@agent-native/core 0.164.12 → 0.164.15

package/dist/client/org/OrgSwitcher.js

@@ -7,6 +7,7 @@ import { setBrowserDemoModeEnabled } from "../../demo/browser-state.js";
 import { shouldOfferWorkspace } from "../../org/workspace-url.js";
 import { agentNativePath } from "../api-path.js";
 import { useT } from "../i18n.js";
+import { buildSignInReturnHref } from "../require-session.js";
 import { useDemoModeStatus } from "../use-demo-mode-status.js";
 import { notifySessionInvalidated, useSession } from "../use-session.js";
 import { useOrg, useSwitchOrg, useCreateOrg, useInviteMember, useAcceptInvitation, useJoinByDomain, } from "./hooks.js";
@@ -142,16 +143,19 @@ export function OrgSwitcher({ className, hideWhenSingle, reserveSpace, compact,
             return;
         setSigningOut(true);
         try {
-            await fetch(agentNativePath("/_agent-native/auth/logout"), {
+            const response = await fetch(agentNativePath("/_agent-native/auth/logout"), {
                 method: "POST",
                 credentials: "include",
             });
+            if (!response.ok) {
+                console.warn("Logout request returned an error before sign-in", response.status);
+            }
         }
-        catch {
-            /* fall through to reload — server may already have cleared the cookie */
+        catch (error) {
+            console.warn("Unable to complete logout request before sign-in", error);
         }
         notifySessionInvalidated();
-        window.location.reload();
+        window.location.replace(buildSignInReturnHref());
     };
     if (!org) {
         return reserveSpace && isLoading ? (_jsx(OrgSwitcherLoadingPlaceholder, { className: className })) : null;

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/mcp-client/config.d.ts

@@ -60,12 +60,23 @@ export interface McpConfig {
     /** Where the config was loaded from (workspace root path, app path, or "env") */
     source?: string;
 }
+export interface DesktopChildComputerMcpServer {
+    id: string;
+    config: McpHttpServerConfig;
+}
 /**
  * Load MCP configuration.
  *
  * @param startDir - Directory to start the upward search from (defaults to cwd)
  */
 export declare function loadMcpConfig(startDir?: string): McpConfig | null;
+/**
+ * The desktop process supplies this configuration only to a child it spawned
+ * for a specific Agent run. Raw MCP config cannot opt into this trust path:
+ * the explicit child gate, loopback URL, and strong per-run bearer are all
+ * required. Existing user servers always win on key collisions.
+ */
+export declare function resolveDesktopChildComputerMcpServer(existingServers: Record<string, McpServerConfig>, environment?: NodeJS.ProcessEnv): DesktopChildComputerMcpServer | null;
 /**
  * Auto-detect the claude-in-chrome MCP server if it's installed but no
  * config file exists. Gated by `AGENT_NATIVE_DISABLE_MCP_AUTODETECT`.

package/dist/mcp-client/config.js

@@ -96,39 +96,46 @@ export function loadMcpConfig(startDir) {
  * the explicit child gate, loopback URL, and strong per-run bearer are all
  * required. Existing user servers always win on key collisions.
  */
-function mergeDesktopChildComputerConfig(base) {
-    if (process.env.AGENT_NATIVE_DESKTOP_CHILD !== "1")
-        return base;
-    const url = process.env.AGENT_NATIVE_DESKTOP_COMPUTER_MCP_URL?.trim();
-    const token = process.env.AGENT_NATIVE_DESKTOP_COMPUTER_MCP_TOKEN?.trim();
+export function resolveDesktopChildComputerMcpServer(existingServers, environment = process.env) {
+    if (environment.AGENT_NATIVE_DESKTOP_CHILD !== "1")
+        return null;
+    const url = environment.AGENT_NATIVE_DESKTOP_COMPUTER_MCP_URL?.trim();
+    const token = environment.AGENT_NATIVE_DESKTOP_COMPUTER_MCP_TOKEN?.trim();
     if (!url || !token || !/^[A-Za-z0-9_-]{32,}$/.test(token))
-        return base;
-    try {
-        const parsed = new URL(url);
-        if (parsed.protocol !== "http:" ||
-            parsed.hostname !== "127.0.0.1" ||
-            parsed.pathname !== "/mcp" ||
-            parsed.username ||
-            parsed.password) {
-            return base;
-        }
-    }
-    catch {
-        return base;
+        return null;
+    if (!URL.canParse(url))
+        return null;
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" ||
+        parsed.hostname !== "127.0.0.1" ||
+        parsed.pathname !== "/mcp" ||
+        parsed.username ||
+        parsed.password) {
+        return null;
     }
-    const servers = { ...(base?.servers ?? {}) };
     let serverId = DESKTOP_COMPUTER_SERVER_ID;
-    for (let suffix = 2; servers[serverId]; suffix += 1) {
+    for (let suffix = 2; existingServers[serverId]; suffix += 1) {
         serverId = `${DESKTOP_COMPUTER_SERVER_ID}-${suffix}`;
     }
-    servers[serverId] = {
-        type: "http",
-        url,
-        headers: { Authorization: `Bearer ${token}` },
-        description: "Authenticated computer control for this Agent Native desktop task",
+    return {
+        id: serverId,
+        config: {
+            type: "http",
+            url,
+            headers: { Authorization: `Bearer ${token}` },
+            description: "Authenticated computer control for this Agent Native desktop task",
+        },
     };
+}
+function mergeDesktopChildComputerConfig(base) {
+    const desktopServer = resolveDesktopChildComputerMcpServer(base?.servers ?? {});
+    if (!desktopServer)
+        return base;
     return {
-        servers,
+        servers: {
+            ...(base?.servers ?? {}),
+            [desktopServer.id]: desktopServer.config,
+        },
         source: base?.source ? `${base.source}+desktop-child` : "desktop-child",
     };
 }

package/dist/resources/handlers.d.ts

@@ -51,8 +51,8 @@ export declare function handleDeleteResource(event: any): Promise<{
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -73,10 +73,10 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
+    error?: undefined;
     url: string;
     provider: string;
     storageSetupRequired?: undefined;
-    error?: undefined;
 } | {
     error: string;
     storageSetupRequired: boolean;

package/dist/server/auth.js

@@ -405,6 +405,8 @@ export function isLoopbackRequest(event) {
 async function readDesktopSsoSafely(event) {
     if (process.env.NODE_ENV === "production")
         return null;
+    if (getAppConfig().auth.disableDesktopSsoFallbackInDevelopment)
+        return null;
     if (!isElectronRequest(event))
         return null;
     if (!isLoopbackRequest(event))
@@ -1242,7 +1244,7 @@ export function prepareDesktopOAuthBrowserBinding(event) {
     if (!binding || !/^[A-Za-z0-9_-]{43}$/.test(binding)) {
         binding = crypto.randomBytes(32).toString("base64url");
         setCookie(event, DESKTOP_OAUTH_BROWSER_BINDING_COOKIE, binding, {
-            ...crossSiteCookieAttrs(event),
+            ...desktopOAuthBrowserBindingCookieAttrs(event),
             httpOnly: true,
             path: "/",
             maxAge: Math.floor(DESKTOP_EXCHANGE_TTL_MS / 1_000),
@@ -2810,6 +2812,18 @@ function crossSiteCookieAttrs(event) {
         ? { sameSite: "none", secure: true, partitioned: true }
         : { sameSite: "lax", secure: false };
 }
+/**
+ * The binding cookie is set before navigating to Google and read after the
+ * provider redirects back. A partitioned cookie uses the top-level site from
+ * the bootstrap request, so it is unavailable when the callback starts from
+ * Google's top-level site. Keep this host-scoped cookie unpartitioned while
+ * retaining the cross-site and transport protections required by the flow.
+ */
+function desktopOAuthBrowserBindingCookieAttrs(event) {
+    return isHttpsRequest(event)
+        ? { sameSite: "none", secure: true }
+        : { sameSite: "lax", secure: false };
+}
 function setFirstRunOnboardingCookie(event) {
     setCookie(event, FIRST_RUN_ONBOARDING_COOKIE, "1", {
         ...crossSiteCookieAttrs(event),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.164.12",
+  "version": "0.164.15",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {