@agent-native/core 0.161.14 → 0.161.17

package/dist/server/cors-origins.js

@@ -12,6 +12,26 @@ export function isTrustedNativeAppOrigin(origin) {
 export function isLocalhostOrigin(origin) {
     return LOCALHOST_ORIGIN_RE.test(origin);
 }
+/**
+ * Normalize an allowlist entry or an incoming `Origin` header for exact-match
+ * comparison. This does not widen what is admitted — it is still an exact
+ * scheme+host+port match — it only tolerates formatting slop that carries no
+ * security meaning:
+ *  - scheme/host casing (RFC 6454 origins are case-insensitive; an operator
+ *    pasting a domain from a UI that preserves entered case can end up with
+ *    e.g. "HTTPS://App.Example.com")
+ *  - a trailing slash (browsers never send one in `Origin`, but it's an easy
+ *    copy/paste mistake when configuring the allowlist)
+ *  - a bare domain with no scheme (`CORS_ALLOWED_ORIGINS` is operationally a
+ *    "domain allowlist" — operators reasonably enter "app.example.com"
+ *    instead of "https://app.example.com", which then never matches a real
+ *    Origin header and silently locks out that legitimate origin)
+ */
+function normalizeCorsOrigin(value) {
+    const trimmed = value.trim().replace(/\/+$/, "");
+    const hasScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed);
+    return (hasScheme ? trimmed : `https://${trimmed}`).toLowerCase();
+}
 export function getAllowedCorsOrigin(origin, options = {}) {
     if (!origin)
         return null;
@@ -22,7 +42,10 @@ export function getAllowedCorsOrigin(origin, options = {}) {
         return origin;
     const allowedOrigins = options.allowedOrigins ?? readCorsAllowedOrigins();
     if (allowedOrigins.length > 0) {
-        return allowedOrigins.includes(origin) ? origin : null;
+        const normalizedOrigin = normalizeCorsOrigin(origin);
+        return allowedOrigins.some((allowed) => normalizeCorsOrigin(allowed) === normalizedOrigin)
+            ? origin
+            : null;
     }
     if (options.allowAnyOriginWhenNoAllowlist)
         return origin;

package/dist/templates/chat/vitest.config.ts

@@ -1,9 +1,14 @@
-import baseConfig from "@agent-native/core/vitest-config";
-import { mergeConfig } from "vitest/config";
+import path from "node:path";
 
-import viteConfig from "./vite.config";
+import { defineConfig } from "vitest/config";
 
-// Kept separate from vite.config.ts so the production config never imports
-// vitest: `agent-native build` loads vite.config.ts in installs where vitest
-// is absent.
-export default mergeConfig(viteConfig, baseConfig);
+// Keep tests independent from vite.config.ts: the production config starts
+// Nitro/Vite watchers and evaluates browser-targeted CommonJS SSR modules.
+export default defineConfig({
+  resolve: {
+    alias: {
+      "@": path.resolve(__dirname, "./app"),
+      "@shared": path.resolve(__dirname, "./shared"),
+    },
+  },
+});

package/dist/transcription/builder-transcription.js

@@ -1,4 +1,4 @@
-import { resolveBuilderGatewayAuth, getBuilderProxyOrigin, } from "../server/credential-provider.js";
+import { resolveBuilderGatewayAuth, getBuilderProxyOrigin, recordBuilderGatewayAuthFailure, } from "../server/credential-provider.js";
 function describeError(err) {
     if (!(err instanceof Error))
         return String(err);
@@ -64,6 +64,17 @@ export async function transcribeWithBuilder(opts) {
     }
     if (!res.ok) {
         const text = await res.text().catch(() => "");
+        // The chat path records this so a rejected credential is not retried for
+        // BUILDER_AUTH_FAILURE_TTL_MS; transcription never did, so one bad
+        // credential re-sent the same doomed request on every attempt -- prod
+        // logged 24 identical `Missing Authentication header` 401s in a day off a
+        // single unusable credential, with nothing to stop the next one.
+        if (res.status === 401 || res.status === 403) {
+            await recordBuilderGatewayAuthFailure({
+                status: res.status,
+                message: text,
+            });
+        }
         throw new Error(`Builder transcription failed (${res.status} ${res.statusText}): ${text}`);
     }
     return (await res.json());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.161.14",
+  "version": "0.161.17",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/src/templates/chat/vitest.config.ts

@@ -1,9 +1,14 @@
-import baseConfig from "@agent-native/core/vitest-config";
-import { mergeConfig } from "vitest/config";
+import path from "node:path";
 
-import viteConfig from "./vite.config";
+import { defineConfig } from "vitest/config";
 
-// Kept separate from vite.config.ts so the production config never imports
-// vitest: `agent-native build` loads vite.config.ts in installs where vitest
-// is absent.
-export default mergeConfig(viteConfig, baseConfig);
+// Keep tests independent from vite.config.ts: the production config starts
+// Nitro/Vite watchers and evaluates browser-targeted CommonJS SSR modules.
+export default defineConfig({
+  resolve: {
+    alias: {
+      "@": path.resolve(__dirname, "./app"),
+      "@shared": path.resolve(__dirname, "./shared"),
+    },
+  },
+});