@agent-native/core 0.161.17 → 0.161.22

package/dist/client/frame.js

@@ -1,3 +1,4 @@
+import { isTruthyRuntimeValue } from "../shared/runtime-config.js";
 import { agentNativePath } from "./api-path.js";
 /**
  * Frame Communication (browser)
@@ -174,8 +175,7 @@ export function getCallbackOrigin() {
     return typeof window !== "undefined" ? window.location.origin : "";
 }
 function envFlag(name) {
-    const value = runtimeEnvValue(name);
-    return value === "1" || value === "true" || value === true;
+    return isTruthyRuntimeValue(runtimeEnvValue(name));
 }
 function runtimeEnvValue(name) {
     const importMetaEnv = import.meta.env;
@@ -193,9 +193,21 @@ function workspaceOAuthOrigin() {
     // guaranteed — which is why the chain lists both and why it is not the
     // primary path any more.
     const shell = typeof window !== "undefined" ? window.__AGENT_NATIVE_CONFIG__ : undefined;
-    const raw = shell?.workspaceOAuthOrigin ||
-        shell?.appUrl ||
-        shell?.workspaceGatewayUrl ||
+    const projectedRaw = shell?.workspaceOAuthOrigin || shell?.appUrl || shell?.workspaceGatewayUrl;
+    if (shell?.workspaceRuntime === true) {
+        if (typeof projectedRaw === "string" && projectedRaw.trim()) {
+            try {
+                return new URL(projectedRaw).origin;
+            }
+            catch {
+                // coercion-ok: a stale projected origin intentionally falls back below.
+                // Fall through to the current origin when the projected value is stale.
+            }
+        }
+        const currentOrigin = getCallbackOrigin();
+        return currentOrigin || null;
+    }
+    const raw = projectedRaw ||
         runtimeEnvValue("VITE_WORKSPACE_OAUTH_ORIGIN") ||
         runtimeEnvValue("WORKSPACE_OAUTH_ORIGIN") ||
         runtimeEnvValue("VITE_APP_URL") ||
@@ -214,7 +226,9 @@ function workspaceOAuthOrigin() {
     }
 }
 function shouldUseWorkspaceCallbackRelay(path) {
-    return (envFlag("VITE_AGENT_NATIVE_WORKSPACE") &&
+    const projectedWorkspaceRuntime = typeof window !== "undefined" &&
+        window.__AGENT_NATIVE_CONFIG__?.workspaceRuntime === true;
+    return ((projectedWorkspaceRuntime || envFlag("VITE_AGENT_NATIVE_WORKSPACE")) &&
         path.startsWith("/_agent-native/") &&
         (path.endsWith("/callback") || path.includes("/callback/")));
 }

package/dist/client/org/workspace-app-links.js

@@ -1,5 +1,6 @@
 import { useEffect, useMemo, useState } from "react";
 import { coreTemplates, getTemplate } from "../../cli/templates-meta.js";
+import { isTruthyRuntimeValue } from "../../shared/runtime-config.js";
 const DISPATCH_ID = "dispatch";
 export const ORG_SWITCHER_MAX_APP_LINKS = 9;
 function runtimeEnv() {
@@ -9,6 +10,13 @@ function envString(env, key) {
     const value = env[key];
     return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
+function envFlag(env, key) {
+    return isTruthyRuntimeValue(env[key]);
+}
+function projectedWorkspaceRuntime() {
+    return (typeof window !== "undefined" &&
+        window.__AGENT_NATIVE_CONFIG__?.workspaceRuntime === true);
+}
 function titleCase(value) {
     return value
         .split(/[-_\s]+/)
@@ -170,7 +178,8 @@ export function defaultOrgAppLinks() {
     })));
 }
 export function isWorkspaceAppEnvironment(env = runtimeEnv()) {
-    return (envString(env, "VITE_AGENT_NATIVE_WORKSPACE") === "1" ||
+    return (envFlag(env, "VITE_AGENT_NATIVE_WORKSPACE") ||
+        projectedWorkspaceRuntime() ||
         Boolean(envString(env, "VITE_WORKSPACE_GATEWAY_URL")) ||
         Boolean(envString(env, "VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON")));
 }

package/dist/client/route-state.js

@@ -58,19 +58,24 @@ function shallowEqualNavigationState(left, right) {
     }
     return true;
 }
-function stringifyForWriteDedup(value) {
+/**
+ * Dedup token for the navigation write. Unserializable state falls back to the
+ * state's own identity, never a fresh symbol: the caller's `navigationKeys` is
+ * usually a new array each render, so a symbol recomputed here would never
+ * match the last one and every re-render would issue another failing write.
+ * Identity still lets a genuinely different state reach the write path.
+ */
+function navigationWriteDedupToken(keys, state) {
     try {
-        const serialized = JSON.stringify(value);
-        return typeof serialized === "string"
-            ? serialized
-            : Symbol("unserializable navigation state");
+        const serialized = JSON.stringify({ keys, state });
+        if (typeof serialized === "string")
+            return serialized;
     }
     catch {
-        // Do not turn a serialization failure into a reusable string key. A
-        // distinct token lets a changed unserializable state reach the write path
-        // and surface its real error instead of being silently deduplicated.
-        return Symbol("unserializable navigation state");
+        // coercion-ok: deferred, not dropped — the write below still rejects with
+        // this error and reports it through `onError`.
     }
+    return state;
 }
 function resolveAgentChatViewTransitionOption(option, command, path) {
     const resolved = typeof option === "function" ? option(command, path) : option;
@@ -92,16 +97,15 @@ export function useSemanticNavigationState(options) {
     const commandKeys = useMemo(() => uniqueKeys(options.commandKeys ?? ["navigate"]), [options.commandKeys]);
     const commandQueryKey = useMemo(() => options.commandQueryKey ?? ["navigate-command"], [options.commandQueryKey]);
     const navigationState = options.state ?? null;
-    const navigationWriteDedup = useMemo(() => stringifyForWriteDedup({
-        keys: navigationKeys,
-        state: navigationState,
-    }), [navigationKeys, navigationState]);
+    const navigationWriteDedup = useMemo(() => navigationWriteDedupToken(navigationKeys, navigationState), [navigationKeys, navigationState]);
     const getCommandDedupKeyRef = useRef(options.getCommandDedupKey);
     const onCommandRef = useRef(options.onCommand);
     const onErrorRef = useRef(options.onError);
     getCommandDedupKeyRef.current = options.getCommandDedupKey;
     onCommandRef.current = options.onCommand;
     onErrorRef.current = options.onError;
+    // `null` is safe as "never written": a null state serializes to a string, so
+    // the token itself is never null.
     const lastNavigationWriteRef = useRef(null);
     useEffect(() => {
         if (!enabled)

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/deploy/build.js

@@ -25,6 +25,7 @@ import { RECURRING_JOBS_SWEEP_PATH, RECURRING_JOBS_SWEEP_TOKEN_SUBJECT, } from "
 import { normalizeAppBasePath } from "../server/app-base-path.js";
 import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, } from "../shared/cache-control.js";
 import { mcpEmbedStaticAssetRouteRules } from "../shared/mcp-embed-headers.js";
+import { isTruthyRuntimeValue } from "../shared/runtime-config.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_CACHE_BUSTER, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, } from "../shared/social-meta.js";
 import { generateActionRegistryForProject } from "../vite/action-types-plugin.js";
 import { createAgentNativeConfigContext, loadResolvedAgentNativeConfig, } from "../vite/agent-native-config-loader.js";
@@ -882,6 +883,14 @@ function firstNonEmpty() {
   }
 }
 
+function isTruthyRuntimeValue(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value !== "string") return false;
+  return ["1", "true", "yes", "on"].includes(
+    value.trim().toLowerCase(),
+  );
+}
+
 function getSentryClientConfigScript() {
   const env = globalThis.process?.env || {};
   const key = firstNonEmpty(env.SENTRY_CLIENT_KEY, env.VITE_SENTRY_CLIENT_KEY);
@@ -993,10 +1002,21 @@ function getAppOriginClientConfigScript() {
     env.WORKSPACE_OAUTH_ORIGIN,
     env.VITE_WORKSPACE_OAUTH_ORIGIN,
   );
+  const workspaceRuntime = [
+    env.AGENT_NATIVE_WORKSPACE,
+    env.VITE_AGENT_NATIVE_WORKSPACE,
+  ].some((value) => isTruthyRuntimeValue(value)) ||
+    Boolean(
+      firstNonEmpty(
+        env.AGENT_NATIVE_WORKSPACE_APPS_JSON,
+        env.VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON,
+      ),
+    );
   const config = {
     ...(appUrl ? { appUrl } : {}),
     ...(workspaceGatewayUrl ? { workspaceGatewayUrl } : {}),
     ...(workspaceOAuthOrigin ? { workspaceOAuthOrigin } : {}),
+    ...(workspaceRuntime ? { workspaceRuntime: true } : {}),
   };
   if (Object.keys(config).length === 0) return null;
   return (
@@ -3044,8 +3064,12 @@ function reportNetlifyFunctionSizes(internalDir, failures) {
 export function assertSingleTemplateNetlifyBuildOutput(projectCwd) {
     const failures = [];
     const publishDir = path.join(projectCwd, "dist");
-    const workspaceAppBasePath = process.env.AGENT_NATIVE_WORKSPACE === "1" ||
-        process.env.VITE_AGENT_NATIVE_WORKSPACE === "1"
+    const workspaceAppBasePath = [
+        process.env.AGENT_NATIVE_WORKSPACE,
+        process.env.VITE_AGENT_NATIVE_WORKSPACE,
+    ].some((value) => isTruthyRuntimeValue(value)) ||
+        Boolean(process.env.AGENT_NATIVE_WORKSPACE_APPS_JSON?.trim()) ||
+        Boolean(process.env.VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON?.trim())
         ? normalizeConfiguredAppBasePath()
         : "";
     const assetsRelativeDir = workspaceAppBasePath

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;

package/dist/notifications/routes.d.ts

@@ -28,6 +28,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     ok: boolean;
-    error?: undefined;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,9 +75,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
+    message?: undefined;
     id?: undefined;
-    provider?: undefined;
     deleted?: undefined;
+    found?: undefined;
     providers: {
         id: string;
         label: string;
@@ -88,46 +89,45 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    found?: undefined;
+    provider?: undefined;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    message?: undefined;
+    count?: undefined;
     id?: undefined;
     deleted?: undefined;
     providers?: undefined;
-    count?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
+    message?: undefined;
+    count?: undefined;
     deleted?: undefined;
     providers?: undefined;
-    count?: undefined;
+    provider?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
-    providers?: undefined;
+    message?: undefined;
     count?: undefined;
     found?: undefined;
+    providers?: undefined;
+    provider?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
-    deleted?: undefined;
-    providers?: undefined;
     count?: undefined;
+    deleted?: undefined;
     found?: undefined;
+    providers?: undefined;
+    provider?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -312,7 +312,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         scope?: "org" | "user" | undefined;
     }, {
         id?: undefined;
-        message?: undefined;
+        deleted?: undefined;
+        provider?: undefined;
+        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -323,47 +325,45 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
-        provider?: undefined;
-        found?: undefined;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
         id?: undefined;
-        message?: undefined;
+        deleted?: undefined;
         providers?: undefined;
         count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
+    } | {
+        deleted?: undefined;
+        provider?: undefined;
         providers?: undefined;
         count?: undefined;
-        provider?: undefined;
         found: boolean;
         id: string;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        providers?: undefined;
-        count?: undefined;
+    } | {
         provider?: undefined;
         found?: undefined;
+        providers?: undefined;
+        count?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        providers?: undefined;
-        count?: undefined;
+        deleted?: undefined;
         provider?: undefined;
         found?: undefined;
-        deleted?: undefined;
+        providers?: undefined;
+        count?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/app-origin-config.d.ts

@@ -19,5 +19,6 @@ export declare function resolvePublicAppOriginConfig(): {
     appUrl?: string;
     workspaceGatewayUrl?: string;
     workspaceOAuthOrigin?: string;
+    workspaceRuntime?: boolean;
 } | null;
 export declare function getAppOriginClientConfigScript(): string | null;

package/dist/server/app-origin-config.js

@@ -18,6 +18,8 @@ import { getAppConfig } from "../app-config/index.js";
  */
 export function resolvePublicAppOriginConfig() {
     const config = getAppConfig();
+    const workspaceRuntime = config.workspace.isWorkspace === true ||
+        typeof config.workspace.appsJson === "string";
     const resolved = {
         ...(config.app.url ? { appUrl: config.app.url } : {}),
         ...(config.workspace.gatewayUrl
@@ -26,6 +28,7 @@ export function resolvePublicAppOriginConfig() {
         ...(config.workspace.oauthOrigin
             ? { workspaceOAuthOrigin: config.workspace.oauthOrigin }
             : {}),
+        ...(workspaceRuntime ? { workspaceRuntime: true } : {}),
     };
     return Object.keys(resolved).length > 0 ? resolved : null;
 }

package/dist/server/auth.d.ts

@@ -37,6 +37,12 @@ export interface AuthOptions {
      * Both page routes and API routes can be made public.
      */
     publicPaths?: string[];
+    /**
+     * Public, unauthenticated ingest paths that may receive cross-origin
+     * requests when CORS_ALLOWED_ORIGINS is unset. These routes must perform
+     * their own request validation and must not rely on cookies for auth.
+     */
+    publicCorsPaths?: string[];
     /**
      * Workspace-level audience for the app.
      *

package/dist/server/auth.js

@@ -1380,11 +1380,11 @@ export async function runAuthGuard(event) {
  * unauthenticated requests. Returns the login HTML for page routes
  * or a 401 JSON response for API routes.
  *
- * Reads loginHtml and publicPaths from _authGuardConfig on every request
+ * Reads loginHtml and public paths from _authGuardConfig on every request
  * so that a custom plugin can update them after the default has already
  * installed this middleware (the production race condition fix).
  */
-function applyCorsHeaders(event) {
+function applyCorsHeaders(event, publicCorsPaths = [], requestPath) {
     // Framework-level CORS. The auth guard runs before any of the app's own
     // route handlers, so we need to set CORS here too — otherwise a 401
     // response would be missing the Allow-Origin header and the browser
@@ -1404,15 +1404,22 @@ function applyCorsHeaders(event) {
             Boolean(getHeader(event, EMBED_TARGET_HEADER)) ||
             Boolean(getHeader(event, EMBED_TRANSPLANT_HEADER)) ||
             Boolean(getHeader(event, "authorization")));
+    const isPublicCorsPath = Boolean(requestPath && matchesPathList(requestPath, publicCorsPaths));
     const allowedOrigin = getAllowedCorsOrigin(origin, {
         allowedOrigins: readCorsAllowedOrigins(),
+        // Public ingestion endpoints such as analytics replay are intentionally
+        // callable by browser apps on arbitrary origins. The endpoint still owns
+        // its public-key, payload, quota, and origin checks; this only lets the
+        // browser complete the preflight when no deployment-wide allowlist exists.
+        allowAnyOriginWhenNoAllowlist: isPublicCorsPath,
     });
     const responseOrigin = mcpEmbedCorsRequest ? origin : allowedOrigin;
     if (!responseOrigin)
         return { hasOrigin: true, allowed: false };
     setResponseHeader(event, "Access-Control-Allow-Origin", responseOrigin);
     setResponseHeader(event, "Vary", "Origin");
-    if (!mcpEmbedCorsRequest || shouldAllowMcpEmbedCredentials(responseOrigin)) {
+    if (!isPublicCorsPath &&
+        (!mcpEmbedCorsRequest || shouldAllowMcpEmbedCredentials(responseOrigin))) {
         setResponseHeader(event, "Access-Control-Allow-Credentials", "true");
     }
     setResponseHeader(event, "Access-Control-Allow-Methods", "GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS");
@@ -1431,7 +1438,7 @@ function applyCorsHeaders(event) {
 }
 function createAuthCorsHandler() {
     return defineEventHandler((event) => {
-        const cors = applyCorsHeaders(event);
+        const cors = applyCorsHeaders(event, _authGuardConfig?.publicCorsPaths);
         if (getMethod(event) !== "OPTIONS")
             return;
         if (cors.hasOrigin && !cors.allowed) {
@@ -1835,7 +1842,7 @@ function createAuthGuardFn(app) {
             return callbackRelay;
         // Emit CORS headers on every request the guard sees so that even
         // error responses (401) reach the browser.
-        const cors = applyCorsHeaders(event);
+        const cors = applyCorsHeaders(event, config.publicCorsPaths, p);
         // Preflight short-circuit: the browser sends OPTIONS before the real
         // credentialed request. Must return success without invoking auth.
         if (getMethod(event) === "OPTIONS") {
@@ -2950,8 +2957,8 @@ async function mountBetterAuthRoutes(app, options) {
                 redirectPath: oauthDebugUrlPath(redirectUri),
                 returnUrl,
                 redirect: q.redirect === "1",
-                workspace: process.env.AGENT_NATIVE_WORKSPACE === "1" ||
-                    process.env.VITE_AGENT_NATIVE_WORKSPACE === "1",
+                workspace: getAppConfig().workspace.isWorkspace === true ||
+                    typeof getAppConfig().workspace.appsJson === "string",
             });
             const params = new URLSearchParams({
                 client_id: googleSignInCredentials.clientId,
@@ -4039,6 +4046,7 @@ async function mountBetterAuthRoutes(app, options) {
     _authGuardConfig = {
         ...loginHtmlConfig,
         publicPaths,
+        publicCorsPaths: options.publicCorsPaths ?? [],
         workspaceAppAudience,
         workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
         workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
@@ -4236,6 +4244,14 @@ export async function autoMountAuth(app, options = {}) {
                     ...options.publicPaths,
                 ];
             }
+            if (options.publicCorsPaths) {
+                _authGuardConfig.publicCorsPaths = [
+                    ...new Set([
+                        ...(_authGuardConfig.publicCorsPaths ?? []),
+                        ...options.publicCorsPaths,
+                    ]),
+                ];
+            }
             if (options.workspaceAppAudience) {
                 _authGuardConfig.workspaceAppAudience =
                     resolveWorkspaceAppAudience(options);
@@ -4307,6 +4323,7 @@ export async function autoMountAuth(app, options = {}) {
                     getLoginHtml: () => getCustomAuthRequiredHtml(),
                 }),
             publicPaths,
+            publicCorsPaths: options.publicCorsPaths ?? [],
             workspaceAppAudience,
             workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
             workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,
@@ -4334,6 +4351,7 @@ export async function autoMountAuth(app, options = {}) {
         _authGuardConfig = {
             ...loginHtmlConfig,
             publicPaths,
+            publicCorsPaths: options.publicCorsPaths ?? [],
             workspaceAppAudience,
             workspaceAppPublicPaths: workspaceAppRouteAccess.publicPaths,
             workspaceAppProtectedPaths: workspaceAppRouteAccess.protectedPaths,