@agent-native/core 0.168.3 → 0.168.4

package/dist/client/AssistantChat.d.ts

@@ -345,6 +345,8 @@ export interface AssistantChatProps {
     composerDisabledPlaceholder?: string;
     /** When true, skip the restore skeleton (used for freshly created threads with no messages) */
     isNewThread?: boolean;
+    /** Replace an active tab when its saved thread no longer exists. */
+    onThreadRestoreNotFound?: () => void;
     /** Defer restore until the owning thread list has reconciled the active id. */
     isThreadStateLoading?: boolean;
     /** Called when a slash command (e.g. /clear, /help) is executed */

package/dist/client/AssistantChat.js

@@ -1387,7 +1387,7 @@ function approvalResolutionIdentity(approvalKey, toolCallId,
 askId) {
     return `${toolCallId ?? ""}\u0000${approvalKey}\u0000${askId ?? ""}`;
 }
-const AssistantChatInner = forwardRef(function AssistantChatInner({ emptyStateText, suggestions, dynamicSuggestions, threadFooterSlot, emptyStateAddon, showHeader = true, onSwitchToCli, className, apiUrl, tabId, browserTabId, threadId, contextScope, isolateHistoryByScope = false, contextNamespace, isActiveComposer = true, onMessageCountChange, onSaveThread, onGenerateTitle, composerSlot, onComposerTextChange, composerAreaClassName, composerPlaceholder, missingApiKeySetupLayout = "default", composerLayoutVariant = "default", centerComposerWhenEmpty = false, emptyStateDisplay = "default", composerToolbarSlot, composerExtraActionButton, showModelSelector = true, composerDisabled = false, composerDisabledPlaceholder, isNewThread, isThreadStateLoading, onSlashCommand, execMode, onExecModeChange, approvalActions, planModeDisabled, planModeDisabledReason, selectedModel, defaultModel, selectedEngine, selectedEffort, availableModels, modelListLoading, onModelChange, onEffortChange, availableAgents, selectedAgent, hostedHarness, onAgentChange, imageModelMenu, onForkChat, onConnectProvider, onConnectLocalRuntime, plusMenuMode = "full", providerStatusChecksEnabled = true, loadHistoryRepository, historyReloadKey, externalStreaming = false, agentChatSurface = "app", desktopIdentityUnauthenticated = false, desktopIdentityAuthenticated = false, suppressInlineOpenApp = false, }, ref) {
+const AssistantChatInner = forwardRef(function AssistantChatInner({ emptyStateText, suggestions, dynamicSuggestions, threadFooterSlot, emptyStateAddon, showHeader = true, onSwitchToCli, className, apiUrl, tabId, browserTabId, threadId, contextScope, isolateHistoryByScope = false, contextNamespace, isActiveComposer = true, onMessageCountChange, onSaveThread, onGenerateTitle, composerSlot, onComposerTextChange, composerAreaClassName, composerPlaceholder, missingApiKeySetupLayout = "default", composerLayoutVariant = "default", centerComposerWhenEmpty = false, emptyStateDisplay = "default", composerToolbarSlot, composerExtraActionButton, showModelSelector = true, composerDisabled = false, composerDisabledPlaceholder, isNewThread, isThreadStateLoading, onSlashCommand, execMode, onExecModeChange, approvalActions, planModeDisabled, planModeDisabledReason, selectedModel, defaultModel, selectedEngine, selectedEffort, availableModels, modelListLoading, onModelChange, onEffortChange, availableAgents, selectedAgent, hostedHarness, onAgentChange, imageModelMenu, onForkChat, onConnectProvider, onConnectLocalRuntime, plusMenuMode = "full", providerStatusChecksEnabled = true, loadHistoryRepository, historyReloadKey, externalStreaming = false, agentChatSurface = "app", desktopIdentityUnauthenticated = false, desktopIdentityAuthenticated = false, onThreadRestoreNotFound, suppressInlineOpenApp = false, }, ref) {
     const t = useT();
     const thread = useThread();
     const threadRuntime = useThreadRuntime();
@@ -1856,6 +1856,9 @@ const AssistantChatInner = forwardRef(function AssistantChatInner({ emptyStateTe
         setIsRestoring(true);
         setRestoreAttempt((attempt) => attempt + 1);
     }, [isNewThread, threadId]);
+    const missingThreadNotifiedRef = useRef(null);
+    const desktopIdentityAuthenticatedRef = useRef(desktopIdentityAuthenticated);
+    const desktopIdentityRestoreRetryPendingRef = useRef(false);
     // The desktop identity gate and chat restore run in sibling surfaces. If the
     // gate wins the race after a masked 404 has already rendered, clear the
     // transient not-found card and leave the user at a fresh composer.
@@ -1864,7 +1867,6 @@ const AssistantChatInner = forwardRef(function AssistantChatInner({ emptyStateTe
             return;
         setThreadRestoreError((current) => current === "not-found" ? null : current);
     }, [desktopIdentityUnauthenticated]);
-    const desktopIdentityAuthenticatedRef = useRef(desktopIdentityAuthenticated);
     useEffect(() => {
         const becameAuthenticated = desktopIdentityAuthenticated && !desktopIdentityAuthenticatedRef.current;
         desktopIdentityAuthenticatedRef.current = desktopIdentityAuthenticated;
@@ -1877,6 +1879,7 @@ const AssistantChatInner = forwardRef(function AssistantChatInner({ emptyStateTe
         // A saved-thread request can race the identity handoff and be masked as a
         // 404/401/403. Retry once the host confirms the authenticated session so
         // the thread is restored without requiring a remount or manual retry.
+        desktopIdentityRestoreRetryPendingRef.current = true;
         retryThreadRestore();
     }, [
         agentChatSurface,
@@ -1885,6 +1888,30 @@ const AssistantChatInner = forwardRef(function AssistantChatInner({ emptyStateTe
         retryThreadRestore,
         threadId,
     ]);
+    useEffect(() => {
+        if (threadRestoreError !== "not-found") {
+            desktopIdentityRestoreRetryPendingRef.current = false;
+            return;
+        }
+        if (!threadId ||
+            !onThreadRestoreNotFound ||
+            missingThreadNotifiedRef.current === threadId ||
+            (agentChatSurface === "desktop" &&
+                (!desktopIdentityAuthenticated ||
+                    desktopIdentityUnauthenticated ||
+                    desktopIdentityRestoreRetryPendingRef.current))) {
+            return;
+        }
+        missingThreadNotifiedRef.current = threadId;
+        onThreadRestoreNotFound();
+    }, [
+        agentChatSurface,
+        desktopIdentityAuthenticated,
+        desktopIdentityUnauthenticated,
+        onThreadRestoreNotFound,
+        threadId,
+        threadRestoreError,
+    ]);
     const onSaveThreadRef = useRef(onSaveThread);
     onSaveThreadRef.current = onSaveThread;
     const onGenerateTitleRef = useRef(onGenerateTitle);

package/dist/client/MultiTabAssistantChat.js

@@ -1970,7 +1970,11 @@ export function MultiTabAssistantChat({ showTabBar = true, renderHeader, renderO
                                         else {
                                             chatRefs.current.delete(tabId);
                                         }
-                                    }, threadId: tabId, tabId: tabId, browserTabId: browserTabId, contextScope: scope, contextNamespace: contextNamespace, isolateHistoryByScope: isolateHistoryByScope, isActiveComposer: tabId === activeThreadId, apiUrl: apiUrl, isNewThread: newThreadIds.current.has(tabId) || isNewThread(tabId), isThreadStateLoading: isLoading, onMessageCountChange: (count) => setMessageCounts((prev) => prev[tabId] === count
+                                    }, threadId: tabId, tabId: tabId, browserTabId: browserTabId, contextScope: scope, contextNamespace: contextNamespace, isolateHistoryByScope: isolateHistoryByScope, isActiveComposer: tabId === activeThreadId, apiUrl: apiUrl, isNewThread: newThreadIds.current.has(tabId) || isNewThread(tabId), onThreadRestoreNotFound: tabId === activeThreadId &&
+                                        (props.agentChatSurface !== "desktop" ||
+                                            props.desktopIdentityAuthenticated === true)
+                                        ? clearActiveTab
+                                        : undefined, isThreadStateLoading: isLoading, onMessageCountChange: (count) => setMessageCounts((prev) => prev[tabId] === count
                                         ? prev
                                         : { ...prev, [tabId]: count }), onSaveThread: handleSaveThread, onGenerateTitle: handleGenerateTitle, onSlashCommand: handleSlashCommand, selectedModel: modelSelection?.model, selectedEngine: modelSelection?.engine, selectedEffort: modelSelection?.effort ?? DEFAULT_REASONING_EFFORT, composerSlot: props.composerSlot, defaultModel: defaultModel, availableModels: availableModels, modelListLoading: modelListLoading, onModelChange: handleModelChange, onEffortChange: handleEffortChange, onForkChat: () => handleForkChat(tabId), 
                                     // Sub-agent tabs are read-only: sending a new message from the

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/notifications/routes.d.ts

@@ -11,14 +11,14 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
+    error?: undefined;
     count: number;
     updated?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated: number;
-    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -26,8 +26,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,9 +59,9 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,7 +75,6 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    message?: undefined;
     deleted?: undefined;
     found?: undefined;
     id?: undefined;
@@ -92,8 +91,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     provider?: undefined;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     deleted?: undefined;
     id?: undefined;
     providers?: undefined;
@@ -102,8 +101,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     deleted?: undefined;
     providers?: undefined;
     count?: undefined;
@@ -112,8 +111,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     id: string;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     found?: undefined;
     providers?: undefined;
     count?: undefined;
@@ -122,6 +121,7 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     id: string;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
     deleted?: undefined;
     found?: undefined;

package/dist/provider-api/actions/provider-api.d.ts

@@ -330,39 +330,39 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
     } | {
         id?: undefined;
-        count?: undefined;
         deleted?: undefined;
         message?: undefined;
         providers?: undefined;
+        count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
         label?: undefined;
     } | {
-        count?: undefined;
         deleted?: undefined;
         message?: undefined;
         providers?: undefined;
+        count?: undefined;
         provider?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
     } | {
-        count?: undefined;
         found?: undefined;
         message?: undefined;
         providers?: undefined;
+        count?: undefined;
         provider?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
     } | {
-        count?: undefined;
         deleted?: undefined;
         found?: undefined;
         providers?: undefined;
+        count?: undefined;
         provider?: undefined;
         registered: boolean;
         id: string;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/auth.js

@@ -2277,8 +2277,14 @@ function createAuthGuardFn(app) {
         // health exposes only aggregate readiness and a trivial `SELECT 1`.
         // Without this bypass the gate below 401s anonymous /_agent-native/*
         // requests before either probe can run.
-        if (p === "/_agent-native/ping" || p === "/_agent-native/health")
+        if (p === "/_agent-native/ping" ||
+            p === "/_agent-native/health" ||
+            // The credential self-check is read by an unauthenticated monitor. Without
+            // this the gate 401s it, the monitor reads a non-JSON body as "route not
+            // deployed", and the check silently never runs.
+            p === "/_agent-native/health/google") {
             return;
+        }
         if (getMethod(event) === "GET" && p.startsWith("/_agent-native/avatar/")) {
             return;
         }

package/dist/server/better-auth-instance.js

@@ -31,7 +31,7 @@ import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
 import { renderMagicLinkEmail, renderResetPasswordEmail, renderVerifySignupEmail, } from "./email-templates.js";
 import { getEmailReadiness, sendEmail } from "./email.js";
-import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
+import { recordActiveGoogleSignInCredentials, resolveGoogleSignInCredentials, } from "./google-oauth-credentials.js";
 import { readMagicLinkSignupAttribution } from "./magic-link-attribution.js";
 import { getRequestContext, hasContinuationLocalRequestContext, } from "./request-context.js";
 export { getAuthLoginMode, resolveAuthLoginMode, resolveAuthLoginModeFromReadiness, } from "./auth-login-mode.js";
@@ -865,14 +865,28 @@ async function createBetterAuthInstance(config) {
         ...config?.socialProviders,
     };
     const extraScopes = config?.googleScopes ?? [];
+    const configuredGoogleProvider = typeof config?.socialProviders?.google === "function"
+        ? await config.socialProviders.google()
+        : config?.socialProviders?.google;
+    const configuredGoogleCredentials = configuredGoogleProvider &&
+        typeof configuredGoogleProvider.clientId === "string" &&
+        typeof configuredGoogleProvider.clientSecret === "string"
+        ? {
+            clientId: configuredGoogleProvider.clientId,
+            clientSecret: configuredGoogleProvider.clientSecret,
+        }
+        : null;
     const googleCredentials = extraScopes.length > 0
         ? process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET
             ? {
                 clientId: process.env.GOOGLE_CLIENT_ID,
                 clientSecret: process.env.GOOGLE_CLIENT_SECRET,
             }
-            : null
-        : resolveGoogleSignInCredentials();
+            : configuredGoogleCredentials
+        : (resolveGoogleSignInCredentials() ?? configuredGoogleCredentials);
+    // Publish the pair actually wired to the provider so the credential
+    // self-check probes what the callback uses, not what it would prefer.
+    recordActiveGoogleSignInCredentials(googleCredentials);
     if (googleCredentials) {
         // When the template requests broader scopes (Gmail, Calendar, etc.)
         // ask for them on the primary sign-in flow so a separate "Connect
@@ -884,6 +898,7 @@ async function createBetterAuthInstance(config) {
         const baseScopes = ["openid", "email", "profile"];
         const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));
         socialProviders.google = {
+            ...(configuredGoogleProvider ?? {}),
             clientId: googleCredentials.clientId,
             clientSecret: googleCredentials.clientSecret,
             ...(extraScopes.length > 0

package/dist/server/core-routes-plugin.js

@@ -53,6 +53,7 @@ import { createEmbedStartRouteHandler } from "./embed-route.js";
 import { shouldReportError } from "./error-noise-filter.js";
 import { FRAMEWORK_AUTH_EARLY_PATHS, getH3App, awaitBootstrap, markDefaultPluginProvided, markFrameworkRoutesReadyBeforeBootstrap, trackPluginInit, } from "./framework-request-handler.js";
 import { createGatewayAccessCheckHandler } from "./gateway-access-check.js";
+import { checkGoogleSignInCredential } from "./google-credential-check.js";
 import { getAppBasePath, getOrigin } from "./google-oauth.js";
 import { createGoogleRealtimeSessionHandler } from "./google-realtime-session.js";
 import { readBody, DEFAULT_UPLOAD_MAX_FILE_BYTES, isAllowedUploadMimeType, } from "./h3-helpers.js";
@@ -1002,6 +1003,17 @@ export function createCoreRoutesPlugin(options = {}) {
                 }));
             }
             if (!options.disableHealth) {
+                // Registered before `/health` because h3 matches by prefix, and the
+                // health handler would otherwise swallow this path.
+                getH3App(nitroApp).use(`${P}/health/google`, defineEventHandler(async (event) => {
+                    setResponseHeader(event, "cache-control", "no-store");
+                    const result = await checkGoogleSignInCredential();
+                    // `invalid` is the fleet-wide outage shape: the deploy is up and
+                    // healthy while nobody can sign in. Page on it.
+                    if (result.status === "invalid")
+                        setResponseStatus(event, 503);
+                    return result;
+                }));
                 getH3App(nitroApp).use(`${P}/health`, defineEventHandler(async (event) => {
                     setResponseHeader(event, "cache-control", "no-store");
                     const schema = event.url?.searchParams.get("schema") === "1" ||

package/dist/server/google-credential-check.d.ts

@@ -0,0 +1,38 @@
+export type GoogleCredentialStatus = 
+/** Google accepted the client id and secret. */
+"valid"
+/** Google rejected the client id or secret — sign-in is broken. */
+ | "invalid"
+/** No sign-in credentials are configured on this deploy. */
+ | "unconfigured"
+/** Google could not be reached, or answered something unrecognised. */
+ | "unknown";
+export interface GoogleCredentialCheck {
+    status: GoogleCredentialStatus;
+    clientId: string | null;
+    /** Both credential pairs are set to different Google clients. */
+    mismatchedPairs: boolean;
+    /**
+     * Where the probed pair came from. `active` is the pair Better Auth wired to
+     * the provider; `preferred` means auth had not initialised yet and this fell
+     * back to the preferred pair, which a scoped template may not use.
+     */
+    credentialSource: "active" | "preferred";
+    /** Google's `error` field, or the transport failure, when there was one. */
+    reason: string | null;
+    checkedAt: number;
+}
+/** Test seam: drop the memoised result. */
+export declare function resetGoogleCredentialCheckCache(): void;
+/**
+ * Ask Google whether this deploy's sign-in credentials still authenticate.
+ *
+ * The app's own callback collapses every Google failure into one error page,
+ * so a wrong secret is invisible from outside. This is the signal a monitor
+ * can read: it needs no browser, no consent grant, and no access to the secret
+ * beyond the process that already holds it.
+ */
+export declare function checkGoogleSignInCredential(options?: {
+    ttlMs?: number;
+    now?: () => number;
+}): Promise<GoogleCredentialCheck>;

package/dist/server/google-credential-check.js

@@ -0,0 +1,115 @@
+import { describeGoogleSignInCredentialPairs, getActiveGoogleSignInCredentials, resolveGoogleSignInCredentials, } from "./google-oauth-credentials.js";
+const GOOGLE_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
+/**
+ * Google authenticates the client before it looks at the code, so a
+ * deliberately invalid code separates the two failures: `invalid_client` means
+ * the secret is wrong, `invalid_grant` means the secret authenticated and only
+ * the code was rejected. The redirect_uri is never reached and is a constant.
+ */
+const PROBE_CODE = "agent-native-credential-probe";
+const PROBE_REDIRECT_URI = "https://example.com/agent-native-credential-probe";
+const DEFAULT_TTL_MS = 5 * 60 * 1000;
+const REQUEST_TIMEOUT_MS = 10_000;
+let cached = null;
+/** Test seam: drop the memoised result. */
+export function resetGoogleCredentialCheckCache() {
+    cached = null;
+}
+async function probeGoogle(clientId, clientSecret) {
+    let response;
+    try {
+        response = await fetch(GOOGLE_TOKEN_ENDPOINT, {
+            method: "POST",
+            headers: { "content-type": "application/x-www-form-urlencoded" },
+            body: new URLSearchParams({
+                grant_type: "authorization_code",
+                code: PROBE_CODE,
+                client_id: clientId,
+                client_secret: clientSecret,
+                redirect_uri: PROBE_REDIRECT_URI,
+            }),
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        // Unreachable is not the same as wrong. Reporting "valid" here would
+        // recreate the exact blind spot this check exists to remove.
+        return {
+            status: "unknown",
+            reason: error instanceof Error ? error.message : "fetch failed",
+        };
+    }
+    let error = null;
+    try {
+        const body = (await response.json());
+        if (typeof body?.error === "string")
+            error = body.error;
+    }
+    catch {
+        error = null;
+    }
+    if (error === "invalid_grant")
+        return { status: "valid", reason: error };
+    if (error === "invalid_client")
+        return { status: "invalid", reason: error };
+    if (response.ok) {
+        // A probe code must never mint a token. Something is not the API we think.
+        return { status: "unknown", reason: "unexpected token grant" };
+    }
+    return { status: "unknown", reason: error ?? `http ${response.status}` };
+}
+/**
+ * Ask Google whether this deploy's sign-in credentials still authenticate.
+ *
+ * The app's own callback collapses every Google failure into one error page,
+ * so a wrong secret is invisible from outside. This is the signal a monitor
+ * can read: it needs no browser, no consent grant, and no access to the secret
+ * beyond the process that already holds it.
+ */
+export async function checkGoogleSignInCredential(options) {
+    const now = options?.now ?? Date.now;
+    const ttlMs = options?.ttlMs ?? DEFAULT_TTL_MS;
+    const at = now();
+    // Prefer what Better Auth actually wired up. A template requesting broader
+    // scopes runs on GOOGLE_CLIENT_*, so re-deriving the preferred pair here
+    // would test a credential the callback never touches.
+    const active = getActiveGoogleSignInCredentials();
+    if (cached &&
+        cached.expiresAt > at &&
+        cached.activeCredentialsVersion === active.version) {
+        return cached.value;
+    }
+    const pairs = describeGoogleSignInCredentialPairs();
+    const credentials = active.recorded
+        ? active.credentials
+        : resolveGoogleSignInCredentials();
+    const credentialSource = active.recorded
+        ? "active"
+        : "preferred";
+    const value = credentials
+        ? {
+            ...(await probeGoogle(credentials.clientId, credentials.clientSecret)),
+            clientId: credentials.clientId,
+            mismatchedPairs: pairs.mismatched,
+            credentialSource,
+            checkedAt: at,
+        }
+        : {
+            status: "unconfigured",
+            clientId: null,
+            mismatchedPairs: pairs.mismatched,
+            credentialSource,
+            reason: null,
+            checkedAt: at,
+        };
+    // Only memoise answers Google actually gave. Caching a transport failure for
+    // five minutes would hide a recovery for five minutes.
+    if (value.status !== "unknown") {
+        cached = {
+            value,
+            expiresAt: at + ttlMs,
+            activeCredentialsVersion: active.version,
+        };
+    }
+    return value;
+}

package/dist/server/google-oauth-credentials.d.ts

@@ -44,6 +44,34 @@ export declare function resolveGoogleProviderCredentialCandidatesWithReader(opti
  */
 export declare function resolveGoogleSignInCredentials(): GoogleOAuthCredentials | null;
 export declare function hasGoogleSignInCredentials(): boolean;
+/**
+ * Record the pair Better Auth actually handed to the Google provider.
+ *
+ * The effective pair is not always the preferred one: a template asking for
+ * broader scopes is wired to GOOGLE_CLIENT_ID/SECRET instead. Anything testing
+ * "the credential the callback will use" must read this rather than
+ * re-deriving it, or it will verify a pair nothing reads and report healthy.
+ */
+export declare function recordActiveGoogleSignInCredentials(credentials: GoogleOAuthCredentials | null): void;
+/** Test seam: forget what Better Auth wired, as if it had not initialised. */
+export declare function resetActiveGoogleSignInCredentials(): void;
+export declare function getActiveGoogleSignInCredentials(): {
+    credentials: GoogleOAuthCredentials | null;
+    recorded: boolean;
+    version: number;
+};
+/**
+ * Which sign-in credential pairs are configured, and whether they disagree.
+ *
+ * `mismatched` is the state that hid the 2026-08-20 outage: two pairs naming
+ * different Google clients, where only the winner is ever read. Callers report
+ * it; the resolver only warns.
+ */
+export declare function describeGoogleSignInCredentialPairs(): {
+    signInClientId: string | null;
+    providerClientId: string | null;
+    mismatched: boolean;
+};
 export declare function resolveGoogleProviderCredentials(): GoogleOAuthCredentials | null;
 export declare function resolveGoogleLegacyProviderCredentials(): GoogleOAuthCredentials | null;
 export declare function resolveGoogleProviderCredentialCandidates(): GoogleOAuthCredentials[];

package/dist/server/google-oauth-credentials.js

@@ -75,6 +75,51 @@ export function resolveGoogleSignInCredentials() {
 export function hasGoogleSignInCredentials() {
     return resolveGoogleSignInCredentials() !== null;
 }
+let activeSignInCredentials = null;
+let activeSignInCredentialsRecorded = false;
+let activeSignInCredentialsVersion = 0;
+/**
+ * Record the pair Better Auth actually handed to the Google provider.
+ *
+ * The effective pair is not always the preferred one: a template asking for
+ * broader scopes is wired to GOOGLE_CLIENT_ID/SECRET instead. Anything testing
+ * "the credential the callback will use" must read this rather than
+ * re-deriving it, or it will verify a pair nothing reads and report healthy.
+ */
+export function recordActiveGoogleSignInCredentials(credentials) {
+    activeSignInCredentials = credentials;
+    activeSignInCredentialsRecorded = true;
+    activeSignInCredentialsVersion += 1;
+}
+/** Test seam: forget what Better Auth wired, as if it had not initialised. */
+export function resetActiveGoogleSignInCredentials() {
+    activeSignInCredentials = null;
+    activeSignInCredentialsRecorded = false;
+    activeSignInCredentialsVersion += 1;
+}
+export function getActiveGoogleSignInCredentials() {
+    return {
+        credentials: activeSignInCredentials,
+        recorded: activeSignInCredentialsRecorded,
+        version: activeSignInCredentialsVersion,
+    };
+}
+/**
+ * Which sign-in credential pairs are configured, and whether they disagree.
+ *
+ * `mismatched` is the state that hid the 2026-08-20 outage: two pairs naming
+ * different Google clients, where only the winner is ever read. Callers report
+ * it; the resolver only warns.
+ */
+export function describeGoogleSignInCredentialPairs() {
+    const signIn = readCredentialPair("GOOGLE_SIGN_IN_CLIENT_ID", "GOOGLE_SIGN_IN_CLIENT_SECRET");
+    const provider = readCredentialPair("GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET");
+    return {
+        signInClientId: signIn?.clientId ?? null,
+        providerClientId: provider?.clientId ?? null,
+        mismatched: Boolean(signIn && provider && signIn.clientId !== provider.clientId),
+    };
+}
 export function resolveGoogleProviderCredentials() {
     return readCredentialPair(GOOGLE_PRIMARY_PROVIDER_CREDENTIAL_KEYS.clientIdKey, GOOGLE_PRIMARY_PROVIDER_CREDENTIAL_KEYS.clientSecretKey);
 }

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.168.3",
+  "version": "0.168.4",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -428,8 +428,8 @@
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.32",
     "zod": "^4.3.6",
-    "@agent-native/recap-cli": "0.5.7",
-    "@agent-native/toolkit": "^0.16.9"
+    "@agent-native/toolkit": "^0.16.9",
+    "@agent-native/recap-cli": "0.5.7"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",