@agent-native/core 0.203.0 → 0.203.1-nightly-20261007183952

package/dist/observability/routes.d.ts

@@ -27,38 +27,38 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    ok?: undefined;
     error: string;
     message: string;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
+    ok?: undefined;
     message?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/observability/trace-error.d.ts

@@ -15,8 +15,10 @@ export declare function sanitizeToolErrorMessage(value: string): string;
  * captureToolResults off: the first non-blank line, bounded. It is stored
  * without the owner opting in, so beyond credentials (a quoted secret can span
  * lines, so redact the whole text first) it also drops the emails and opaque
- * ids a failing tool echoes back. Never empty — an empty `error_message` reads
- * as "no reason was captured", which is a different fact from "the tool gave no
- * text".
+ * ids a failing tool echoes back. The `Error running <tool>: ` prefix is
+ * dropped so signatures group by cause, and a JSON `{ error, message }` result
+ * is summarized as `error: message` rather than its opening brace. Never
+ * empty — an empty `error_message` reads as "no reason was captured", which is
+ * a different fact from "the tool gave no text".
  */
 export declare function toolErrorSignature(value: unknown): string;

package/dist/observability/trace-error.js

@@ -58,19 +58,44 @@ const EMAIL_PATTERN = /[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+/g;
 // 16+ characters of an id alphabet with a digit in them: Google file ids, Gmail
 // message ids, ObjectIds, session ids. Plain identifiers have no digit.
 const OPAQUE_ID_PATTERN = /\b(?=[A-Za-z0-9_-]*\d)[A-Za-z0-9_-]{16,}\b/g;
+const TOOL_ERROR_PREFIX_PATTERN = /^Error running [^\s:]+:\s*/;
 /**
  * The part of a tool failure that is always recorded, even with
  * captureToolResults off: the first non-blank line, bounded. It is stored
  * without the owner opting in, so beyond credentials (a quoted secret can span
  * lines, so redact the whole text first) it also drops the emails and opaque
- * ids a failing tool echoes back. Never empty — an empty `error_message` reads
- * as "no reason was captured", which is a different fact from "the tool gave no
- * text".
+ * ids a failing tool echoes back. The `Error running <tool>: ` prefix is
+ * dropped so signatures group by cause, and a JSON `{ error, message }` result
+ * is summarized as `error: message` rather than its opening brace. Never
+ * empty — an empty `error_message` reads as "no reason was captured", which is
+ * a different fact from "the tool gave no text".
  */
 export function toolErrorSignature(value) {
-    const redacted = redactToolErrorMessage(typeof value === "string" ? value : "")
+    const text = (typeof value === "string" ? value : "")
+        .trim()
+        .replace(TOOL_ERROR_PREFIX_PATTERN, "");
+    const redacted = redactToolErrorMessage(jsonErrorSummary(text) ?? text)
         .replace(EMAIL_PATTERN, "[email]")
         .replace(OPAQUE_ID_PATTERN, "[id]");
     const firstLine = redacted.split(/\r?\n/).find((line) => line.trim());
     return boundToolErrorMessage(firstLine?.trim() || "Tool failed with no error text");
 }
+/** `error: message` for a JSON `{ error, message }` result; `undefined` when the text is not one. */
+function jsonErrorSummary(text) {
+    if (!text.startsWith("{"))
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+        // coercion-ok: unparseable text is not a JSON error result; the caller still records its first line
+    }
+    catch {
+        return undefined;
+    }
+    const { error, message } = (parsed ?? {});
+    if (typeof error !== "string" || !error.trim())
+        return undefined;
+    return typeof message === "string" && message.trim()
+        ? `${error}: ${message}`
+        : error;
+}

package/dist/observability/traces.js

@@ -1230,6 +1230,10 @@ export async function instrumentAgentLoop(opts) {
                         run_id: runId,
                         thread_id: threadId,
                         llm_calls: llmCallCount || undefined,
+                        follow_up_ms: usage?.followUpMs,
+                        follow_up_input_tokens: usage?.followUpInputTokens,
+                        receipt_unverified_count: usage?.receiptUnverifiedCount,
+                        receipt_changed_false_count: usage?.receiptChangedFalseCount,
                         tool_calls: toolCallCount,
                         successful_tools: successfulTools,
                         failed_tools: failedTools,
@@ -1413,6 +1417,8 @@ export async function instrumentAgentLoop(opts) {
                     errorMessage: redactCapturedError(errorMessage),
                     attributes: {
                         "agent.llm_calls": llmCallCount,
+                        "agent.follow_up_ms": usage?.followUpMs,
+                        "agent.follow_up_input_tokens": usage?.followUpInputTokens,
                         "agent.tool_calls": toolCallCount,
                         "agent.successful_tools": successfulTools,
                         "agent.failed_tools": failedTools,

package/dist/progress/routes.d.ts

@@ -2,6 +2,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,6 +311,7 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
+        id?: undefined;
         deleted?: undefined;
         found?: undefined;
         providers: {
@@ -325,17 +326,16 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         count: number;
         provider?: undefined;
         registered?: undefined;
-        id?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
+        id?: undefined;
         deleted?: undefined;
         count?: undefined;
         providers?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
-        id?: undefined;
         label?: undefined;
         message?: undefined;
     } | {

package/dist/resources/handlers.d.ts

@@ -39,8 +39,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
     error: string;
 }>;
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -58,47 +58,47 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     error: string;
     errorCode?: undefined;
     retryable?: undefined;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable?: undefined;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable: boolean;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     errorCode?: undefined;
     retryable?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -126,11 +126,11 @@ export declare function createAdHocSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/action-routes.js

@@ -750,6 +750,9 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                         appId: options?.appId,
                         caller,
                         requestHeaders: event.headers,
+                        ...(directoryWidgetReadAllowed
+                            ? { mcpDirectoryWidgetReadOnly: true }
+                            : {}),
                         ...(event.req?.signal ? { signal: event.req.signal } : {}),
                         actionName: name,
                         ...(resolvedCaller?.delegationJti

package/dist/server/agent-chat/prompt-resources.d.ts

@@ -39,6 +39,15 @@ export interface PromptResourceManifestSection {
     sourceRef?: ContextManifestSourceRef;
 }
 export declare function promptResourceManifestSections(prompt: string): PromptResourceManifestSection[];
+/** The compact prompt's skills index. `skillReadTool` is the tool the request
+ *  registry actually has for reading a skill; with none, the index is dropped
+ *  because it would send the model to a tool it cannot call. */
+export declare function buildCompactSkillsSummary(skills: ReadonlyArray<{
+    meta: {
+        name: string;
+        description?: string;
+    };
+}>, skillReadTool: string | null): string | null;
 /** @internal exported for unit tests only */
 export declare function promptResourceBlock(input: {
     name: string;
@@ -104,4 +113,8 @@ export declare function preloadJevContextForPrompt(options: {
  */
 export declare function loadResourcesForPrompt(owner: string, compact?: boolean, selfAppId?: string, orgId?: string | null, opts?: {
     disabledFrameworkGroups?: ReadonlySet<FrameworkToolGroup>;
+    /** The tool the compact skills summary sends the model to for skill text,
+     *  or `null` when the request registry has none. Omitted means
+     *  `docs-search`, the framework default. */
+    skillReadTool?: string | null;
 }): Promise<string>;

package/dist/server/agent-chat/prompt-resources.js

@@ -275,6 +275,24 @@ function ensureSentence(value) {
         return "";
     return /[.!?]$/.test(trimmed) ? trimmed : `${trimmed}.`;
 }
+/** The compact prompt's skills index. `skillReadTool` is the tool the request
+ *  registry actually has for reading a skill; with none, the index is dropped
+ *  because it would send the model to a tool it cannot call. */
+export function buildCompactSkillsSummary(skills, skillReadTool) {
+    if (skills.length === 0 || !skillReadTool)
+        return null;
+    const listedSkills = skills.slice(0, PROMPT_SKILL_SUMMARY_LIMIT);
+    const lines = listedSkills.map((s) => {
+        const description = s.meta.description?.trim()
+            ? ` - ${ensureSentence(compactPromptLine(s.meta.description, PROMPT_SUMMARY_DESCRIPTION_MAX_CHARS))}`
+            : "";
+        return `- \`${s.meta.name}\`${description} Read with \`${skillReadTool} --slug "${skillDocsSlug(s.meta.name)}"\` before starting a task it applies to; reuse that page for subsequent steps in this turn.`;
+    });
+    if (skills.length > listedSkills.length) {
+        lines.push(`- ...${skills.length - listedSkills.length} more codebase skills. Use \`${skillReadTool} --query "<topic>"\` to discover the relevant one.`);
+    }
+    return `<skills-summary>\nCodebase skills bundled from \`.agents/skills/\` (or legacy \`.agent/skills/\`) are available as ${skillReadTool} pages. Do not use MCP resource reads for these skills. Read each relevant page once per turn and reuse it; do not repeat an equivalent ${skillReadTool} lookup unless the page or question is different.\n\n${lines.join("\n")}\n</skills-summary>`;
+}
 function escapeXmlAttribute(value) {
     return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
 }
@@ -1119,6 +1137,7 @@ export async function preloadJevContextForPrompt(options) {
  */
 export async function loadResourcesForPrompt(owner, compact = false, selfAppId, orgId = getRequestOrgId() ?? null, opts) {
     await ensurePersonalDefaults(owner);
+    const skillReadTool = opts?.skillReadTool === undefined ? "docs-search" : opts.skillReadTool;
     const sections = [];
     const addSection = (content, governance = "inherited") => {
         if (content?.trim())
@@ -1163,18 +1182,8 @@ export async function loadResourcesForPrompt(owner, compact = false, selfAppId,
         const skillsBlock = generateSkillsPromptBlock(bundle, runtimeSkills);
         addSection(skillsBlock);
     }
-    else if (runtimeSkills.length > 0) {
-        const listedSkills = runtimeSkills.slice(0, PROMPT_SKILL_SUMMARY_LIMIT);
-        const lines = listedSkills.map((s) => {
-            const description = s.meta.description?.trim()
-                ? ` - ${ensureSentence(compactPromptLine(s.meta.description, PROMPT_SUMMARY_DESCRIPTION_MAX_CHARS))}`
-                : "";
-            return `- \`${s.meta.name}\`${description} Read with \`docs-search --slug "${skillDocsSlug(s.meta.name)}"\` before starting a task it applies to; reuse that page for subsequent steps in this turn.`;
-        });
-        if (runtimeSkills.length > listedSkills.length) {
-            lines.push(`- ...${runtimeSkills.length - listedSkills.length} more codebase skills. Use \`docs-search --query "<topic>"\` to discover the relevant one.`);
-        }
-        addSection(`<skills-summary>\nCodebase skills bundled from \`.agents/skills/\` (or legacy \`.agent/skills/\`) are available as docs-search pages. Do not use MCP resource reads for these skills. Read each relevant page once per turn and reuse it; do not repeat an equivalent docs-search lookup unless the page or question is different.\n\n${lines.join("\n")}\n</skills-summary>`);
+    else {
+        addSection(buildCompactSkillsSummary(runtimeSkills, skillReadTool));
     }
     const workspaceOwner = workspaceResourceOwner(orgId);
     const workspaceAgents = await loadAgentsResourceForPrompt(workspaceOwner, "workspace", promptResourceMaxChars, orgId);

package/dist/server/agent-chat-plugin.js

@@ -405,8 +405,13 @@ async function resolveResourceOrgId(event, resolveOrgId) {
     const resolved = resolveOrgId ? await resolveOrgId(event) : undefined;
     return resolved === undefined ? getRequestOrgId() : resolved;
 }
+// Lean runs never receive the compact framework prompt, so the batching rule
+// it carries has to ride the run policy instead.
+const LEAN_PARALLEL_READS_NOTE = "\n\nWhen several independent reads are needed, emit them in the same step.";
 export function buildLeanRunPolicyPrompt(codeEditingSurfaceRestriction, prodCodeExecPromptNote) {
-    return codeEditingSurfaceRestriction + prodCodeExecPromptNote;
+    return (LEAN_PARALLEL_READS_NOTE +
+        codeEditingSurfaceRestriction +
+        prodCodeExecPromptNote);
 }
 export function filterPromptActionsToSurface(actions, allowedActionNames) {
     if (!allowedActionNames)
@@ -851,6 +856,16 @@ export function createAgentChatPlugin(options) {
             const docsScripts = frameworkTools.isEnabled("docs")
                 ? await createDocsScriptEntries()
                 : {};
+            // The compact prompt sends the model to `docs-search` for skill text, so
+            // it is the one docs tool the lean registry keeps (`framework-search`
+            // stays out of the first request). Every registry carries it through
+            // `docsScripts` or `skillReadScripts`, which is why one resolved name
+            // serves every prompt site.
+            const docsSearchEntry = docsScripts["docs-search"];
+            const skillReadScripts = docsSearchEntry
+                ? { "docs-search": docsSearchEntry }
+                : {};
+            const skillReadTool = docsSearchEntry ? "docs-search" : null;
             const databaseToolsMode = normalizeDatabaseToolsMode(frameworkTools.database);
             const databaseToolsEnabled = databaseToolsMode !== "off";
             const databaseWriteToolsEnabled = databaseToolsMode === "write";
@@ -1843,7 +1858,7 @@ export function createAgentChatPlugin(options) {
                     const devActive = isDevMode();
                     // Build the same system prompt the interactive agent uses
                     const owner = userEmail;
-                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
+                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups, skillReadTool });
                     const schemaBlock = lazyContext
                         ? ""
                         : await buildSchemaBlock(owner, databaseToolsMode);
@@ -2468,7 +2483,7 @@ export function createAgentChatPlugin(options) {
                         // catalog on its very first request, undermining the compact MCP
                         // catalog this surface is supposed to keep external callers on.
                         const mcpToolSurface = createA2AEngineToolSurface(actionsToEngineTools(mcpActions), effectiveInitialToolNames);
-                        const resources = await loadResourcesForPrompt(SHARED_OWNER, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
+                        const resources = await loadResourcesForPrompt(SHARED_OWNER, lazyContext, options?.appId, undefined, { disabledFrameworkGroups, skillReadTool });
                         const schemaBlock = lazyContext
                             ? ""
                             : await buildSchemaBlock(SHARED_OWNER, databaseToolsMode);
@@ -3109,6 +3124,7 @@ export function createAgentChatPlugin(options) {
             const leanActionEntries = {
                 ...templateScripts,
                 ...resourceScripts,
+                ...skillReadScripts,
                 ...workspaceFileActions,
                 ...refreshScreenTool,
                 ...urlTools,
@@ -3454,7 +3470,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     // so everything after it can change without a cache write.
                     if (leanPrompt) {
                         const leanRunPolicyPrompt = buildLeanRunPolicyPrompt(codeEditingSurfaceRestriction, `${requestProdCodeExecPromptNote}${hostedHarnessPromptNote ? `\n\n${hostedHarnessPromptNote}` : ""}`);
-                        const resources = await loadResourcesForPrompt(owner, true, options?.appId, undefined, { disabledFrameworkGroups });
+                        const resources = await loadResourcesForPrompt(owner, true, options?.appId, undefined, { disabledFrameworkGroups, skillReadTool });
                         await emitContextXraySystemSections(event, {
                             frameworkPrompt: requestLeanPrompt.slice(0, Math.max(0, requestLeanPrompt.length - requestLeanActionsPrompt.length)),
                             actionsPrompt: requestLeanActionsPrompt,
@@ -3474,7 +3490,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             runtimeContext,
                         }));
                     }
-                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
+                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups, skillReadTool });
                     // In lazy context mode, skip embedding the full schema. When database
                     // tools are enabled the agent can call `db-schema` on demand.
                     const schemaBlock = lazyContext
@@ -3756,7 +3772,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         // cached prompt prefix as possible. See the prod handler above
                         // for the same pattern.
                         if (leanPrompt) {
-                            const resources = await loadResourcesForPrompt(owner, true, options?.appId, undefined, { disabledFrameworkGroups });
+                            const resources = await loadResourcesForPrompt(owner, true, options?.appId, undefined, { disabledFrameworkGroups, skillReadTool });
                             await emitContextXraySystemSections(event, {
                                 frameworkPrompt: requestLeanPrompt.slice(0, Math.max(0, requestLeanPrompt.length - requestLeanActionsPrompt.length)),
                                 actionsPrompt: requestLeanActionsPrompt,
@@ -3773,7 +3789,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                                 runtimeContext,
                             }));
                         }
-                        const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
+                        const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups, skillReadTool });
                         const schemaBlock = lazyContext || !databaseToolsEnabled
                             ? ""
                             : await buildSchemaBlock(owner, databaseToolsMode);
@@ -6261,7 +6277,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 const schedulerDeps = {
                     getActions: getBackgroundActionEntries,
                     getSystemPrompt: async (owner) => {
-                        const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
+                        const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups, skillReadTool });
                         const schemaBlock = lazyContext
                             ? ""
                             : await buildSchemaBlock(owner, databaseToolsMode);
@@ -6671,7 +6687,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             await initTriggerDispatcher({
                 getActions: getBackgroundActionEntries,
                 getSystemPrompt: async (owner) => {
-                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
+                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups, skillReadTool });
                     const schemaBlock = lazyContext
                         ? ""
                         : await buildSchemaBlock(owner, databaseToolsMode);

package/dist/server/agent-engine-api-key-route.d.ts

@@ -65,6 +65,7 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     error: any;
     code: any;
 } | {
+    error?: undefined;
     errorCode?: undefined;
     code?: undefined;
     ok: boolean;
@@ -72,6 +73,5 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
     defaultModel?: import("./agent-engine-default-model-route.js").SavedKeyDefaultModelOutcome;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-engine-default-model-route.d.ts

@@ -9,16 +9,16 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    scope?: undefined;
     ok?: undefined;
+    scope?: undefined;
 } | {
     ok: boolean;
     error: any;
     scope?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     scope: "org" | "user";
-    error?: undefined;
 }>>;
 export interface DefaultModelSelectionRequest {
     engine: string;

package/dist/server/email-auth-links.js

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import { canonicalFrameworkPathname, publicFrameworkPath, } from "./framework-route-prefix.js";
 export const EMAIL_AUTH_LINK_LANDING_PATH = "/_agent-native/auth/email-link/landing";
 const BETTER_AUTH_MAGIC_LINK_VERIFY_PATH = "/_agent-native/auth/ba/magic-link/verify";
@@ -108,16 +109,111 @@ function escapeHtml(value) {
         }
     });
 }
+const EMAIL_AUTH_LINK_LANDING_STYLES = `
+  *, *::before, *::after { box-sizing: border-box; }
+  :root {
+    color-scheme: dark;
+    --auth-canvas: #0a0a0a; /* guard:allow-raw-color - match the standalone auth palette */
+    --auth-card: #141414; /* guard:allow-raw-color - match the standalone auth palette */
+    --auth-border: rgba(255, 255, 255, 0.08); /* guard:allow-raw-color - match the standalone auth palette */
+    --auth-foreground: #e5e5e5; /* guard:allow-raw-color - match the standalone auth palette */
+    --auth-heading: #fff; /* guard:allow-raw-color - match the standalone auth palette */
+    --auth-muted: #888; /* guard:allow-raw-color - match the standalone auth palette */
+    --auth-primary: #fff; /* guard:allow-raw-color - match the standalone auth palette */
+    --auth-primary-foreground: #000; /* guard:allow-raw-color - match the standalone auth palette */
+    --auth-primary-hover: #e5e5e5; /* guard:allow-raw-color - match the standalone auth palette */
+    --auth-focus: #33c4ff; /* guard:allow-raw-color - match the standalone auth palette */
+  }
+  body {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    min-height: 100vh;
+    min-height: 100svh;
+    margin: 0;
+    padding: 1rem;
+    background: var(--auth-canvas);
+    color: var(--auth-foreground);
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+  }
+  .auth-card {
+    width: 100%;
+    max-width: 400px;
+    padding: 2rem;
+    background: var(--auth-card);
+    border: 1px solid var(--auth-border);
+    border-radius: 12px;
+  }
+  h1 {
+    margin: 0 0 0.25rem;
+    color: var(--auth-heading);
+    font-size: 1.25rem;
+    font-weight: 600;
+    line-height: 1.5;
+  }
+  p {
+    margin: 0 0 1.5rem;
+    color: var(--auth-muted);
+    font-size: 0.8125rem;
+    line-height: 1.5;
+  }
+  form { margin: 0; }
+  button {
+    width: 100%;
+    min-height: 2.75rem;
+    padding: 0.625rem 0.75rem;
+    background: var(--auth-primary);
+    color: var(--auth-primary-foreground);
+    border: 0;
+    border-radius: 6px;
+    font: inherit;
+    font-size: 0.875rem;
+    font-weight: 500;
+    cursor: pointer;
+    transition: background-color 120ms ease;
+  }
+  button:hover { background: var(--auth-primary-hover); }
+  button:focus-visible {
+    outline: 2px solid var(--auth-focus);
+    outline-offset: 2px;
+  }
+  @media (max-width: 420px) {
+    .auth-card { padding: 1.5rem; }
+  }
+  @media (prefers-reduced-motion: reduce) {
+    button { transition: none; }
+  }
+`;
 export function emailAuthLinkLandingPage(actionUrl, fields, copy, locale, direction) {
     const hiddenInputs = Object.entries(fields)
         .map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`)
         .join("");
-    const html = `<!DOCTYPE html><html lang="${escapeHtml(locale)}" dir="${direction}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(copy.title)}</title></head><body><main><h1>${escapeHtml(copy.title)}</h1><p>${escapeHtml(copy.message)}</p><form method="post" action="${escapeHtml(actionUrl)}" autocomplete="off">${hiddenInputs}<button type="submit">${escapeHtml(copy.action)}</button></form></main></body></html>`;
+    // A nonce keeps the standalone page styled without allowing arbitrary inline CSS.
+    const styleNonce = randomBytes(16).toString("base64");
+    const html = `<!doctype html>
+<html lang="${escapeHtml(locale)}" dir="${direction}">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>${escapeHtml(copy.title)}</title>
+    <style nonce="${styleNonce}">${EMAIL_AUTH_LINK_LANDING_STYLES}</style>
+  </head>
+  <body>
+    <main class="auth-card">
+      <h1>${escapeHtml(copy.title)}</h1>
+      <p>${escapeHtml(copy.message)}</p>
+      <form method="post" action="${escapeHtml(actionUrl)}" autocomplete="off">
+        ${hiddenInputs}
+        <button type="submit">${escapeHtml(copy.action)}</button>
+      </form>
+    </main>
+  </body>
+</html>`;
     return new Response(html, {
         status: 200,
         headers: {
             "cache-control": "no-store",
-            "content-security-policy": "default-src 'none'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'",
+            "content-security-policy": `default-src 'none'; style-src 'nonce-${styleNonce}'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'`,
             "content-type": "text/html; charset=utf-8",
             "referrer-policy": "no-referrer",
             "x-robots-tag": "noindex",

package/dist/server/embed-route.js

@@ -1,6 +1,6 @@
 import { defineEventHandler, getHeader, getMethod, getQuery, setResponseHeader, } from "h3";
 import { withCollapsedAgentSidebarParam } from "../shared/agent-sidebar-url.js";
-import { EMBED_MODE_QUERY_PARAM, EMBED_START_PATH, EMBED_TOKEN_QUERY_PARAM, MCP_APP_CHAT_BRIDGE_QUERY_PARAM, } from "../shared/embed-auth.js";
+import { EMBED_MODE_QUERY_PARAM, EMBED_START_PATH, EMBED_TOKEN_QUERY_PARAM, MCP_APP_CHAT_BRIDGE_QUERY_PARAM, MCP_DIRECTORY_WIDGET_QUERY_PARAM, } from "../shared/embed-auth.js";
 import { isMcpEmbedTransplantOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, } from "../shared/mcp-embed-headers.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { readCorsAllowedOrigins } from "./cors-origins.js";
@@ -21,6 +21,7 @@ function appendEmbedParams(target, token, chatBridgeActive = false) {
     if (chatBridgeActive) {
         url.searchParams.set(MCP_APP_CHAT_BRIDGE_QUERY_PARAM, "1");
     }
+    url.searchParams.delete(MCP_DIRECTORY_WIDGET_QUERY_PARAM);
     return `${url.pathname}${url.search}${url.hash}`;
 }
 function redirectWithStagedCookies(event, location, status = 302) {