@agent-native/core 0.206.0-nightly-20261009124314 → 0.206.0

package/dist/action.d.ts

@@ -3,7 +3,7 @@ import { type ActionChatUIConfig } from "./action-ui.js";
 import type { ActionTool, AgentChatAttachment, AgentChatEvent } from "./agent/types.js";
 import type { ActionAuditConfig } from "./audit/types.js";
 import { type ActionAccessConfig } from "./authorization/action-access-runtime.js";
-export type ActionCaller = "tool" | "http" | "frontend" | "mcp-widget" | "cli" | "mcp" | "webmcp" | "a2a" | "automation";
+export type ActionCaller = "tool" | "http" | "frontend" | "mcp-widget" | "mcp-widget-write" | "cli" | "mcp" | "webmcp" | "a2a" | "automation";
 export interface ActionAutomationContext {
     triggerId: string;
     triggerName: string;
@@ -38,6 +38,12 @@ export interface ActionRunContext {
     actionName?: string;
     /** Present only on frontend GETs authorized by a scoped directory-widget read capability. */
     mcpDirectoryWidgetReadOnly?: true;
+    /** Present only on frontend mutations authorized by a scoped directory-widget write capability. */
+    mcpDirectoryWidgetWrite?: {
+        appId: string;
+        resourceIds: Record<string, string>;
+        actionNames: readonly string[];
+    };
     threadId?: string;
     runId?: string;
     turnId?: string;

package/dist/app-config/extension-display-sources.d.ts

@@ -0,0 +1,31 @@
+/**
+ * What the extension iframe loads for img-src / media-src when a deployment
+ * has not narrowed or widened them.
+ *
+ * This module has no imports on purpose: the client-rendered extension shell
+ * (`extensions/html-shell.ts`, used by `ExtensionViewer` and
+ * `InlineExtensionFrame` in the browser) builds its default CSP from this list,
+ * and must not pull the server app-config store into browser bundles.
+ *
+ * Frozen so an importing module cannot mutate the shared default. The schema
+ * hands out a fresh copy per parse, so a caller mutating its resolved config
+ * cannot reach this list either.
+ */
+export declare const DEFAULT_EXTENSION_DISPLAY_SOURCES: readonly string[];
+/**
+ * One CSP source expression with no whitespace or `;`, so a configured value
+ * can extend `img-src` / `media-src` but can never terminate the directive and
+ * append a new one. Shared by the app-config schema and the CSP builder, so the
+ * value that is validated at config time is validated again where it is
+ * interpolated.
+ */
+export declare const EXTENSION_DISPLAY_SOURCE_PATTERN: RegExp;
+export declare const EXTENSION_DISPLAY_SOURCE_MESSAGE = "must be one CSP source expression: 'self', 'none', a scheme such as https: or blob:, or an http(s) origin such as https://cdn.example.com";
+export declare const EXTENSION_DISPLAY_SOURCE_NONE_MESSAGE = "'none' must be the only source in the list";
+/**
+ * Returns why `sources` cannot be interpolated into an img-src / media-src
+ * directive, or `null` when it can. Mirrors the app-config schema: a non-empty
+ * list of single source expressions, with `'none'` only on its own (CSP drops
+ * `'none'` when it is mixed with other sources).
+ */
+export declare function extensionDisplaySourcesError(sources: unknown): string | null;

package/dist/app-config/extension-display-sources.js

@@ -0,0 +1,45 @@
+/**
+ * What the extension iframe loads for img-src / media-src when a deployment
+ * has not narrowed or widened them.
+ *
+ * This module has no imports on purpose: the client-rendered extension shell
+ * (`extensions/html-shell.ts`, used by `ExtensionViewer` and
+ * `InlineExtensionFrame` in the browser) builds its default CSP from this list,
+ * and must not pull the server app-config store into browser bundles.
+ *
+ * Frozen so an importing module cannot mutate the shared default. The schema
+ * hands out a fresh copy per parse, so a caller mutating its resolved config
+ * cannot reach this list either.
+ */
+export const DEFAULT_EXTENSION_DISPLAY_SOURCES = Object.freeze(["'self'", "data:", "blob:"]);
+/**
+ * One CSP source expression with no whitespace or `;`, so a configured value
+ * can extend `img-src` / `media-src` but can never terminate the directive and
+ * append a new one. Shared by the app-config schema and the CSP builder, so the
+ * value that is validated at config time is validated again where it is
+ * interpolated.
+ */
+export const EXTENSION_DISPLAY_SOURCE_PATTERN = /^(?:'self'|'none'|(?:https?|data|blob|mediastream):|https?:\/\/(?:\*\.)?[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*(?::\d{1,5})?)$/;
+export const EXTENSION_DISPLAY_SOURCE_MESSAGE = "must be one CSP source expression: 'self', 'none', a scheme such as https: or blob:, or an http(s) origin such as https://cdn.example.com";
+export const EXTENSION_DISPLAY_SOURCE_NONE_MESSAGE = "'none' must be the only source in the list";
+/**
+ * Returns why `sources` cannot be interpolated into an img-src / media-src
+ * directive, or `null` when it can. Mirrors the app-config schema: a non-empty
+ * list of single source expressions, with `'none'` only on its own (CSP drops
+ * `'none'` when it is mixed with other sources).
+ */
+export function extensionDisplaySourcesError(sources) {
+    if (!Array.isArray(sources) || sources.length === 0) {
+        return "must be a non-empty list of CSP source expressions";
+    }
+    for (const source of sources) {
+        if (typeof source !== "string" ||
+            !EXTENSION_DISPLAY_SOURCE_PATTERN.test(source)) {
+            return `${JSON.stringify(source)} ${EXTENSION_DISPLAY_SOURCE_MESSAGE}`;
+        }
+    }
+    if (sources.includes("'none'") && sources.length !== 1) {
+        return EXTENSION_DISPLAY_SOURCE_NONE_MESSAGE;
+    }
+    return null;
+}

package/dist/app-config/extensions.d.ts

@@ -0,0 +1,7 @@
+import { z } from "zod";
+import { DEFAULT_EXTENSION_DISPLAY_SOURCES } from "./extension-display-sources.js";
+export { DEFAULT_EXTENSION_DISPLAY_SOURCES };
+export declare const extensionsConfig: z.ZodObject<{
+    iframeImageSources: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    iframeMediaSources: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;

package/dist/app-config/extensions.js

@@ -0,0 +1,39 @@
+import { z } from "zod";
+import { DEFAULT_EXTENSION_DISPLAY_SOURCES, EXTENSION_DISPLAY_SOURCE_MESSAGE, EXTENSION_DISPLAY_SOURCE_NONE_MESSAGE, EXTENSION_DISPLAY_SOURCE_PATTERN, } from "./extension-display-sources.js";
+/**
+ * SECURITY — these values are interpolated into the sandboxed extension
+ * iframe's Content-Security-Policy. A source expression is validated as a
+ * single token with no whitespace or `;`, so a configured value can extend
+ * `img-src` / `media-src` but can never terminate the directive and append a
+ * new one. `connect-src` is not configurable and stays `'self'`. A remote
+ * `img-src` / `media-src` origin is still an explicit egress permission:
+ * the browser requests that URL, so extension script can encode data into
+ * it. The host bridge is the permission-gated path for API calls, not a
+ * claim that these sources are egress-free.
+ */
+const cspSource = z
+    .string()
+    .regex(EXTENSION_DISPLAY_SOURCE_PATTERN, EXTENSION_DISPLAY_SOURCE_MESSAGE);
+// The iframe shell builds its default CSP from this same list, so the declared
+// default and the shipped policy cannot drift apart. It lives in an
+// import-free module so the client-rendered shell can use it without pulling
+// the app-config store into browser bundles.
+export { DEFAULT_EXTENSION_DISPLAY_SOURCES };
+function displaySources(doc) {
+    return (z
+        .array(cspSource)
+        .min(1)
+        // CSP drops a directive that mixes 'none' with other sources, so
+        // ["'none'", "https:"] reads as a deny-all that still allows https.
+        // Reject the combination instead of emitting a policy that does not
+        // say what the config says.
+        .refine((sources) => !sources.includes("'none'") || sources.length === 1, { error: EXTENSION_DISPLAY_SOURCE_NONE_MESSAGE })
+        // A fresh copy per parse: the shared default is frozen, and a caller
+        // mutating its resolved config must not reach the next parse.
+        .default(() => [...DEFAULT_EXTENSION_DISPLAY_SOURCES])
+        .meta({ doc }));
+}
+export const extensionsConfig = z.object({
+    iframeImageSources: displaySources("Replaces the image sources the sandboxed extension iframe may load. Defaults to 'self' data: blob:, which blocks every remote image; add https: or one origin to show product photos, avatars, or CDN assets. Every allowed remote origin is an explicit egress permission: the browser requests that URL. connect-src stays 'self'.").meta({ env: "AGENT_NATIVE_EXTENSION_IFRAME_IMAGE_SOURCES" }),
+    iframeMediaSources: displaySources("Replaces the media sources the sandboxed extension iframe may load, with the same syntax and the same default as `extensions.iframeImageSources`. A remote entry is an explicit egress permission: the browser requests that URL.").meta({ env: "AGENT_NATIVE_EXTENSION_IFRAME_MEDIA_SOURCES" }),
+});

package/dist/app-config/index.d.ts

@@ -1,4 +1,5 @@
 export { defineAppConfig, enterpriseAuthAdaptersBuilt, getAppConfig, resetAppConfigForTests, } from "./store.js";
 export { resolveAppHomePath } from "./app-identity.js";
 export { AppConfigurationError } from "./configuration-error.js";
+export { DEFAULT_EXTENSION_DISPLAY_SOURCES } from "./extensions.js";
 export { appConfigSchema, type AppConfig, type AppConfigInput, } from "./schema.js";

package/dist/app-config/index.js

@@ -1,4 +1,5 @@
 export { defineAppConfig, enterpriseAuthAdaptersBuilt, getAppConfig, resetAppConfigForTests, } from "./store.js";
 export { resolveAppHomePath } from "./app-identity.js";
 export { AppConfigurationError } from "./configuration-error.js";
+export { DEFAULT_EXTENSION_DISPLAY_SOURCES } from "./extensions.js";
 export { appConfigSchema, } from "./schema.js";

package/dist/app-config/schema.d.ts

@@ -71,6 +71,10 @@ export declare const appConfigSchema: z.ZodObject<{
         workspaceOwnerEmails: z.ZodDefault<z.ZodArray<z.ZodString>>;
         defaultOwnerEmail: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
+    extensions: z.ZodPrefault<z.ZodObject<{
+        iframeImageSources: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        iframeMediaSources: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
     integrations: z.ZodPrefault<z.ZodObject<{
         durableDispatch: z.ZodOptional<z.ZodBoolean>;
         allowUnverifiedWebhooks: z.ZodDefault<z.ZodBoolean>;

package/dist/app-config/schema.js

@@ -6,6 +6,7 @@ import { analyticsConfig } from "./analytics.js";
 import { appConfig } from "./app.js";
 import { authConfig } from "./auth.js";
 import { dispatchConfig } from "./dispatch.js";
+import { extensionsConfig } from "./extensions.js";
 import { integrationsConfig } from "./integrations.js";
 import { launchDarklyConfig } from "./launchdarkly.js";
 import { mcpConfig } from "./mcp.js";
@@ -26,6 +27,7 @@ export const appConfigSchema = z.object({
     app: appConfig.prefault({}),
     auth: authConfig.prefault({}),
     dispatch: dispatchConfig.prefault({}),
+    extensions: extensionsConfig.prefault({}),
     integrations: integrationsConfig.prefault({}),
     launchDarkly: launchDarklyConfig.prefault({}),
     mcp: mcpConfig.prefault({}),

package/dist/client/agent-chat/index.d.ts

@@ -13,7 +13,7 @@ export { useSendToAgentChat } from "../use-send-to-agent-chat.js";
 export { DEFAULT_MODEL, CHAT_MODEL_SELECTION_CHANGED_EVENT, chatModelSelectionStorageKey, loadChatModelCatalog, useChatModels, type UseChatModelsResult, type UseChatModelsOptions, type PersistedModelSelection, type EngineModelGroup, } from "../use-chat-models.js";
 export { fetchAgentEngineConfiguredState, useAgentEngineConfigured, type AgentEngineConfiguredState, type FetchAgentEngineConfiguredStateOptions, type UseAgentEngineConfiguredResult, } from "../use-agent-engine-configured.js";
 export { AGENT_CHAT_AI_SETUP_REQUIRED_CODE, AgentChatAiSetupRequiredError, ensureAgentEngineReadiness, getAgentEngineReadiness, invalidateAgentEngineReadiness, isAgentChatAiSetupRequiredError, isLocalRuntimeEngine, requireAgentEngineConfiguredForDispatch, subscribeAgentEngineReadiness, LOCAL_RUNTIME_ENGINE_IDS, agentEngineStatusUrlForChatApi, type AgentEngineReadinessSource, } from "../agent-engine-readiness.js";
-export { AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES, getMcpAppHostContext, initializeMcpAppHost, isMcpAppWidgetEmbed, isOpenAiMcpAppHost, openMcpAppHostLink, requestMcpAppDisplayMode, sendMcpAppHostMessage, updateMcpAppModelContext, useIsMcpAppWidgetEmbed, useMcpAppHostContext, type AgentNativeMcpAppHostMessageType, type McpAppDisplayMode, type McpAppHostChatMessage, type McpAppHostCapabilities, type McpAppHostContext, type McpAppHostInfo, type McpAppHostContextSnapshot, type McpAppModelContextContentPart, type McpAppModelContextUpdate, } from "../mcp-app-host.js";
+export { AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES, getMcpAppHostContext, initializeMcpAppHost, isMcpAppWidgetEmbed, isOpenAiMcpAppHost, openMcpAppHostLink, requestMcpAppDisplayMode, sendMcpAppHostMessage, updateMcpAppModelContext, useIsMcpAppWidgetEmbed, useIsMcpDirectoryWidgetReadOnlyEmbed, useIsMcpDirectoryWidgetWriteEmbed, useMcpAppHostContext, type AgentNativeMcpAppHostMessageType, type McpAppDisplayMode, type McpAppHostChatMessage, type McpAppHostCapabilities, type McpAppHostContext, type McpAppHostInfo, type McpAppHostContextSnapshot, type McpAppModelContextContentPart, type McpAppModelContextUpdate, } from "../mcp-app-host.js";
 export { buildDynamicAgentSuggestions, dedupeSuggestions, mergeAgentSuggestions, normalizeAgentDynamicSuggestionsConfig, useAgentDynamicSuggestions, useAgentDynamicSuggestionsResult, type AgentDynamicSuggestionContext, type AgentDynamicSuggestionsConfig, type AgentDynamicSuggestionsOption, } from "../dynamic-suggestions.js";
 export { clearChatStorage } from "../chat/storage.js";
 export { isAssistantChatHistoryVersion, coerceAssistantChatHistoryDate, type AssistantChatHistoryDate, type AssistantChatHistoryVersion, } from "../chat/assistant-chat-history-version.js";

package/dist/client/agent-chat/index.js

@@ -13,7 +13,7 @@ export { useSendToAgentChat } from "../use-send-to-agent-chat.js";
 export { DEFAULT_MODEL, CHAT_MODEL_SELECTION_CHANGED_EVENT, chatModelSelectionStorageKey, loadChatModelCatalog, useChatModels, } from "../use-chat-models.js";
 export { fetchAgentEngineConfiguredState, useAgentEngineConfigured, } from "../use-agent-engine-configured.js";
 export { AGENT_CHAT_AI_SETUP_REQUIRED_CODE, AgentChatAiSetupRequiredError, ensureAgentEngineReadiness, getAgentEngineReadiness, invalidateAgentEngineReadiness, isAgentChatAiSetupRequiredError, isLocalRuntimeEngine, requireAgentEngineConfiguredForDispatch, subscribeAgentEngineReadiness, LOCAL_RUNTIME_ENGINE_IDS, agentEngineStatusUrlForChatApi, } from "../agent-engine-readiness.js";
-export { AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES, getMcpAppHostContext, initializeMcpAppHost, isMcpAppWidgetEmbed, isOpenAiMcpAppHost, openMcpAppHostLink, requestMcpAppDisplayMode, sendMcpAppHostMessage, updateMcpAppModelContext, useIsMcpAppWidgetEmbed, useMcpAppHostContext, } from "../mcp-app-host.js";
+export { AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES, getMcpAppHostContext, initializeMcpAppHost, isMcpAppWidgetEmbed, isOpenAiMcpAppHost, openMcpAppHostLink, requestMcpAppDisplayMode, sendMcpAppHostMessage, updateMcpAppModelContext, useIsMcpAppWidgetEmbed, useIsMcpDirectoryWidgetReadOnlyEmbed, useIsMcpDirectoryWidgetWriteEmbed, useMcpAppHostContext, } from "../mcp-app-host.js";
 export { buildDynamicAgentSuggestions, dedupeSuggestions, mergeAgentSuggestions, normalizeAgentDynamicSuggestionsConfig, useAgentDynamicSuggestions, useAgentDynamicSuggestionsResult, } from "../dynamic-suggestions.js";
 export { clearChatStorage } from "../chat/storage.js";
 export { isAssistantChatHistoryVersion, coerceAssistantChatHistoryDate, } from "../chat/assistant-chat-history-version.js";

package/dist/client/embed-auth.d.ts

@@ -11,12 +11,14 @@ export declare function getEmbedAuthToken(): string | null;
  * allowed.
  */
 export declare function hasMcpDirectoryWidgetCapabilityToken(): boolean;
+export declare function hasMcpDirectoryWidgetWriteCapabilityToken(): boolean;
 /**
  * True when this document is the app nested in an MCP App widget shell (the
  * chat bridge is active) on a directory-widget read capability, which the
  * server limits to the widget's own resource reads.
  */
 export declare function isMcpDirectoryWidgetReadOnlyEmbed(): boolean;
+export declare function isMcpDirectoryWidgetWriteEmbed(): boolean;
 export declare function isEmbedAuthActive(): boolean;
 export declare function _resetEmbedAuthForTests(): void;
 /**

package/dist/client/embed-auth.js

@@ -1,5 +1,5 @@
-import { EMBED_MODE_QUERY_PARAM, EMBED_START_PATH, EMBED_TARGET_HEADER, EMBED_TARGET_QUERY_PARAM, EMBED_TOKEN_QUERY_PARAM, MCP_APP_CHAT_BRIDGE_QUERY_PARAM, } from "../shared/embed-auth.js";
-import { isMcpDirectoryWidgetReadCapabilityScope } from "../shared/embed-auth.js";
+import { EMBED_MODE_QUERY_PARAM, EMBED_START_PATH, EMBED_TARGET_HEADER, EMBED_TARGET_QUERY_PARAM, EMBED_TOKEN_QUERY_PARAM, MCP_APP_CHAT_BRIDGE_QUERY_PARAM, MCP_DIRECTORY_WIDGET_SESSION_EXPIRED_HEADER, } from "../shared/embed-auth.js";
+import { isMcpDirectoryWidgetReadCapabilityScope, isMcpDirectoryWidgetWriteCapabilityScope, } from "../shared/embed-auth.js";
 import { FRAMEWORK_INTERNAL_ROUTE_PREFIX } from "../shared/framework-route-prefix.js";
 import { MCP_APP_HOST_FILL_ATTRIBUTE } from "../shared/mcp-app-display.js";
 import { EMBED_TOKEN_STORAGE_KEY, MCP_CHAT_BRIDGE_STORAGE_KEY, } from "../shared/mcp-app-widget-embed.js";
@@ -7,11 +7,16 @@ import { SIGN_IN_ENTRY_PATH, SIGN_IN_LEGACY_ENTRY_PATH, } from "../shared/sign-i
 import { frameworkRoutePrefix } from "./api-path.js";
 let installed = false;
 let memoryToken = null;
+let renewedFromUrlToken = null;
+let pendingWidgetSessionRenewal = null;
+let widgetSessionRenewalRequestId = 0;
 let mcpChatBridgeActive = false;
 let mcpChatBridgeScope = null;
 const AUTH_FAILURE_COOLDOWN_MS = 60_000;
 const GUARDED_METHODS = new Set(["GET", "HEAD"]);
 const AUTH_FAILURE_HEADER = "x-agent-native-auth-circuit-breaker";
+const EMBED_TOKEN_RENEWED_FROM_STORAGE_KEY = `${EMBED_TOKEN_STORAGE_KEY}:renewed-from`;
+const EMBED_SESSION_RENEWAL_TIMEOUT_MS = 15_000;
 const MCP_CHAT_BRIDGE_VIEWPORT_STYLE_ID = "agent-native-mcp-chat-bridge-viewport";
 const MCP_CHAT_BRIDGE_VIEWPORT_HEIGHT = 560;
 let pendingMcpChatBridgeViewportNotification = null;
@@ -43,7 +48,7 @@ export function readEmbedMcpChatBridgeFlagFromUrl() {
     return value === "1" || value === "true";
 }
 function currentMcpChatBridgeScope(win) {
-    return readTokenFromUrl(win) ?? memoryToken ?? storedToken(win);
+    return getEmbedAuthToken() ?? memoryToken ?? storedToken(win);
 }
 function clearMcpChatBridge(win) {
     mcpChatBridgeActive = false;
@@ -142,6 +147,31 @@ export function getEmbedAuthToken() {
         return null;
     const fromUrl = readTokenFromUrl(win);
     if (fromUrl) {
+        let renewedFrom = renewedFromUrlToken;
+        if (!renewedFrom) {
+            try {
+                renewedFrom =
+                    win.sessionStorage?.getItem(EMBED_TOKEN_RENEWED_FROM_STORAGE_KEY) ??
+                        null;
+            }
+            catch {
+                renewedFrom = null;
+            }
+        }
+        if (renewedFrom === fromUrl) {
+            const refreshed = memoryToken ?? storedToken(win);
+            if (refreshed && refreshed !== fromUrl)
+                return refreshed;
+        }
+        if (renewedFrom && renewedFrom !== fromUrl) {
+            renewedFromUrlToken = null;
+            try {
+                win.sessionStorage?.removeItem(EMBED_TOKEN_RENEWED_FROM_STORAGE_KEY);
+            }
+            catch {
+                // coercion-ok: cleanup is best-effort; the refreshed URL token still supersedes this marker.
+            }
+        }
         storeToken(fromUrl, win);
         return fromUrl;
     }
@@ -160,7 +190,7 @@ function readEmbedTokenScope(token) {
         return undefined;
     }
 }
-let readOnlyScopeCache = null;
+let widgetScopeCache = null;
 /**
  * True when the embed credential is a directory-widget read capability, which
  * only the MCP App widget flows mint. It stays readable after a client
@@ -173,13 +203,29 @@ export function hasMcpDirectoryWidgetCapabilityToken() {
     const token = getEmbedAuthToken();
     if (!token)
         return false;
-    if (readOnlyScopeCache?.token !== token) {
-        readOnlyScopeCache = {
+    if (widgetScopeCache?.token !== token) {
+        const scope = readEmbedTokenScope(token);
+        widgetScopeCache = {
             token,
-            readOnly: isMcpDirectoryWidgetReadCapabilityScope(readEmbedTokenScope(token)),
+            readOnly: isMcpDirectoryWidgetReadCapabilityScope(scope),
+            writable: isMcpDirectoryWidgetWriteCapabilityScope(scope),
         };
     }
-    return readOnlyScopeCache.readOnly;
+    return widgetScopeCache.readOnly || widgetScopeCache.writable;
+}
+export function hasMcpDirectoryWidgetWriteCapabilityToken() {
+    const token = getEmbedAuthToken();
+    if (!token)
+        return false;
+    if (widgetScopeCache?.token !== token) {
+        const scope = readEmbedTokenScope(token);
+        widgetScopeCache = {
+            token,
+            readOnly: isMcpDirectoryWidgetReadCapabilityScope(scope),
+            writable: isMcpDirectoryWidgetWriteCapabilityScope(scope),
+        };
+    }
+    return widgetScopeCache.writable;
 }
 /**
  * True when this document is the app nested in an MCP App widget shell (the
@@ -187,7 +233,21 @@ export function hasMcpDirectoryWidgetCapabilityToken() {
  * server limits to the widget's own resource reads.
  */
 export function isMcpDirectoryWidgetReadOnlyEmbed() {
-    return hasMcpDirectoryWidgetCapabilityToken() && isEmbedMcpChatBridgeActive();
+    const token = getEmbedAuthToken();
+    if (!token)
+        return false;
+    if (widgetScopeCache?.token !== token) {
+        const scope = readEmbedTokenScope(token);
+        widgetScopeCache = {
+            token,
+            readOnly: isMcpDirectoryWidgetReadCapabilityScope(scope),
+            writable: isMcpDirectoryWidgetWriteCapabilityScope(scope),
+        };
+    }
+    return widgetScopeCache.readOnly && isEmbedMcpChatBridgeActive();
+}
+export function isMcpDirectoryWidgetWriteEmbed() {
+    return (hasMcpDirectoryWidgetWriteCapabilityToken() && isEmbedMcpChatBridgeActive());
 }
 export function isEmbedAuthActive() {
     const win = browserWindow();
@@ -303,7 +363,10 @@ export function _resetEmbedAuthForTests() {
     }
     installed = false;
     memoryToken = null;
-    readOnlyScopeCache = null;
+    renewedFromUrlToken = null;
+    pendingWidgetSessionRenewal = null;
+    widgetSessionRenewalRequestId = 0;
+    widgetScopeCache = null;
     mcpChatBridgeActive = false;
     mcpChatBridgeScope = null;
     authFailureCache.clear();
@@ -526,6 +589,63 @@ function requestUrlAndKey(input, init, win) {
         shouldGuard: shouldGuardAuthFailure(method, url),
     };
 }
+function requestWidgetSessionRenewal(win) {
+    if (pendingWidgetSessionRenewal)
+        return pendingWidgetSessionRenewal;
+    if (!win.parent || win.parent === win)
+        return Promise.resolve(false);
+    widgetSessionRenewalRequestId += 1;
+    const requestId = `embed-renewal-${Date.now()}-${widgetSessionRenewalRequestId}`;
+    const renewal = new Promise((resolve) => {
+        let settled = false;
+        let timeoutId = null;
+        const finish = (succeeded) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timeoutId !== null)
+                win.clearTimeout(timeoutId);
+            win.removeEventListener("message", onMessage);
+            resolve(succeeded);
+        };
+        const onMessage = (event) => {
+            if (event.source !== win.parent)
+                return;
+            const message = event.data;
+            const data = message && typeof message === "object" ? message.data : null;
+            if (message?.type !== "agentNative.embedSessionRenewed" ||
+                data?.requestId !== requestId) {
+                return;
+            }
+            if (data.ok !== true) {
+                finish(false);
+                return;
+            }
+            try {
+                win.parent.postMessage({ type: "agentNative.embedSessionRenewalApplied", requestId }, "*");
+            }
+            catch (error) {
+                console.warn("[agent-native] could not acknowledge embedded session renewal", error);
+            }
+            finish(true);
+        };
+        win.addEventListener("message", onMessage);
+        timeoutId = win.setTimeout(() => finish(false), EMBED_SESSION_RENEWAL_TIMEOUT_MS);
+        try {
+            win.parent.postMessage({
+                type: "agentNative.embedSessionExpired",
+                data: { requestId },
+            }, "*");
+        }
+        catch {
+            finish(false);
+        }
+    }).finally(() => {
+        pendingWidgetSessionRenewal = null;
+    });
+    pendingWidgetSessionRenewal = renewal;
+    return renewal;
+}
 export function ensureEmbedAuthFetchInterceptor() {
     const win = browserWindow();
     if (!win)
@@ -534,7 +654,7 @@ export function ensureEmbedAuthFetchInterceptor() {
         markEmbedMcpChatBridgeActive();
     const urlToken = readTokenFromUrl(win);
     if (urlToken) {
-        storeToken(urlToken, win);
+        getEmbedAuthToken();
         stripTokenFromUrl(win);
     }
     ensureMcpChatBridgeViewportClamp(win);
@@ -562,7 +682,35 @@ export function ensureEmbedAuthFetchInterceptor() {
         if (token && sameOrigin(input, win)) {
             [fetchInput, fetchInit] = withEmbedAuthHeaders(input, init, token, win);
         }
-        const response = await originalFetch(fetchInput, fetchInit);
+        const canRenewWidgetSession = Boolean(token) &&
+            isMcpDirectoryWidgetWriteEmbed() &&
+            request &&
+            sameOrigin(input, win);
+        let replayRequest = null;
+        let firstRequest = null;
+        if (canRenewWidgetSession) {
+            try {
+                firstRequest = new Request(fetchInput, fetchInit);
+                replayRequest = firstRequest.clone();
+            }
+            catch {
+                // coercion-ok: non-cloneable streamed writes retain their original response and are not replayed.
+            }
+        }
+        let response = firstRequest
+            ? await originalFetch(firstRequest)
+            : await originalFetch(fetchInput, fetchInit);
+        if (response.status === 401 && canRenewWidgetSession) {
+            const sessionExpired = response.headers.get(MCP_DIRECTORY_WIDGET_SESSION_EXPIRED_HEADER) ===
+                "1";
+            if (sessionExpired && replayRequest && token) {
+                const renewed = await requestWidgetSessionRenewal(win);
+                if (renewed) {
+                    const [retryInput, retryInit] = withEmbedAuthHeaders(replayRequest, undefined, token, win);
+                    response = await originalFetch(retryInput, retryInit);
+                }
+            }
+        }
         if (request?.shouldGuard && isAuthFailureStatus(response.status)) {
             await recordAuthFailure(request.key, response);
         }

package/dist/client/host/index.d.ts

@@ -1,12 +1,12 @@
 export { initializeAgentNativeClient } from "../client-bootstrap.js";
 export { agentNativeApiDisabledReason, AgentNativeApiDisabledError, setAgentNativeApiDisabled, } from "../api-surface.js";
-export { ensureEmbedAuthFetchInterceptor, getEmbedAuthToken, isEmbedAuthActive, isEmbedMcpChatBridgeActive, isMcpDirectoryWidgetReadOnlyEmbed, } from "../embed-auth.js";
+export { ensureEmbedAuthFetchInterceptor, getEmbedAuthToken, isEmbedAuthActive, isEmbedMcpChatBridgeActive, isMcpDirectoryWidgetReadOnlyEmbed, isMcpDirectoryWidgetWriteEmbed, } from "../embed-auth.js";
 export { sendToFrame, onFrameMessage, requestUserInfo, getFrameOrigin, getFramePostMessageTargetOrigin, getCallbackOrigin, oauthRedirectUri, isInFrame, isTrustedFrameMessage, enterStyleEditing, enterTextEditing, exitSelectionMode, type UserInfo, } from "../frame.js";
 export { getBuilderParentOrigin, isInBuilderFrame, sendToBuilderChat, shouldParentFrameOwnAgentPanel, isTrustedBuilderMessage, tryDelegateBuildRequestToBuilder, type BuilderChatMessage, } from "../builder-frame.js";
 export { getClientSurface, type ClientSurface } from "../client-surface.js";
 export { defineClientAction, type AgentNativeClientActionDefinition, type AgentNativeClientActionRunner, } from "../client-action.js";
 export { DESKTOP_LOCAL_CODE_CHANGE_EVENT, requestDesktopLocalCodeChange, type DesktopLocalCodeChangeDetail, } from "../desktop-local-code-change.js";
-export { buildSessionReplayIframeBootstrap, injectSessionReplayIframeBootstrap, } from "../../extensions/session-replay-iframe.js";
+export { buildSessionReplayIframeBootstrap, injectSessionReplayIframeBootstrap, RRWEB_RECORD_IFRAME_CDN_URL, } from "../../extensions/session-replay-iframe.js";
 export { SESSION_REPLAY_IFRAME_ATTRIBUTE, SESSION_REPLAY_IFRAME_PROBE, SESSION_REPLAY_IFRAME_START, SESSION_REPLAY_IFRAME_STOP, } from "../../session-replay-iframe-protocol.js";
 export { AGENT_NATIVE_HOST_BRIDGE_VERSION, AGENT_NATIVE_HOST_MESSAGE_TYPES, announceAgentNativeFrameReady, createAgentNativeHostBridge, defaultAgentNativeHostCommands, onAgentNativeHostInit, readAgentNativeScreenContext, requestAgentNativeHostActions, requestAgentNativeHostContext, requestAgentNativeHostWebMcpTools, runAgentNativeHostAction, runAgentNativeHostWebMcpTool, sendAgentNativeHostCommand, type AgentNativeActionAvailability, type AgentNativeActionManifestEntry, type AgentNativeClientAction, type AgentNativeClientActionApprovalConfig, type AgentNativeClientActionGetter, type AgentNativeClientActionRuntime, type AgentNativeClientActions, type AgentNativeHostAuth, type AgentNativeHostAuthPayload, type AgentNativeHostBridge, type AgentNativeHostBridgeEvent, type AgentNativeHostBridgeOptions, type AgentNativeHostCapabilities, type AgentNativeHostCommandHandler, type AgentNativeHostCommandHandlers, type AgentNativeHostCommandRequest, type AgentNativeHostContext, type AgentNativeHostContextGetter, type AgentNativeHostInit, type AgentNativeHostMessageType, type AgentNativeHostRequestOptions, type AgentNativeHostResourceContext, type AgentNativeHostRouteContext, type AgentNativeHostSelectionContext, type AgentNativeHostSession, type AgentNativeJsonSchema, type AgentNativeScreenSnapshot, type AgentNativeScreenSnapshotOptions, type BuiltInAgentNativeHostCommand, } from "../host-bridge.js";
 export { AgentNativeWebMcpUnsupportedError, createAgentNativeWebMcpClient, createAgentNativeWebMcpRegistration, initializeAgentNativeWebMcp, isAgentNativeWebMcpSupported, type AgentNativeWebMcpApprovalRequest, type AgentNativeWebMcpClient, type AgentNativeWebMcpClientOptions, type AgentNativeWebMcpRegistration, type AgentNativeWebMcpRegistrationOptions, type AgentNativeWebMcpTool, type AgentNativeWebMcpToolAnnotations, type AgentNativeWebMcpToolExecutionOptions, type AgentNativeWebMcpToolResult, } from "../webmcp.js";

package/dist/client/host/index.js

@@ -1,12 +1,12 @@
 export { initializeAgentNativeClient } from "../client-bootstrap.js";
 export { agentNativeApiDisabledReason, AgentNativeApiDisabledError, setAgentNativeApiDisabled, } from "../api-surface.js";
-export { ensureEmbedAuthFetchInterceptor, getEmbedAuthToken, isEmbedAuthActive, isEmbedMcpChatBridgeActive, isMcpDirectoryWidgetReadOnlyEmbed, } from "../embed-auth.js";
+export { ensureEmbedAuthFetchInterceptor, getEmbedAuthToken, isEmbedAuthActive, isEmbedMcpChatBridgeActive, isMcpDirectoryWidgetReadOnlyEmbed, isMcpDirectoryWidgetWriteEmbed, } from "../embed-auth.js";
 export { sendToFrame, onFrameMessage, requestUserInfo, getFrameOrigin, getFramePostMessageTargetOrigin, getCallbackOrigin, oauthRedirectUri, isInFrame, isTrustedFrameMessage, enterStyleEditing, enterTextEditing, exitSelectionMode, } from "../frame.js";
 export { getBuilderParentOrigin, isInBuilderFrame, sendToBuilderChat, shouldParentFrameOwnAgentPanel, isTrustedBuilderMessage, tryDelegateBuildRequestToBuilder, } from "../builder-frame.js";
 export { getClientSurface } from "../client-surface.js";
 export { defineClientAction, } from "../client-action.js";
 export { DESKTOP_LOCAL_CODE_CHANGE_EVENT, requestDesktopLocalCodeChange, } from "../desktop-local-code-change.js";
-export { buildSessionReplayIframeBootstrap, injectSessionReplayIframeBootstrap, } from "../../extensions/session-replay-iframe.js";
+export { buildSessionReplayIframeBootstrap, injectSessionReplayIframeBootstrap, RRWEB_RECORD_IFRAME_CDN_URL, } from "../../extensions/session-replay-iframe.js";
 export { SESSION_REPLAY_IFRAME_ATTRIBUTE, SESSION_REPLAY_IFRAME_PROBE, SESSION_REPLAY_IFRAME_START, SESSION_REPLAY_IFRAME_STOP, } from "../../session-replay-iframe-protocol.js";
 export { AGENT_NATIVE_HOST_BRIDGE_VERSION, AGENT_NATIVE_HOST_MESSAGE_TYPES, announceAgentNativeFrameReady, createAgentNativeHostBridge, defaultAgentNativeHostCommands, onAgentNativeHostInit, readAgentNativeScreenContext, requestAgentNativeHostActions, requestAgentNativeHostContext, requestAgentNativeHostWebMcpTools, runAgentNativeHostAction, runAgentNativeHostWebMcpTool, sendAgentNativeHostCommand, } from "../host-bridge.js";
 export { AgentNativeWebMcpUnsupportedError, createAgentNativeWebMcpClient, createAgentNativeWebMcpRegistration, initializeAgentNativeWebMcp, isAgentNativeWebMcpSupported, } from "../webmcp.js";

package/dist/client/mcp-app-host.d.ts

@@ -64,6 +64,7 @@ export declare function useIsMcpAppWidgetEmbed(): boolean;
  * instead of showing errors for requests that can never land.
  */
 export declare function useIsMcpDirectoryWidgetReadOnlyEmbed(): boolean;
+export declare function useIsMcpDirectoryWidgetWriteEmbed(): boolean;
 export declare function isOpenAiMcpAppHost(): boolean;
 export declare function initializeMcpAppHost(): Promise<boolean>;
 export declare function sendMcpAppHostMessage(chat: McpAppHostChatMessage): Promise<boolean | null> | false;

package/dist/client/mcp-app-host.js

@@ -2,7 +2,7 @@ import { useSyncExternalStore } from "react";
 import { EMBED_MODE_QUERY_PARAM, EMBED_TOKEN_QUERY_PARAM, MCP_APP_CHAT_BRIDGE_QUERY_PARAM, } from "../shared/embed-auth.js";
 import { MCP_APP_HOST_FILL_ATTRIBUTE, mcpAppHostFillsContainer, } from "../shared/mcp-app-display.js";
 import { MCP_APP_WIDGET_EMBED_ATTRIBUTE } from "../shared/mcp-app-widget-embed.js";
-import { getEmbedAuthToken, hasMcpDirectoryWidgetCapabilityToken, isEmbedAuthActive, markEmbedMcpChatBridgeActive, isEmbedMcpChatBridgeActive, isMcpDirectoryWidgetReadOnlyEmbed, readEmbedMcpChatBridgeFlagFromUrl, } from "./embed-auth.js";
+import { getEmbedAuthToken, hasMcpDirectoryWidgetCapabilityToken, isEmbedAuthActive, markEmbedMcpChatBridgeActive, isEmbedMcpChatBridgeActive, isMcpDirectoryWidgetReadOnlyEmbed, isMcpDirectoryWidgetWriteEmbed, readEmbedMcpChatBridgeFlagFromUrl, } from "./embed-auth.js";
 import { getFrameOrigin } from "./frame.js";
 export const AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES = {
     HOST_CONTEXT: "agentNative.mcpHostContext",
@@ -410,6 +410,9 @@ export function useIsMcpAppWidgetEmbed() {
 export function useIsMcpDirectoryWidgetReadOnlyEmbed() {
     return useSyncExternalStore(() => () => { }, isMcpDirectoryWidgetReadOnlyEmbed, () => false);
 }
+export function useIsMcpDirectoryWidgetWriteEmbed() {
+    return useSyncExternalStore(() => () => { }, isMcpDirectoryWidgetWriteEmbed, () => false);
+}
 export function isOpenAiMcpAppHost() {
     return (isInChildFrame() && isMcpAppBridgeEnabled() && readOpenAiBridge() !== null);
 }

package/dist/client/session-replay.js

@@ -2005,7 +2005,38 @@ function installSessionReplayIframeBridge(state, options) {
     const stopMessage = {
         type: SESSION_REPLAY_IFRAME_STOP,
     };
-    const sendStart = (iframe) => postSessionReplayIframeMessage(iframe, startMessage);
+    const recordingFrames = new Set();
+    const startFrame = (iframe, retry = false) => {
+        if (!state.active ||
+            !iframe.hasAttribute(SESSION_REPLAY_IFRAME_ATTRIBUTE)) {
+            return;
+        }
+        if (recordingFrames.has(iframe)) {
+            if (retry)
+                postSessionReplayIframeMessage(iframe, startMessage);
+            return;
+        }
+        recordingFrames.add(iframe);
+        postSessionReplayIframeMessage(iframe, startMessage);
+    };
+    const stopFrame = (iframe) => {
+        if (!recordingFrames.delete(iframe))
+            return;
+        postSessionReplayIframeMessage(iframe, stopMessage);
+    };
+    const iframesIn = (node) => {
+        if (node.nodeType !== 1 && node.nodeType !== 11)
+            return [];
+        const element = node;
+        const frames = [];
+        if (element.nodeType === 1 && element.localName === "iframe") {
+            frames.push(element);
+        }
+        if (typeof element.querySelectorAll === "function") {
+            frames.push(...Array.from(element.querySelectorAll("iframe")));
+        }
+        return frames;
+    };
     const onMessage = (event) => {
         if (!state.active)
             return;
@@ -2016,16 +2047,49 @@ function installSessionReplayIframeBridge(state, options) {
         }
         const iframe = markedSessionReplayIframeForSource(event.source);
         if (iframe)
-            sendStart(iframe);
+            startFrame(iframe, true);
     };
     window.addEventListener("message", onMessage);
+    const observer = typeof MutationObserver === "undefined" || !document.documentElement
+        ? null
+        : new MutationObserver((records) => {
+            for (const record of records) {
+                if (record.type === "attributes") {
+                    const target = record.target;
+                    if (target.localName !== "iframe")
+                        continue;
+                    const iframe = target;
+                    if (iframe.hasAttribute(SESSION_REPLAY_IFRAME_ATTRIBUTE)) {
+                        startFrame(iframe);
+                    }
+                    else {
+                        stopFrame(iframe);
+                    }
+                    continue;
+                }
+                for (const removed of Array.from(record.removedNodes)) {
+                    for (const iframe of iframesIn(removed))
+                        stopFrame(iframe);
+                }
+                for (const added of Array.from(record.addedNodes)) {
+                    for (const iframe of iframesIn(added))
+                        startFrame(iframe);
+                }
+            }
+        });
+    observer?.observe(document.documentElement, {
+        attributes: true,
+        attributeFilter: [SESSION_REPLAY_IFRAME_ATTRIBUTE],
+        childList: true,
+        subtree: true,
+    });
     for (const iframe of markedSessionReplayIframes())
-        sendStart(iframe);
+        startFrame(iframe);
     state.restoreIframeBridge = () => {
         window.removeEventListener("message", onMessage);
-        for (const iframe of markedSessionReplayIframes()) {
-            postSessionReplayIframeMessage(iframe, stopMessage);
-        }
+        observer?.disconnect();
+        for (const iframe of recordingFrames)
+            stopFrame(iframe);
         state.restoreIframeBridge = null;
     };
 }