@agent-native/core 0.164.4 → 0.164.12

package/corpus/templates/clips/desktop/src/app.tsx

@@ -2062,11 +2062,19 @@ export function App() {
       const controller = new AbortController();
       const abortTimer = setTimeout(() => controller.abort(), POLL_ABORT_MS);
       try {
-        const exchangeParams = new URLSearchParams({ flow_id: flowId });
-        if (verifier) exchangeParams.set("verifier", verifier);
         const xr = await fetch(
-          `${base}/_agent-native/auth/desktop-exchange?${exchangeParams.toString()}`,
-          { credentials: "include", signal: controller.signal },
+          `${base}/_agent-native/auth/desktop-exchange?flow_id=${encodeURIComponent(flowId)}`,
+          {
+            credentials: "include",
+            ...(verifier
+              ? {
+                  headers: {
+                    "X-Agent-Native-Desktop-Verifier": verifier,
+                  },
+                }
+              : {}),
+            signal: controller.signal,
+          },
         );
         if (!xr.ok) {
           if (Date.now() - start > TIMEOUT_MS) {
@@ -2130,25 +2138,79 @@ export function App() {
     void tick();
   }
 
-  // Google and magic-link verification open in the system browser because
-  // the Tauri WebView has its own cookie jar. Both flows return through the
-  // same short-lived server-side exchange.
+  // Google verification stays in the bound Tauri WebView so the callback sees
+  // the same browser-binding cookie. Magic-link verification still completes
+  // in the system browser through its own exchange flow.
   async function signInExternal() {
     if (signInInflightRef.current) return;
     signInInflightRef.current = true;
 
     try {
       setSignInError(null);
-      const flowId =
-        crypto.randomUUID?.() ||
-        Math.random().toString(36).slice(2) + Date.now().toString(36);
+      const flowId = crypto.randomUUID?.() ?? null;
+      const verifier = (() => {
+        const randomUuid = crypto.randomUUID;
+        if (typeof randomUuid === "function") {
+          return `${randomUuid.call(crypto)}${randomUuid.call(crypto)}`;
+        }
+        if (typeof crypto.getRandomValues === "function") {
+          const bytes = new Uint8Array(32);
+          crypto.getRandomValues(bytes);
+          let binary = "";
+          for (const byte of bytes) binary += String.fromCharCode(byte);
+          return btoa(binary)
+            .replace(/\+/g, "-")
+            .replace(/\//g, "_")
+            .replace(/=+$/, "");
+        }
+        return null;
+      })();
+      if (!flowId || !verifier) {
+        // A Math.random flow id is guessable, which lets anyone else claim this
+        // sign-in's exchange slot; fail closed rather than weaken the credential.
+        throw new Error("Secure OAuth flow generation is unavailable.");
+      }
       const base = serverUrl.replace(/\/+$/, "");
 
-      await openExternal(
-        `${base}/_agent-native/google/auth-url?desktop=1&flow_id=${flowId}&redirect=1`,
+      const authParams = new URLSearchParams({
+        desktop: "1",
+        flow_id: flowId,
+        webview: "1",
+      });
+      const authResponse = await fetch(
+        `${base}/_agent-native/google/auth-url?${authParams.toString()}`,
+        {
+          method: "POST",
+          headers: {
+            Accept: "application/json",
+            "X-Agent-Native-Desktop-Verifier": verifier,
+          },
+        },
       );
+      let authPayload: {
+        url?: unknown;
+        error?: unknown;
+        message?: unknown;
+      };
+      try {
+        authPayload = (await authResponse.json()) as typeof authPayload;
+      } catch {
+        throw new Error("Could not start Google sign-in.");
+      }
+      if (!authResponse.ok || typeof authPayload?.url !== "string") {
+        const message =
+          typeof authPayload.message === "string"
+            ? authPayload.message
+            : typeof authPayload.error === "string"
+              ? authPayload.error
+              : "Could not start Google sign-in.";
+        throw new Error(message);
+      }
       setSignInPending("google");
-      startDesktopAuthExchange(flowId, "google");
+      // Stay in this exact WebView: the auth bootstrap set the HttpOnly
+      // browser-binding cookie here, and the callback returns this page with
+      // the staged session cookie after Google completes.
+      window.location.href = authPayload.url;
     } catch (err) {
       console.error("[clips-tray] signInExternal failed:", err);
       signInInflightRef.current = false;
@@ -3912,8 +3974,8 @@ export function App() {
   // (not a separate Tauri window). This avoids Tauri 2's separate-WebKit-
   // data-store-per-WebviewWindow cookie-jar issue — the cookie is set in
   // the same webview that reads it on the next /auth/session poll.
-  // Google and magic-link verification use the system browser, while the
-  // password fallback stays inline in this WebView.
+  // Google verification uses the bound WebView, while magic-link verification
+  // uses the system browser and password stays inline here.
   if (authStatus === "anon") {
     return (
       <div className="app" ref={appRef}>
@@ -4822,7 +4884,7 @@ function SignInForm({
         type="button"
         className="signin-google"
         onClick={onUseBrowser}
-        title="Opens your default browser to complete Google sign-in"
+        title="Returns to Clips to complete Google sign-in"
       >
         <GoogleIcon />
         Sign in with Google

package/corpus/templates/clips/desktop/src-tauri/Cargo.toml

@@ -15,8 +15,9 @@ crate-type = ["lib", "cdylib", "staticlib"]
 
 # Force the dev binary name so macOS shows "Clips" in the Dock / app switcher
 # (macOS derives the display name from the executable filename when the app
-# is unbundled — e.g. during `tauri dev`). Bundled .app builds read the name
-# from `productName` in tauri.conf.json instead.
+# is unbundled — e.g. during `tauri dev`). The Nightly release workflow
+# rewrites this target and tauri.conf.json's mainBinaryName to
+# `Clips-Nightly` before packaging so both lanes can coexist.
 [[bin]]
 name = "Clips"
 path = "src/main.rs"

package/corpus/templates/clips/desktop/src-tauri/tauri.conf.json

@@ -2,6 +2,7 @@
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Clips",
   "version": "0.1.1",
+  "mainBinaryName": "Clips",
   "identifier": "com.clips.tray",
   "build": {
     "beforeDevCommand": "pnpm vite:dev",

package/corpus/templates/clips/server/routes/[base]/_agent-native/google/auth-url.post.ts

@@ -0,0 +1 @@
+export { default } from "../../../_agent-native/google/auth-url.get.js";

package/corpus/templates/clips/server/routes/_agent-native/google/auth-url.get.ts

@@ -4,10 +4,14 @@ import {
   isElectron,
   resolveGoogleSignInCredentials,
   resolveOAuthRedirectUri,
+  registerDesktopExchange,
+  prepareDesktopOAuthBrowserBinding,
   safeReturnPath,
 } from "@agent-native/core/server";
 import {
   defineEventHandler,
+  getHeader,
+  getMethod,
   getQuery,
   setResponseStatus,
   type H3Event,
@@ -54,11 +58,39 @@ export default defineEventHandler(async (event: H3Event) => {
       isElectron(event) || q.desktop === "1" || q.desktop === "true";
     const flowId =
       desktop && typeof q.flow_id === "string" ? q.flow_id : undefined;
+    if (getMethod(event) === "POST" && (!desktop || !flowId)) {
+      setResponseStatus(event, 400);
+      return { error: "Invalid desktop exchange challenge." };
+    }
+    const calendarConnect =
+      q.calendar === "1" || q.calendar === "true" || q.product === "calendar";
+    let desktopVerifierHash: string | undefined;
+    let desktopBrowserBindingHash: string | undefined;
+    if (flowId && !calendarConnect) {
+      if (getMethod(event) !== "POST" || q.redirect !== undefined) {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+      const verifier = getHeader(event, "x-agent-native-desktop-verifier");
+      if (!verifier || q.verifier !== undefined) {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+      try {
+        desktopBrowserBindingHash = prepareDesktopOAuthBrowserBinding(event);
+        desktopVerifierHash = await registerDesktopExchange(
+          flowId,
+          verifier,
+          desktopBrowserBindingHash,
+        );
+      } catch {
+        setResponseStatus(event, 400);
+        return { error: "Invalid desktop exchange challenge." };
+      }
+    }
     const requestedReturn =
       typeof q.return === "string" ? safeReturnPath(q.return) : "/";
     const returnUrl = requestedReturn !== "/" ? requestedReturn : undefined;
-    const calendarConnect =
-      q.calendar === "1" || q.calendar === "true" || q.product === "calendar";
     const credentials = calendarConnect
       ? ((await resolveGoogleOAuthCredentialCandidates())[0] ?? null)
       : resolveGoogleSignInCredentials();
@@ -84,10 +116,16 @@ export default defineEventHandler(async (event: H3Event) => {
       redirectUri,
       owner,
       desktop,
+      desktopWebview: desktop && q.webview === "1" && !calendarConnect,
       addAccount: calendarConnect,
       app: CLIPS_GOOGLE_OAUTH_APP_ID,
-      returnUrl,
+      returnUrl:
+        desktop && q.webview === "1" && !calendarConnect
+          ? "/?desktop_auth=complete"
+          : returnUrl,
       flowId: calendarConnect ? undefined : flowId,
+      desktopVerifierHash,
+      desktopBrowserBindingHash,
     });
 
     const params = new URLSearchParams({

package/corpus/templates/clips/server/routes/_agent-native/google/auth-url.post.ts

@@ -0,0 +1 @@
+export { default } from "./auth-url.get.js";

package/corpus/templates/clips/server/routes/_agent-native/google/callback.get.ts

@@ -6,6 +6,7 @@ import {
   oauthErrorPage,
   resolveGoogleSignInCredentials,
   resolveOAuthOwner,
+  matchesDesktopOAuthBrowserBinding,
   setDesktopExchange,
   type OAuthStatePayload,
 } from "@agent-native/core/server";
@@ -31,6 +32,17 @@ async function handleGoogleSignInCallback(
 ) {
   const desktop = state.desktop;
   const flowId = state.flowId;
+  if (
+    flowId &&
+    (!state.desktopVerifierHash ||
+      !state.desktopBrowserBindingHash ||
+      !matchesDesktopOAuthBrowserBinding(
+        event,
+        state.desktopBrowserBindingHash,
+      ))
+  ) {
+    return oauthErrorPage("Desktop OAuth browser binding is invalid.");
+  }
 
   try {
     const query = getQuery(event);
@@ -107,12 +119,21 @@ async function handleGoogleSignInCallback(
     });
 
     if (flowId && sessionToken) {
-      setDesktopExchange(flowId, sessionToken, email);
+      if (!state.desktopVerifierHash) {
+        throw new Error("Missing desktop exchange challenge.");
+      }
+      await setDesktopExchange(
+        flowId,
+        sessionToken,
+        email,
+        state.desktopVerifierHash,
+      );
     }
 
     return oauthCallbackResponse(event, email, {
       sessionToken,
       desktop,
+      desktopWebview: state.desktopWebview,
       returnUrl: state.returnUrl,
       flowId,
       appName: "Clips",

package/corpus/templates/clips/server/routes/api/clips-updater.json.get.ts

@@ -1,17 +1,23 @@
-import { defineEventHandler, setResponseHeaders } from "h3";
+import { defineEventHandler, getQuery, setResponseHeaders } from "h3";
 
 /**
  * Tauri updater manifest endpoint for the Clips desktop app.
  *
  * The installed app only needs this endpoint to be valid JSON when no signed
- * updater bundle is available. If the `clips-latest` GitHub pointer release
- * exists, we proxy its signed manifest. If it does not, return a deliberately
- * old no-update manifest so the desktop UI stays quiet instead of surfacing a
+ * updater bundle is available. If the channel's GitHub pointer release exists,
+ * we proxy its signed manifest. If it does not, return a deliberately old
+ * no-update manifest so the desktop UI stays quiet instead of surfacing a
  * release-channel setup error to end users.
  */
 
-const GITHUB_MANIFEST_URL =
-  "https://github.com/BuilderIO/agent-native/releases/download/clips-latest/clips-latest.json";
+type ClipsUpdateChannel = "production" | "nightly";
+
+const GITHUB_MANIFEST_URL: Record<ClipsUpdateChannel, string> = {
+  production:
+    "https://github.com/BuilderIO/agent-native/releases/download/clips-latest/clips-latest.json",
+  nightly:
+    "https://github.com/BuilderIO/agent-native/releases/download/clips-nightly-latest/clips-nightly-latest.json",
+};
 const CACHE_TTL_MS = 5 * 60_000;
 
 // Tauri throws a red-banner error if the requesting client's target triple is
@@ -48,8 +54,8 @@ export const INERT_MANIFEST = {
   },
 };
 
-let cache: { data: unknown; ts: number } | null = null;
-let inFlight: Promise<unknown> | null = null;
+const cache = new Map<ClipsUpdateChannel, { data: unknown; ts: number }>();
+const inFlight = new Map<ClipsUpdateChannel, Promise<unknown>>();
 
 function isManifestLike(value: unknown): value is Record<string, unknown> {
   if (!value || typeof value !== "object") return false;
@@ -72,8 +78,10 @@ export function hasAllRequiredPlatforms(value: unknown): boolean {
   return REQUIRED_PLATFORM_KEYS.every((k) => k in platforms);
 }
 
-async function fetchSignedManifest(): Promise<unknown> {
-  const res = await fetch(GITHUB_MANIFEST_URL, {
+async function fetchSignedManifest(
+  channel: ClipsUpdateChannel,
+): Promise<unknown> {
+  const res = await fetch(GITHUB_MANIFEST_URL[channel], {
     headers: {
       accept: "application/json",
       "user-agent": "clips-updater-manifest",
@@ -94,38 +102,49 @@ async function fetchSignedManifest(): Promise<unknown> {
   return json;
 }
 
-async function getManifest(): Promise<unknown> {
+function normalizeChannel(value: unknown): ClipsUpdateChannel {
+  return value === "nightly" ? "nightly" : "production";
+}
+
+async function getManifest(
+  channel: ClipsUpdateChannel = "production",
+): Promise<unknown> {
   const now = Date.now();
-  if (cache && now - cache.ts < CACHE_TTL_MS) return cache.data;
-  if (inFlight) return inFlight;
-  inFlight = (async () => {
+  const cached = cache.get(channel);
+  if (cached && now - cached.ts < CACHE_TTL_MS) return cached.data;
+  const pending = inFlight.get(channel);
+  if (pending) return pending;
+  const request = (async () => {
     try {
-      const data = await fetchSignedManifest();
-      cache = { data, ts: Date.now() };
+      const data = await fetchSignedManifest(channel);
+      cache.set(channel, { data, ts: Date.now() });
       return data;
     } catch {
       // A validation or network failure may serve the last good manifest (or
       // inert fallback), but it must not make that fallback fresh again.
       // Otherwise an incomplete release manifest can indefinitely extend the
       // stale cache window on every failed refresh.
-      return cache?.data ?? INERT_MANIFEST;
+      return cache.get(channel)?.data ?? INERT_MANIFEST;
     } finally {
-      inFlight = null;
+      inFlight.delete(channel);
     }
   })();
-  return inFlight;
+  inFlight.set(channel, request);
+  return request;
 }
 
 export const __clipsUpdaterTest = {
   getManifest,
   reset() {
-    cache = null;
-    inFlight = null;
+    cache.clear();
+    inFlight.clear();
   },
 };
 
 export default defineEventHandler(async (event) => {
-  const manifest = await getManifest();
+  const query = getQuery(event);
+  const channel = normalizeChannel(query.channel);
+  const manifest = await getManifest(channel);
   setResponseHeaders(event, {
     "content-type": "application/json; charset=utf-8",
     "cache-control": "public, max-age=60",

package/corpus/templates/factory/AGENTS.md

@@ -63,7 +63,7 @@ decisions, feedback, agent runs, and provider audit records.
 | `evaluate-triage-item` | Append a decision. |
 | `record-triage-feedback` | Capture human correction for learning. |
 | `approve-factory-item` | Explicitly authorize one bounded run. |
-| `start-builder-for-item` | Govern clear-bug dispatch through Slack or Builder API. |
+| `start-builder-for-item` | Govern clear-bug dispatch through Slack or Builder API, or record a skip reason. |
 | `govern-agent-native-pull-request` | Apply PR evidence and ownership gates. |
 | `list-factory-automations` / `save-factory-automation` / `run-factory-automation` | Inspect or edit org-owned automations. |
 | `list-factory-audit` | Inspect automation runs, evidence, decisions, and provider actions. |
@@ -71,7 +71,8 @@ decisions, feedback, agent runs, and provider audit records.
 | `suggest-factory-rules` | Mine feedback into proposals. |
 | `reconcile-triage-run` | Persist callback/provider reconciliation. |
 | `list-factories` / `get-factory-graph` | Inspect definitions, versions, and metrics. |
-| `save-factory-graph` | Create or version a complete visual graph; never starts provider work. |
+| `save-factory-graph` | Create/version a graph with inspected `expectedGraphVersion`; never starts provider work. |
+| graph history actions | Factory graph version history. |
 | `list-factory-comments` / `add-factory-comment` | Read or attach comments to a canvas, node, or edge. |
 | `provider-api-catalog` / `provider-api-docs` / `provider-api-request` | Use connected provider APIs with shared credentials; never request raw keys. |
 | `list-workspace-apps` / `update-workspace-app-metadata` | Inventory and edit mounted apps. |

package/corpus/templates/factory/actions/get-factory-graph-version.ts

@@ -0,0 +1,69 @@
+import { defineAction } from "@agent-native/core/action";
+import { and, eq } from "drizzle-orm";
+import { z } from "zod";
+
+import { getDb } from "../server/db/index.js";
+import { factoryGraphVersions } from "../server/db/schema.js";
+import {
+  DEFAULT_FACTORY_ID,
+  parseFactoryGraph,
+  readFactoryDefinition,
+} from "../server/factory-graph/store.js";
+import {
+  requireWorkspaceMember,
+  workspaceMemberIdentityFromContext,
+} from "../server/lib/require-workspace-member.js";
+
+export default defineAction({
+  description:
+    "Read one validated Factory visual graph version for history preview. The snapshot is scoped to the active workspace and does not change the current Factory.",
+  schema: z.object({
+    factoryId: z
+      .string()
+      .trim()
+      .min(1)
+      .max(120)
+      .regex(/^[a-z0-9][a-z0-9-]*$/)
+      .default(DEFAULT_FACTORY_ID),
+    versionId: z.string().trim().min(1).max(240),
+  }),
+  http: { method: "GET" },
+  readOnly: true,
+  parallelSafe: true,
+  run: async ({ factoryId, versionId }, context) => {
+    const { orgId } = await requireWorkspaceMember(
+      workspaceMemberIdentityFromContext(context),
+    );
+    const currentDefinition = await readFactoryDefinition(orgId, factoryId);
+    const currentVersion = currentDefinition?.graphVersion ?? null;
+    const row = (
+      await getDb()
+        .select()
+        .from(factoryGraphVersions)
+        .where(
+          and(
+            eq(factoryGraphVersions.id, versionId),
+            eq(factoryGraphVersions.factoryId, factoryId),
+            eq(factoryGraphVersions.orgId, orgId),
+          ),
+        )
+        .limit(1)
+    )[0];
+
+    if (!row) {
+      throw new Error("Factory graph version not found.");
+    }
+
+    return {
+      id: row.id,
+      factoryId: row.factoryId,
+      version: row.version,
+      graph: parseFactoryGraph(row.graphJson),
+      source: row.source,
+      changeSummary: row.changeSummary,
+      createdAt: row.createdAt,
+      createdBy: row.createdBy,
+      isCurrent: currentVersion === row.version,
+    };
+  },
+});

package/corpus/templates/factory/actions/list-factory-automations.ts

@@ -41,6 +41,10 @@ export default defineAction({
           timezone: meta.timezone ?? null,
           condition: meta.condition ?? null,
           createdBy: meta.createdBy ?? null,
+          updatedAt:
+            Number.isFinite(resource.updatedAt) && resource.updatedAt > 0
+              ? new Date(resource.updatedAt).toISOString()
+              : null,
           canUpdate,
           runs: await listAutomationRuns({
             owners: [resource.owner],

package/corpus/templates/factory/actions/list-factory-graph-versions.ts

@@ -0,0 +1,82 @@
+import { defineAction } from "@agent-native/core/action";
+import { and, desc, eq, lt } from "drizzle-orm";
+import { z } from "zod";
+
+import { getDb } from "../server/db/index.js";
+import { factoryGraphVersions } from "../server/db/schema.js";
+import {
+  DEFAULT_FACTORY_ID,
+  readFactoryDefinition,
+} from "../server/factory-graph/store.js";
+import {
+  requireWorkspaceMember,
+  workspaceMemberIdentityFromContext,
+} from "../server/lib/require-workspace-member.js";
+
+export default defineAction({
+  description:
+    "List bounded saved visual graph version metadata for a Factory, newest first. Use get-factory-graph-version to read one validated snapshot for preview or restore.",
+  schema: z.object({
+    factoryId: z
+      .string()
+      .trim()
+      .min(1)
+      .max(120)
+      .regex(/^[a-z0-9][a-z0-9-]*$/)
+      .default(DEFAULT_FACTORY_ID),
+    limit: z.coerce.number().int().min(1).max(50).default(25),
+    beforeVersion: z.coerce.number().int().positive().optional(),
+  }),
+  http: { method: "GET" },
+  readOnly: true,
+  parallelSafe: true,
+  run: async ({ factoryId, limit, beforeVersion }, context) => {
+    const { orgId } = await requireWorkspaceMember(
+      workspaceMemberIdentityFromContext(context),
+    );
+    const currentDefinition = await readFactoryDefinition(orgId, factoryId);
+    const currentVersion = currentDefinition?.graphVersion ?? null;
+    const rows = await getDb()
+      .select({
+        id: factoryGraphVersions.id,
+        factoryId: factoryGraphVersions.factoryId,
+        version: factoryGraphVersions.version,
+        source: factoryGraphVersions.source,
+        changeSummary: factoryGraphVersions.changeSummary,
+        createdAt: factoryGraphVersions.createdAt,
+        createdBy: factoryGraphVersions.createdBy,
+      })
+      .from(factoryGraphVersions)
+      .where(
+        and(
+          eq(factoryGraphVersions.factoryId, factoryId),
+          eq(factoryGraphVersions.orgId, orgId),
+          beforeVersion === undefined
+            ? undefined
+            : lt(factoryGraphVersions.version, beforeVersion),
+        ),
+      )
+      .orderBy(desc(factoryGraphVersions.version))
+      .limit(limit + 1);
+    const page = rows.slice(0, limit);
+    const hasMore = rows.length > limit;
+
+    return {
+      factoryId,
+      currentVersion,
+      hasMore,
+      nextBeforeVersion:
+        hasMore && page.length > 0 ? page[page.length - 1].version : null,
+      versions: page.map((row) => ({
+        id: row.id,
+        factoryId: row.factoryId,
+        version: row.version,
+        source: row.source,
+        changeSummary: row.changeSummary,
+        createdAt: row.createdAt,
+        createdBy: row.createdBy,
+        isCurrent: currentVersion === row.version,
+      })),
+    };
+  },
+});