@agent-native/core 0.164.3 → 0.164.11

package/dist/provider-api/custom-registry.js

@@ -42,7 +42,7 @@ const CREATE_SQL = `CREATE TABLE IF NOT EXISTS custom_api_providers (
   PRIMARY KEY (scope, scope_id, id)
 )`;
 let _initPromise;
-async function ensureTable() {
+export async function ensureTable() {
     if (!_initPromise) {
         _initPromise = (async () => {
             const client = getDbExec();

package/dist/provider-api/quota-governor.d.ts

@@ -50,3 +50,4 @@ export declare function createProviderRequestDedupeKey(input: {
 }): string | undefined;
 export declare function executeWithProviderQuota<T>(options: ExecuteWithProviderQuotaOptions<T>): Promise<T>;
 export declare function resetProviderQuotaStateForTests(): void;
+export declare function ensureCooldownTable(): Promise<void>;

package/dist/provider-api/quota-governor.js

@@ -244,7 +244,7 @@ function persistenceTemporarilyUnavailable() {
     return Boolean(state.persistenceUnavailableUntil &&
         state.persistenceUnavailableUntil > Date.now());
 }
-async function ensureCooldownTable() {
+export async function ensureCooldownTable() {
     if (!shouldPersistCooldowns())
         return;
     if (persistenceTemporarilyUnavailable())

package/dist/provider-api/staged-datasets-store.d.ts

@@ -14,6 +14,7 @@
  */
 export declare const MAX_ROWS_PER_APP = 200000;
 export declare const MAX_BYTES_PER_APP: number;
+export declare function ensureTables(): Promise<void>;
 export interface StagedDatasetMeta {
     id: string;
     appId: string;

package/dist/provider-api/staged-datasets-store.js

@@ -23,7 +23,7 @@ export const MAX_BYTES_PER_APP = 50 * 1024 * 1024; // 50 MB
 // Table initialisation
 // ---------------------------------------------------------------------------
 let _initPromise;
-async function ensureTables() {
+export async function ensureTables() {
     if (!_initPromise) {
         _initPromise = (async () => {
             const db = getDbExec();

package/dist/resources/handlers.d.ts

@@ -48,11 +48,11 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -73,10 +73,10 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
-    error?: undefined;
     url: string;
     provider: string;
     storageSetupRequired?: undefined;
+    error?: undefined;
 } | {
     error: string;
     storageSetupRequired: boolean;

package/dist/resources/store.d.ts

@@ -94,6 +94,7 @@ export interface EffectiveResourceContext {
 export declare const LOCAL_WORKSPACE_RESOURCE_METADATA_SOURCE = "local-workspace-resource";
 export declare function canWriteLocalWorkspaceResourcePath(resourcePath: string): Promise<boolean>;
 export { isLocalWorkspaceResourceId };
+export declare function ensureTable(): Promise<void>;
 /**
  * Seed personal AGENTS.md and LEARNINGS.md for a user if they don't exist.
  * Called when listing resources or from the agent chat plugin.

package/dist/resources/store.js

@@ -601,7 +601,7 @@ function scheduleExpiredAgentScratchCleanup(client) {
         console.warn("[resources] expired agent-scratch cleanup failed; will retry on a later read:", err?.message ?? err);
     });
 }
-async function ensureTable() {
+export async function ensureTable() {
     if (!_initPromise) {
         _initPromise = _doEnsureTable().catch((err) => {
             // Don't cache the rejection — let the next caller retry a fresh init.

package/dist/scripts/dev/index.js

@@ -6,6 +6,7 @@
  * registered in production.
  */
 import { createCodingToolRegistry } from "../../coding-tools/index.js";
+import { getRequestRunContext } from "../../server/request-context.js";
 import { normalizeDatabaseToolsMode, } from "../db/tool-mode.js";
 import { dbExecToolParameters } from "../db/tool-schemas.js";
 import { tool as listFilesTool, run as listFilesRun } from "./list-files.js";
@@ -67,6 +68,19 @@ function blockedDatabaseActionFromBash(command, databaseToolsMode) {
     }
     return null;
 }
+function unauthorizedActionFromBash(command, allowedActionNames) {
+    if (!allowedActionNames)
+        return null;
+    const allowed = new Set(allowedActionNames);
+    const actionCommands = command.matchAll(/\b(?:pnpm|npm|yarn|bun)(?:\s+\S+){0,4}\s+action\s+([a-z][a-z0-9-]*)\b/g);
+    for (const match of actionCommands) {
+        const actionName = match[1];
+        if (actionName && !allowed.has(actionName)) {
+            return `Error: action "${actionName}" is not available in this request's action surface.`;
+        }
+    }
+    return null;
+}
 /**
  * Creates the dev-mode script registry with shared bash/read/edit/write
  * coding tools and database tools. Call this and merge with your app's registry
@@ -200,7 +214,7 @@ export async function createDevScriptRegistry(options = {}) {
     const codingEntries = createCodingToolRegistry({
         cwd: process.cwd(),
         bashThrowsOnNonZero: true,
-        beforeBash: ({ command }) => blockedDatabaseActionFromBash(command, databaseToolsMode),
+        beforeBash: ({ command }) => unauthorizedActionFromBash(command, getRequestRunContext()?.allowedActionNames) ?? blockedDatabaseActionFromBash(command, databaseToolsMode),
     });
     const legacyEntries = options.legacyAliases
         ? {

package/dist/search/index.js

@@ -48,6 +48,9 @@ export function assertPgVectorAvailable(postgres = isPostgres()) {
     if (!postgres)
         throw new Error(PGVECTOR_REQUIRED_MESSAGE);
 }
+// guard:allow-unreleased-schema - the table name is derived at call time from
+// the search namespace and embedding dimensions (`${namespace}_vectors${suffix}`),
+// so the set of tables is not known at release time and cannot be pre-created.
 export async function ensurePgVectorIndex(db, dimensions, options) {
     const resolved = pgVectorOptions(options);
     const names = searchNamespaceIdentifiers(resolved.namespace, dimensions);

package/dist/secrets/storage.d.ts

@@ -12,6 +12,7 @@
  * Secret values are NEVER logged and NEVER returned from any route handler.
  */
 import type { SecretScope } from "./register.js";
+export declare function ensureTable(): Promise<void>;
 /**
  * Return the last 4 characters of a secret, with any leading characters
  * masked. Used to show a preview without leaking the value.

package/dist/secrets/storage.js

@@ -21,7 +21,7 @@ import { APP_SECRETS_CREATE_SQL } from "./schema.js";
 // Table bootstrap
 // ---------------------------------------------------------------------------
 let _initPromise;
-async function ensureTable() {
+export async function ensureTable() {
     if (!_initPromise) {
         _initPromise = (async () => {
             const client = getDbExec();

package/dist/server/agent-chat/action-filters-a2a.d.ts

@@ -1,4 +1,4 @@
-import { type A2AArtifactResponseOptions, type A2AToolResultSummary } from "../../a2a/artifact-response.js";
+import { type A2AArtifactResponseOptions, type A2APersistedMutationReceipt, type A2AToolResultSummary } from "../../a2a/artifact-response.js";
 import type { AgentSkill } from "../../a2a/types.js";
 import type { EngineTool } from "../../agent/engine/types.js";
 import { type ActionEntry, type AgentLoopOutcome } from "../../agent/production-agent.js";
@@ -74,6 +74,7 @@ export declare function assembleA2AFinalResponse(events: readonly AgentChatEvent
 }): {
     responseText: string;
     finalText: string;
+    mutationReceipts: A2APersistedMutationReceipt[];
 };
 type A2AAgentLoopRunner = typeof runAgentLoopDirectWithSoftTimeout;
 /**

package/dist/server/agent-chat/action-filters-a2a.js

@@ -1,5 +1,5 @@
 import { getHeader } from "h3";
-import { appendA2AArtifactLinks, } from "../../a2a/artifact-response.js";
+import { appendA2AArtifactLinks, extractA2APersistedMutationReceipts, } from "../../a2a/artifact-response.js";
 import { collectFinalResponseTextFromAgentEvents } from "../../a2a/response-text.js";
 import { resolveMainChatMaxOutputTokens } from "../../agent/engine/output-tokens.js";
 import { filterInitialEngineTools, resolveAgentRequestReasoningEffort, } from "../../agent/production-agent.js";
@@ -200,7 +200,15 @@ export function assembleA2AFinalResponse(events, toolResults, options = {}) {
         baseUrl: options.baseUrl ?? resolveArtifactBaseUrl(options.event),
         includeReferencedArtifacts: true,
         includePersistedArtifactMarker: true,
+        persistedArtifactSecret: options.persistedArtifactSecret,
+        delegatedTaskId: options.delegatedTaskId,
     });
+    const mutationReceipts = extractA2APersistedMutationReceipts([...toolResults], options.persistedArtifactSecret
+        ? {
+            persistedArtifactSecrets: [options.persistedArtifactSecret],
+            expectedDelegatedTaskId: options.delegatedTaskId,
+        }
+        : {});
     if (terminalError) {
         const partialResult = finalText.trim()
             ? `\n\nPartial verified results before the failure:\n${finalText.trim()}`
@@ -210,7 +218,7 @@ export function assembleA2AFinalResponse(events, toolResults, options = {}) {
     if (!finalText.trim()) {
         throw new Error("Agent completed without a response or verified artifact.\ncode: empty_agent_response");
     }
-    return { responseText, finalText };
+    return { responseText, finalText, mutationReceipts };
 }
 function terminalErrorFromOutcome(outcome) {
     if (outcome.state === "completed")

package/dist/server/agent-chat-plugin.js

@@ -199,17 +199,19 @@ export function createSerializedA2ATaskStatusWriter(taskId, writeStatus = update
 const A2A_ACTIVITY_CHECKPOINT_MIN_INTERVAL_MS = 2_000;
 export async function resolveA2ARecoverableArtifactSecret(orgId = getRequestOrgId()) {
     const globalSecret = process.env.A2A_SECRET?.trim();
-    if (globalSecret)
-        return globalSecret;
-    if (!orgId)
-        return undefined;
-    try {
-        const { getOrgA2ASecret } = await import("../org/context.js");
-        return (await getOrgA2ASecret(orgId))?.trim() || undefined;
-    }
-    catch {
-        return undefined;
+    if (orgId) {
+        try {
+            const { getOrgA2ASecret } = await import("../org/context.js");
+            const orgSecret = (await getOrgA2ASecret(orgId))?.trim();
+            if (orgSecret)
+                return orgSecret;
+            // coercion-ok: undefined is the fail-closed result when organization secret lookup throws
+        }
+        catch {
+            return undefined;
+        }
     }
+    return globalSecret || undefined;
 }
 export function buildLeanRunPolicyPrompt(codeEditingSurfaceRestriction, prodCodeExecPromptNote) {
     return codeEditingSurfaceRestriction + prodCodeExecPromptNote;
@@ -1619,6 +1621,7 @@ export function createAgentChatPlugin(options) {
                                         baseUrl: artifactBaseUrl,
                                         includePersistedArtifactMarker: true,
                                         persistedArtifactSecret: recoverableArtifactSecret,
+                                        delegatedTaskId: context.taskId,
                                     })
                                     : null;
                                 if (recoverableArtifactText &&
@@ -1723,7 +1726,12 @@ export function createAgentChatPlugin(options) {
                         };
                         return;
                     }
-                    const { responseText, finalText } = assembleA2AFinalResponse(a2aEvents, a2aToolResults, { event: context.event, outcome: a2aOutcome });
+                    const { responseText, finalText, mutationReceipts } = assembleA2AFinalResponse(a2aEvents, a2aToolResults, {
+                        event: context.event,
+                        outcome: a2aOutcome,
+                        persistedArtifactSecret: recoverableArtifactSecret,
+                        delegatedTaskId: context.taskId,
+                    });
                     console.log(`[A2A] Loop complete. Text: ${responseText.slice(0, 100)}...`);
                     // Yield the final accumulated text
                     yield {
@@ -1734,6 +1742,18 @@ export function createAgentChatPlugin(options) {
                                 type: "text",
                                 text: finalText,
                             },
+                            ...(mutationReceipts.length > 0
+                                ? [
+                                    {
+                                        type: "data",
+                                        data: {
+                                            kind: "agent-native/mutation-receipts",
+                                            version: 1,
+                                            receipts: mutationReceipts,
+                                        },
+                                    },
+                                ]
+                                : []),
                         ],
                     };
                 },
@@ -1791,9 +1811,7 @@ export function createAgentChatPlugin(options) {
             // `nativeActionsInDev` or `leanPrompt`), the dev prompt's "invoke
             // template actions via bash" guidance is wrong — use the prod prompt
             // + tool-format action list instead, same as production.
-            const devNative = options?.nativeActionsInDev === true ||
-                leanPrompt ||
-                Boolean(options?.resolveActionSurface);
+            const devNative = options?.nativeActionsInDev === true || leanPrompt;
             // Keep legacy names for the composition below
             const basePrompt = prodPrompt;
             const getFrameworkPromptActions = () => Object.fromEntries(Object.entries(prodActions).filter(([name]) => !templateScripts[name] && !mcpActionEntries[name]));
@@ -2000,8 +2018,10 @@ export function createAgentChatPlugin(options) {
                                 delegation: { protocol: "mcp" },
                             },
                         });
+                        const persistedArtifactSecret = await resolveA2ARecoverableArtifactSecret();
                         return assembleA2AFinalResponse(mcpEvents, mcpToolResults, {
                             outcome: mcpOutcome,
+                            persistedArtifactSecret,
                         }).finalText;
                     },
                 });
@@ -2933,11 +2953,44 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 // template's actions as native tools instead of routing through bash.
                 // Templates with structured-arg actions (objects/arrays) need this to
                 // avoid round-tripping JSON through the CLI parser.
+                // Request-scoped dev actions are present for authorization and the
+                // `pnpm action` prompt, but remain CLI-only instead of becoming native
+                // tools. The resolver therefore sees the same action names that the
+                // dev prompt can teach without changing the shell-backed dev surface.
+                const requestScopedDevActions = options?.resolveActionSurface
+                    ? Object.fromEntries(Object.entries({ ...discoveredActions, ...templateScripts }).map(([name, entry]) => [name, { ...entry, agentTool: false }]))
+                    : {};
+                // Keep the local coding registry in every dev handler variant. Native
+                // action mode changes how app actions are called; it must not remove
+                // bash/read/edit/write from Electron's local chat surface.
+                const devScriptRegistry = await createDevScriptRegistry({
+                    databaseTools: databaseToolsMode,
+                });
+                const localDevActionNames = new Set(Object.keys(devScriptRegistry));
+                const resolveDevActionSurface = options?.resolveActionSurface
+                    ? async (details) => {
+                        const appActionNames = details.availableActionNames.filter((name) => !localDevActionNames.has(name));
+                        const surface = await options.resolveActionSurface({
+                            ...details,
+                            availableActionNames: appActionNames,
+                        });
+                        const localActionNames = details.availableActionNames.filter((name) => localDevActionNames.has(name));
+                        return {
+                            allowedActionNames: [
+                                ...new Set([
+                                    ...surface.allowedActionNames,
+                                    ...localActionNames,
+                                ]),
+                            ],
+                        };
+                    }
+                    : undefined;
                 const devActions = attachToolSearch(leanPrompt
-                    ? leanActions
+                    ? { ...devScriptRegistry, ...leanActions }
                     : devNative
-                        ? prodActions
+                        ? { ...devScriptRegistry, ...prodActions }
                         : {
+                            ...requestScopedDevActions,
                             ...resourceScripts,
                             ...docsScripts,
                             ...(lazyContext ? frameworkContextTool : {}),
@@ -2959,9 +3012,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             ...coreAttachmentTools,
                             ...browserTools,
                             ...mcpActionEntries,
-                            ...(await createDevScriptRegistry({
-                                databaseTools: databaseToolsMode,
-                            })),
+                            ...devScriptRegistry,
                             // Full-database admin tools (NODE_ENV=development gate — see
                             // dbAdminScripts; also in prodActions so App mode has them too).
                             ...dbAdminScripts,
@@ -3051,7 +3102,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         }
                         return options?.prepareRequest?.(details);
                     },
-                    resolveActionSurface: options?.resolveActionSurface,
+                    resolveActionSurface: resolveDevActionSurface,
                     skipFilesContext,
                     initialToolNames: effectiveInitialToolNames,
                     ...(options?.toolLimits ? { toolLimits: options.toolLimits } : {}),

package/dist/server/agent-teams-run-queue.d.ts

@@ -51,6 +51,7 @@ export interface AgentTeamRunQueueRow {
     createdAt: number;
     updatedAt: number;
 }
+export declare function ensureTable(): Promise<void>;
 declare function getAffectedRowCount(result: unknown): number;
 export interface EnqueueAgentTeamRunInput {
     taskId: string;

package/dist/server/agent-teams-run-queue.js

@@ -37,7 +37,7 @@ export const RUN_DISPATCH_STUCK_AFTER_MS = 15_000;
  * retried (side-effectful work may already have happened). Mirrors A2A. */
 export const RUN_PROCESSING_STUCK_AFTER_MS = 5 * 60 * 1000;
 let _initPromise;
-async function ensureTable() {
+export async function ensureTable() {
     if (!_initPromise) {
         _initPromise = (async () => {
             const client = getDbExec();

package/dist/server/auth-marketing.js

@@ -203,7 +203,9 @@ function slugFromHost(value) {
     if (!host)
         return undefined;
     if (host.endsWith(".agent-native.com")) {
-        return normalizeSlug(host.slice(0, -".agent-native.com".length));
+        const hostSlug = host.slice(0, -".agent-native.com".length);
+        return (normalizeSlug(hostSlug) ??
+            normalizeSlug(hostSlug.replace(/^beta[.-]/, "")));
     }
     return undefined;
 }

package/dist/server/auth.d.ts

@@ -211,6 +211,7 @@ export declare function isLoopbackAddress(ip: string | undefined): boolean;
  */
 export declare function isLoopbackRequest(event: H3Event): boolean;
 export declare function isExpectedAuthFailure(error: unknown): boolean;
+export declare function ensureSessionTable(): Promise<void>;
 /**
  * Create a new session in the legacy sessions table.
  * Used by google-oauth.ts for mobile deep linking.
@@ -244,7 +245,23 @@ export interface DesktopExchangeErrorPayload {
     existingOwner?: string;
     attemptedOwner?: string;
 }
-export declare function setDesktopExchange(flowId: string, token: string, email: string): void;
+export declare const DESKTOP_OAUTH_BROWSER_BINDING_COOKIE = "an_desktop_oauth_binding";
+/**
+ * Create or reuse the browser-local binding for a desktop Google OAuth flow.
+ * The raw value stays in an HttpOnly cookie; only its hash travels in signed
+ * OAuth state and the exchange challenge. This prevents a caller from
+ * initiating a flow and handing its authorization URL to another browser.
+ */
+export declare function prepareDesktopOAuthBrowserBinding(event: H3Event): string;
+/** Verify that a desktop OAuth callback is returning to its initiating browser. */
+export declare function matchesDesktopOAuthBrowserBinding(event: H3Event, expectedHash: string): boolean;
+export declare function setDesktopExchange(flowId: string, token: string, email: string, verifierHash: string): Promise<void>;
+/**
+ * Register the client-held verifier for a desktop OAuth flow before Google
+ * sees the request. Only the verifier hash is persisted; the initiating
+ * browser keeps the raw verifier and presents it when polling the exchange.
+ */
+export declare function registerDesktopExchange(flowId: string, verifier: string, browserBindingHash?: string): Promise<string>;
 export declare function setDesktopExchangeError(flowId: string, error: DesktopExchangeErrorPayload): void;
 /**
  * Run the auth guard on an event. Returns a Response/object to block the