@agent-native/core 0.161.20 → 0.161.22

package/dist/client/frame.js

@@ -1,3 +1,4 @@
+import { isTruthyRuntimeValue } from "../shared/runtime-config.js";
 import { agentNativePath } from "./api-path.js";
 /**
  * Frame Communication (browser)
@@ -174,8 +175,7 @@ export function getCallbackOrigin() {
     return typeof window !== "undefined" ? window.location.origin : "";
 }
 function envFlag(name) {
-    const value = runtimeEnvValue(name);
-    return value === "1" || value === "true" || value === true;
+    return isTruthyRuntimeValue(runtimeEnvValue(name));
 }
 function runtimeEnvValue(name) {
     const importMetaEnv = import.meta.env;
@@ -193,9 +193,21 @@ function workspaceOAuthOrigin() {
     // guaranteed — which is why the chain lists both and why it is not the
     // primary path any more.
     const shell = typeof window !== "undefined" ? window.__AGENT_NATIVE_CONFIG__ : undefined;
-    const raw = shell?.workspaceOAuthOrigin ||
-        shell?.appUrl ||
-        shell?.workspaceGatewayUrl ||
+    const projectedRaw = shell?.workspaceOAuthOrigin || shell?.appUrl || shell?.workspaceGatewayUrl;
+    if (shell?.workspaceRuntime === true) {
+        if (typeof projectedRaw === "string" && projectedRaw.trim()) {
+            try {
+                return new URL(projectedRaw).origin;
+            }
+            catch {
+                // coercion-ok: a stale projected origin intentionally falls back below.
+                // Fall through to the current origin when the projected value is stale.
+            }
+        }
+        const currentOrigin = getCallbackOrigin();
+        return currentOrigin || null;
+    }
+    const raw = projectedRaw ||
         runtimeEnvValue("VITE_WORKSPACE_OAUTH_ORIGIN") ||
         runtimeEnvValue("WORKSPACE_OAUTH_ORIGIN") ||
         runtimeEnvValue("VITE_APP_URL") ||
@@ -214,7 +226,9 @@ function workspaceOAuthOrigin() {
     }
 }
 function shouldUseWorkspaceCallbackRelay(path) {
-    return (envFlag("VITE_AGENT_NATIVE_WORKSPACE") &&
+    const projectedWorkspaceRuntime = typeof window !== "undefined" &&
+        window.__AGENT_NATIVE_CONFIG__?.workspaceRuntime === true;
+    return ((projectedWorkspaceRuntime || envFlag("VITE_AGENT_NATIVE_WORKSPACE")) &&
         path.startsWith("/_agent-native/") &&
         (path.endsWith("/callback") || path.includes("/callback/")));
 }

package/dist/client/org/workspace-app-links.js

@@ -1,5 +1,6 @@
 import { useEffect, useMemo, useState } from "react";
 import { coreTemplates, getTemplate } from "../../cli/templates-meta.js";
+import { isTruthyRuntimeValue } from "../../shared/runtime-config.js";
 const DISPATCH_ID = "dispatch";
 export const ORG_SWITCHER_MAX_APP_LINKS = 9;
 function runtimeEnv() {
@@ -9,6 +10,13 @@ function envString(env, key) {
     const value = env[key];
     return typeof value === "string" && value.trim() ? value.trim() : undefined;
 }
+function envFlag(env, key) {
+    return isTruthyRuntimeValue(env[key]);
+}
+function projectedWorkspaceRuntime() {
+    return (typeof window !== "undefined" &&
+        window.__AGENT_NATIVE_CONFIG__?.workspaceRuntime === true);
+}
 function titleCase(value) {
     return value
         .split(/[-_\s]+/)
@@ -170,7 +178,8 @@ export function defaultOrgAppLinks() {
     })));
 }
 export function isWorkspaceAppEnvironment(env = runtimeEnv()) {
-    return (envString(env, "VITE_AGENT_NATIVE_WORKSPACE") === "1" ||
+    return (envFlag(env, "VITE_AGENT_NATIVE_WORKSPACE") ||
+        projectedWorkspaceRuntime() ||
         Boolean(envString(env, "VITE_WORKSPACE_GATEWAY_URL")) ||
         Boolean(envString(env, "VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON")));
 }

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/deploy/build.js

@@ -25,6 +25,7 @@ import { RECURRING_JOBS_SWEEP_PATH, RECURRING_JOBS_SWEEP_TOKEN_SUBJECT, } from "
 import { normalizeAppBasePath } from "../server/app-base-path.js";
 import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, } from "../shared/cache-control.js";
 import { mcpEmbedStaticAssetRouteRules } from "../shared/mcp-embed-headers.js";
+import { isTruthyRuntimeValue } from "../shared/runtime-config.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_CACHE_BUSTER, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, } from "../shared/social-meta.js";
 import { generateActionRegistryForProject } from "../vite/action-types-plugin.js";
 import { createAgentNativeConfigContext, loadResolvedAgentNativeConfig, } from "../vite/agent-native-config-loader.js";
@@ -882,6 +883,14 @@ function firstNonEmpty() {
   }
 }
 
+function isTruthyRuntimeValue(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value !== "string") return false;
+  return ["1", "true", "yes", "on"].includes(
+    value.trim().toLowerCase(),
+  );
+}
+
 function getSentryClientConfigScript() {
   const env = globalThis.process?.env || {};
   const key = firstNonEmpty(env.SENTRY_CLIENT_KEY, env.VITE_SENTRY_CLIENT_KEY);
@@ -993,10 +1002,21 @@ function getAppOriginClientConfigScript() {
     env.WORKSPACE_OAUTH_ORIGIN,
     env.VITE_WORKSPACE_OAUTH_ORIGIN,
   );
+  const workspaceRuntime = [
+    env.AGENT_NATIVE_WORKSPACE,
+    env.VITE_AGENT_NATIVE_WORKSPACE,
+  ].some((value) => isTruthyRuntimeValue(value)) ||
+    Boolean(
+      firstNonEmpty(
+        env.AGENT_NATIVE_WORKSPACE_APPS_JSON,
+        env.VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON,
+      ),
+    );
   const config = {
     ...(appUrl ? { appUrl } : {}),
     ...(workspaceGatewayUrl ? { workspaceGatewayUrl } : {}),
     ...(workspaceOAuthOrigin ? { workspaceOAuthOrigin } : {}),
+    ...(workspaceRuntime ? { workspaceRuntime: true } : {}),
   };
   if (Object.keys(config).length === 0) return null;
   return (
@@ -3044,8 +3064,12 @@ function reportNetlifyFunctionSizes(internalDir, failures) {
 export function assertSingleTemplateNetlifyBuildOutput(projectCwd) {
     const failures = [];
     const publishDir = path.join(projectCwd, "dist");
-    const workspaceAppBasePath = process.env.AGENT_NATIVE_WORKSPACE === "1" ||
-        process.env.VITE_AGENT_NATIVE_WORKSPACE === "1"
+    const workspaceAppBasePath = [
+        process.env.AGENT_NATIVE_WORKSPACE,
+        process.env.VITE_AGENT_NATIVE_WORKSPACE,
+    ].some((value) => isTruthyRuntimeValue(value)) ||
+        Boolean(process.env.AGENT_NATIVE_WORKSPACE_APPS_JSON?.trim()) ||
+        Boolean(process.env.VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON?.trim())
         ? normalizeConfiguredAppBasePath()
         : "";
     const assetsRelativeDir = workspaceAppBasePath

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,11 +17,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;

package/dist/notifications/routes.d.ts

@@ -28,6 +28,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    ok?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    ok?: undefined;
-    error?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     ok: boolean;
-    error?: undefined;
 }>>;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,9 +75,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
+    message?: undefined;
     id?: undefined;
-    provider?: undefined;
     deleted?: undefined;
+    found?: undefined;
     providers: {
         id: string;
         label: string;
@@ -88,46 +89,45 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    found?: undefined;
+    provider?: undefined;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    message?: undefined;
+    count?: undefined;
     id?: undefined;
     deleted?: undefined;
     providers?: undefined;
-    count?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
+    message?: undefined;
+    count?: undefined;
     deleted?: undefined;
     providers?: undefined;
-    count?: undefined;
+    provider?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
-    providers?: undefined;
+    message?: undefined;
     count?: undefined;
     found?: undefined;
+    providers?: undefined;
+    provider?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
-    deleted?: undefined;
-    providers?: undefined;
     count?: undefined;
+    deleted?: undefined;
     found?: undefined;
+    providers?: undefined;
+    provider?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -312,7 +312,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         scope?: "org" | "user" | undefined;
     }, {
         id?: undefined;
-        message?: undefined;
+        deleted?: undefined;
+        provider?: undefined;
+        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -323,47 +325,45 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
-        provider?: undefined;
-        found?: undefined;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
         id?: undefined;
-        message?: undefined;
+        deleted?: undefined;
         providers?: undefined;
         count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
+    } | {
+        deleted?: undefined;
+        provider?: undefined;
         providers?: undefined;
         count?: undefined;
-        provider?: undefined;
         found: boolean;
         id: string;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        providers?: undefined;
-        count?: undefined;
+    } | {
         provider?: undefined;
         found?: undefined;
+        providers?: undefined;
+        count?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        providers?: undefined;
-        count?: undefined;
+        deleted?: undefined;
         provider?: undefined;
         found?: undefined;
-        deleted?: undefined;
+        providers?: undefined;
+        count?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/app-origin-config.d.ts

@@ -19,5 +19,6 @@ export declare function resolvePublicAppOriginConfig(): {
     appUrl?: string;
     workspaceGatewayUrl?: string;
     workspaceOAuthOrigin?: string;
+    workspaceRuntime?: boolean;
 } | null;
 export declare function getAppOriginClientConfigScript(): string | null;

package/dist/server/app-origin-config.js

@@ -18,6 +18,8 @@ import { getAppConfig } from "../app-config/index.js";
  */
 export function resolvePublicAppOriginConfig() {
     const config = getAppConfig();
+    const workspaceRuntime = config.workspace.isWorkspace === true ||
+        typeof config.workspace.appsJson === "string";
     const resolved = {
         ...(config.app.url ? { appUrl: config.app.url } : {}),
         ...(config.workspace.gatewayUrl
@@ -26,6 +28,7 @@ export function resolvePublicAppOriginConfig() {
         ...(config.workspace.oauthOrigin
             ? { workspaceOAuthOrigin: config.workspace.oauthOrigin }
             : {}),
+        ...(workspaceRuntime ? { workspaceRuntime: true } : {}),
     };
     return Object.keys(resolved).length > 0 ? resolved : null;
 }

package/dist/server/auth.js

@@ -2957,8 +2957,8 @@ async function mountBetterAuthRoutes(app, options) {
                 redirectPath: oauthDebugUrlPath(redirectUri),
                 returnUrl,
                 redirect: q.redirect === "1",
-                workspace: process.env.AGENT_NATIVE_WORKSPACE === "1" ||
-                    process.env.VITE_AGENT_NATIVE_WORKSPACE === "1",
+                workspace: getAppConfig().workspace.isWorkspace === true ||
+                    typeof getAppConfig().workspace.appsJson === "string",
             });
             const params = new URLSearchParams({
                 client_id: googleSignInCredentials.clientId,

package/dist/server/cookie-namespace.js

@@ -1,9 +1,12 @@
 import fs from "node:fs";
 import path from "node:path";
+import { getAppConfig } from "../app-config/index.js";
+import { isTruthyRuntimeValue } from "../shared/runtime-config.js";
 const FIRST_PARTY_COOKIE_DOMAIN = "agent-native.com";
 export function resolveAuthCookieNamespace(env = process.env, cwd = process.cwd()) {
-    const isWorkspaceMode = env.AGENT_NATIVE_WORKSPACE === "1" ||
-        env.VITE_AGENT_NATIVE_WORKSPACE === "1";
+    const isWorkspaceMode = env === process.env
+        ? isConfiguredWorkspaceRuntime()
+        : isWorkspaceModeFromEnv(env);
     const configuredCookieDomain = normalizeCookieDomain(env.COOKIE_DOMAIN);
     const isFirstPartyCookieDomain = normalizeDomainForCompare(configuredCookieDomain) ===
         FIRST_PARTY_COOKIE_DOMAIN;
@@ -63,6 +66,18 @@ export function resolveAuthCookieNamespace(env = process.env, cwd = process.cwd(
         isFirstPartyCookieDomain,
     };
 }
+function isConfiguredWorkspaceRuntime() {
+    const workspace = getAppConfig().workspace;
+    return (workspace.isWorkspace === true || typeof workspace.appsJson === "string");
+}
+function isWorkspaceModeFromEnv(env) {
+    const workspaceFlag = firstConfiguredValue(env.AGENT_NATIVE_WORKSPACE, env.VITE_AGENT_NATIVE_WORKSPACE);
+    const workspaceApps = firstConfiguredValue(env.AGENT_NATIVE_WORKSPACE_APPS_JSON, env.VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON);
+    return isTruthyRuntimeValue(workspaceFlag) || Boolean(workspaceApps);
+}
+function firstConfiguredValue(...values) {
+    return values.find((value) => value?.trim())?.trim();
+}
 function readPackageJsonName(cwd) {
     try {
         const raw = fs.readFileSync(path.join(cwd, "package.json"), "utf8");

package/dist/server/credential-provider.js

@@ -22,6 +22,7 @@ import { CREDENTIAL_STORE_UNAVAILABLE_ERROR_CODE, GATEWAY_UNAVAILABLE_VISITOR_ME
 import { getAppConfig } from "../app-config/index.js";
 import { getDbExec, isLocalDatabase, isTransientDatabaseError, } from "../db/client.js";
 import { getOrgSetting } from "../settings/org-settings.js";
+import { isTruthyRuntimeValue } from "../shared/runtime-config.js";
 import { getRequestUserEmail, getRequestOrgId } from "./request-context.js";
 const DISPATCH_VAULT_ACCESS_SETTINGS_KEY = "dispatch-vault-access-settings";
 /**
@@ -209,8 +210,10 @@ function isHostedWorkspaceRuntime() {
     const hasFusionPreview = Boolean(process.env.FUSION_ENVIRONMENT ||
         process.env.FUSION_ENV_ORIGIN ||
         process.env.VITE_FUSION_ENV_ORIGIN);
-    return (/^(1|true)$/i.test(process.env.AGENT_NATIVE_WORKSPACE ?? "") ||
-        /^(1|true)$/i.test(process.env.VITE_AGENT_NATIVE_WORKSPACE ?? "") ||
+    return (isTruthyRuntimeValue(process.env.AGENT_NATIVE_WORKSPACE) ||
+        isTruthyRuntimeValue(process.env.VITE_AGENT_NATIVE_WORKSPACE) ||
+        Boolean(process.env.AGENT_NATIVE_WORKSPACE_APPS_JSON?.trim()) ||
+        Boolean(process.env.VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON?.trim()) ||
         hasFusionPreview);
 }
 function isProductionLikeRuntime() {

package/dist/server/derived-secret.js

@@ -1,8 +1,9 @@
 import crypto from "node:crypto";
+import { getAppConfig } from "../app-config/index.js";
 const DERIVED_SECRET_PREFIX = "agent-native:derived-secret:v1";
 function isWorkspaceRuntime() {
-    return (process.env.AGENT_NATIVE_WORKSPACE === "1" ||
-        process.env.VITE_AGENT_NATIVE_WORKSPACE === "1");
+    const workspace = getAppConfig().workspace;
+    return (workspace.isWorkspace === true || typeof workspace.appsJson === "string");
 }
 export function deriveServerSecret(rootSecret, purpose) {
     return crypto

package/dist/server/onboarding-html.js

@@ -6,6 +6,7 @@
  *
  * After first account exists, this page acts as a normal login page.
  */
+import { getAppConfig } from "../app-config/index.js";
 import { getLocaleInitScript } from "../localization/server.js";
 import { DEFAULT_LOCALE, LOCALE_METADATA, LOCALE_STORAGE_KEY, SUPPORTED_LOCALES, } from "../localization/shared.js";
 import { NATIVE_AUTH_COPY } from "../shared/auth-copy.js";
@@ -42,6 +43,25 @@ function getConnectionLabel() {
         return "Turso";
     return "SQL database";
 }
+function isWorkspaceRuntime() {
+    const workspace = getAppConfig().workspace;
+    return (workspace.isWorkspace === true || typeof workspace.appsJson === "string");
+}
+function workspaceBasePathFromRequest(requestPath) {
+    if (!isWorkspaceRuntime() || !requestPath)
+        return "";
+    const pathname = requestPath.split(/[?#]/, 1)[0] || "/";
+    const firstSegment = pathname.split("/").find(Boolean);
+    if (!firstSegment ||
+        firstSegment === "_agent-native" ||
+        firstSegment === "api" ||
+        firstSegment === "sign-in" ||
+        firstSegment === "login" ||
+        firstSegment === "signup") {
+        return "";
+    }
+    return normalizeAppBasePath(`/${firstSegment}`);
+}
 function withAppBasePath(path) {
     const cleanPath = path.startsWith("/") ? path : `/${path}`;
     const basePath = normalizeAppBasePath(process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH);
@@ -997,7 +1017,9 @@ export function getOnboardingHtml(opts = {}) {
     // for every visitor. A genuinely misconfigured server instead surfaces a
     // clear error at click time via the auth API.
     const renderGoogleButton = showGoogle || googleOnly;
-    const appBasePath = normalizeAppBasePath(process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH);
+    const configuredAppBasePath = normalizeAppBasePath(process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH);
+    const appBasePath = configuredAppBasePath || workspaceBasePathFromRequest(opts.requestPath);
+    const workspaceRuntime = isWorkspaceRuntime();
     const publicOAuthOrigin = getPublicOAuthOrigin();
     const workspaceGatewayReturnOrigin = getWorkspaceGatewayReturnOrigin();
     const googleAuthMode = resolveGoogleAuthMode(opts.googleAuthMode);
@@ -2126,7 +2148,17 @@ ${signupLocalModeNoteHtml}
     if (configured) return configured;
     var marker = '/_agent-native';
     var idx = window.location.pathname.indexOf(marker);
-    return idx > 0 ? window.location.pathname.slice(0, idx) : '';
+    if (idx > 0) return window.location.pathname.slice(0, idx);
+    if (${JSON.stringify(workspaceRuntime)}) {
+      var segments = window.location.pathname.split('/');
+      for (var i = 0; i < segments.length; i++) {
+        var segment = segments[i];
+        if (segment && segment !== '_agent-native' && segment !== 'api' && segment !== 'sign-in' && segment !== 'login' && segment !== 'signup') {
+          return '/' + segment;
+        }
+      }
+    }
+    return '';
   }
     function __anPath(path) {
       return __anBasePath() + path;

package/dist/server/workspace-oauth.js

@@ -1,3 +1,5 @@
+import { getAppConfig } from "../app-config/index.js";
+import { isTruthyRuntimeValue } from "../shared/runtime-config.js";
 /**
  * Whether workspace OAuth callbacks use the root framework relay.
  *
@@ -8,13 +10,16 @@
  * the mounted app that initiated it.
  */
 export function isWorkspaceOAuthCallbackRelayEnabled() {
+    const workspace = getAppConfig().workspace;
     const metaEnv = import.meta.env;
-    return ([
-        process.env.AGENT_NATIVE_WORKSPACE,
-        process.env.VITE_AGENT_NATIVE_WORKSPACE,
-        metaEnv?.AGENT_NATIVE_WORKSPACE,
-        metaEnv?.VITE_AGENT_NATIVE_WORKSPACE,
-    ].some((value) => value === "1" || value === "true") ||
+    return (workspace.isWorkspace === true ||
+        typeof workspace.appsJson === "string" ||
+        [
+            process.env.AGENT_NATIVE_WORKSPACE,
+            process.env.VITE_AGENT_NATIVE_WORKSPACE,
+            metaEnv?.AGENT_NATIVE_WORKSPACE,
+            metaEnv?.VITE_AGENT_NATIVE_WORKSPACE,
+        ].some((value) => isTruthyRuntimeValue(value)) ||
         [
             process.env.AGENT_NATIVE_WORKSPACE_APP_ID,
             process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID,

package/dist/shared/runtime-config.d.ts

@@ -37,6 +37,8 @@ export interface RuntimeConfigReportOptions {
     phase?: RuntimeConfigPhase;
     appName?: string;
 }
+/** Parse the truthy spellings accepted by typed runtime configuration flags. */
+export declare function isTruthyRuntimeValue(value: string | boolean | undefined): boolean;
 export declare function runtimeConfigRequirementsFromSearchParams(searchParams: URLSearchParams): RuntimeConfigRequirements;
 export declare function buildRuntimeConfigPrompt(report: Pick<RuntimeConfigReport, "environment" | "phase" | "issues">, appName?: string): string;
 export declare function getRuntimeConfigReport(env: Record<string, string | undefined>, requirements?: RuntimeConfigRequirements, options?: RuntimeConfigReportOptions): RuntimeConfigReport;