@agent-native/core 0.185.0 → 0.186.0-nightly-20260923174435

package/dist/provider-api/actions/provider-api.d.ts

@@ -312,8 +312,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         scope?: "org" | "user" | undefined;
     }, {
         id?: undefined;
-        provider?: undefined;
         deleted?: undefined;
+        provider?: undefined;
         providers: {
             id: string;
             label: string;
@@ -339,8 +339,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
-        provider?: undefined;
         deleted?: undefined;
+        provider?: undefined;
         count?: undefined;
         providers?: undefined;
         found: boolean;
@@ -359,8 +359,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
-        provider?: undefined;
         deleted?: undefined;
+        provider?: undefined;
         count?: undefined;
         providers?: undefined;
         found?: undefined;

package/dist/scripts/agent-engines/test-agent-engine.js

@@ -4,7 +4,7 @@
 import { getAgentEngineEntry, registerBuiltinEngines, } from "../../agent/engine/index.js";
 import { OLLAMA_BASE_URL_ENV_VAR, OPENAI_BASE_URL_ENV_VAR, } from "../../agent/engine/openai-compatible-endpoint.js";
 import { validateProviderBaseUrl } from "../../agent/engine/provider-endpoint-validation.js";
-import { canUseDeployCredentialFallbackForRequest, readDeployCredentialEnv, resolveSecret, } from "../../server/credential-provider.js";
+import { canUseDeployCredentialFallbackForRequest, isTrustedSelfHostedRuntime, readDeployCredentialEnv, resolveSecret, } from "../../server/credential-provider.js";
 export const tool = {
     description: "Test an agent engine by sending a trivial prompt and measuring latency. Useful for verifying API keys and connectivity before switching engines.",
     parameters: {
@@ -42,18 +42,19 @@ async function resolveAgentEngineSecret(key) {
         : undefined;
 }
 async function resolveAgentEngineEndpoint(key) {
+    const isOllama = key === OLLAMA_BASE_URL_ENV_VAR;
     const value = await resolveSecret(key);
     if (value) {
         return validateProviderBaseUrl(value, {
-            allowLocalOllama: key === OLLAMA_BASE_URL_ENV_VAR &&
-                process.env.NODE_ENV === "development",
+            allowLocalOllama: isOllama && isTrustedSelfHostedRuntime(),
+            isOllama,
         });
     }
     if (!canUseDeployCredentialFallbackForRequest(key))
         return undefined;
     const deployValue = readDeployCredentialEnv(key);
     return deployValue
-        ? validateProviderBaseUrl(deployValue, { allowPrivate: true })
+        ? validateProviderBaseUrl(deployValue, { allowPrivate: true, isOllama })
         : undefined;
 }
 function canUseDeployEnvForEntry(entry) {
@@ -69,14 +70,15 @@ async function createEngineConfig(entry, args) {
         allowEnvFallback: canUseDeployEnvForEntry(entry),
     };
     if (entry.name === "ai-sdk:openai" || entry.name === "ai-sdk:ollama") {
-        const endpointKey = entry.name === "ai-sdk:ollama"
+        const isOllama = entry.name === "ai-sdk:ollama";
+        const endpointKey = isOllama
             ? OLLAMA_BASE_URL_ENV_VAR
             : OPENAI_BASE_URL_ENV_VAR;
         const explicitBaseUrl = args.baseUrl?.trim();
         const baseUrl = explicitBaseUrl
             ? await validateProviderBaseUrl(explicitBaseUrl, {
-                allowLocalOllama: entry.name === "ai-sdk:ollama" &&
-                    process.env.NODE_ENV === "development",
+                allowLocalOllama: isOllama && isTrustedSelfHostedRuntime(),
+                isOllama,
             })
             : await resolveAgentEngineEndpoint(endpointKey);
         if (baseUrl)

package/dist/secrets/routes.d.ts

@@ -57,16 +57,16 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     status: string;
     error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     removed: boolean;
@@ -77,9 +77,9 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     note?: undefined;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -43,8 +43,8 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
     key?: undefined;
-    ok?: undefined;
     scope?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     key: string;
@@ -52,14 +52,14 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     error?: undefined;
 } | {
     key?: undefined;
+    scope?: undefined;
     ok: boolean;
     error: string;
-    scope?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-engine-api-key-route.js

@@ -1,11 +1,11 @@
 import { defineEventHandler, getMethod, setResponseStatus, } from "h3";
-import { normalizeOpenAiBaseUrl } from "../agent/engine/openai-compatible-endpoint.js";
+import { normalizeOpenAiBaseUrl, stripOllamaV1Suffix, } from "../agent/engine/openai-compatible-endpoint.js";
 import { validateProviderBaseUrl } from "../agent/engine/provider-endpoint-validation.js";
 import { OLLAMA_BASE_URL_ENV_VAR, OPENAI_BASE_URL_ENV_VAR, PROVIDER_ENV_META, } from "../agent/engine/provider-env-vars.js";
 import { getOrgContext } from "../org/context.js";
 import { deleteAppSecret, writeAppSecret } from "../secrets/storage.js";
-import { getSession, isLoopbackRequest } from "./auth.js";
-import { clearProviderCredentialAuthFailure } from "./credential-provider.js";
+import { getSession } from "./auth.js";
+import { clearProviderCredentialAuthFailure, isTrustedSelfHostedRuntime, } from "./credential-provider.js";
 import { readBody } from "./h3-helpers.js";
 const PROVIDER_TO_ENV_VAR = new Map(Object.entries(PROVIDER_ENV_META).map(([provider, meta]) => [
     provider,
@@ -89,6 +89,9 @@ export function normalizeAgentEngineApiKeyPayload(body) {
         }
         try {
             baseUrl = normalizeOpenAiBaseUrl(rawBaseUrl);
+            if (key === OLLAMA_BASE_URL_ENV_VAR) {
+                baseUrl = stripOllamaV1Suffix(baseUrl);
+            }
         }
         catch (err) {
             return {
@@ -236,9 +239,9 @@ export function createAgentEngineApiKeyHandler() {
         if (payload.baseUrl) {
             try {
                 await validateProviderBaseUrl(payload.baseUrl, {
+                    isOllama: payload.key === OLLAMA_BASE_URL_ENV_VAR,
                     allowLocalOllama: payload.key === OLLAMA_BASE_URL_ENV_VAR &&
-                        process.env.NODE_ENV !== "production" &&
-                        isLoopbackRequest(event),
+                        isTrustedSelfHostedRuntime(),
                 });
             }
             catch (err) {

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -0,0 +1,15 @@
+/**
+ * GET /_agent-native/agent-engine/ollama-models — lists the models an Ollama
+ * server actually has pulled, via its native `/api/tags` endpoint. Backs the
+ * provider setup form so it shows real installed models instead of only the
+ * static suggestion list in `model-config.ts`.
+ */
+export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    error: string;
+    models?: undefined;
+    ok?: undefined;
+} | {
+    ok: boolean;
+    models: string[];
+    error?: undefined;
+}>>;

package/dist/server/agent-engine-ollama-models-route.js

@@ -0,0 +1,105 @@
+import { defineEventHandler, getQuery, setResponseStatus, } from "h3";
+import { validateProviderBaseUrl } from "../agent/engine/provider-endpoint-validation.js";
+import { OLLAMA_BASE_URL_ENV_VAR } from "../agent/engine/provider-env-vars.js";
+import { ssrfSafeFetch } from "../extensions/url-safety.js";
+import { getOrgContext } from "../org/context.js";
+import { getSession } from "./auth.js";
+import { isTrustedSelfHostedRuntime, resolveSecret, } from "./credential-provider.js";
+import { runWithRequestContext } from "./request-context.js";
+const DEFAULT_OLLAMA_BASE_URL = "http://localhost:11434";
+/**
+ * `resolveSecret` reads through the ambient request context set by
+ * `runWithRequestContext`, not from this event directly — a plain route
+ * handler that never establishes it (unlike action routes, which are wrapped
+ * upstream) sees no signed-in user/org, so every saved secret read comes back
+ * empty and the caller silently falls back to a default. Mirrors
+ * `resolveAgentEngineStatusIdentity` in `core-routes-plugin.ts`.
+ */
+async function resolveRequestIdentity(event) {
+    // coercion-ok: a session lookup failure here degrades to the unauthenticated
+    // path (401, same as no session at all) rather than 500ing this route.
+    const session = await getSession(event).catch(() => null);
+    const userEmail = session?.email;
+    if (!userEmail)
+        return { userEmail: undefined, orgId: undefined };
+    try {
+        const orgCtx = await getOrgContext(event);
+        return { userEmail, orgId: orgCtx.orgId ?? undefined };
+    }
+    catch {
+        return { userEmail, orgId: undefined };
+    }
+}
+function parseModelNames(payload) {
+    const models = payload?.models;
+    if (!Array.isArray(models))
+        return [];
+    const names = models
+        .map((entry) => (typeof entry?.name === "string" ? entry.name.trim() : ""))
+        .filter((name) => name.length > 0);
+    return [...new Set(names)];
+}
+/**
+ * GET /_agent-native/agent-engine/ollama-models — lists the models an Ollama
+ * server actually has pulled, via its native `/api/tags` endpoint. Backs the
+ * provider setup form so it shows real installed models instead of only the
+ * static suggestion list in `model-config.ts`.
+ */
+export function createAgentEngineOllamaModelsHandler() {
+    return defineEventHandler(async (event) => {
+        const { userEmail, orgId } = await resolveRequestIdentity(event);
+        // This route lets the caller name an arbitrary `baseUrl` and makes the
+        // server fetch it — a session is required so it can't become an
+        // anonymous SSRF/outbound-request primitive, mirroring the DELETE
+        // handler in `agent-engine-api-key-route.ts`.
+        if (!userEmail) {
+            setResponseStatus(event, 401);
+            return { error: "Authentication required" };
+        }
+        const query = getQuery(event);
+        const requestedBaseUrl = typeof query.baseUrl === "string" ? query.baseUrl.trim() : "";
+        return runWithRequestContext({ userEmail, orgId }, async () => {
+            const trusted = isTrustedSelfHostedRuntime();
+            let baseUrl;
+            try {
+                if (requestedBaseUrl) {
+                    baseUrl = await validateProviderBaseUrl(requestedBaseUrl, {
+                        allowLocalOllama: trusted,
+                        isOllama: true,
+                    });
+                }
+                else {
+                    const saved = await resolveSecret(OLLAMA_BASE_URL_ENV_VAR);
+                    baseUrl = await validateProviderBaseUrl(saved ?? DEFAULT_OLLAMA_BASE_URL, { allowLocalOllama: trusted, isOllama: true });
+                }
+            }
+            catch (err) {
+                setResponseStatus(event, 400);
+                return { error: err instanceof Error ? err.message : String(err) };
+            }
+            try {
+                // `validateProviderBaseUrl` already approved this exact URL above;
+                // `ssrfSafeFetch` runs its own independent private-address check on
+                // every request (by design — it has no idea about the Ollama
+                // allowance), so the same trusted local/LAN origin must be passed
+                // through here too, or a loopback/LAN endpoint we just approved would
+                // be blocked again at fetch time.
+                const response = await ssrfSafeFetch(`${baseUrl}/api/tags`, { signal: AbortSignal.timeout(8_000) }, { allowedPrivateOrigins: trusted ? [baseUrl] : [] });
+                if (!response.ok) {
+                    setResponseStatus(event, 502);
+                    return {
+                        error: `Ollama responded with HTTP ${response.status}. Is the server running at ${baseUrl}?`,
+                    };
+                }
+                const models = parseModelNames(await response.json());
+                return { ok: true, models };
+            }
+            catch {
+                setResponseStatus(event, 502);
+                return {
+                    error: `Could not reach Ollama at ${baseUrl}. Check that it's running and the address is correct.`,
+                };
+            }
+        });
+    });
+}

package/dist/server/core-routes-plugin.js

@@ -44,6 +44,7 @@ import { registerBuiltinProviders } from "../tracking/providers.js";
 import { validateTrackPayload } from "../tracking/route.js";
 import { createAutomationsHandler } from "../triggers/routes.js";
 import { createAgentEngineApiKeyHandler } from "./agent-engine-api-key-route.js";
+import { createAgentEngineOllamaModelsHandler } from "./agent-engine-ollama-models-route.js";
 import { readAnalyticsClientPlatformHeader, readBrowserSessionIdHeader, } from "./agent-run-context.js";
 import { getConfiguredAppBasePath, stripAppBasePath } from "./app-base-path.js";
 import { getSession } from "./auth.js";
@@ -3296,6 +3297,10 @@ export function createCoreRoutesPlugin(options = {}) {
                 }));
             }
             getH3App(nitroApp).use(`${P}/agent-engine/api-key`, createAgentEngineApiKeyHandler());
+            // GET /_agent-native/agent-engine/ollama-models — lists the models an
+            // Ollama server actually has installed, so the provider setup form can
+            // show real options instead of only the static suggestion list.
+            getH3App(nitroApp).use(`${P}/agent-engine/ollama-models`, createAgentEngineOllamaModelsHandler());
             // GET /_agent-native/agent-engine/status — reports whether an engine
             // is configured (settings row, settings+env, or auto-detected from env).
             // The agent-chat UI uses this to skip the onboarding gate for providers

package/dist/server/credential-provider.d.ts

@@ -101,6 +101,19 @@ export declare const BUILDER_GATEWAY_SPACE_ID_ENV_VAR = "BUILDER_GATEWAY_SPACE_I
  */
 export declare function hasPlatformRuntimeMarker(): boolean;
 export declare function isProductionLikeRuntime(): boolean;
+/**
+ * Whether this process is a genuinely self-hosted, single-tenant deployment
+ * rather than the hosted multi-tenant workspace runtime — the same bar
+ * `canUseDeployCredentialFallbackForRequest` uses to decide whether relaxing
+ * a security boundary for "this is the operator's own machine" is safe.
+ * `NODE_ENV` alone proves nothing (it travels with a copied `.env`), so a
+ * production-shaped runtime still counts as trusted when it is backed by the
+ * local embedded database, which has no cross-tenant blast radius.
+ *
+ * Used to allow a user-supplied Ollama endpoint to target a LAN address
+ * instead of only loopback — see `provider-endpoint-validation.ts`.
+ */
+export declare function isTrustedSelfHostedRuntime(): boolean;
 type BuilderCredentialSource = "user" | "org" | "workspace" | "env";
 export interface BuilderCredentialLookupIdentity {
     /** The verified owner of a background run, when it has no browser request. */

package/dist/server/credential-provider.js

@@ -245,6 +245,25 @@ export function hasPlatformRuntimeMarker() {
 export function isProductionLikeRuntime() {
     return process.env.NODE_ENV === "production" || hasPlatformRuntimeMarker();
 }
+/**
+ * Whether this process is a genuinely self-hosted, single-tenant deployment
+ * rather than the hosted multi-tenant workspace runtime — the same bar
+ * `canUseDeployCredentialFallbackForRequest` uses to decide whether relaxing
+ * a security boundary for "this is the operator's own machine" is safe.
+ * `NODE_ENV` alone proves nothing (it travels with a copied `.env`), so a
+ * production-shaped runtime still counts as trusted when it is backed by the
+ * local embedded database, which has no cross-tenant blast radius.
+ *
+ * Used to allow a user-supplied Ollama endpoint to target a LAN address
+ * instead of only loopback — see `provider-endpoint-validation.ts`.
+ */
+export function isTrustedSelfHostedRuntime() {
+    if (isHostedWorkspaceRuntime())
+        return false;
+    if (!isProductionLikeRuntime())
+        return true;
+    return isLocalDatabase();
+}
 /**
  * Whether deployment-level Builder env keys may back the current request.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.185.0",
+  "version": "0.186.0-nightly-20260923174435",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -493,9 +493,9 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.32",
     "zod": "^4.3.6",
+    "@agent-native/toolkit": "^0.20.7",
     "@agent-native/agentkit": "^0.2.7",
-    "@agent-native/recap-cli": "0.5.37",
-    "@agent-native/toolkit": "^0.20.7"
+    "@agent-native/recap-cli": "0.5.37"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",