@agent-native/core 0.164.3 → 0.164.11

package/corpus/templates/mail/actions/view-screen.ts

@@ -70,7 +70,7 @@ async function fetchEmailList(
 
       const gmailQuery = buildGmailEmailSearchQuery({ view, q: search });
       const effectiveQuery =
-        view === "all" && !search ? "" : gmailQuery || "in:inbox -in:sent";
+        view === "all" && !search ? "" : gmailQuery || "in:inbox";
       const { messages } = await listGmailMessages(
         effectiveQuery,
         50,

package/corpus/templates/mail/app/components/GoogleConnectBanner.tsx

@@ -76,6 +76,25 @@ const ADD_ACCOUNT_POLL_ABORT_MS = Math.max(
   ADD_ACCOUNT_POLL_INTERVAL_MS * 4,
 );
 
+function newDesktopOAuthVerifier(): string | null {
+  const cryptoApi = globalThis.crypto;
+  const randomUuid = cryptoApi?.randomUUID;
+  if (typeof randomUuid === "function") {
+    return `${randomUuid.call(cryptoApi)}${randomUuid.call(cryptoApi)}`;
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = new Uint8Array(32);
+    cryptoApi.getRandomValues(bytes);
+    let binary = "";
+    for (const byte of bytes) binary += String.fromCharCode(byte);
+    return btoa(binary)
+      .replace(/\+/g, "-")
+      .replace(/\//g, "_")
+      .replace(/=+$/, "");
+  }
+  return null;
+}
+
 interface GoogleConnectBannerProps {
   variant?: "banner" | "hero";
 }
@@ -128,20 +147,81 @@ export function GoogleConnectBanner({
     const flowId =
       crypto.randomUUID?.() ||
       Math.random().toString(36).slice(2) + Date.now().toString(36);
+    const verifier = newDesktopOAuthVerifier();
+    if (!verifier) {
+      setDesktopAuthIssue({
+        code: "desktop_auth_start_failed",
+        message: t("mail.error.failedToConnect"),
+      });
+      return;
+    }
     const origin = window.location.origin;
     const endpoint = addAccount
       ? "/_agent-native/google/add-account/auth-url"
       : "/_agent-native/google/auth-url";
-    const redirectUri = encodeURIComponent(
-      oauthRedirectUri("/_agent-native/google/callback"),
-    );
-    window.open(
-      `${origin}${agentNativePath(endpoint)}?redirect_uri=${redirectUri}&desktop=1&flow_id=${flowId}&redirect=1`,
-      "_blank",
-    );
+    const params = new URLSearchParams({
+      redirect_uri: oauthRedirectUri("/_agent-native/google/callback"),
+      desktop: "1",
+      flow_id: flowId,
+    });
+    const popup = window.open("", "_blank");
+    if (!popup) {
+      setDesktopAuthIssue({
+        code: "popup_blocked",
+        message: t("mail.error.failedToConnect"),
+      });
+      return;
+    }
+    let pollHandle: ReturnType<typeof setInterval> | null = null;
+    const stopPoll = () => {
+      if (!pollHandle) return;
+      clearInterval(pollHandle);
+      if (desktopPollRef.current === pollHandle) {
+        desktopPollRef.current = null;
+      }
+      pollHandle = null;
+    };
+    void fetch(`${origin}${agentNativePath(endpoint)}?${params.toString()}`, {
+      method: "POST",
+      credentials: "include",
+      headers: { "X-Agent-Native-Desktop-Verifier": verifier },
+    })
+      .then(async (response) => {
+        let data: {
+          url?: unknown;
+          message?: unknown;
+          error?: unknown;
+        };
+        try {
+          data = (await response.json()) as typeof data;
+        } catch {
+          throw new Error(t("mail.googleConnect.connectionFailed"));
+        }
+        if (!response.ok || typeof data?.url !== "string") {
+          const message =
+            typeof data.message === "string"
+              ? data.message
+              : typeof data.error === "string"
+                ? data.error
+                : t("mail.googleConnect.connectionFailed");
+          throw new Error(message);
+        }
+        popup.location.href = data.url;
+      })
+      .catch((error) => {
+        stopPoll();
+        popup.close();
+        setDesktopAuthIssue({
+          code: "desktop_auth_start_failed",
+          message:
+            error instanceof Error
+              ? error.message
+              : t("mail.googleConnect.connectionFailed"),
+        });
+      });
     const start = Date.now();
     if (desktopPollRef.current) clearInterval(desktopPollRef.current);
-    desktopPollRef.current = setInterval(async () => {
+    pollHandle = setInterval(async () => {
       if (document.hidden || desktopPollInFlightRef.current) return;
       desktopPollInFlightRef.current = true;
       const controller = new AbortController();
@@ -153,18 +233,21 @@ export function GoogleConnectBanner({
         try {
           const res = await fetch(
             agentNativePath(
-              `/_agent-native/auth/desktop-exchange?flow_id=${flowId}`,
+              `/_agent-native/auth/desktop-exchange?flow_id=${encodeURIComponent(flowId)}`,
             ),
-            { signal: controller.signal },
+            {
+              headers: {
+                "X-Agent-Native-Desktop-Verifier": verifier,
+              },
+              signal: controller.signal,
+            },
           );
           const data = await res.json();
           if (data?.error) {
-            clearInterval(desktopPollRef.current!);
-            desktopPollRef.current = null;
+            stopPoll();
             setDesktopAuthIssue(data);
           } else if (data?.token) {
-            clearInterval(desktopPollRef.current!);
-            desktopPollRef.current = null;
+            stopPoll();
             await fetch(
               agentNativePath(
                 `/_agent-native/auth/session?_session=${data.token}`,
@@ -176,13 +259,11 @@ export function GoogleConnectBanner({
             );
             window.location.reload();
           } else if (Date.now() - start > 120_000) {
-            clearInterval(desktopPollRef.current!);
-            desktopPollRef.current = null;
+            stopPoll();
           }
         } catch {
           if (Date.now() - start > 120_000) {
-            clearInterval(desktopPollRef.current!);
-            desktopPollRef.current = null;
+            stopPoll();
           }
         }
       } finally {
@@ -190,6 +271,7 @@ export function GoogleConnectBanner({
         desktopPollInFlightRef.current = false;
       }
     }, DESKTOP_POLL_INTERVAL_MS);
+    desktopPollRef.current = pollHandle;
   }
 
   const [authError, setAuthError] = useState<string | null>(null);

package/corpus/templates/mail/server/handlers/google-auth.ts

@@ -15,6 +15,9 @@ import {
   oauthCallbackResponse,
   oauthDesktopExchangePage,
   oauthErrorPage,
+  registerDesktopExchange,
+  prepareDesktopOAuthBrowserBinding,
+  matchesDesktopOAuthBrowserBinding,
   safeReturnPath,
   setDesktopExchange,
   setDesktopExchangeError,
@@ -22,6 +25,8 @@ import {
 import { getUserSetting, putUserSetting } from "@agent-native/core/settings";
 import {
   defineEventHandler,
+  getHeader,
+  getMethod,
   getQuery,
   setResponseStatus,
   type H3Event,
@@ -64,17 +69,25 @@ function googleOAuthErrorPayload(
     error?.name === "OAuthAccountOwnedByOtherUserError"
   ) {
     const account = error.accountId || "This Google account";
+    const message = `${account} is connected to another login. Sign out, then sign in with ${account}.`;
     return {
-      message: `${account} is already connected to another login. Sign out, then sign in with the login that originally connected it.`,
+      message,
       code: "account_owner_mismatch",
       accountId: error.accountId,
     };
   }
 
   const msg = error?.message || "Unknown error";
+  const statusCode = Number(error?.statusCode || error?.status || 0);
   const isPermission =
+    error?.oauthErrorCode === "access_denied" ||
+    error?.oauthErrorCode === "forbidden" ||
+    error?.oauthErrorCode === "insufficient_scope" ||
     msg.includes("Insufficient Permission") ||
-    msg.includes("insufficient_scope");
+    msg.includes("insufficient_scope") ||
+    /insufficient authentication scopes/i.test(msg) ||
+    (statusCode === 403 &&
+      /\b(?:scope|permission|forbidden|access denied)\b/i.test(msg));
   return {
     message: isPermission
       ? "This account wasn't granted the required permissions. Make sure you check all the permission boxes on the consent screen. If the app is in testing mode, add this email as a test user in Google Cloud Console."
@@ -99,6 +112,7 @@ function googleOAuthErrorResponse(
 export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
   try {
     const q = getQuery(event);
+    const method = getMethod(event);
     const redirectUri = resolveOAuthRedirectUri(event);
     if (!redirectUri) {
       setResponseStatus(event, 400);
@@ -113,6 +127,34 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
     const desktop =
       isElectron(event) || q.desktop === "1" || q.desktop === "true";
     const flowId = desktop ? (q.flow_id as string) || undefined : undefined;
+    if (method === "POST" && (!desktop || !flowId)) {
+      setResponseStatus(event, 400);
+      return { error: "Invalid desktop exchange challenge." };
+    }
+    let desktopVerifierHash: string | undefined;
+    let desktopBrowserBindingHash: string | undefined;
+    if (flowId) {
+      if (method !== "POST" || q.redirect !== undefined) {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+      const verifier = getHeader(event, "x-agent-native-desktop-verifier");
+      if (!verifier || q.verifier !== undefined) {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+      try {
+        desktopBrowserBindingHash = prepareDesktopOAuthBrowserBinding(event);
+        desktopVerifierHash = await registerDesktopExchange(
+          flowId,
+          verifier,
+          desktopBrowserBindingHash,
+        );
+      } catch {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+    }
     const requestedReturn =
       typeof q.return === "string" ? safeReturnPath(q.return) : "/";
     const returnUrl = requestedReturn !== "/" ? requestedReturn : undefined;
@@ -127,6 +169,8 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
       app: OAUTH_STATE_APP_ID,
       returnUrl,
       flowId,
+      desktopVerifierHash,
+      desktopBrowserBindingHash,
     });
     const url = await getAuthUrl(undefined, redirectUri, state, owner);
     if (q.redirect === "1") {
@@ -159,22 +203,28 @@ export const handleGoogleCallback = defineEventHandler(
       );
       desktop = state.desktop ?? false;
       flowId = state.flowId;
+      if (
+        flowId &&
+        (!state.desktopVerifierHash ||
+          !state.desktopBrowserBindingHash ||
+          !matchesDesktopOAuthBrowserBinding(
+            event,
+            state.desktopBrowserBindingHash,
+          ))
+      ) {
+        throw new Error("Desktop OAuth browser binding is invalid.");
+      }
 
       // Handle Google authorization errors (e.g. user denied access, invalid client)
       const googleError = query.error as string | undefined;
       if (googleError) {
         const errorDesc =
           (query.error_description as string | undefined) || googleError;
-        const isPermission =
-          googleError === "access_denied" ||
-          errorDesc.includes("Insufficient Permission");
-        const userMessage = isPermission
-          ? "Access was denied. Make sure to check all the permission boxes on the consent screen. If the app is in testing mode, add this email as a test user in Google Cloud Console."
-          : `Connection failed: ${errorDesc}`;
-        return googleOAuthErrorResponse(event, new Error(userMessage), {
-          desktop,
-          flowId,
-        });
+        return googleOAuthErrorResponse(
+          event,
+          Object.assign(new Error(errorDesc), { oauthErrorCode: googleError }),
+          { desktop, flowId },
+        );
       }
 
       const code = query.code as string;
@@ -183,7 +233,13 @@ export const handleGoogleCallback = defineEventHandler(
         return { error: "Missing authorization code" };
       }
 
-      const { redirectUri, owner: stateOwner, addAccount, returnUrl } = state;
+      const {
+        redirectUri,
+        owner: stateOwner,
+        addAccount,
+        returnUrl,
+        desktopVerifierHash,
+      } = state;
 
       // 1. Resolve owner (needs session context, before exchangeCode)
       const { owner, hasProductionSession } = await resolveOAuthOwner(
@@ -249,7 +305,15 @@ export const handleGoogleCallback = defineEventHandler(
           });
 
       if (flowId && sessionToken) {
-        setDesktopExchange(flowId, sessionToken, email);
+        if (!desktopVerifierHash) {
+          throw new Error("Missing desktop exchange challenge.");
+        }
+        await setDesktopExchange(
+          flowId,
+          sessionToken,
+          email,
+          desktopVerifierHash,
+        );
       }
 
       // 4. Return platform-appropriate response
@@ -284,6 +348,7 @@ export const getGoogleAddAccountUrl = defineEventHandler(
     }
     try {
       const q = getQuery(event);
+      const method = getMethod(event);
       const redirectUri = resolveOAuthRedirectUri(event);
       if (!redirectUri) {
         setResponseStatus(event, 400);
@@ -295,6 +360,34 @@ export const getGoogleAddAccountUrl = defineEventHandler(
       const desktop =
         isElectron(event) || q.desktop === "1" || q.desktop === "true";
       const flowId = desktop ? (q.flow_id as string) || undefined : undefined;
+      if (method === "POST" && (!desktop || !flowId)) {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+      let desktopVerifierHash: string | undefined;
+      let desktopBrowserBindingHash: string | undefined;
+      if (flowId) {
+        if (method !== "POST" || q.redirect !== undefined) {
+          setResponseStatus(event, 400);
+          return { error: "Invalid desktop exchange challenge." };
+        }
+        const verifier = getHeader(event, "x-agent-native-desktop-verifier");
+        if (!verifier || q.verifier !== undefined) {
+          setResponseStatus(event, 400);
+          return { error: "Invalid desktop exchange challenge." };
+        }
+        try {
+          desktopBrowserBindingHash = prepareDesktopOAuthBrowserBinding(event);
+          desktopVerifierHash = await registerDesktopExchange(
+            flowId,
+            verifier,
+            desktopBrowserBindingHash,
+          );
+        } catch {
+          setResponseStatus(event, 400);
+          return { error: "Invalid desktop exchange challenge." };
+        }
+      }
       const state = encodeOAuthState({
         redirectUri,
         owner: session.email,
@@ -302,6 +395,8 @@ export const getGoogleAddAccountUrl = defineEventHandler(
         addAccount: true,
         app: OAUTH_STATE_APP_ID,
         flowId,
+        desktopVerifierHash,
+        desktopBrowserBindingHash,
       });
       const url = await getAuthUrl(
         undefined,
@@ -333,22 +428,28 @@ export const handleGoogleAddAccountCallback = defineEventHandler(
       );
       desktop = state.desktop ?? false;
       flowId = state.flowId;
+      if (
+        flowId &&
+        (!state.desktopVerifierHash ||
+          !state.desktopBrowserBindingHash ||
+          !matchesDesktopOAuthBrowserBinding(
+            event,
+            state.desktopBrowserBindingHash,
+          ))
+      ) {
+        throw new Error("Desktop OAuth browser binding is invalid.");
+      }
 
       // Handle Google authorization errors (e.g. user denied access, invalid client)
       const googleError = query.error as string | undefined;
       if (googleError) {
         const errorDesc =
           (query.error_description as string | undefined) || googleError;
-        const isPermission =
-          googleError === "access_denied" ||
-          errorDesc.includes("Insufficient Permission");
-        const userMessage = isPermission
-          ? "Access was denied. Make sure to check all the permission boxes on the consent screen. If the app is in testing mode, add this email as a test user in Google Cloud Console."
-          : `Connection failed: ${errorDesc}`;
-        return googleOAuthErrorResponse(event, new Error(userMessage), {
-          desktop,
-          flowId,
-        });
+        return googleOAuthErrorResponse(
+          event,
+          Object.assign(new Error(errorDesc), { oauthErrorCode: googleError }),
+          { desktop, flowId },
+        );
       }
 
       const { redirectUri, owner: stateOwner } = state;

package/corpus/templates/mail/server/lib/gmail-query.ts

@@ -6,8 +6,11 @@ import { isSelfAddressedThread } from "@shared/self-notes.js";
 import type { EmailMessage } from "@shared/types.js";
 
 export const VIEW_QUERIES: Record<string, string> = {
-  inbox: "in:inbox -in:sent",
-  unread: "is:unread in:inbox -in:sent",
+  // Keep sent replies in a matching Gmail thread. The local thread filter
+  // below excludes sent-only threads while preserving received inbox threads
+  // whose latest message was sent by the user.
+  inbox: "in:inbox",
+  unread: "is:unread in:inbox",
   starred: "is:starred",
   sent: "in:sent",
   drafts: "in:drafts",

package/corpus/templates/mail/server/routes/[base]/_agent-native/google/add-account/auth-url.post.ts

@@ -0,0 +1 @@
+export { default } from "../../../../_agent-native/google/add-account/auth-url.post.js";

package/corpus/templates/mail/server/routes/[base]/_agent-native/google/auth-url.post.ts

@@ -0,0 +1 @@
+export { default } from "../../../_agent-native/google/auth-url.post.js";

package/corpus/templates/mail/server/routes/_agent-native/google/add-account/auth-url.post.ts

@@ -0,0 +1 @@
+export { getGoogleAddAccountUrl as default } from "../../../../handlers/google-auth.js";

package/corpus/templates/mail/server/routes/_agent-native/google/auth-url.post.ts

@@ -0,0 +1 @@
+export { getGoogleAuthUrl as default } from "../../../handlers/google-auth.js";

package/corpus/templates/plan/app/pages/PlansPage.tsx

@@ -1,6 +1,5 @@
 import {
   SIDEBAR_STATE_CHANGE_EVENT,
-  BuilderSetupCard,
   sendToAgentChat,
   setAgentChatContextItem,
   useAgentEngineConfigured,
@@ -8466,23 +8465,12 @@ function CreatePlanDialog({
           </DialogDescription>
         </DialogHeader>
         <div className="grid gap-3">
-          {canCreate && agentMissing ? (
-            <BuilderSetupCard
-              fullWidth
-              onConnected={() =>
-                window.dispatchEvent(
-                  new Event("agent-engine:configured-changed"),
-                )
-              }
-            />
-          ) : null}
           <div className="rounded-xl border border-border bg-background p-2 shadow-sm">
             <PromptComposer
               autoFocus
               disabled={composerLocked}
               attachmentsEnabled={false}
               showModelSelector={false}
-              modelStatusChecksEnabled={false}
               placeholder={t("plansPage.create.placeholder")}
               draftScope="plans:create-plan"
               initialText={promptSeed}

package/corpus/templates/plan/changelog/2026-08-19-plan-prompts-now-guide-you-to-connect-ai-before-sending-and-.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-08-19
+---
+
+Plan prompts now guide you to connect AI before sending and offer a clear retry after setup.