@agent-native/core 0.164.4 → 0.164.12

package/corpus/templates/calendar/app/hooks/use-google-auth.ts

@@ -45,6 +45,25 @@ const DESKTOP_AUTH_POLL_ABORT_MS = Math.max(
   DESKTOP_AUTH_POLL_INTERVAL_MS * 4,
 );
 
+function newDesktopOAuthVerifier(): string | null {
+  const cryptoApi = globalThis.crypto;
+  const randomUuid = cryptoApi?.randomUUID;
+  if (typeof randomUuid === "function") {
+    return `${randomUuid.call(cryptoApi)}${randomUuid.call(cryptoApi)}`;
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = new Uint8Array(32);
+    cryptoApi.getRandomValues(bytes);
+    let binary = "";
+    for (const byte of bytes) binary += String.fromCharCode(byte);
+    return btoa(binary)
+      .replace(/\+/g, "-")
+      .replace(/\//g, "_")
+      .replace(/=+$/, "");
+  }
+  return null;
+}
+
 function bodyError(
   body: any,
   raw: string | undefined,
@@ -229,6 +248,15 @@ export function useGoogleDesktopAuth(options: DesktopAuthOptions = {}) {
       const flowId =
         globalThis.crypto?.randomUUID?.() ||
         Math.random().toString(36).slice(2) + Date.now().toString(36);
+      const verifier = newDesktopOAuthVerifier();
+      if (!verifier) {
+        setIsPending(false);
+        onError?.({
+          code: "desktop_auth_start_failed",
+          message: "Secure OAuth verifier generation is unavailable.",
+        });
+        return true;
+      }
       const redirectUri = oauthRedirectUri("/_agent-native/google/callback");
       const params = new URLSearchParams({
         redirect_uri: redirectUri,
@@ -285,7 +313,13 @@ export function useGoogleDesktopAuth(options: DesktopAuthOptions = {}) {
             : "/_agent-native/google/auth-url";
           const { url } = await fetchJson<{ url: string }>(
             agentNativePath(`${path}?${params.toString()}`),
-            { credentials: "include" },
+            {
+              method: "POST",
+              credentials: "include",
+              headers: {
+                "X-Agent-Native-Desktop-Verifier": verifier,
+              },
+            },
           );
           openAuthUrl(url);
         } catch (err) {
@@ -305,9 +339,15 @@ export function useGoogleDesktopAuth(options: DesktopAuthOptions = {}) {
           try {
             const exchangeRes = await fetch(
               agentNativePath(
-                `/_agent-native/auth/desktop-exchange?flow_id=${flowId}`,
+                `/_agent-native/auth/desktop-exchange?flow_id=${encodeURIComponent(flowId)}`,
               ),
-              { credentials: "include", signal: controller.signal },
+              {
+                credentials: "include",
+                headers: {
+                  "X-Agent-Native-Desktop-Verifier": verifier,
+                },
+                signal: controller.signal,
+              },
             );
             const exchange = await exchangeRes.json();
             if (exchange?.error) {

package/corpus/templates/calendar/app/i18n-data.ts

@@ -748,8 +748,10 @@ const enUS = {
     customEllipsis: "Custom...",
     customRepeatGoogleCalendar:
       "Custom repeat schedules must be edited in Google Calendar.",
+    customRecurrenceTitle: "Custom recurrence",
     customSchedule: "Custom schedule",
     daily: "Daily",
+    day: "day",
     default: "Default",
     delete: "Delete",
     description: "Description",
@@ -800,6 +802,7 @@ const enUS = {
     location: "Location",
     meet: "Meet",
     monthly: "Monthly",
+    month: "month",
     newEvent: "New Event",
     newEventLower: "New event",
     noGuests: "No guests",
@@ -832,6 +835,13 @@ const enUS = {
     recurringResponseScope: "Recurring response scope",
     repeats: "Repeats",
     repeat: "Repeat",
+    repeatEvery: "Repeat every",
+    repeatOn: "Repeat on",
+    ends: "Ends",
+    never: "Never",
+    on: "On",
+    after: "After",
+    occurrences: "occurrences",
     reviewInvite: "Review Invite",
     responseAwaitingCount: "{{count}} awaiting",
     responseMaybeCount: "{{count}} maybe",
@@ -888,12 +898,14 @@ const enUS = {
     onMonthDay: "on the {{day}}",
     weekdaysShort: "Mon–Fri",
     weekly: "Weekly",
+    week: "week",
     workingFrom: "Working from",
     workingLocation: "Working location",
     workingLocationDesk: "Desk {{desk}}",
     workingLocationFloor: "Floor {{floor}}",
     workingLocationTitle: "Working location: {{location}}",
     yearly: "Yearly",
+    year: "year",
     zoom: "Zoom",
     zoomAdded: "Zoom added",
     zoomAddFailed: "Failed to add Zoom",
@@ -6141,6 +6153,18 @@ const translatedCalendarInlineEditorLabels = {
   "zh-CN": {
     eventForm: {
       addGuest: "添加客人",
+      customRecurrenceTitle: "自定义重复",
+      day: "天",
+      month: "月",
+      repeatEvery: "每隔",
+      repeatOn: "重复于",
+      ends: "结束",
+      never: "从不",
+      on: "于",
+      after: "之后",
+      occurrences: "次",
+      week: "周",
+      year: "年",
       everyTwoWeeks: "每两周",
       repeat: "重复",
       onDate: "于 {{date}}",
@@ -6152,6 +6176,18 @@ const translatedCalendarInlineEditorLabels = {
   "es-ES": {
     eventForm: {
       addGuest: "Añadir invitado",
+      customRecurrenceTitle: "Repetición personalizada",
+      day: "día",
+      month: "mes",
+      repeatEvery: "Repetir cada",
+      repeatOn: "Repetir el",
+      ends: "Termina",
+      never: "Nunca",
+      on: "El",
+      after: "Después de",
+      occurrences: "repeticiones",
+      week: "semana",
+      year: "año",
       everyTwoWeeks: "Cada 2 semanas",
       repeat: "Repetir",
       onDate: "el {{date}}",
@@ -6163,6 +6199,18 @@ const translatedCalendarInlineEditorLabels = {
   "fr-FR": {
     eventForm: {
       addGuest: "Ajouter un invité",
+      customRecurrenceTitle: "Répétition personnalisée",
+      day: "jour",
+      month: "mois",
+      repeatEvery: "Répéter tous les",
+      repeatOn: "Répéter le",
+      ends: "Se termine",
+      never: "Jamais",
+      on: "Le",
+      after: "Après",
+      occurrences: "occurrences",
+      week: "semaine",
+      year: "an",
       everyTwoWeeks: "Toutes les 2 semaines",
       repeat: "Répéter",
       onDate: "le {{date}}",
@@ -6174,6 +6222,18 @@ const translatedCalendarInlineEditorLabels = {
   "de-DE": {
     eventForm: {
       addGuest: "Gast hinzufügen",
+      customRecurrenceTitle: "Benutzerdefinierte Wiederholung",
+      day: "Tag",
+      month: "Monat",
+      repeatEvery: "Wiederholen alle",
+      repeatOn: "Wiederholen am",
+      ends: "Endet",
+      never: "Nie",
+      on: "Am",
+      after: "Nach",
+      occurrences: "Vorkommen",
+      week: "Woche",
+      year: "Jahr",
       everyTwoWeeks: "Alle 2 Wochen",
       repeat: "Wiederholen",
       onDate: "am {{date}}",
@@ -6185,6 +6245,18 @@ const translatedCalendarInlineEditorLabels = {
   "ja-JP": {
     eventForm: {
       addGuest: "ゲストを追加",
+      customRecurrenceTitle: "カスタム繰り返し",
+      day: "日",
+      month: "月",
+      repeatEvery: "繰り返す間隔",
+      repeatOn: "繰り返す曜日",
+      ends: "終了",
+      never: "なし",
+      on: "指定日",
+      after: "次の",
+      occurrences: "回",
+      week: "週",
+      year: "年",
       everyTwoWeeks: "2週間ごと",
       repeat: "繰り返し",
       onDate: "{{date}}",
@@ -6196,6 +6268,18 @@ const translatedCalendarInlineEditorLabels = {
   "ko-KR": {
     eventForm: {
       addGuest: "게스트 추가",
+      customRecurrenceTitle: "맞춤 반복",
+      day: "일",
+      month: "월",
+      repeatEvery: "반복 간격",
+      repeatOn: "반복 요일",
+      ends: "종료",
+      never: "안 함",
+      on: "날짜",
+      after: "후",
+      occurrences: "회",
+      week: "주",
+      year: "년",
       everyTwoWeeks: "2주마다",
       repeat: "반복",
       onDate: "{{date}}",
@@ -6207,6 +6291,18 @@ const translatedCalendarInlineEditorLabels = {
   "pt-BR": {
     eventForm: {
       addGuest: "Adicionar convidado",
+      customRecurrenceTitle: "Repetição personalizada",
+      day: "dia",
+      month: "mês",
+      repeatEvery: "Repetir a cada",
+      repeatOn: "Repetir em",
+      ends: "Termina",
+      never: "Nunca",
+      on: "Em",
+      after: "Após",
+      occurrences: "ocorrências",
+      week: "semana",
+      year: "ano",
       everyTwoWeeks: "A cada 2 semanas",
       repeat: "Repetir",
       onDate: "em {{date}}",
@@ -6218,6 +6314,18 @@ const translatedCalendarInlineEditorLabels = {
   "hi-IN": {
     eventForm: {
       addGuest: "अतिथि जोड़ें",
+      customRecurrenceTitle: "कस्टम दोहराव",
+      day: "दिन",
+      month: "महीना",
+      repeatEvery: "हर",
+      repeatOn: "इन दिनों दोहराएं",
+      ends: "समाप्त",
+      never: "कभी नहीं",
+      on: "इस दिन",
+      after: "के बाद",
+      occurrences: "बार",
+      week: "सप्ताह",
+      year: "वर्ष",
       everyTwoWeeks: "हर 2 सप्ताह",
       repeat: "दोहराएं",
       onDate: "{{date}} को",
@@ -6229,6 +6337,18 @@ const translatedCalendarInlineEditorLabels = {
   "ar-SA": {
     eventForm: {
       addGuest: "إضافة ضيف",
+      customRecurrenceTitle: "تكرار مخصص",
+      day: "يوم",
+      month: "شهر",
+      repeatEvery: "تكرار كل",
+      repeatOn: "تكرار في",
+      ends: "ينتهي",
+      never: "أبدًا",
+      on: "في",
+      after: "بعد",
+      occurrences: "مرات",
+      week: "أسبوع",
+      year: "سنة",
       everyTwoWeeks: "كل أسبوعين",
       repeat: "تكرار",
       onDate: "في {{date}}",

package/corpus/templates/calendar/app/lib/event-form-utils.ts

@@ -12,6 +12,18 @@ export type RecurrencePreset =
   | "yearly"
   | "custom";
 
+export type RecurrenceUnit = "day" | "week" | "month" | "year";
+export type RecurrenceEndMode = "never" | "date" | "count";
+
+export interface CustomRecurrenceDraft {
+  interval: number;
+  unit: RecurrenceUnit;
+  days: string[];
+  endMode: RecurrenceEndMode;
+  endDate: string;
+  count: number;
+}
+
 export interface ReminderDraft {
   id: string;
   method: ReminderMethod;
@@ -387,6 +399,107 @@ export function getRecurrencePreset(recurrence?: string[]): RecurrencePreset {
   return "custom";
 }
 
+function recurrenceFieldValue(rule: string, key: string): string | undefined {
+  return rule.match(new RegExp(`${key}=([^;]+)`, "i"))?.[1];
+}
+
+function recurrenceWeekday(startIso: string, timeZone?: string) {
+  return eventWeekdayCode(startIso, timeZone);
+}
+
+export function createCustomRecurrenceDraft(
+  startIso: string,
+  timeZone?: string,
+): CustomRecurrenceDraft {
+  return {
+    interval: 1,
+    unit: "week",
+    days: [recurrenceWeekday(startIso, timeZone)],
+    endMode: "never",
+    endDate: "",
+    count: 13,
+  };
+}
+
+export function parseCustomRecurrence(
+  recurrence: string[] | undefined,
+  startIso: string,
+  timeZone?: string,
+): CustomRecurrenceDraft {
+  const draft = createCustomRecurrenceDraft(startIso, timeZone);
+  const rule = recurrenceRule(recurrence);
+  if (!rule) return draft;
+
+  const freq = recurrenceFieldValue(rule, "FREQ")?.toLowerCase();
+  const unit: RecurrenceUnit =
+    freq === "daily"
+      ? "day"
+      : freq === "weekly"
+        ? "week"
+        : freq === "monthly"
+          ? "month"
+          : freq === "yearly"
+            ? "year"
+            : draft.unit;
+  const interval = Number.parseInt(
+    recurrenceFieldValue(rule, "INTERVAL") || "1",
+    10,
+  );
+  const count = Number.parseInt(
+    recurrenceFieldValue(rule, "COUNT") || String(draft.count),
+    10,
+  );
+  const until = recurrenceFieldValue(rule, "UNTIL");
+  const byDay = recurrenceFieldValue(rule, "BYDAY")
+    ?.split(",")
+    .map((day) => day.replace(/^[+-]?\d+/, "").toUpperCase())
+    .filter(Boolean);
+
+  return {
+    interval: Number.isFinite(interval) ? Math.max(1, interval) : 1,
+    unit,
+    days: byDay && byDay.length > 0 ? byDay : unit === "week" ? draft.days : [],
+    endMode: until
+      ? "date"
+      : recurrenceFieldValue(rule, "COUNT")
+        ? "count"
+        : "never",
+    endDate:
+      until && /^\d{8}/.test(until)
+        ? `${until.slice(0, 4)}-${until.slice(4, 6)}-${until.slice(6, 8)}`
+        : "",
+    count: Number.isFinite(count) ? Math.max(1, count) : draft.count,
+  };
+}
+
+export function buildCustomRecurrenceRules(
+  draft: CustomRecurrenceDraft,
+): string[] {
+  const interval = Math.max(1, Math.round(draft.interval));
+  const frequency = {
+    day: "DAILY",
+    week: "WEEKLY",
+    month: "MONTHLY",
+    year: "YEARLY",
+  }[draft.unit];
+  const parts = [
+    `FREQ=${frequency}`,
+    ...(interval > 1 ? [`INTERVAL=${interval}`] : []),
+  ];
+  if (draft.unit === "week" && draft.days.length > 0) {
+    parts.push(`BYDAY=${draft.days.join(",")}`);
+  }
+  if (draft.unit === "month" && draft.days.length > 0) {
+    parts.push(`BYDAY=${draft.days.join(",")}`);
+  }
+  if (draft.endMode === "date" && /^\d{4}-\d{2}-\d{2}$/.test(draft.endDate)) {
+    parts.push(`UNTIL=${draft.endDate.replace(/-/g, "")}T235959Z`);
+  } else if (draft.endMode === "count") {
+    parts.push(`COUNT=${Math.max(1, Math.round(draft.count))}`);
+  }
+  return [`RRULE:${parts.join(";")}`];
+}
+
 export function buildRecurrenceRules(
   preset: RecurrencePreset,
   startIso: string,

package/corpus/templates/calendar/changelog/2026-08-18-the-agent-can-now-remove-many-meetings-at-once-such-as-every.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-08-18
+---
+
+The agent can now remove many meetings at once, such as every Saturday and Sunday meeting in a range, instead of failing partway through

package/corpus/templates/calendar/server/handlers/google-auth.ts

@@ -16,6 +16,9 @@ import {
   oauthCallbackResponse,
   oauthDesktopExchangePage,
   oauthErrorPage,
+  registerDesktopExchange,
+  prepareDesktopOAuthBrowserBinding,
+  matchesDesktopOAuthBrowserBinding,
   setDesktopExchange,
   setDesktopExchangeError,
   safeReturnPath,
@@ -23,6 +26,8 @@ import {
 } from "@agent-native/core/server";
 import {
   defineEventHandler,
+  getHeader,
+  getMethod,
   getQuery,
   setResponseStatus,
   type H3Event,
@@ -55,6 +60,8 @@ type CalendarOAuthStateOptions = {
   app?: string;
   returnUrl?: string;
   flowId?: string;
+  desktopVerifierHash?: string;
+  desktopBrowserBindingHash?: string;
 };
 
 function encodeCalendarOAuthState(options: CalendarOAuthStateOptions): string {
@@ -226,6 +233,7 @@ function missingCredentialsResponse(
 export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
   try {
     const q = getQuery(event);
+    const method = getMethod(event);
     const redirectUri = resolveOAuthRedirectUri(event);
     if (!redirectUri) {
       setResponseStatus(event, 400);
@@ -241,6 +249,10 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
       isElectron(event) || q.desktop === "1" || q.desktop === "true";
     const mobile = q.mobile === "1" || q.mobile === "true";
     const flowId = desktop ? (q.flow_id as string) || undefined : undefined;
+    if (method === "POST" && (!desktop || !flowId)) {
+      setResponseStatus(event, 400);
+      return { error: "Invalid desktop exchange challenge." };
+    }
     const calendarConnect = isCalendarConnectRequest(q, owner);
     const credentials = calendarConnect
       ? await resolveCalendarOAuthCredentials(event)
@@ -264,6 +276,31 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
       };
     }
 
+    let desktopVerifierHash: string | undefined;
+    let desktopBrowserBindingHash: string | undefined;
+    if (flowId) {
+      if (method !== "POST" || q.redirect !== undefined) {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+      const verifier = getHeader(event, "x-agent-native-desktop-verifier");
+      if (!verifier || q.verifier !== undefined) {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+      try {
+        desktopBrowserBindingHash = prepareDesktopOAuthBrowserBinding(event);
+        desktopVerifierHash = await registerDesktopExchange(
+          flowId,
+          verifier,
+          desktopBrowserBindingHash,
+        );
+      } catch {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+    }
+
     const requestedReturn =
       typeof q.return === "string" ? safeReturnPath(q.return) : "/";
     const returnUrl = requestedReturn !== "/" ? requestedReturn : undefined;
@@ -279,6 +316,8 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
       app: OAUTH_STATE_APP_ID,
       returnUrl,
       flowId,
+      desktopVerifierHash,
+      desktopBrowserBindingHash,
     });
 
     const url = calendarConnect
@@ -316,6 +355,17 @@ export const handleGoogleCallback = defineEventHandler(
       desktop = state.desktop ?? false;
       mobile = state.mobile ?? false;
       flowId = state.flowId;
+      if (
+        flowId &&
+        (!state.desktopVerifierHash ||
+          !state.desktopBrowserBindingHash ||
+          !matchesDesktopOAuthBrowserBinding(
+            event,
+            state.desktopBrowserBindingHash,
+          ))
+      ) {
+        throw new Error("Desktop OAuth browser binding is invalid.");
+      }
 
       const googleError = query.error as string | undefined;
       if (googleError) {
@@ -366,7 +416,15 @@ export const handleGoogleCallback = defineEventHandler(
         );
 
         if (flowId && sessionToken) {
-          setDesktopExchange(flowId, sessionToken, identity.email);
+          if (!state.desktopVerifierHash) {
+            throw new Error("Missing desktop exchange challenge.");
+          }
+          await setDesktopExchange(
+            flowId,
+            sessionToken,
+            identity.email,
+            state.desktopVerifierHash,
+          );
         }
 
         return oauthCallbackResponse(event, identity.email, {
@@ -410,7 +468,15 @@ export const handleGoogleCallback = defineEventHandler(
         : { sessionToken: undefined };
 
       if (flowId && sessionToken) {
-        setDesktopExchange(flowId, sessionToken, sessionOwner);
+        if (!state.desktopVerifierHash) {
+          throw new Error("Missing desktop exchange challenge.");
+        }
+        await setDesktopExchange(
+          flowId,
+          sessionToken,
+          sessionOwner,
+          state.desktopVerifierHash,
+        );
       }
 
       // 4. Return platform-appropriate response
@@ -436,10 +502,15 @@ export const getGoogleAddAccountUrl = defineEventHandler(
       return { error: "Must be logged in to add an account" };
     }
     const q = getQuery(event);
+    const method = getMethod(event);
     const desktop =
       isElectron(event) || q.desktop === "1" || q.desktop === "true";
     const mobile = q.mobile === "1" || q.mobile === "true";
     const flowId = desktop ? (q.flow_id as string) || undefined : undefined;
+    if (method === "POST" && (!desktop || !flowId)) {
+      setResponseStatus(event, 400);
+      return { error: "Invalid desktop exchange challenge." };
+    }
     if (!(await resolveCalendarOAuthCredentials(event))) {
       return missingCredentialsResponse(
         event,
@@ -456,6 +527,30 @@ export const getGoogleAddAccountUrl = defineEventHandler(
           message: "redirect_uri must stay on this app's _agent-native routes.",
         };
       }
+      let desktopVerifierHash: string | undefined;
+      let desktopBrowserBindingHash: string | undefined;
+      if (flowId) {
+        if (method !== "POST" || q.redirect !== undefined) {
+          setResponseStatus(event, 400);
+          return { error: "Invalid desktop exchange challenge." };
+        }
+        const verifier = getHeader(event, "x-agent-native-desktop-verifier");
+        if (!verifier || q.verifier !== undefined) {
+          setResponseStatus(event, 400);
+          return { error: "Invalid desktop exchange challenge." };
+        }
+        try {
+          desktopBrowserBindingHash = prepareDesktopOAuthBrowserBinding(event);
+          desktopVerifierHash = await registerDesktopExchange(
+            flowId,
+            verifier,
+            desktopBrowserBindingHash,
+          );
+        } catch {
+          setResponseStatus(event, 400);
+          return { error: "Invalid desktop exchange challenge." };
+        }
+      }
       const state = encodeCalendarOAuthState({
         redirectUri,
         owner: session.email,
@@ -465,6 +560,8 @@ export const getGoogleAddAccountUrl = defineEventHandler(
         addAccount: true,
         app: OAUTH_STATE_APP_ID,
         flowId,
+        desktopVerifierHash,
+        desktopBrowserBindingHash,
       });
       const url = await getAuthUrl(
         undefined,
@@ -499,6 +596,17 @@ export const handleGoogleAddAccountCallback = defineEventHandler(
       desktop = state.desktop ?? false;
       mobile = state.mobile ?? false;
       flowId = state.flowId;
+      if (
+        flowId &&
+        (!state.desktopVerifierHash ||
+          !state.desktopBrowserBindingHash ||
+          !matchesDesktopOAuthBrowserBinding(
+            event,
+            state.desktopBrowserBindingHash,
+          ))
+      ) {
+        throw new Error("Desktop OAuth browser binding is invalid.");
+      }
 
       const googleError = query.error as string | undefined;
       if (googleError) {
@@ -547,7 +655,15 @@ export const handleGoogleAddAccountCallback = defineEventHandler(
           : { sessionToken: undefined };
 
       if (flowId && sessionToken) {
-        setDesktopExchange(flowId, sessionToken, ownerEmail);
+        if (!state.desktopVerifierHash) {
+          throw new Error("Missing desktop exchange challenge.");
+        }
+        await setDesktopExchange(
+          flowId,
+          sessionToken,
+          ownerEmail,
+          state.desktopVerifierHash,
+        );
       }
 
       return oauthCallbackResponse(event, addedEmail, {