@agent-native/core 0.206.0-nightly-20261009124314 → 0.206.0

package/dist/collab/routes.d.ts

@@ -13,8 +13,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
     };
 }>>;
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/db/client.js

@@ -156,7 +156,9 @@ export function pgliteDataDirFromUrl(url) {
     if (!dataDir || dataDir === "/")
         return "./data/pglite";
     if (dataDir === "memory" ||
+        dataDir === "memory:" ||
         dataDir === "/memory" ||
+        dataDir === "/memory:" ||
         dataDir === ":memory:" ||
         dataDir === "/:memory:" ||
         dataDir === "memory://") {

package/dist/db/drizzle-config.js

@@ -20,7 +20,9 @@ function pgliteDataDirFromUrl(url) {
     if (!dataDir || dataDir === "/")
         return "./data/pglite";
     if (dataDir === "memory" ||
+        dataDir === "memory:" ||
         dataDir === "/memory" ||
+        dataDir === "/memory:" ||
         dataDir === ":memory:" ||
         dataDir === "/:memory:" ||
         dataDir === "memory://") {

package/dist/event-bus/bus.d.ts

@@ -1,6 +1,12 @@
 import type { EventMeta } from "./types.js";
 type Handler = (payload: unknown, meta: EventMeta) => void | Promise<void>;
+type AnyEventHandler = (event: string, payload: unknown, meta: EventMeta) => void | Promise<void>;
 export declare function subscribe(event: string, handler: Handler): string;
+/**
+ * Subscribe to every emitted event. For a subscriber whose interest is stored
+ * data it should not read until an event actually arrives.
+ */
+export declare function subscribeAll(handler: AnyEventHandler): string;
 export declare function unsubscribe(id: string): boolean;
 export declare function emit(event: string, payload: unknown, meta?: Partial<EventMeta>): void;
 /** Emit an event and wait until every subscriber has accepted it. */

package/dist/event-bus/bus.js

@@ -11,6 +11,11 @@ function getBus() {
     }
     return g[BUS_KEY];
 }
+function getAnyEventSubscriptions() {
+    const bus = getBus();
+    bus.anyEventSubscriptions ??= new Map();
+    return bus.anyEventSubscriptions;
+}
 export function subscribe(event, handler) {
     if (typeof event !== "string" || !event) {
         throw new Error("subscribe: event name is required");
@@ -24,7 +29,21 @@ export function subscribe(event, handler) {
     bus.emitter.on(event, handler);
     return id;
 }
+/**
+ * Subscribe to every emitted event. For a subscriber whose interest is stored
+ * data it should not read until an event actually arrives.
+ */
+export function subscribeAll(handler) {
+    if (typeof handler !== "function") {
+        throw new Error("subscribeAll: handler must be a function");
+    }
+    const id = randomUUID();
+    getAnyEventSubscriptions().set(id, handler);
+    return id;
+}
 export function unsubscribe(id) {
+    if (getAnyEventSubscriptions().delete(id))
+        return true;
     const bus = getBus();
     const sub = bus.subscriptions.get(id);
     if (!sub)
@@ -95,7 +114,10 @@ function prepareDispatch(event, payload, meta, throwOnInvalid) {
         emittedAt: meta?.emittedAt ?? new Date().toISOString(),
         owner: meta?.owner,
     };
-    const listeners = bus.emitter.listeners(event);
+    const listeners = [
+        ...bus.emitter.listeners(event),
+        ...[...getAnyEventSubscriptions().values()].map((handler) => (eventPayload, eventMeta) => handler(event, eventPayload, eventMeta)),
+    ];
     return { payload: validated, meta: fullMeta, listeners };
 }
 export function listSubscriptions(event) {
@@ -112,4 +134,5 @@ export function __resetEventBus() {
     const bus = getBus();
     bus.emitter.removeAllListeners();
     bus.subscriptions.clear();
+    getAnyEventSubscriptions().clear();
 }

package/dist/event-bus/index.d.ts

@@ -1,3 +1,3 @@
 export { registerEvent, listEvents, getEvent } from "./registry.js";
-export { emit, emitAsync, subscribe, unsubscribe, listSubscriptions, } from "./bus.js";
+export { emit, emitAsync, subscribe, subscribeAll, unsubscribe, listSubscriptions, } from "./bus.js";
 export type { EventDefinition, EventSubscription, EventMeta } from "./types.js";

package/dist/event-bus/index.js

@@ -1,2 +1,2 @@
 export { registerEvent, listEvents, getEvent } from "./registry.js";
-export { emit, emitAsync, subscribe, unsubscribe, listSubscriptions, } from "./bus.js";
+export { emit, emitAsync, subscribe, subscribeAll, unsubscribe, listSubscriptions, } from "./bus.js";

package/dist/extensions/html-shell.d.ts

@@ -1,6 +1,31 @@
+/**
+ * Builds the iframe CSP from the img-src / media-src lists.
+ *
+ * SECURITY: both lists are validated again here, at the point they are
+ * interpolated, rather than trusted because they came from app config. The
+ * resolved config is a cached, mutable object, and the client renderers pass
+ * lists fetched from the server, so neither is guaranteed to still be what the
+ * schema accepted. A list that fails validation throws instead of producing a
+ * policy with an injected directive.
+ */
+export declare function extensionIframeCspBase(imageSources: readonly string[], mediaSources: readonly string[]): string;
 export declare const EXTENSION_FRAME_ANCESTORS: string;
 export declare const EXTENSION_IFRAME_CSP: string;
-export declare const EXTENSION_IFRAME_META_CSP = "default-src 'none'; script-src 'self' https://cdn.jsdelivr.net 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src https://fonts.gstatic.com; connect-src 'self'; img-src 'self' data: blob:; media-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none';";
+export declare const EXTENSION_IFRAME_META_CSP: string;
+/**
+ * Authenticated endpoint that returns the deployment's validated
+ * `{ imageSources, mediaSources }`, so the client-rendered `srcDoc` frames
+ * (`ExtensionViewer`, `InlineExtensionFrame`) can apply the same img-src /
+ * media-src policy as the server render route without importing app config.
+ */
+export declare const EXTENSION_IFRAME_DISPLAY_SOURCES_PATH = "/_agent-native/extensions/iframe/display-sources";
+/**
+ * Builds the meta CSP for a client-rendered frame from the
+ * `EXTENSION_IFRAME_DISPLAY_SOURCES_PATH` response. Anything that is not a
+ * valid pair of source lists falls back to the default policy, which blocks
+ * every remote image and media source (fail closed).
+ */
+export declare function extensionIframeMetaCspFromDisplaySources(value: unknown): string;
 /**
  * SECURITY — EXTENSION CONTENT IS UNTRUSTED.
  *
@@ -21,6 +46,14 @@ export declare const EXTENSION_IFRAME_META_CSP = "default-src 'none'; script-src
  *      header sanitization, and method allowlist; do not relax those gates
  *      for "convenience" in this file or any caller.
  *
+ *   3. `connect-src` stays `'self'` and stays out of app config. Remote
+ *      images and media are `extensions.iframeImageSources` /
+ *      `iframeMediaSources`, which reach only `img-src` / `media-src`.
+ *      Each allowed remote origin is an explicit egress permission: the
+ *      browser sends the URL, and extension script can encode data into
+ *      it. API calls stay on the permission-gated host bridge. Token
+ *      validation still stops a value from appending another directive.
+ *
  * For the trust model rationale, see audit 05-tools-sandbox.md (C1) and the
  * `extensions` skill. When in doubt, fail closed.
  *
@@ -58,4 +91,4 @@ export interface ExtensionRenderBinding {
         externalFetch?: boolean;
     };
 }
-export declare function buildExtensionHtml(content: string, themeVars: string, isDark: boolean, extensionId?: string, binding?: ExtensionRenderBinding): string;
+export declare function buildExtensionHtml(content: string, themeVars: string, isDark: boolean, extensionId?: string, binding?: ExtensionRenderBinding, metaCsp?: string): string;

package/dist/extensions/html-shell.js

@@ -1,5 +1,31 @@
+// Import-free on purpose: this shell is also built in the browser
+// (ExtensionViewer, InlineExtensionFrame), so it must not import the
+// app-config store. Configured sources are resolved server-side in
+// ./iframe-csp.ts: the render route passes them in, and the client renderers
+// fetch them from EXTENSION_IFRAME_DISPLAY_SOURCES_PATH.
+import { DEFAULT_EXTENSION_DISPLAY_SOURCES, extensionDisplaySourcesError, } from "../app-config/extension-display-sources.js";
 import { buildSessionReplayIframeBootstrap } from "./session-replay-iframe.js";
-const EXTENSION_IFRAME_CSP_BASE = "default-src 'none'; script-src 'self' https://cdn.jsdelivr.net 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src https://fonts.gstatic.com; connect-src 'self'; img-src 'self' data: blob:; media-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none';";
+/**
+ * Builds the iframe CSP from the img-src / media-src lists.
+ *
+ * SECURITY: both lists are validated again here, at the point they are
+ * interpolated, rather than trusted because they came from app config. The
+ * resolved config is a cached, mutable object, and the client renderers pass
+ * lists fetched from the server, so neither is guaranteed to still be what the
+ * schema accepted. A list that fails validation throws instead of producing a
+ * policy with an injected directive.
+ */
+export function extensionIframeCspBase(imageSources, mediaSources) {
+    const imageError = extensionDisplaySourcesError(imageSources);
+    if (imageError) {
+        throw new TypeError(`Invalid extension iframe img-src: ${imageError}`);
+    }
+    const mediaError = extensionDisplaySourcesError(mediaSources);
+    if (mediaError) {
+        throw new TypeError(`Invalid extension iframe media-src: ${mediaError}`);
+    }
+    return `default-src 'none'; script-src 'self' https://cdn.jsdelivr.net 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src https://fonts.gstatic.com; connect-src 'self'; img-src ${imageSources.join(" ")}; media-src ${mediaSources.join(" ")}; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none';`;
+}
 export const EXTENSION_FRAME_ANCESTORS = [
     "'self'",
     "https://agent-native.com",
@@ -10,9 +36,40 @@ export const EXTENSION_FRAME_ANCESTORS = [
     "https://*.claudemcpcontent.com",
     "https://*.web-sandbox.oaiusercontent.com",
 ].join(" ");
-export const EXTENSION_IFRAME_CSP = `${EXTENSION_IFRAME_CSP_BASE} frame-ancestors ${EXTENSION_FRAME_ANCESTORS};`;
-export const EXTENSION_IFRAME_META_CSP = EXTENSION_IFRAME_CSP_BASE;
-export function buildExtensionHtml(content, themeVars, isDark, extensionId, binding) {
+// The two constants below are the policy an app gets before it configures
+// anything. `buildExtensionIframeCsp()` (server-only, ./iframe-csp.ts) resolves `extensions.iframeImageSources`
+// and `extensions.iframeMediaSources` and is what the render route sets, so a
+// deployment that widens img-src / media-src still gets the same
+// `connect-src 'self'` as one that does not. A remote image or media
+// origin is its own egress permission: the browser requests that URL.
+export const EXTENSION_IFRAME_CSP = `${extensionIframeCspBase(DEFAULT_EXTENSION_DISPLAY_SOURCES, DEFAULT_EXTENSION_DISPLAY_SOURCES)} frame-ancestors ${EXTENSION_FRAME_ANCESTORS};`;
+export const EXTENSION_IFRAME_META_CSP = extensionIframeCspBase(DEFAULT_EXTENSION_DISPLAY_SOURCES, DEFAULT_EXTENSION_DISPLAY_SOURCES);
+/**
+ * Authenticated endpoint that returns the deployment's validated
+ * `{ imageSources, mediaSources }`, so the client-rendered `srcDoc` frames
+ * (`ExtensionViewer`, `InlineExtensionFrame`) can apply the same img-src /
+ * media-src policy as the server render route without importing app config.
+ */
+export const EXTENSION_IFRAME_DISPLAY_SOURCES_PATH = "/_agent-native/extensions/iframe/display-sources";
+/**
+ * Builds the meta CSP for a client-rendered frame from the
+ * `EXTENSION_IFRAME_DISPLAY_SOURCES_PATH` response. Anything that is not a
+ * valid pair of source lists falls back to the default policy, which blocks
+ * every remote image and media source (fail closed).
+ */
+export function extensionIframeMetaCspFromDisplaySources(value) {
+    if (typeof value !== "object" || value === null) {
+        return EXTENSION_IFRAME_META_CSP;
+    }
+    const { imageSources, mediaSources } = value;
+    try {
+        return extensionIframeCspBase(imageSources, mediaSources);
+    }
+    catch {
+        return EXTENSION_IFRAME_META_CSP;
+    }
+}
+export function buildExtensionHtml(content, themeVars, isDark, extensionId, binding, metaCsp = EXTENSION_IFRAME_META_CSP) {
     const extensionIdJson = JSON.stringify(extensionId ?? "");
     const extensionIdAttr = escapeHtmlAttribute(extensionId ?? "");
     const bindingJson = JSON.stringify(binding ?? {
@@ -26,7 +83,7 @@ export function buildExtensionHtml(content, themeVars, isDark, extensionId, bind
 <head>
   <meta charset="utf-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <meta http-equiv="Content-Security-Policy" content="${EXTENSION_IFRAME_META_CSP}" />
+  <meta http-equiv="Content-Security-Policy" content="${metaCsp}" />
   ${binding && !binding.isAuthor ? `<meta name="agent-native-extension-author" content="${escapeHtmlAttribute(binding.authorEmail)}" />` : ""}
   <link rel="preconnect" href="https://fonts.googleapis.com" />
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />

package/dist/extensions/iframe-csp.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Server-only: resolves `extensions.iframeImageSources` /
+ * `extensions.iframeMediaSources` from app config. Kept out of
+ * `html-shell.ts` because that shell is also built in the browser, where the
+ * app-config store must not be imported.
+ */
+export declare function buildExtensionIframeMetaCsp(): string;
+export interface ExtensionIframeDisplaySources {
+    imageSources: string[];
+    mediaSources: string[];
+}
+/**
+ * The configured img-src / media-src lists for the client-rendered frames,
+ * served at `EXTENSION_IFRAME_DISPLAY_SOURCES_PATH`. Validated through the same
+ * CSP builder before they leave the server, and copied so the response cannot
+ * alias the cached resolved config.
+ */
+export declare function getExtensionIframeDisplaySources(): ExtensionIframeDisplaySources;
+/** The header CSP the render route sets: the meta CSP plus `frame-ancestors`. */
+export declare function buildExtensionIframeCsp(): string;

package/dist/extensions/iframe-csp.js

@@ -0,0 +1,30 @@
+import { getAppConfig } from "../app-config/index.js";
+import { EXTENSION_FRAME_ANCESTORS, extensionIframeCspBase, } from "./html-shell.js";
+/**
+ * Server-only: resolves `extensions.iframeImageSources` /
+ * `extensions.iframeMediaSources` from app config. Kept out of
+ * `html-shell.ts` because that shell is also built in the browser, where the
+ * app-config store must not be imported.
+ */
+export function buildExtensionIframeMetaCsp() {
+    const { iframeImageSources, iframeMediaSources } = getAppConfig().extensions;
+    return extensionIframeCspBase(iframeImageSources, iframeMediaSources);
+}
+/**
+ * The configured img-src / media-src lists for the client-rendered frames,
+ * served at `EXTENSION_IFRAME_DISPLAY_SOURCES_PATH`. Validated through the same
+ * CSP builder before they leave the server, and copied so the response cannot
+ * alias the cached resolved config.
+ */
+export function getExtensionIframeDisplaySources() {
+    const { iframeImageSources, iframeMediaSources } = getAppConfig().extensions;
+    extensionIframeCspBase(iframeImageSources, iframeMediaSources);
+    return {
+        imageSources: [...iframeImageSources],
+        mediaSources: [...iframeMediaSources],
+    };
+}
+/** The header CSP the render route sets: the meta CSP plus `frame-ancestors`. */
+export function buildExtensionIframeCsp() {
+    return `${buildExtensionIframeMetaCsp()} frame-ancestors ${EXTENSION_FRAME_ANCESTORS};`;
+}

package/dist/extensions/routes.js

@@ -9,7 +9,8 @@ import { runWithRequestContext, getRequestOrgId, } from "../server/request-conte
 import { ForbiddenError, resolveAccess } from "../sharing/access.js";
 import { ROLE_RANK } from "../sharing/schema.js";
 import { ExtensionContentEditError } from "./content-patch.js";
-import { buildExtensionHtml, EXTENSION_IFRAME_CSP } from "./html-shell.js";
+import { buildExtensionHtml } from "./html-shell.js";
+import { buildExtensionIframeCsp, buildExtensionIframeMetaCsp, getExtensionIframeDisplaySources, } from "./iframe-csp.js";
 import { getLocalExtension, isLocalExtensionRow, listLocalExtensions, } from "./local.js";
 import { collectSecretValues, normalizeExtensionProxyMethod, readResponseTextWithLimit, redactSecrets, redactString, sanitizeOutboundHeaders, } from "./proxy-security.js";
 import { listExtensions, getExtension, getExtensionHistoryVersion, listExtensionHistory, createExtension, updateExtension, updateExtensionContent, restoreExtensionHistoryVersion, deleteExtension, hideExtension, unhideExtension, globalHideExtension, globalUnhideExtension, ensureExtensionsTables, } from "./store.js";
@@ -51,6 +52,17 @@ export function createExtensionsHandler(options = {}) {
                     setResponseStatus(event, 403);
                     return { error: "Extension creation is disabled for this app" };
                 }
+                // The configured img-src / media-src for client-rendered srcDoc frames
+                // (EXTENSION_IFRAME_DISPLAY_SOURCES_PATH). It only reads validated app
+                // config, so it is answered before the extension tables are set up.
+                // Two segments, and no extension route uses `display-sources`, so this
+                // cannot shadow an extension id.
+                if (method === "GET" &&
+                    parts.length === 2 &&
+                    parts[0] === "iframe" &&
+                    parts[1] === "display-sources") {
+                    return getExtensionIframeDisplaySources();
+                }
                 await ensureExtensionsTables();
                 return dispatch(event, method, parts, userEmail);
             });
@@ -130,9 +142,9 @@ async function dispatch(event, method, parts, userEmail) {
                 role: "viewer",
                 source: "local-files",
                 permissions: localExtension.source.permissions,
-            });
+            }, buildExtensionIframeMetaCsp());
             setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
-            setResponseHeader(event, "Content-Security-Policy", EXTENSION_IFRAME_CSP);
+            setResponseHeader(event, "Content-Security-Policy", buildExtensionIframeCsp());
             setResponseHeader(event, "X-Content-Type-Options", "nosniff");
             setResponseHeader(event, "Referrer-Policy", "no-referrer");
             return html;
@@ -153,11 +165,11 @@ async function dispatch(event, method, parts, userEmail) {
             viewerEmail: userEmail,
             isAuthor,
             role: renderRole,
-        });
+        }, buildExtensionIframeMetaCsp());
         // Security headers per render. `frame-ancestors` in the CSP must be set as
         // an HTTP header to be enforced; meta-CSP can't set it per spec.
         setResponseHeader(event, "Content-Type", "text/html; charset=utf-8");
-        setResponseHeader(event, "Content-Security-Policy", EXTENSION_IFRAME_CSP);
+        setResponseHeader(event, "Content-Security-Policy", buildExtensionIframeCsp());
         setResponseHeader(event, "X-Content-Type-Options", "nosniff");
         setResponseHeader(event, "Referrer-Policy", "no-referrer");
         return html;

package/dist/mcp/build-server.d.ts

@@ -34,6 +34,8 @@ export interface MCPConfig {
     productionActions?: Record<string, ActionEntry>;
     /** Unlisted from this MCP surface; used only when minting scoped widget tickets. */
     widgetReadActions?: Record<string, ActionEntry>;
+    /** Unlisted from this MCP surface; editor mutations callable only by scoped widget grants. */
+    widgetWriteActions?: Record<string, ActionEntry>;
     askAgent?: (message: string) => Promise<string>;
     builtinCrossAppTools?: boolean;
     /**
@@ -55,7 +57,15 @@ export interface MCPConfig {
         widgets?: boolean;
         widgetDomain?: string;
         widgetTargets?: Record<string, (args: Record<string, unknown>, result: unknown) => McpDirectoryWidgetTarget | null>;
+        authorizeWidgetWrite?: (input: {
+            toolName: string;
+            args: Record<string, unknown>;
+            result: unknown;
+            target: McpDirectoryWidgetTarget;
+            identity: MCPCallerIdentity;
+        }) => boolean | Promise<boolean>;
         widgetReadActionArguments?: Record<string, Record<string, McpDirectoryWidgetReadArgument>>;
+        widgetWriteActionArguments?: Record<string, Record<string, McpDirectoryWidgetReadArgument>>;
         /** Actions whose capability-backed `mcp-widget` execution is strictly read-only. */
         widgetReadOnlyActions?: readonly string[];
         /** Unlisted public reads that are available only through a scoped widget ticket. */
@@ -79,10 +89,14 @@ export interface MCPConfig {
 export interface McpDirectoryWidgetTarget {
     targetPath: string;
     resourceIds: Record<string, string>;
+    /** Mutations available to this artifact's editor, selected from the profile allowlist. */
+    writeActions?: readonly string[];
 }
 export interface MCPCallerIdentity {
     userEmail: string | undefined;
     identityAssurance?: "user" | "organization" | "service";
+    /** Issue time, in milliseconds, from a verified app-issued MCP credential. */
+    mcpCredentialIssuedAtMs?: number;
     orgId?: string | null;
     orgDomain: string | undefined;
     oauthScopes?: string[];
@@ -108,6 +122,7 @@ export declare class McpDirectoryProfileValidationError extends Error {
 }
 export declare function selectMcpActionSurface(config: MCPConfig, requestMeta?: MCPRequestMeta): Record<string, ActionEntry>;
 export declare function selectMcpDirectoryWidgetReadActions(profile: MCPConfig["directoryProfile"] | undefined, actions: Record<string, ActionEntry>): Record<string, ActionEntry> | undefined;
+export declare function selectMcpDirectoryWidgetWriteActions(profile: MCPConfig["directoryProfile"] | undefined, actions: Record<string, ActionEntry>): Record<string, ActionEntry> | undefined;
 export declare function getConfiguredMcpOwnerEmail(): string | undefined;
 export declare function validateMcpDirectoryProfile(config: MCPConfig, sourceActions?: Record<string, ActionEntry>): void;
 export declare function validateMcpDirectoryWidgetDomain(domain: string | undefined): void;