_MAGIC_LINK_LANDING_PATH, defineEventHandler((event) => {
+        if (!isReadMethod(event)) {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const query = getQuery(event);
+        const token = typeof query.token === "string" ? query.token.trim() : "";
+        const callbackURL = typeof query.callbackURL === "string" ? query.callbackURL : "";
+        if (!token || !callbackURL) {
+            setResponseStatus(event, 400);
+            return { error: "Invalid desktop magic-link" };
+        }
+        let callback;
+        try {
+            callback = new URL(callbackURL, getOrigin(event));
+        }
+        catch {
+            setResponseStatus(event, 400);
+            return { error: "Invalid desktop magic-link" };
+        }
+        if (callback.origin !== new URL(getOrigin(event)).origin ||
+            !callback.pathname.endsWith(DESKTOP_MAGIC_LINK_CALLBACK_PATH) ||
+            !normalizeDesktopFlowId(callback.searchParams.get("flow_id")) ||
+            !normalizeDesktopFlowVerifier(callback.searchParams.get("verifier"))) {
+            setResponseStatus(event, 400);
+            return { error: "Invalid desktop magic-link" };
+        }
+        const verificationURL = new URL(getOrigin(event));
+        verificationURL.pathname =
+            getAppBasePath() + BETTER_AUTH_MAGIC_LINK_VERIFY_PATH;
+        verificationURL.searchParams.set("token", token);
+        for (const key of [
+            "callbackURL",
+            "newUserCallbackURL",
+            "errorCallbackURL",
+        ]) {
+            const value = query[key];
+            if (typeof value === "string" && value) {
+                verificationURL.searchParams.set(key, value);
+            }
+        }
+        return desktopMagicLinkLandingPage(verificationURL.toString());
+    }));
     app.use("/_agent-native/auth/magic-link/desktop-callback", defineEventHandler(async (event) => {
         if (!isReadMethod(event)) {
             setResponseStatus(event, 405);
@@ -3041,18 +3103,42 @@ async function mountBetterAuthRoutes(app, options) {
         }
         const flowId = normalizeDesktopFlowId(getQuery(event).flow_id);
         const verifier = normalizeDesktopFlowVerifier(getQuery(event).verifier);
+        const callbackError = getQuery(event).error;
         if (!flowId) {
             setResponseStatus(event, 400);
             return { error: "Missing flow_id" };
         }
         if (!verifier) {
+            setDesktopExchangeError(flowId, {
+                message: AUTH_MAGIC_LINK_FALLBACK,
+                code: "missing_verifier",
+            });
+            return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
+        }
+        if (typeof callbackError === "string" && callbackError.trim()) {
+            const code = callbackError
+                .trim()
+                .replace(/[^a-z0-9_-]/gi, "_")
+                .slice(0, 64);
+            setDesktopExchangeError(flowId, {
+                message: AUTH_MAGIC_LINK_FALLBACK,
+                code: code || "callback_error",
+            });
+            logGoogleOAuthDebug(event, "magic-link-callback-error", {
+                flowId,
+                message: callbackError,
+                code: code || "callback_error",
+            });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
         const session = await getSession(event);
         if (!session?.email || !session.token) {
             setDesktopExchangeError(flowId, {
                 message: AUTH_MAGIC_LINK_FALLBACK,
-                code: "callback_error",
+                code: "callback_session_missing",
+            });
+            logGoogleOAuthDebug(event, "magic-link-callback-session-missing", {
+                flowId,
             });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
@@ -3068,11 +3154,18 @@ async function mountBetterAuthRoutes(app, options) {
             });
             setDesktopExchangeError(flowId, {
                 message: AUTH_MAGIC_LINK_FALLBACK,
-                code: "callback_error",
+                code: "callback_session_persist_failed",
+            });
+            logGoogleOAuthDebug(event, "magic-link-callback-session-persist-failed", {
+                flowId,
             });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
-        if (!(await claimDesktopMagicLinkFlow(flowId, verifier, session.token, session.email))) {
+        const claimed = await claimDesktopMagicLinkFlow(flowId, verifier, session.token, session.email);
+        if (!claimed) {
+            logGoogleOAuthDebug(event, "magic-link-callback-flow-claim-failed", {
+                flowId,
+            });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
         return oauthDesktopExchangePage("Sign-in complete. You can return to the app.", !isElectronRequest(event));

package/dist/server/better-auth-instance.d.ts

@@ -152,6 +152,15 @@ export declare function getBetterAuth(config?: BetterAuthConfig): Promise<Better
  * Use this in hot paths where you know init has already happened.
  */
 export declare function getBetterAuthSync(): BetterAuthInstance | undefined;
+/**
+ * Email security scanners commonly prefetch ordinary GET links. Better Auth
+ * intentionally consumes a magic-link token on that first GET, so a scanner
+ * can otherwise spend a desktop flow before the user ever clicks it. Keep the
+ * normal web link unchanged and put only desktop flows behind an explicit
+ * confirmation page that hands the original verification URL back after the
+ * user acts.
+ */
+export declare function desktopMagicLinkLandingUrl(value: string): string | undefined;
 /**
  * The subset of Better Auth's internal adapter we use for federated-SSO
  * JIT account linking. Better Auth owns these writes (id + timestamp +

package/dist/server/better-auth-instance.js

@@ -549,6 +549,53 @@ export async function getBetterAuth(config) {
 export function getBetterAuthSync() {
     return _auth;
 }
+const BETTER_AUTH_MAGIC_LINK_VERIFY_MARKER = "/_agent-native/auth/ba/magic-link/verify";
+const DESKTOP_MAGIC_LINK_CALLBACK_MARKER = "/_agent-native/auth/magic-link/desktop-callback";
+const DESKTOP_MAGIC_LINK_LANDING_MARKER = "/_agent-native/auth/magic-link/desktop-landing";
+/**
+ * Email security scanners commonly prefetch ordinary GET links. Better Auth
+ * intentionally consumes a magic-link token on that first GET, so a scanner
+ * can otherwise spend a desktop flow before the user ever clicks it. Keep the
+ * normal web link unchanged and put only desktop flows behind an explicit
+ * confirmation page that hands the original verification URL back after the
+ * user acts.
+ */
+export function desktopMagicLinkLandingUrl(value) {
+    try {
+        const verificationUrl = new URL(value);
+        const callbackValue = verificationUrl.searchParams.get("callbackURL");
+        if (!callbackValue)
+            return undefined;
+        const callbackUrl = new URL(callbackValue, verificationUrl.origin);
+        if (callbackUrl.origin !== verificationUrl.origin)
+            return undefined;
+        if (!callbackUrl.pathname.endsWith(DESKTOP_MAGIC_LINK_CALLBACK_MARKER)) {
+            return undefined;
+        }
+        const verifyMarkerIndex = verificationUrl.pathname.lastIndexOf(BETTER_AUTH_MAGIC_LINK_VERIFY_MARKER);
+        if (verifyMarkerIndex < 0)
+            return undefined;
+        const landingUrl = new URL(verificationUrl.origin);
+        landingUrl.pathname =
+            verificationUrl.pathname.slice(0, verifyMarkerIndex) +
+                DESKTOP_MAGIC_LINK_LANDING_MARKER;
+        for (const key of [
+            "token",
+            "callbackURL",
+            "newUserCallbackURL",
+            "errorCallbackURL",
+        ]) {
+            const queryValue = verificationUrl.searchParams.get(key);
+            if (queryValue)
+                landingUrl.searchParams.set(key, queryValue);
+        }
+        return landingUrl.toString();
+    }
+    catch {
+        // coercion-ok: malformed provider URLs keep the original link unchanged.
+        return undefined;
+    }
+}
 /**
  * Replace the only unverified credential account and add Google in one
  * database transaction. The read in ensureGoogleAuthIdentityWithAdapter is
@@ -1118,9 +1165,10 @@ async function createBetterAuthInstance(config) {
                     const magicLinkUrl = appBasePath
                         ? url.replace(/(\/\/[^/]+)(\/)/, `$1${appBasePath}$2`)
                         : url;
+                    const deliveredMagicLinkUrl = desktopMagicLinkLandingUrl(magicLinkUrl) ?? magicLinkUrl;
                     const { subject, html, text, appSender } = renderMagicLinkEmail({
                         email,
-                        magicLinkUrl,
+                        magicLinkUrl: deliveredMagicLinkUrl,
                     });
                     await sendEmail({ to: email, subject, html, text, appSender });
                 },

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.158.3",
+  "version": "0.158.4",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {