@agent-native/core 0.161.12 → 0.161.16

package/dist/observability/routes.d.ts

@@ -41,14 +41,14 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    error?: undefined;
     ok?: undefined;
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
 } | {
-    error?: undefined;
     ok?: undefined;
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;

package/dist/secrets/routes.d.ts

@@ -37,17 +37,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
@@ -58,13 +58,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     error: string;
     note?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/agent-teams.js

@@ -1236,7 +1236,9 @@ export async function processAgentTeamRun(opts) {
             catch {
                 priorThreadData = undefined;
             }
-            messages = threadDataToEngineMessages(priorThreadData);
+            messages = threadDataToEngineMessages(priorThreadData, {
+                includeToolCalls: true,
+            });
             if (messages.length === 0) {
                 messages = [
                     {

package/dist/server/cors-origins.js

@@ -12,6 +12,26 @@ export function isTrustedNativeAppOrigin(origin) {
 export function isLocalhostOrigin(origin) {
     return LOCALHOST_ORIGIN_RE.test(origin);
 }
+/**
+ * Normalize an allowlist entry or an incoming `Origin` header for exact-match
+ * comparison. This does not widen what is admitted — it is still an exact
+ * scheme+host+port match — it only tolerates formatting slop that carries no
+ * security meaning:
+ *  - scheme/host casing (RFC 6454 origins are case-insensitive; an operator
+ *    pasting a domain from a UI that preserves entered case can end up with
+ *    e.g. "HTTPS://App.Example.com")
+ *  - a trailing slash (browsers never send one in `Origin`, but it's an easy
+ *    copy/paste mistake when configuring the allowlist)
+ *  - a bare domain with no scheme (`CORS_ALLOWED_ORIGINS` is operationally a
+ *    "domain allowlist" — operators reasonably enter "app.example.com"
+ *    instead of "https://app.example.com", which then never matches a real
+ *    Origin header and silently locks out that legitimate origin)
+ */
+function normalizeCorsOrigin(value) {
+    const trimmed = value.trim().replace(/\/+$/, "");
+    const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed);
+    return (hasScheme ? trimmed : `https://${trimmed}`).toLowerCase();
+}
 export function getAllowedCorsOrigin(origin, options = {}) {
     if (!origin)
         return null;
@@ -22,7 +42,10 @@ export function getAllowedCorsOrigin(origin, options = {}) {
         return origin;
     const allowedOrigins = options.allowedOrigins ?? readCorsAllowedOrigins();
     if (allowedOrigins.length > 0) {
-        return allowedOrigins.includes(origin) ? origin : null;
+        const normalizedOrigin = normalizeCorsOrigin(origin);
+        return allowedOrigins.some((allowed) => normalizeCorsOrigin(allowed) === normalizedOrigin)
+            ? origin
+            : null;
     }
     if (options.allowAnyOriginWhenNoAllowlist)
         return origin;

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/styles/agent-conversation.css

@@ -331,6 +331,27 @@
   font-size: 12px;
 }
 
+.agent-mcp-app__error {
+  pointer-events: none;
+  background: transparent;
+}
+
+.agent-mcp-app__error-box {
+  display: flex;
+  max-width: min(100%, 540px);
+  flex-direction: column;
+  align-items: center;
+  gap: 8px;
+  padding: 12px 14px;
+  border: 1px solid hsl(var(--destructive) / 0.35);
+  border-radius: calc(var(--radius) - 2px);
+  background: hsl(var(--background) / 0.96);
+  box-shadow: 0 8px 24px hsl(var(--foreground) / 0.12);
+  color: hsl(var(--destructive));
+  text-align: center;
+  pointer-events: auto;
+}
+
 .agent-mcp-app__error {
   flex-direction: column;
   text-align: center;
@@ -338,10 +359,10 @@
 
 .agent-mcp-app__open {
   min-height: 28px;
-  border: 1px solid hsl(var(--destructive) / 0.35);
+  border: 1px solid hsl(var(--foreground));
   border-radius: calc(var(--radius) - 2px);
-  background: hsl(var(--background));
-  color: hsl(var(--foreground));
+  background: hsl(var(--foreground));
+  color: hsl(var(--background));
   cursor: pointer;
   font: inherit;
   font-weight: 600;
@@ -349,7 +370,7 @@
 }
 
 .agent-mcp-app__open:hover {
-  background: hsl(var(--muted));
+  opacity: 0.86;
 }
 
 .agent-mcp-app__error,

package/dist/transcription/builder-transcription.js

@@ -1,4 +1,4 @@
-import { resolveBuilderGatewayAuth, getBuilderProxyOrigin, } from "../server/credential-provider.js";
+import { resolveBuilderGatewayAuth, getBuilderProxyOrigin, recordBuilderGatewayAuthFailure, } from "../server/credential-provider.js";
 function describeError(err) {
     if (!(err instanceof Error))
         return String(err);
@@ -64,6 +64,17 @@ export async function transcribeWithBuilder(opts) {
     }
     if (!res.ok) {
         const text = await res.text().catch(() => "");
+        // The chat path records this so a rejected credential is not retried for
+        // BUILDER_AUTH_FAILURE_TTL_MS; transcription never did, so one bad
+        // credential re-sent the same doomed request on every attempt -- prod
+        // logged 24 identical `Missing Authentication header` 401s in a day off a
+        // single unusable credential, with nothing to stop the next one.
+        if (res.status === 401 || res.status === 403) {
+            await recordBuilderGatewayAuthFailure({
+                status: res.status,
+                message: text,
+            });
+        }
         throw new Error(`Builder transcription failed (${res.status} ${res.statusText}): ${text}`);
     }
     return (await res.json());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.161.12",
+  "version": "0.161.16",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {