npm - @agent-native/core - Versions diffs - 0.158.3 → 0.158.5 - Mend

@agent-native/core 0.158.3 → 0.158.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/dist/collab/awareness.d.ts +2 -2
package/dist/collab/struct-routes.d.ts +1 -1
package/dist/observability/routes.d.ts +1 -1
package/dist/resources/handlers.d.ts +1 -1
package/dist/server/auth.js +129 -3
package/dist/server/better-auth-instance.d.ts +9 -0
package/dist/server/better-auth-instance.js +49 -1
package/dist/server/realtime-token.d.ts +1 -1
package/package.json +1 -1

package/dist/collab/awareness.d.ts CHANGED Viewed

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts CHANGED Viewed

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/observability/routes.d.ts CHANGED Viewed

@@ -62,6 +62,6 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/resources/handlers.d.ts CHANGED Viewed

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/auth.js CHANGED Viewed

@@ -1535,6 +1535,56 @@ function escapeHtmlAttr(value) {
         .replace(/>/g, "&gt;")
         .replace(/"/g, "&quot;");
 }
+const DESKTOP_MAGIC_LINK_CALLBACK_PATH = "/_agent-native/auth/magic-link/desktop-callback";
+const DESKTOP_MAGIC_LINK_LANDING_PATH = "/_agent-native/auth/magic-link/desktop-landing";
+const BETTER_AUTH_MAGIC_LINK_VERIFY_PATH = "/_agent-native/auth/ba/magic-link/verify";
+function desktopMagicLinkVerificationUrl(event, values) {
+    const value = (key) => typeof values[key] === "string" ? values[key] : "";
+    const token = value("token").trim();
+    const callbackURL = value("callbackURL");
+    if (!token || !callbackURL)
+        return undefined;
+    try {
+        const callback = new URL(callbackURL, getOrigin(event));
+        if (callback.origin !== new URL(getOrigin(event)).origin ||
+            !callback.pathname.endsWith(DESKTOP_MAGIC_LINK_CALLBACK_PATH) ||
+            !normalizeDesktopFlowId(callback.searchParams.get("flow_id")) ||
+            !normalizeDesktopFlowVerifier(callback.searchParams.get("verifier"))) {
+            return undefined;
+        }
+        const verificationURL = new URL(getAppUrl(event, BETTER_AUTH_MAGIC_LINK_VERIFY_PATH));
+        verificationURL.searchParams.set("token", token);
+        for (const key of [
+            "callbackURL",
+            "newUserCallbackURL",
+            "errorCallbackURL",
+        ]) {
+            const queryValue = value(key);
+            if (queryValue)
+                verificationURL.searchParams.set(key, queryValue);
+        }
+        return verificationURL;
+        // coercion-ok: malformed user-supplied callback data is rejected as absent.
+    }
+    catch {
+        return undefined;
+    }
+}
+function desktopMagicLinkLandingPage(actionUrl, fields) {
+    const safeActionUrl = escapeHtmlAttr(actionUrl);
+    const hiddenInputs = Object.entries(fields)
+        .map(([name, value]) => `<input type="hidden" name="${escapeHtmlAttr(name)}" value="${escapeHtmlAttr(value)}">`)
+        .join("");
+    const html = `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Continue sign-in</title></head><body><main><h1>Continue signing in</h1><p>Click continue to finish signing in to the Agent Native desktop app.</p><form method="post" action="${safeActionUrl}" autocomplete="off">${hiddenInputs}<button type="submit">Continue</button></form></main></body></html>`;
+    return new Response(html, {
+        status: 200,
+        headers: {
+            "cache-control": "no-store",
+            "content-type": "text/html; charset=utf-8",
+            "referrer-policy": "no-referrer",
+        },
+    });
+}
 function injectLoginSocialImageMeta(loginHtml, event) {
     const headCloseIdx = loginHtml.indexOf("</head>");
     if (headCloseIdx === -1)
@@ -3034,6 +3084,51 @@ async function mountBetterAuthRoutes(app, options) {
     // Magic-link verification happens in the system browser, so native shells
     // need the verified browser session copied into the same one-time exchange
     // used by Google OAuth before they can establish their own WebView session.
+    // Keep the desktop email URL itself non-consuming: mail security scanners
+    // commonly prefetch GET links, while Better Auth consumes a magic-link token
+    // on the first verification GET. The explicit form action below is the only
+    // request that reaches Better Auth's consuming verification endpoint.
+    app.use(DESKTOP_MAGIC_LINK_LANDING_PATH, defineEventHandler((event) => {
+        if (getMethod(event) === "POST") {
+            return readBody(event).then((body) => {
+                const verificationURL = desktopMagicLinkVerificationUrl(event, body);
+                if (!verificationURL) {
+                    setResponseStatus(event, 400);
+                    return { error: "Invalid desktop magic-link" };
+                }
+                return new Response(null, {
+                    status: 303,
+                    headers: {
+                        "cache-control": "no-store",
+                        location: verificationURL.toString(),
+                        "referrer-policy": "no-referrer",
+                    },
+                });
+            });
+        }
+        if (!isReadMethod(event)) {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const query = getQuery(event);
+        const verificationURL = desktopMagicLinkVerificationUrl(event, query);
+        if (!verificationURL) {
+            setResponseStatus(event, 400);
+            return { error: "Invalid desktop magic-link" };
+        }
+        const fields = {};
+        for (const key of [
+            "token",
+            "callbackURL",
+            "newUserCallbackURL",
+            "errorCallbackURL",
+        ]) {
+            if (typeof query[key] === "string" && query[key]) {
+                fields[key] = query[key];
+            }
+        }
+        return desktopMagicLinkLandingPage(getAppUrl(event, DESKTOP_MAGIC_LINK_LANDING_PATH), fields);
+    }));
     app.use("/_agent-native/auth/magic-link/desktop-callback", defineEventHandler(async (event) => {
         if (!isReadMethod(event)) {
             setResponseStatus(event, 405);
@@ -3041,18 +3136,42 @@ async function mountBetterAuthRoutes(app, options) {
         }
         const flowId = normalizeDesktopFlowId(getQuery(event).flow_id);
         const verifier = normalizeDesktopFlowVerifier(getQuery(event).verifier);
+        const callbackError = getQuery(event).error;
         if (!flowId) {
             setResponseStatus(event, 400);
             return { error: "Missing flow_id" };
         }
         if (!verifier) {
+            setDesktopExchangeError(flowId, {
+                message: AUTH_MAGIC_LINK_FALLBACK,
+                code: "missing_verifier",
+            });
+            return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
+        }
+        if (typeof callbackError === "string" && callbackError.trim()) {
+            const code = callbackError
+                .trim()
+                .replace(/[^a-z0-9_-]/gi, "_")
+                .slice(0, 64);
+            setDesktopExchangeError(flowId, {
+                message: AUTH_MAGIC_LINK_FALLBACK,
+                code: code || "callback_error",
+            });
+            logGoogleOAuthDebug(event, "magic-link-callback-error", {
+                flowId,
+                message: callbackError,
+                code: code || "callback_error",
+            });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
         const session = await getSession(event);
         if (!session?.email || !session.token) {
             setDesktopExchangeError(flowId, {
                 message: AUTH_MAGIC_LINK_FALLBACK,
-                code: "callback_error",
+                code: "callback_session_missing",
+            });
+            logGoogleOAuthDebug(event, "magic-link-callback-session-missing", {
+                flowId,
             });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
@@ -3068,11 +3187,18 @@ async function mountBetterAuthRoutes(app, options) {
             });
             setDesktopExchangeError(flowId, {
                 message: AUTH_MAGIC_LINK_FALLBACK,
-                code: "callback_error",
+                code: "callback_session_persist_failed",
+            });
+            logGoogleOAuthDebug(event, "magic-link-callback-session-persist-failed", {
+                flowId,
             });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
-        if (!(await claimDesktopMagicLinkFlow(flowId, verifier, session.token, session.email))) {
+        const claimed = await claimDesktopMagicLinkFlow(flowId, verifier, session.token, session.email);
+        if (!claimed) {
+            logGoogleOAuthDebug(event, "magic-link-callback-flow-claim-failed", {
+                flowId,
+            });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
         return oauthDesktopExchangePage("Sign-in complete. You can return to the app.", !isElectronRequest(event));

package/dist/server/better-auth-instance.d.ts CHANGED Viewed

@@ -152,6 +152,15 @@ export declare function getBetterAuth(config?: BetterAuthConfig): Promise<Better
  * Use this in hot paths where you know init has already happened.
  */
 export declare function getBetterAuthSync(): BetterAuthInstance | undefined;
+/**
+ * Email security scanners commonly prefetch ordinary GET links. Better Auth
+ * intentionally consumes a magic-link token on that first GET, so a scanner
+ * can otherwise spend a desktop flow before the user ever clicks it. Keep the
+ * normal web link unchanged and put only desktop flows behind an explicit
+ * confirmation page that hands the original verification URL back after the
+ * user acts.
+ */
+export declare function desktopMagicLinkLandingUrl(value: string): string | undefined;
 /**
  * The subset of Better Auth's internal adapter we use for federated-SSO
  * JIT account linking. Better Auth owns these writes (id + timestamp +

package/dist/server/better-auth-instance.js CHANGED Viewed

@@ -549,6 +549,53 @@ export async function getBetterAuth(config) {
 export function getBetterAuthSync() {
     return _auth;
 }
+const BETTER_AUTH_MAGIC_LINK_VERIFY_MARKER = "/_agent-native/auth/ba/magic-link/verify";
+const DESKTOP_MAGIC_LINK_CALLBACK_MARKER = "/_agent-native/auth/magic-link/desktop-callback";
+const DESKTOP_MAGIC_LINK_LANDING_MARKER = "/_agent-native/auth/magic-link/desktop-landing";
+/**
+ * Email security scanners commonly prefetch ordinary GET links. Better Auth
+ * intentionally consumes a magic-link token on that first GET, so a scanner
+ * can otherwise spend a desktop flow before the user ever clicks it. Keep the
+ * normal web link unchanged and put only desktop flows behind an explicit
+ * confirmation page that hands the original verification URL back after the
+ * user acts.
+ */
+export function desktopMagicLinkLandingUrl(value) {
+    try {
+        const verificationUrl = new URL(value);
+        const callbackValue = verificationUrl.searchParams.get("callbackURL");
+        if (!callbackValue)
+            return undefined;
+        const callbackUrl = new URL(callbackValue, verificationUrl.origin);
+        if (callbackUrl.origin !== verificationUrl.origin)
+            return undefined;
+        if (!callbackUrl.pathname.endsWith(DESKTOP_MAGIC_LINK_CALLBACK_MARKER)) {
+            return undefined;
+        }
+        const verifyMarkerIndex = verificationUrl.pathname.lastIndexOf(BETTER_AUTH_MAGIC_LINK_VERIFY_MARKER);
+        if (verifyMarkerIndex < 0)
+            return undefined;
+        const landingUrl = new URL(verificationUrl.origin);
+        landingUrl.pathname =
+            verificationUrl.pathname.slice(0, verifyMarkerIndex) +
+                DESKTOP_MAGIC_LINK_LANDING_MARKER;
+        for (const key of [
+            "token",
+            "callbackURL",
+            "newUserCallbackURL",
+            "errorCallbackURL",
+        ]) {
+            const queryValue = verificationUrl.searchParams.get(key);
+            if (queryValue)
+                landingUrl.searchParams.set(key, queryValue);
+        }
+        return landingUrl.toString();
+    }
+    catch {
+        // coercion-ok: malformed provider URLs keep the original link unchanged.
+        return undefined;
+    }
+}
 /**
  * Replace the only unverified credential account and add Google in one
  * database transaction. The read in ensureGoogleAuthIdentityWithAdapter is
@@ -1118,9 +1165,10 @@ async function createBetterAuthInstance(config) {
                     const magicLinkUrl = appBasePath
                         ? url.replace(/(\/\/[^/]+)(\/)/, `$1${appBasePath}$2`)
                         : url;
+                    const deliveredMagicLinkUrl = desktopMagicLinkLandingUrl(magicLinkUrl) ?? magicLinkUrl;
                     const { subject, html, text, appSender } = renderMagicLinkEmail({
                         email,
-                        magicLinkUrl,
+                        magicLinkUrl: deliveredMagicLinkUrl,
                     });
                     await sendEmail({ to: email, subject, html, text, appSender });
                 },

package/dist/server/realtime-token.d.ts CHANGED Viewed

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.158.3",
+  "version": "0.158.5",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {