@agent-native/core 0.206.0-nightly-20261009153146 → 0.206.0

package/dist/mcp/build-server.js

@@ -16,7 +16,7 @@ import { buildDeepLink, isAgentNativeOpenUrl, isSameOriginUrl, toAbsoluteOpenUrl
 import { getRequestContext, getRequestOrgId, getRequestUserEmail, runWithRequestContext, } from "../server/request-context.js";
 import { agentNativeMcpInstructions, agentNativeToolTitle, } from "../shared/agent-mcp-metadata.js";
 import { withCollapsedAgentSidebarParam } from "../shared/agent-sidebar-url.js";
-import { createMcpDirectoryWidgetReadCapability, MCP_APP_CHAT_BRIDGE_QUERY_PARAM, } from "../shared/embed-auth.js";
+import { createMcpDirectoryWidgetReadCapability, createMcpDirectoryWidgetWriteCapability, MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_AGE_MS, MCP_APP_CHAT_BRIDGE_QUERY_PARAM, renewMcpDirectoryWidgetCapabilityScope, } from "../shared/embed-auth.js";
 import { describeMcpError, readClientInfoFromRequest, trackMcpResourceRead, trackMcpResourcesList, trackMcpToolCall, trackMcpToolsList, } from "./analytics.js";
 import { consumeMcpApprovalGrant, createMcpApprovalGrant, } from "./approval-store.js";
 import { getBuiltinCrossAppTools } from "./builtin-tools.js";
@@ -199,6 +199,13 @@ export function selectMcpDirectoryWidgetReadActions(profile, actions) {
         .map((name) => [name, actions[name]])
         .filter((entry) => Boolean(entry[1])));
 }
+export function selectMcpDirectoryWidgetWriteActions(profile, actions) {
+    if (!profile)
+        return undefined;
+    return Object.fromEntries(Object.keys(profile.widgetWriteActionArguments ?? {})
+        .map((name) => [name, actions[name]])
+        .filter((entry) => Boolean(entry[1])));
+}
 export function getConfiguredMcpOwnerEmail() {
     return getAppConfig().auth.mcpOwnerEmail;
 }
@@ -349,6 +356,45 @@ export function validateMcpDirectoryProfile(config, sourceActions = config.produ
             throw new McpDirectoryProfileValidationError(`[agent-native] MCP directory widget read route "${name}" must be an explicitly scoped read-only GET action with valid resource arguments in the connector allowlist or hidden-read profiles.`);
         }
     }
+    for (const [name, argumentMap] of Object.entries(profile?.widgetWriteActionArguments ?? {})) {
+        const entry = actions[name] ?? config.widgetWriteActions?.[name];
+        if (!entry ||
+            entry.http === false ||
+            entry.http?.method === "GET" ||
+            entry.readOnly === true ||
+            entry.requiresAuth === false ||
+            !entry.schema ||
+            typeof entry.schema !== "object" ||
+            !("~standard" in entry.schema) ||
+            Object.keys(argumentMap).length === 0 ||
+            !Object.values(argumentMap).some((rule) => typeof rule === "string" ||
+                (rule?.type === "actionSchemaResourceBound" &&
+                    MCP_DIRECTORY_WIDGET_ARGUMENT.test(rule.resourceKey))) ||
+            Object.entries(argumentMap).some(([argumentName, argument]) => !MCP_DIRECTORY_WIDGET_ARGUMENT.test(argumentName) ||
+                (typeof argument === "string"
+                    ? !MCP_DIRECTORY_WIDGET_ARGUMENT.test(argument)
+                    : argument?.type === "actionSchema"
+                        ? Object.keys(argument).length !== 1 ||
+                            !entry.schema ||
+                            typeof entry.schema !== "object" ||
+                            !("~standard" in entry.schema)
+                        : argument?.type === "actionSchemaResourceBound"
+                            ? Object.keys(argument).length !== 2 ||
+                                !MCP_DIRECTORY_WIDGET_ARGUMENT.test(argument.resourceKey) ||
+                                !entry.schema ||
+                                typeof entry.schema !== "object" ||
+                                !("~standard" in entry.schema)
+                            : !argument ||
+                                argument.type !== "integerRange" ||
+                                Object.keys(argument).length !== 3 ||
+                                !Number.isSafeInteger(argument.min) ||
+                                !Number.isSafeInteger(argument.max) ||
+                                argument.min < 0 ||
+                                argument.max < argument.min ||
+                                argument.max > 5_000))) {
+            throw new McpDirectoryProfileValidationError(`[agent-native] MCP directory widget write action "${name}" must be an authenticated mutation action with an exact resource ID binding and valid argument allowlist.`);
+        }
+    }
 }
 export function validateMcpDirectoryWidgetDomain(domain) {
     let validWidgetDomain = false;
@@ -746,36 +792,59 @@ function mcpAppEmbedOpenLinkMeta(result, resource, meta) {
             : {}),
     };
 }
+function mcpDirectoryWidgetSourceMeta(toolName, embedMeta) {
+    const embedStart = metadataObject(embedMeta["agent-native/embedStart"]);
+    if (typeof embedStart.startUrl !== "string") {
+        return { "agent-native/widgetSource": { toolName } };
+    }
+    try {
+        const url = new URL(embedStart.startUrl, "https://agent-native.invalid");
+        const sourceTicket = url.pathname.includes("/_agent-native/embed/start")
+            ? url.searchParams.get("ticket")
+            : null;
+        return {
+            "agent-native/widgetSource": {
+                toolName,
+                ...(sourceTicket ? { sourceTicket } : {}),
+            },
+        };
+    }
+    catch {
+        return { "agent-native/widgetSource": { toolName } };
+    }
+}
 async function withServerMintedMcpAppEmbedStart(result, meta, directoryLinkUrl, directoryWidget) {
     if (!result || typeof result !== "object" || Array.isArray(result)) {
         return result;
     }
     const out = result;
-    const restrictDirectoryWidgetRead = directoryWidget !== undefined;
+    const restrictDirectoryWidgetCapability = directoryWidget !== undefined;
     const resultWithoutExistingEmbedTicket = { ...out };
-    if (restrictDirectoryWidgetRead) {
+    if (restrictDirectoryWidgetCapability) {
         delete resultWithoutExistingEmbedTicket.embedStartUrl;
         delete resultWithoutExistingEmbedTicket.embedTargetPath;
         delete resultWithoutExistingEmbedTicket.embedExpiresAt;
     }
     if (out.embed === false ||
-        (!restrictDirectoryWidgetRead && out.embed !== true && !directoryLinkUrl)) {
-        return restrictDirectoryWidgetRead
+        (!restrictDirectoryWidgetCapability &&
+            out.embed !== true &&
+            !directoryLinkUrl)) {
+        return restrictDirectoryWidgetCapability
             ? resultWithoutExistingEmbedTicket
             : result;
     }
-    if (!restrictDirectoryWidgetRead &&
+    if (!restrictDirectoryWidgetCapability &&
         typeof out.embedStartUrl === "string" &&
         out.embedStartUrl.trim()) {
         return result;
     }
-    if (!restrictDirectoryWidgetRead &&
+    if (!restrictDirectoryWidgetCapability &&
         typeof out.url === "string" &&
         out.url.trim() &&
         isEmbedStartUrl(out.url)) {
         return result;
     }
-    const candidates = restrictDirectoryWidgetRead
+    const candidates = restrictDirectoryWidgetCapability
         ? [directoryWidget.targetPath]
         : out.embed === true
             ? [out.url, out.path, out.deepLinkUrl, directoryLinkUrl]
@@ -783,10 +852,10 @@ async function withServerMintedMcpAppEmbedStart(result, meta, directoryLinkUrl,
     const candidate = candidates.find((value) => {
         if (typeof value !== "string" || value.trim().length === 0)
             return false;
-        return !restrictDirectoryWidgetRead || !isEmbedStartUrl(value);
+        return !restrictDirectoryWidgetCapability || !isEmbedStartUrl(value);
     });
     if (!candidate) {
-        return restrictDirectoryWidgetRead
+        return restrictDirectoryWidgetCapability
             ? resultWithoutExistingEmbedTicket
             : result;
     }
@@ -794,19 +863,19 @@ async function withServerMintedMcpAppEmbedStart(result, meta, directoryLinkUrl,
     const isPath = trimmed.startsWith("/") && !trimmed.startsWith("//");
     const isAbsoluteHttp = /^https?:\/\//i.test(trimmed);
     if (!isPath && !isAbsoluteHttp) {
-        return restrictDirectoryWidgetRead
+        return restrictDirectoryWidgetCapability
             ? resultWithoutExistingEmbedTicket
             : result;
     }
     if (isAbsoluteHttp && !meta?.origin) {
-        return restrictDirectoryWidgetRead
+        return restrictDirectoryWidgetCapability
             ? resultWithoutExistingEmbedTicket
             : result;
     }
     const ctx = getRequestContext();
     const ownerEmail = ctx?.userEmail?.trim();
     if (!ownerEmail) {
-        return restrictDirectoryWidgetRead
+        return restrictDirectoryWidgetCapability
             ? resultWithoutExistingEmbedTicket
             : result;
     }
@@ -814,30 +883,56 @@ async function withServerMintedMcpAppEmbedStart(result, meta, directoryLinkUrl,
     const { buildEmbedStartPath } = await import("../server/embed-route.js");
     const targetPath = normalizeEmbedTargetPath(withMcpChatBridgeParam(trimmed), meta?.origin);
     if (!targetPath) {
-        return restrictDirectoryWidgetRead
+        return restrictDirectoryWidgetCapability
             ? resultWithoutExistingEmbedTicket
             : result;
     }
-    const scope = restrictDirectoryWidgetRead
-        ? createMcpDirectoryWidgetReadCapability(directoryWidget.capability)
+    if (directoryWidget?.capability.mode === "write" &&
+        (directoryWidget.capability.value.userEmail.toLowerCase() !==
+            ownerEmail.toLowerCase() ||
+            (directoryWidget.capability.value.orgId ?? undefined) !==
+                (ctx?.orgId ?? undefined))) {
+        throw new Error("The widget write grant must match the authenticated MCP user and organization.");
+    }
+    const scope = restrictDirectoryWidgetCapability
+        ? directoryWidget.capability.mode === "write"
+            ? createMcpDirectoryWidgetWriteCapability(directoryWidget.capability.value)
+            : createMcpDirectoryWidgetReadCapability(directoryWidget.capability.value)
         : typeof out.chrome === "string"
             ? out.chrome
             : null;
-    if (restrictDirectoryWidgetRead && !scope) {
-        throw new Error("Could not create a valid read-only capability for this MCP directory widget.");
+    if (restrictDirectoryWidgetCapability && !scope) {
+        throw new Error("Could not create a valid scoped capability for this MCP directory widget.");
+    }
+    const revocationAnchorCandidate = ctx?.mcpCredentialIssuedAtMs;
+    const revocationAnchorCreatedAtMs = typeof revocationAnchorCandidate === "number" &&
+        Number.isSafeInteger(revocationAnchorCandidate)
+        ? revocationAnchorCandidate
+        : undefined;
+    if (restrictDirectoryWidgetCapability &&
+        revocationAnchorCreatedAtMs === undefined) {
+        throw new Error("Directory widget sessions require a trusted MCP credential issue time.");
     }
     const ticket = await createEmbedSessionTicket({
         ownerEmail,
         orgId: ctx?.orgId,
         targetPath,
         scope,
+        ...(directoryWidget?.capability.mode === "write"
+            ? { ttlSeconds: 5 * 60 }
+            : {}),
+        ...(restrictDirectoryWidgetCapability
+            ? { revocationAnchorCreatedAtMs }
+            : {}),
     });
     const startPath = buildEmbedStartPath(ticket.ticket);
     const embedStartUrl = meta?.origin
         ? new URL(startPath, meta.origin).toString()
         : startPath;
     return {
-        ...(restrictDirectoryWidgetRead ? resultWithoutExistingEmbedTicket : out),
+        ...(restrictDirectoryWidgetCapability
+            ? resultWithoutExistingEmbedTicket
+            : out),
         embedStartUrl,
         embedTargetPath: targetPath,
         embedExpiresAt: ticket.expiresAt,
@@ -853,7 +948,7 @@ function withoutMcpAppEmbedTicket(result) {
     delete output.embedExpiresAt;
     return output;
 }
-function mcpDirectoryWidgetCapabilityForTool(config, resource, toolName, args, result, actions, oauthScopes) {
+async function mcpDirectoryWidgetCapabilityForTool(config, resource, toolName, args, result, actions, identity) {
     const profile = config.directoryProfile;
     const resolveTarget = profile?.widgetTargets?.[toolName];
     if (!resolveTarget)
@@ -877,7 +972,7 @@ function mcpDirectoryWidgetCapabilityForTool(config, resource, toolName, args, r
                 !scopedAuthenticatedRead) ||
             (entry.readOnly !== true &&
                 !profile.widgetReadOnlyActions?.includes(actionName)) ||
-            !isActionVisibleForOAuthScope(entry, oauthScopes, profile.widgetReadOnlyActions?.includes(actionName) === true) ||
+            !isActionVisibleForOAuthScope(entry, identity?.oauthScopes, profile.widgetReadOnlyActions?.includes(actionName) === true) ||
             entry.http === false ||
             entry.http?.method !== "GET" ||
             (entry.requiresAuth === false && !scopedPublicRead)) {
@@ -900,15 +995,100 @@ function mcpDirectoryWidgetCapabilityForTool(config, resource, toolName, args, r
             actionArguments[actionName] = scopedArguments;
         }
     }
-    if (Object.keys(actionArguments).length === 0)
+    const writeActionArguments = {};
+    const targetWriteActions = new Set(target.writeActions ?? []);
+    for (const actionName of targetWriteActions) {
+        if (!Object.hasOwn(profile.widgetWriteActionArguments ?? {}, actionName)) {
+            throw new Error(`MCP directory widget target references undeclared write action "${actionName}".`);
+        }
+    }
+    for (const [actionName, argumentMap] of Object.entries(profile.widgetWriteActionArguments ?? {})) {
+        if (!targetWriteActions.has(actionName))
+            continue;
+        const entry = actions[actionName] ?? config.widgetWriteActions?.[actionName];
+        if (!entry ||
+            entry.http === false ||
+            entry.http?.method === "GET" ||
+            entry.readOnly === true ||
+            entry.requiresAuth === false ||
+            !isActionVisibleForOAuthScope(entry, identity?.oauthScopes)) {
+            continue;
+        }
+        const scopedArguments = {};
+        for (const [argumentName, rule] of Object.entries(argumentMap)) {
+            if (typeof rule === "string") {
+                const resourceId = target.resourceIds[rule];
+                if (typeof resourceId !== "string" || !resourceId.trim())
+                    break;
+                scopedArguments[argumentName] = resourceId;
+            }
+            else {
+                scopedArguments[argumentName] = rule;
+            }
+        }
+        if (Object.keys(scopedArguments).length === Object.keys(argumentMap).length &&
+            Object.values(scopedArguments).some((argument) => {
+                if (typeof argument === "string") {
+                    return Object.values(target.resourceIds).includes(argument);
+                }
+                if (argument.type !== "actionSchemaResourceBound")
+                    return false;
+                const resourceId = target.resourceIds[argument.resourceKey];
+                return typeof resourceId === "string" && resourceId.trim().length > 0;
+            })) {
+            writeActionArguments[actionName] = scopedArguments;
+        }
+    }
+    if (Object.keys(actionArguments).length === 0 &&
+        Object.keys(writeActionArguments).length === 0) {
         return undefined;
-    return {
-        targetPath: target.targetPath,
-        capability: {
+    }
+    let editorAccessAllowed = false;
+    if (Object.keys(writeActionArguments).length > 0 &&
+        hasVerifiedMcpUserIdentity(identity) &&
+        profile.authorizeWidgetWrite) {
+        try {
+            editorAccessAllowed = await profile.authorizeWidgetWrite({
+                toolName,
+                args,
+                result,
+                target,
+                identity,
+            });
+        }
+        catch {
+            console.error(`[mcp] Directory widget editor authorization failed for ${toolName}; issuing a read-only capability.`);
+        }
+    }
+    if (Object.keys(writeActionArguments).length > 0 &&
+        hasVerifiedMcpUserIdentity(identity) &&
+        editorAccessAllowed) {
+        const requestOrgId = getRequestContext()?.orgId;
+        const value = {
             appId: config.appId ?? config.name,
             resourceUri: resource.uri,
             resourceIds: target.resourceIds,
-            actionArguments,
+            userEmail: identity.userEmail,
+            ...(typeof requestOrgId === "string" ? { orgId: requestOrgId } : {}),
+            expiresAtMs: Date.now() + MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_AGE_MS,
+            readActionArguments: actionArguments,
+            writeActionArguments,
+        };
+        return {
+            targetPath: target.targetPath,
+            capability: { mode: "write", value },
+        };
+    }
+    return {
+        targetPath: target.targetPath,
+        capability: {
+            mode: "read",
+            value: {
+                appId: config.appId ?? config.name,
+                resourceUri: resource.uri,
+                resourceIds: target.resourceIds,
+                actionArguments,
+            },
         },
     };
 }
@@ -923,21 +1103,25 @@ function mcpDirectoryWidgetSessionTool(config) {
     }
     return {
         name: "create_embed_session",
-        description: "Refresh the authenticated embed session for this app widget after it is reopened.",
+        description: "Creates a short-lived session for the same app widget using its original server-issued result ticket.",
         inputSchema: {
             type: "object",
             properties: {
-                sourceTool: { type: "string", enum: sourceNames },
-                toolInput: { type: "object", additionalProperties: true },
-                toolOutput: { type: "object", additionalProperties: true },
-                chrome: { type: "string", enum: ["full", "minimal"] },
+                sourceTicket: {
+                    type: "string",
+                    description: "Original server-issued widget ticket from this result.",
+                },
+                renewInPlace: {
+                    type: "boolean",
+                    description: "Extend the active scoped widget session without replacing its mounted app frame.",
+                },
             },
-            required: ["toolInput", "toolOutput"],
+            required: ["sourceTicket"],
         },
         _meta: { ui: { visibility: ["app"] } },
     };
 }
-async function renewMcpDirectoryWidgetEmbedSession(config, actions, args, identity, requestMeta) {
+async function renewMcpDirectoryWidgetEmbedSession(config, args, identity) {
     const profile = config.directoryProfile;
     if (!profile || config.catalogMode !== "directory") {
         throw new Error("Directory widget session renewal is not enabled.");
@@ -945,66 +1129,76 @@ async function renewMcpDirectoryWidgetEmbedSession(config, actions, args, identi
     if (!hasVerifiedMcpUserIdentity(identity)) {
         throw new Error("Widget session renewal requires a verified user caller.");
     }
-    const sourceTool = typeof args.sourceTool === "string" && args.sourceTool.trim()
-        ? args.sourceTool.trim()
-        : undefined;
-    const toolInput = metadataObject(args.toolInput);
-    const toolOutput = metadataObject(args.toolOutput);
-    const sourceNames = sourceTool
-        ? [sourceTool]
-        : Object.keys(profile.widgetTargets ?? {});
-    const { normalizeEmbedTargetPath, createEmbedSessionTicket } = await import("../server/embed-session.js");
-    const { buildEmbedStartPath } = await import("../server/embed-route.js");
-    const candidates = [];
-    for (const name of sourceNames) {
-        if (!profile.connectorCatalog.includes(name))
-            continue;
-        const entry = actions[name];
-        const resolver = profile.widgetTargets?.[name];
-        if (!entry?.mcpApp?.resource || !resolver)
-            continue;
-        const target = resolver(toolInput, toolOutput);
-        if (!target)
-            continue;
-        const resource = await resolveMcpAppResourceSafely(config, name, entry, requestMeta);
-        if (!resource)
-            continue;
-        const widgetCapability = mcpDirectoryWidgetCapabilityForTool(config, resource, name, toolInput, toolOutput, actions, identity.oauthScopes);
-        if (!widgetCapability)
-            continue;
-        const targetPath = normalizeEmbedTargetPath(withMcpChatBridgeParam(target.targetPath));
-        if (targetPath) {
-            candidates.push({
-                targetPath,
-                capability: widgetCapability.capability,
-            });
+    const sourceTicket = args.sourceTicket;
+    if (typeof sourceTicket !== "string") {
+        throw new Error("Widget session renewal requires its original result ticket.");
+    }
+    const { createEmbedSessionTicket, readMcpDirectoryWidgetRenewalTicket, renewMcpDirectoryWidgetSession, } = await import("../server/embed-session.js");
+    const originalTicket = await readMcpDirectoryWidgetRenewalTicket(sourceTicket);
+    const callerOrgId = getRequestContext()?.orgId;
+    if (!originalTicket ||
+        originalTicket.ownerEmail.trim().toLowerCase() !==
+            identity.userEmail.trim().toLowerCase() ||
+        (originalTicket.orgId ?? undefined) !== (callerOrgId ?? undefined)) {
+        throw new Error("The original widget ticket is not available to this caller.");
+    }
+    const appId = config.appId ?? config.name;
+    const renewalNow = Date.now();
+    const capabilityExpiresAtMs = Math.min(renewalNow + MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_AGE_MS, originalTicket.renewalExpiresAtMs);
+    const scope = renewMcpDirectoryWidgetCapabilityScope(originalTicket.scope, {
+        appId,
+        resourceUri: getMcpDirectoryWidgetResourceUri(appId),
+        userEmail: identity.userEmail,
+        orgId: callerOrgId,
+        expiresAtMs: capabilityExpiresAtMs,
+        readAllowed: hasMcpOAuthScope(identity.oauthScopes, "mcp:read"),
+        writeAllowed: hasMcpOAuthScope(identity.oauthScopes, "mcp:write"),
+    });
+    if (!scope) {
+        throw new Error("The original widget ticket has an invalid app capability.");
+    }
+    if (args.renewInPlace === true) {
+        if (originalTicket.consumedAtMs === null ||
+            originalTicket.sessionActiveUntilMs === null) {
+            throw new Error("The original widget session cannot be renewed in place.");
         }
+        const expiresAt = await renewMcpDirectoryWidgetSession({
+            sourceTicket,
+            ownerEmail: identity.userEmail,
+            orgId: callerOrgId,
+            expectedScope: originalTicket.scope,
+            renewedScope: scope,
+        });
+        if (!expiresAt) {
+            throw new Error("The original widget session can no longer be renewed in place.");
+        }
+        return { renewed: true, expiresAt };
     }
-    const distinctCandidates = new Map(candidates.map((candidate) => [
-        JSON.stringify([candidate.targetPath, candidate.capability]),
-        candidate,
-    ]));
-    if (distinctCandidates.size !== 1) {
-        throw new Error("Could not resolve one authorized app resource from this saved widget result.");
+    const appOrigin = profile.widgetDomain ?? config.widgetDomain;
+    if (!appOrigin) {
+        throw new Error("Directory widget session renewal requires an app origin.");
     }
-    const [{ targetPath, capability }] = [...distinctCandidates.values()];
-    const scope = createMcpDirectoryWidgetReadCapability(capability);
-    if (!scope) {
-        throw new Error("Could not create a scoped app widget session.");
+    let appOriginUrl;
+    try {
+        appOriginUrl = new URL(appOrigin);
     }
+    catch {
+        throw new Error("Directory widget session renewal has an invalid origin.");
+    }
+    const { buildEmbedStartPath } = await import("../server/embed-route.js");
+    const targetPath = withMcpChatBridgeParam(originalTicket.targetPath);
     const ticket = await createEmbedSessionTicket({
-        ownerEmail: identity.userEmail.trim(),
-        orgId: getRequestOrgId(),
+        ownerEmail: identity.userEmail,
+        orgId: callerOrgId,
         targetPath,
         scope,
+        ttlSeconds: Math.max(1, Math.ceil((capabilityExpiresAtMs - renewalNow) / 1000)),
+        renewalExpiresAtMs: originalTicket.renewalExpiresAtMs,
+        revocationAnchorCreatedAtMs: originalTicket.createdAtMs,
     });
     const startPath = buildEmbedStartPath(ticket.ticket);
-    const appOrigin = profile.widgetDomain ?? config.widgetDomain;
-    if (!appOrigin) {
-        throw new Error("Widget session renewal has no configured app origin.");
-    }
     return {
-        startUrl: new URL(startPath, appOrigin).toString(),
+        startUrl: new URL(startPath, appOriginUrl).toString(),
         targetPath,
         expiresAt: ticket.expiresAt,
     };
@@ -1111,7 +1305,7 @@ function safeUiSegment(value, fallback) {
     return normalized || fallback;
 }
 const MCP_APP_RESOURCE_SHELL_VERSION = "shell-v65";
-const MCP_DIRECTORY_APP_RESOURCE_SHELL_VERSION = "shell-v68";
+const MCP_DIRECTORY_APP_RESOURCE_SHELL_VERSION = "shell-v69";
 export function getMcpDirectoryWidgetResourceUri(appId, fallback = "agent-native") {
     const app = safeUiSegment(appId, fallback);
     return (versionMcpAppResourceUri(`ui://${app}/${MCP_DIRECTORY_APP_RESOURCE_SHELL_VERSION}`, MCP_DIRECTORY_APP_RESOURCE_SHELL_VERSION)?.uri ?? `ui://${app}/${MCP_DIRECTORY_APP_RESOURCE_SHELL_VERSION}`);
@@ -1775,6 +1969,7 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
                 : {}),
             ...(requestMeta?.origin ? { requestOrigin: requestMeta.origin } : {}),
             ...(mcpRequestId ? { mcpRequestId } : {}),
+            mcpCredentialIssuedAtMs: effectiveIdentity?.mcpCredentialIssuedAtMs ?? null,
         }, fn);
     }
     async function requireMcpActionApproval(entry, name, args, ctx) {
@@ -2148,7 +2343,7 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
                 name === "create_embed_session" &&
                 mcpDirectoryWidgetSessionTool(config)) {
                 try {
-                    const renewed = await renewMcpDirectoryWidgetEmbedSession(config, visibleActions, metadataObject(args), effectiveIdentity, requestMeta);
+                    const renewed = await renewMcpDirectoryWidgetEmbedSession(config, metadataObject(args), effectiveIdentity);
                     return {
                         content: [
                             { type: "text", text: "Widget session ready." },
@@ -2234,8 +2429,12 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
                     });
                     directoryLinkUrl = linked?.url ?? undefined;
                 }
-                const directoryWidget = directoryCatalog && mcpAppResourceCandidate
-                    ? mcpDirectoryWidgetCapabilityForTool(config, mcpAppResourceCandidate, name, args ?? {}, projectedRawResult, visibleActions, effectiveIdentity?.oauthScopes)
+                const trustedCredentialIssuedAtMs = effectiveIdentity?.mcpCredentialIssuedAtMs;
+                const directoryWidget = directoryCatalog &&
+                    mcpAppResourceCandidate &&
+                    typeof trustedCredentialIssuedAtMs === "number" &&
+                    Number.isSafeInteger(trustedCredentialIssuedAtMs)
+                    ? await mcpDirectoryWidgetCapabilityForTool(config, mcpAppResourceCandidate, name, args ?? {}, projectedRawResult, visibleActions, effectiveIdentity)
                     : undefined;
                 const missingDirectoryWidgetCapability = directoryCatalog &&
                     config.directoryProfile !== undefined &&
@@ -2261,14 +2460,15 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
                     : null;
                 const embedProducedNothing = !!mcpAppResourceCandidate && !mcpResultIsError && !embedHasContent;
                 const { block, _meta } = buildLinkArtifacts(entry, args ?? {}, actionResultForClient, requestMeta);
+                const mcpAppOpenLinkMeta = mcpAppResource
+                    ? mcpAppEmbedOpenLinkMeta(actionResultForClient, mcpAppResource, requestMeta)
+                    : {};
                 const responseMeta = {
                     ...(_meta ?? {}),
                     ...(directoryCatalog && mcpAppResource
-                        ? { "agent-native/widgetSource": { toolName: name } }
-                        : {}),
-                    ...(mcpAppResource
-                        ? mcpAppEmbedOpenLinkMeta(actionResultForClient, mcpAppResource, requestMeta)
+                        ? mcpDirectoryWidgetSourceMeta(name, mcpAppOpenLinkMeta)
                         : {}),
+                    ...mcpAppOpenLinkMeta,
                     ...(mcpAppResource
                         ? openAiToolResultMeta(mcpAppResource, directoryCatalog)
                         : {}),
@@ -2759,6 +2959,9 @@ async function verifyIssuedMcpCredential(token, resourceUrl) {
         oauthScopes: oauth.scopes,
         oauthClientId: oauth.clientId,
         ...(oauth.catalogScope ? { catalogScope: oauth.catalogScope } : {}),
+        ...(oauth.grantCreatedAtMs !== undefined
+            ? { grantCreatedAtMs: oauth.grantCreatedAtMs }
+            : {}),
         issuedAt: oauth.issuedAt,
     };
 }
@@ -2793,11 +2996,24 @@ async function admitIssuedMcpCredential(credential, requestOrigin) {
         stored = lookup;
     }
     const orgId = credential.orgId !== undefined ? credential.orgId : stored?.orgId;
+    const credentialIssuedAtMs = credential.oauthClientId !== undefined
+        ? credential.grantCreatedAtMs
+        : typeof credential.issuedAt === "number" &&
+            Number.isSafeInteger(credential.issuedAt)
+            ? credential.issuedAt * 1000
+            : undefined;
+    const mcpCredentialIssuedAtMs = credentialIssuedAtMs !== undefined &&
+        Number.isSafeInteger(credentialIssuedAtMs)
+        ? credentialIssuedAtMs
+        : undefined;
     const admitted = await admitIssuedCredential({
         authed: true,
         identity: {
             userEmail: credential.userEmail,
             identityAssurance: stored?.kind === "service" ? "service" : "user",
+            ...(mcpCredentialIssuedAtMs !== undefined
+                ? { mcpCredentialIssuedAtMs }
+                : {}),
             ...(orgId !== undefined ? { orgId } : {}),
             orgDomain: credential.orgDomain,
             ...(credential.oauthScopes

package/dist/mcp/connect-route.js

@@ -186,6 +186,7 @@ async function signConnectToken(params) {
         scope: MCP_OAUTH_DEFAULT_SCOPE,
         resource: mcpResourceUrl(params.issuer),
         issuer: params.issuer,
+        grantCreatedAtMs: Date.now(),
         jti: params.jti,
         expiresIn: params.expiresIn,
         ...(params.catalogScope === "full" ? { catalogScope: "full" } : {}),