@agent-native/core 0.176.1 → 0.176.2-nightly-20260831184159

package/dist/server/agent-chat-plugin.js

@@ -153,6 +153,35 @@ export { resolveRecurringJobsBuildMarker };
 export { scheduledTriggerAvailability };
 export { shouldDisableRecurringJobsRuntime };
 export { finalizeClaimedAgentChatProcessRunFailure };
+function hasSuccessfulSideEffect(run) {
+    return run.events.some(({ event }) => event.type === "tool_done" &&
+        event.completedSideEffect === true &&
+        event.isError !== true);
+}
+export async function runPostAgentTurnAutosave(callback, scope, run) {
+    if (!callback || !scope || !hasSuccessfulSideEffect(run))
+        return;
+    try {
+        await callback(scope, run);
+    }
+    catch (error) {
+        captureError(error, {
+            route: "agent-chat",
+            aiTraceId: run.runId,
+            tags: {
+                source: "agent-chat",
+                failureClass: "post-agent-turn-autosave",
+            },
+            extra: {
+                runId: run.runId,
+                threadId: run.threadId,
+                scopeType: scope.type,
+                scopeId: scope.id,
+            },
+        });
+        console.error("[agent-chat] post-agent-turn autosave failed:", error);
+    }
+}
 /**
  * The model this mount runs with, when the caller does not pass one per request.
  *
@@ -1528,6 +1557,7 @@ export function createAgentChatPlugin(options) {
                             ...urlTools,
                             ...chatScripts,
                             ...(a2aAgentDelegationEnabled ? callAgentScript : {}),
+                            ...automationTools,
                             ...fetchTool,
                             ...webSearchTool,
                             ...workspaceFilesTool,
@@ -1552,6 +1582,7 @@ export function createAgentChatPlugin(options) {
                             ...urlTools,
                             ...chatScripts,
                             ...(a2aAgentDelegationEnabled ? callAgentScript : {}),
+                            ...automationTools,
                             ...fetchTool,
                             ...webSearchTool,
                             ...workspaceFilesTool,
@@ -2128,7 +2159,7 @@ export function createAgentChatPlugin(options) {
                 // Ignore — templates without sharing still work.
             }
             if (Object.keys(httpActions).length > 0) {
-                const { mountActionRoutes } = await import("./action-routes.js");
+                const { mountActionRoutes, mountWebMcpActionRoutes } = await import("./action-routes.js");
                 if (options?.actionRoutePublicPaths?.length) {
                     registerAuthPublicPaths(options.actionRoutePublicPaths, getH3App(nitroApp));
                 }
@@ -2139,6 +2170,13 @@ export function createAgentChatPlugin(options) {
                     resolveOrgId: options?.resolveOrgId,
                     actionRouteAuth: options?.actionRouteAuth,
                 });
+                mountWebMcpActionRoutes(nitroApp, httpActions, {
+                    getOwnerFromEvent,
+                    getUserNameFromEvent,
+                    appId: options?.appId,
+                    resolveOrgId: options?.resolveOrgId,
+                    actionRouteAuth: options?.actionRouteAuth,
+                });
             }
             const preRunGitStatusByThread = new Map();
             async function recordPreRunGitStatus(threadId) {
@@ -2162,6 +2200,7 @@ export function createAgentChatPlugin(options) {
                         preRunGitStatusByThread.delete(runThreadId);
                     return;
                 }
+                const chatScope = getRequestRunContext()?.chatScope;
                 // Serialize the read-modify-write against the same thread's other
                 // `thread_data` writers (setThreadQueuedMessages, setThreadEngineMeta,
                 // the frontend-triggered saves below). Without the lock, a concurrent
@@ -2173,6 +2212,7 @@ export function createAgentChatPlugin(options) {
                         throw new Error(`Agent chat thread ${threadId} was not found while saving run ${run.runId}.`);
                     }
                     const assistantMsg = buildAssistantMessage(run.events ?? [], run.runId, {
+                        scope: chatScope,
                         suppressInternalContinuation: true,
                         turnId: typeof run.turnId === "string" && run.turnId
                             ? run.turnId
@@ -2204,6 +2244,7 @@ export function createAgentChatPlugin(options) {
                         turnId: typeof run.turnId === "string" && run.turnId
                             ? run.turnId
                             : undefined,
+                        parentId: run.parentId,
                     });
                     // Store debug metadata so we can inspect what the LLM actually
                     // received (system prompt, model, engine) when diagnosing issues.
@@ -2219,9 +2260,13 @@ export function createAgentChatPlugin(options) {
                     const meta = extractThreadMeta(repo);
                     await updateThreadData(threadId, JSON.stringify(repo), meta.title || thread.title, meta.preview || thread.preview, repo.messages.length);
                 });
-                // Keep SQL run completion gated only on durable thread data. Follow-up
-                // hooks are useful, but they should never leave agent_runs stuck
-                // "running" if an automation/checkpoint path stalls.
+                // Checkpoint creation is part of durable turn completion. The helper
+                // catches and reports its own failures, so a broken app checkpoint does
+                // not strand the run while a successful checkpoint cannot be lost when
+                // a serverless invocation exits.
+                await runPostAgentTurnAutosave(options?.onAgentTurnComplete, chatScope, run);
+                // Event triggers and local git checkpoints remain best effort and do
+                // not extend the durable chat persistence gate.
                 void (async () => {
                     // Emit agent.turn.completed for automation triggers.
                     //

package/dist/server/agent-engine-api-key-route.d.ts

@@ -34,10 +34,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-run-context.d.ts

@@ -26,6 +26,7 @@ export declare function readAgentRunTimezone(event: H3Event): string | undefined
  */
 export declare function readBrowserSessionIdHeader(event: H3Event): string | undefined;
 export declare function readAnalyticsClientPlatformHeader(event: H3Event): import("../shared/analytics-platform.js").AnalyticsClientPlatform | undefined;
+export declare function readSyntheticTrafficHeader(event: H3Event): boolean;
 export declare function seedAgentRunOwnerContext(event: H3Event, ownerContext: AgentRunOwnerContext): AgentRunOwnerContext;
 export declare function seedBackgroundAgentRunOwnerContext(event: H3Event, runId: string, orgId?: string | null): Promise<AgentRunOwnerContext | null>;
 export declare function resolveAgentRunOwnerContext(event: H3Event, options?: {

package/dist/server/agent-run-context.js

@@ -1,6 +1,7 @@
 import { createError, getHeader } from "h3";
 import { resolveOrgIdForEmail, getOrgContext } from "../org/context.js";
 import { ANALYTICS_CLIENT_PLATFORM_BODY_FIELD, ANALYTICS_CLIENT_PLATFORM_HEADER, normalizeAnalyticsClientPlatform, } from "../shared/analytics-platform.js";
+import { SYNTHETIC_TRAFFIC_HEADER, isSyntheticTrafficValue, } from "../shared/test-traffic.js";
 import { getSession } from "./auth.js";
 import { runWithRequestContext, } from "./request-context.js";
 export const AGENT_RUN_OWNER_CONTEXT_KEY = "__agentNativeOwnerContext";
@@ -69,6 +70,9 @@ export function readAnalyticsClientPlatformHeader(event) {
     return (normalizeAnalyticsClientPlatform(value) ??
         normalizeAnalyticsClientPlatform(event.context?.[ANALYTICS_CLIENT_PLATFORM_BODY_FIELD]));
 }
+export function readSyntheticTrafficHeader(event) {
+    return isSyntheticTrafficValue(readHeaderValue(event, SYNTHETIC_TRAFFIC_HEADER));
+}
 export function seedAgentRunOwnerContext(event, ownerContext) {
     eventContext(event)[AGENT_RUN_OWNER_CONTEXT_KEY] =
         ownerContext;
@@ -158,6 +162,7 @@ export async function resolveAgentRunRequestContext(options) {
     const timezone = readAgentRunTimezone(options.event);
     const browserSessionId = readBrowserSessionIdHeader(options.event);
     const clientPlatform = readAnalyticsClientPlatformHeader(options.event);
+    const isSyntheticTraffic = readSyntheticTrafficHeader(options.event);
     const waitUntil = requestWaitUntil(options.event);
     const run = {
         ...(options.isBackgroundWorker ? { isBackgroundWorker: true } : {}),
@@ -170,6 +175,7 @@ export async function resolveAgentRunRequestContext(options) {
         timezone,
         ...(browserSessionId ? { browserSessionId } : {}),
         ...(clientPlatform ? { clientPlatform } : {}),
+        ...(isSyntheticTraffic ? { isSyntheticTraffic: true } : {}),
         ...(Object.keys(run).length > 0 ? { run } : {}),
     };
 }

package/dist/server/analytics.d.ts

@@ -1,8 +1,9 @@
 /** Project public first-party Analytics config into static auth HTML. */
 export declare function getAgentNativeAnalyticsConfigScript(): string | null;
 /**
- * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
- * block injected next to the gtag.js loader.
+ * The exact JS body (no surrounding `<script>` tags) of the inline gtag
+ * bootstrap block. The loader is created only for real browser traffic so a
+ * synthetic browser never initializes Google's analytics runtime.
  * Returns `null` when GA is not configured.
  */
 export declare function getGaInlineConfigScriptBody(): string | null;

package/dist/server/analytics.js

@@ -1,4 +1,5 @@
 import { getAppConfig } from "../app-config/index.js";
+import { SYNTHETIC_TRAFFIC_BETA_E2E } from "../shared/test-traffic.js";
 const AGENT_NATIVE_ANALYTICS_DEFAULT_ENDPOINT = "https://analytics.agent-native.com/track";
 function normalizeMeasurementId(value) {
     const trimmed = value?.trim();
@@ -23,6 +24,9 @@ function getGtmContainerId() {
         normalizeContainerId(process.env.AGENT_NATIVE_BUILD_GTM_CONTAINER_ID) ||
         normalizeContainerId(getViteBakedGtmContainerId()));
 }
+function getSyntheticTrafficBrowserGuard() {
+    return `window.__AGENT_NATIVE_SYNTHETIC_TRAFFIC__!==${JSON.stringify(SYNTHETIC_TRAFFIC_BETA_E2E)}`;
+}
 function getGaMeasurementId() {
     return (normalizeMeasurementId(process.env.GA_MEASUREMENT_ID) ||
         normalizeMeasurementId(process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID) ||
@@ -51,8 +55,9 @@ export function getAgentNativeAnalyticsConfigScript() {
     ].join("");
 }
 /**
- * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
- * block injected next to the gtag.js loader.
+ * The exact JS body (no surrounding `<script>` tags) of the inline gtag
+ * bootstrap block. The loader is created only for real browser traffic so a
+ * synthetic browser never initializes Google's analytics runtime.
  * Returns `null` when GA is not configured.
  */
 export function getGaInlineConfigScriptBody() {
@@ -60,27 +65,33 @@ export function getGaInlineConfigScriptBody() {
     if (!id)
         return null;
     const jsId = JSON.stringify(id);
-    return (`window.dataLayer=window.dataLayer||[];` +
+    const src = JSON.stringify(`https://www.googletagmanager.com/gtag/js?id=${encodeURIComponent(id)}`);
+    const guard = getSyntheticTrafficBrowserGuard();
+    return (`if(${guard}){` +
+        `window.dataLayer=window.dataLayer||[];` +
         `function gtag(){dataLayer.push(arguments);}` +
         `gtag('js',new Date());` +
         `gtag('config',${jsId});` +
         `if(typeof sessionStorage!=='undefined'&&sessionStorage.getItem('__an_signin')){` +
         `sessionStorage.removeItem('__an_signin');` +
         `gtag('event','sign_in');` +
+        `}` +
+        `var agentNativeGtagScript=document.createElement('script');` +
+        `agentNativeGtagScript.async=true;` +
+        `agentNativeGtagScript.src=${src};` +
+        `document.head.appendChild(agentNativeGtagScript);` +
         `}`);
 }
 function getGaScript() {
     const id = getGaMeasurementId();
     if (!id)
         return null;
-    const srcId = encodeURIComponent(id);
     const inlineBody = getGaInlineConfigScriptBody();
-    return (`<script async src="https://www.googletagmanager.com/gtag/js?id=${srcId}"></script>` +
-        `<script>${inlineBody}</script>`);
+    return `<script>${inlineBody}</script>`;
 }
 function getGtmHeadScript(containerId) {
     const jsId = JSON.stringify(containerId);
-    return `<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer',${jsId});</script>`;
+    return `<script>if(${getSyntheticTrafficBrowserGuard()}){(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer',${jsId});}</script>`;
 }
 function getGtmBodyFallback(containerId) {
     const src = encodeURIComponent(containerId);

package/dist/server/app-url.d.ts

@@ -16,7 +16,8 @@
  *      get a real hostname in emails without needing to set `APP_URL`.
  *   5. Public `WORKSPACE_GATEWAY_URL` — multi-app workspace gateway
  *   6. Local `WORKSPACE_GATEWAY_URL` — local multi-app workspace gateway
- *   7. `http://localhost:3000`
+ *   7. `http://localhost:3000`, unless the caller supplies a different
+ *      fallback
  *
  * Older versions preferred `WORKSPACE_GATEWAY_URL` before platform URLs.
  * That is fine for local development, but in hosted Builder Desktop sessions
@@ -30,4 +31,6 @@ import { type H3Event } from "h3";
  * first-party template or the template has no `prodUrl`.
  */
 export declare function getFirstPartyProdUrl(): string | undefined;
-export declare function getAppProductionUrl(event?: H3Event): string;
+export declare function getAppProductionUrl(event?: H3Event, options?: {
+    fallback?: string;
+}): string;

package/dist/server/app-url.js

@@ -18,7 +18,8 @@ import path from "node:path";
  *      get a real hostname in emails without needing to set `APP_URL`.
  *   5. Public `WORKSPACE_GATEWAY_URL` — multi-app workspace gateway
  *   6. Local `WORKSPACE_GATEWAY_URL` — local multi-app workspace gateway
- *   7. `http://localhost:3000`
+ *   7. `http://localhost:3000`, unless the caller supplies a different
+ *      fallback
  *
  * Older versions preferred `WORKSPACE_GATEWAY_URL` before platform URLs.
  * That is fine for local development, but in hosted Builder Desktop sessions
@@ -119,7 +120,7 @@ export function getFirstPartyProdUrl() {
     const t = TEMPLATES.find((t) => t.name === name);
     return t?.prodUrl;
 }
-export function getAppProductionUrl(event) {
+export function getAppProductionUrl(event, options = {}) {
     const envUrl = firstConfiguredPublicUrl([
         "APP_URL",
         "WORKSPACE_OAUTH_ORIGIN",
@@ -171,5 +172,5 @@ export function getAppProductionUrl(event) {
     const localWorkspaceGateway = workspaceGatewayUrl({ allowLoopback: true });
     if (localWorkspaceGateway)
         return localWorkspaceGateway;
-    return "http://localhost:3000";
+    return options.fallback ?? "http://localhost:3000";
 }

package/dist/server/auth.d.ts

@@ -77,6 +77,11 @@ export interface AuthOptions {
      * Use this for custom login flows (e.g., "Sign in with Google" button).
      */
     loginHtml?: string;
+    /**
+     * Serve the configured auth document at the public root. Defaults to true
+     * when the auth plugin provides marketing or custom login content.
+     */
+    rootAuth?: boolean;
     /**
      * Hide email/password forms on the built-in login page and show only the
      * Google sign-in button. Use this for templates (mail, calendar) where
@@ -155,6 +160,7 @@ export interface AuthOptions {
  */
 export declare function getCookieDomain(): string | undefined;
 export declare const COOKIE_NAME: string;
+export declare const SESSION_HINT_COOKIE: string;
 export declare const BETTER_AUTH_COOKIE_PREFIX: string;
 /**
  * Cookie domain attribute spread into every `setCookie`/`deleteCookie`.
@@ -165,6 +171,7 @@ export declare function cookieDomainAttrs(): {
     domain?: string;
 };
 export declare function getFrameworkSessionCookieValues(event: H3Event): string[];
+export declare function clearFrameworkSessionHintCookies(event: H3Event): void;
 export declare function clearFrameworkSessionCookies(event: H3Event): void;
 /**
  * Check if we're in a development/test environment.
@@ -299,6 +306,24 @@ export declare function isLocalDevAuthAllowed(event: H3Event): boolean;
  * page load.
  */
 export declare function getSession(event: H3Event): Promise<AuthSession | null>;
+/**
+ * Cookie attributes that work in both same-site and third-party iframe
+ * contexts. Over HTTPS we emit `SameSite=None; Secure; Partitioned` —
+ * `None`+`Secure` is required by browsers to ship the cookie back inside a
+ * cross-origin iframe at all; `Partitioned` keeps the cookie working under
+ * Chrome's third-party-cookie deprecation by binding it to the embedding
+ * site's storage partition. (Better Auth already sets the same trio on its
+ * own session cookie; this matches so the framework's legacy cookie —
+ * which the Builder OAuth popup exchange writes via
+ * `setFrameworkSessionCookie` — survives iframe contexts too.) Plain-HTTP
+ * dev keeps the default `SameSite=Lax`; `None` requires Secure, and
+ * `Partitioned` only takes effect alongside `Secure`.
+ */
+export declare function crossSiteCookieAttrs(event: H3Event): {
+    sameSite: "lax" | "none";
+    secure: boolean;
+    partitioned?: boolean;
+};
 export declare function setFrameworkSessionCookie(event: H3Event, token: string): void;
 /**
  * Build a redirect `Response` that carries the security-sensitive headers just