@agent-native/core 0.206.0-nightly-20261009153146 → 0.206.0

package/dist/server/action-routes.js

@@ -9,18 +9,20 @@ import { isTransientDatabaseError } from "../db/client.js";
 import { declaresFeatureFlagDelegation } from "../feature-flags/a2a-action-route.js";
 import { isFeatureFlagAdminEmail } from "../feature-flags/permissions.js";
 import { isFederationMembershipValidatedForEvent, resolveOrgIdForEmail, } from "../org/context.js";
+import { checkWorkspaceAppAccessForRequest } from "../org/workspace-app-access-request.js";
+import { WORKSPACE_APP_ACCESS_UNAVAILABLE, WORKSPACE_APP_ACCESS_UNAVAILABLE_MESSAGE, } from "../org/workspace-app-access.js";
 import { LLM_PROVIDER_MISSING_ERROR_CODE, LLM_PROVIDER_MISSING_STATUS, } from "../shared/action-error-codes.js";
 import { agentNativeMcpInstructions, agentNativeToolTitle, } from "../shared/agent-mcp-metadata.js";
-import { EMBED_TARGET_HEADER, EMBED_TARGET_QUERY_PARAM, EMBED_TOKEN_QUERY_PARAM, allowsMcpDirectoryWidgetReadAction, isMcpDirectoryWidgetReadCapabilityScope, normalizeMcpDirectoryWidgetReadActionArguments, } from "../shared/embed-auth.js";
+import { EMBED_TARGET_HEADER, EMBED_TARGET_QUERY_PARAM, EMBED_TOKEN_QUERY_PARAM, MCP_DIRECTORY_WIDGET_SESSION_EXPIRED_HEADER, allowsMcpDirectoryWidgetReadAction, getMcpDirectoryWidgetWriteCapabilityGrant, isExpiredMcpDirectoryWidgetWriteCapability, isMcpDirectoryWidgetCapabilityScope, isMcpDirectoryWidgetReadCapabilityScope, isMcpDirectoryWidgetWriteCapabilityScope, normalizeMcpDirectoryWidgetReadActionArguments, normalizeMcpDirectoryWidgetWriteActionArguments, } from "../shared/embed-auth.js";
 import { isMcpEmbedCorsOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, shouldAllowMcpEmbedCredentials, } from "../shared/mcp-embed-headers.js";
 import { countActionFailure, countCredentialState, } from "../tracking/failure-counters.js";
 import { redact, redactErrorStack } from "../tracking/redaction.js";
 import { notifyActionChange } from "./action-change.js";
-import { readBrowserSessionIdHeader, readBrowserTabIdHeader, readAnalyticsClientPlatformHeader, readSyntheticTrafficHeader, seedAgentRunOwnerContext, } from "./agent-run-context.js";
+import { readBrowserSessionIdHeader, readBrowserTabIdHeader, readAnalyticsClientPlatformHeader, readSyntheticTrafficHeader, resolveAgentRunOrgId, seedAgentRunOwnerContext, } from "./agent-run-context.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { captureError } from "./capture-error.js";
 import { getAllowedCorsOrigin as resolveAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
-import { resolveEmbedSessionFromRequest, resolvedEmbedCapabilityScope, } from "./embed-session.js";
+import { hasExplicitEmbedSessionCredential, isExpiredMcpDirectoryWidgetSessionRequest, resolveEmbedSessionFromRequest, resolvedEmbedCapabilityScope, } from "./embed-session.js";
 import { readBodyWithSizeLimit } from "./h3-helpers.js";
 import { getHttpRequestTelemetryId, registerHttpRequestTelemetryActionRoute, setHttpRequestTelemetryActionName, } from "./http-response-telemetry.js";
 import { consumeOneTimeJti } from "./identity-sso-store.js";
@@ -47,6 +49,7 @@ import { getVerifiedServiceIdentityFromEvent, getRequestIdentityAuthenticatedAtM
 const ROUTE_PREFIX = "/_agent-native/actions";
 const WEBMCP_ACTION_ROUTE_PREFIX = "/_agent-native/webmcp/actions";
 const MAX_MCP_DIRECTORY_WIDGET_SCHEMA_ARGUMENT_BYTES = 32 * 1024;
+const MAX_MCP_DIRECTORY_WIDGET_WRITE_SCHEMA_ARGUMENT_BYTES = 1024 * 1024;
 const FRONTEND_MUTATION_METHODS = new Set(["POST", "PUT", "DELETE"]);
 const EMBED_ACTION_QUERY_PARAMS = new Set([
     EMBED_TARGET_QUERY_PARAM,
@@ -307,13 +310,14 @@ function allowsWebMcpCapabilityResource(authCapability, params) {
     }
 }
 async function resolveRequestAuthCapability(event) {
-    try {
-        return resolvedEmbedCapabilityScope(await resolveEmbedSessionFromRequest(event));
-    }
-    catch {
-        // Invalid or unavailable embed auth must fail closed as no capability.
-        return undefined;
+    const session = await resolveEmbedSessionFromRequest(event);
+    if (!session && hasExplicitEmbedSessionCredential(event)) {
+        if (await isExpiredMcpDirectoryWidgetSessionRequest(event)) {
+            setResponseHeader(event, MCP_DIRECTORY_WIDGET_SESSION_EXPIRED_HEADER, "1");
+        }
+        throw createError({ statusCode: 401, statusMessage: "Unauthorized" });
     }
+    return resolvedEmbedCapabilityScope(session);
 }
 function resolveRequestEmbedSession(event) {
     return resolveEmbedSessionFromRequest(event);
@@ -335,7 +339,9 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
             (Array.isArray(entry.capabilityScopes) &&
                 entry.capabilityScopes.length) ||
             (!options?.caller &&
-                options?.mcpDirectoryWidgetReadActionArguments?.[name] !== undefined)) {
+                (options?.mcpDirectoryWidgetReadActionArguments?.[name] !== undefined ||
+                    options?.mcpDirectoryWidgetWriteActionArguments?.[name] !==
+                        undefined))) {
             registerAuthPublicPaths([routePath], app);
         }
         if (!options?.caller &&
@@ -351,7 +357,7 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                 return handleOptionsRequest(event);
             }
             setResponseHeader(event, "Cache-Control", "no-store");
-            setResponseHeader(event, "Access-Control-Expose-Headers", "X-Agent-Native-Client-Mismatch,X-Agent-Native-Build-Id,X-Agent-Native-Client-Compatibility,Retry-After");
+            setResponseHeader(event, "Access-Control-Expose-Headers", `X-Agent-Native-Client-Mismatch,X-Agent-Native-Build-Id,X-Agent-Native-Client-Compatibility,Retry-After,${MCP_DIRECTORY_WIDGET_SESSION_EXPIRED_HEADER}`);
             const isFrontendMutation = isFrontendActionRequest(event) &&
                 FRONTEND_MUTATION_METHODS.has(method) &&
                 FRONTEND_MUTATION_METHODS.has(effectiveMethod);
@@ -387,14 +393,23 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
             let userName;
             let authUserId;
             const authCapability = await resolveRequestAuthCapability(event);
-            const directoryWidgetReadCapability = isMcpDirectoryWidgetReadCapabilityScope(authCapability);
-            const embedSession = directoryWidgetReadCapability
+            const directoryWidgetWriteCapability = isMcpDirectoryWidgetWriteCapabilityScope(authCapability);
+            const directoryWidgetCapability = isMcpDirectoryWidgetCapabilityScope(authCapability);
+            const embedSession = directoryWidgetCapability
                 ? await resolveRequestEmbedSession(event)
                 : null;
+            const directoryWidgetWriteGrant = directoryWidgetWriteCapability && embedSession
+                ? getMcpDirectoryWidgetWriteCapabilityGrant(authCapability, {
+                    appId: options?.mcpDirectoryWidgetAppId ?? options?.appId ?? "",
+                    resourceUri: options?.mcpDirectoryWidgetResourceUri ?? "",
+                    userEmail: embedSession.email,
+                    orgId: embedSession.orgId,
+                })
+                : undefined;
             const directoryWidgetReadRequest = isFrontendActionRequest(event) ||
                 (options?.caller === "webmcp" &&
                     options.routePrefix === WEBMCP_ACTION_ROUTE_PREFIX);
-            const directoryWidgetReadAllowed = directoryWidgetReadCapability &&
+            const directoryWidgetReadAllowed = directoryWidgetCapability &&
                 embedSession !== null &&
                 directoryWidgetReadRequest &&
                 entry.http !== false &&
@@ -411,19 +426,34 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                     actionName: name,
                     appId: options.mcpDirectoryWidgetAppId ?? options.appId,
                     resourceUri: options.mcpDirectoryWidgetResourceUri,
+                    userEmail: embedSession?.email,
+                    orgId: embedSession?.orgId,
                     allowedArgumentNames: options.mcpDirectoryWidgetReadActionArguments[name],
                     requireArgumentMatch: false,
                 });
+            const directoryWidgetWriteAllowed = directoryWidgetWriteCapability &&
+                embedSession !== null &&
+                isFrontendActionRequest(event) &&
+                entry.http !== false &&
+                entry.http?.method !== "GET" &&
+                entry.readOnly !== true &&
+                entry.requiresAuth !== false &&
+                options?.mcpDirectoryWidgetWriteActionArguments?.[name] !== undefined;
+            let directoryWidgetWriteResourceIds;
             const directoryWidgetReadRoute = options?.mcpDirectoryWidgetReadActionArguments?.[name] !==
                 undefined &&
                 options?.mcpDirectoryWidgetReadPublicActions?.includes(name) !== true;
-            if (directoryWidgetReadCapability && !directoryWidgetReadAllowed) {
+            const directoryWidgetWriteRoute = options?.mcpDirectoryWidgetWriteActionArguments?.[name] !== undefined;
+            if (directoryWidgetCapability &&
+                !directoryWidgetReadAllowed &&
+                !directoryWidgetWriteAllowed) {
                 setResponseStatus(event, 403);
                 return {
                     error: "This widget capability only permits its scoped data routes.",
                 };
             }
-            if (directoryWidgetReadAllowed && embedSession) {
+            if ((directoryWidgetReadAllowed || directoryWidgetWriteAllowed) &&
+                embedSession) {
                 userEmail = embedSession.email;
                 if (embedSession.orgId == null)
                     markExplicitPersonalOrgScope(event);
@@ -446,9 +476,11 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
             let directoryWidgetReadAuthenticatedFallback = false;
             const capabilityAllowed = (options?.caller === "webmcp" || isFrontendActionRequest(event)) &&
                 (allowsWebMcpCapability(entry, authCapability) ||
-                    directoryWidgetReadAllowed);
+                    directoryWidgetReadAllowed ||
+                    directoryWidgetWriteAllowed);
             if (options?.allowDelegatedCaller !== false &&
-                !directoryWidgetReadAllowed) {
+                !directoryWidgetReadAllowed &&
+                !directoryWidgetWriteAllowed) {
                 let caller;
                 try {
                     caller = options?.actionRouteAuth?.resolveCaller
@@ -512,9 +544,71 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                     }
                 }
             }
+            if (directoryWidgetWriteRoute && !directoryWidgetWriteAllowed) {
+                let ownerContext;
+                if (resolvedCaller) {
+                    if (resolvedCaller.anonymous) {
+                        setResponseStatus(event, 401);
+                        return { error: "Unauthorized" };
+                    }
+                    ownerContext = resolvedCaller;
+                }
+                else {
+                    if (!options?.getOwnerContextFromEvent) {
+                        setResponseStatus(event, 401);
+                        return { error: "Unauthorized" };
+                    }
+                    try {
+                        ownerContext = await options.getOwnerContextFromEvent(event);
+                    }
+                    catch (error) {
+                        if (!isAuthResolutionFailure(error))
+                            throw error;
+                        setResponseStatus(event, 401);
+                        return { error: "Unauthorized" };
+                    }
+                    if (ownerContext.anonymous) {
+                        setResponseStatus(event, 401);
+                        return { error: "Unauthorized" };
+                    }
+                    userEmail = ownerContext.owner;
+                    userName = ownerContext.name;
+                    authUserId = ownerContext.authUserId;
+                    ownerContextResolved = true;
+                }
+                const workspaceOrgId = resolvedCaller
+                    ? resolvedCaller.orgId === null
+                        ? undefined
+                        : (normalizeOrgId(resolvedCaller.orgId) ??
+                            (resolvedCaller.owner && !resolvedCaller.anonymous
+                                ? await storedActiveOrgId(resolvedCaller.owner)
+                                : undefined))
+                    : await resolveAgentRunOrgId({
+                        event,
+                        ownerContext,
+                        resolveOrgId: options?.resolveOrgId,
+                    });
+                const workspaceAppAccess = await checkWorkspaceAppAccessForRequest({
+                    path: `/_agent-native/actions/${name}`,
+                    method: getMethod(event),
+                    email: ownerContext.owner,
+                    orgId: workspaceOrgId,
+                });
+                if (workspaceAppAccess === WORKSPACE_APP_ACCESS_UNAVAILABLE) {
+                    setResponseStatus(event, 503);
+                    return { error: WORKSPACE_APP_ACCESS_UNAVAILABLE_MESSAGE };
+                }
+                if (workspaceAppAccess === false) {
+                    setResponseStatus(event, 403);
+                    return {
+                        error: "You do not have access to this workspace app.",
+                    };
+                }
+            }
             if (!resolvedCaller &&
                 !ownerContextResolved &&
                 !directoryWidgetReadAllowed &&
+                !directoryWidgetWriteAllowed &&
                 options?.caller === "webmcp" &&
                 options?.getOwnerContextFromEvent) {
                 ownerContextResolved = true;
@@ -549,6 +643,7 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
             if (!resolvedCaller &&
                 !ownerContextResolved &&
                 !directoryWidgetReadAllowed &&
+                !directoryWidgetWriteAllowed &&
                 options?.getOwnerFromEvent) {
                 try {
                     userEmail = await options.getOwnerFromEvent(event);
@@ -574,6 +669,7 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                 !resolvedCaller &&
                 !directoryWidgetReadAuthenticatedFallback &&
                 !directoryWidgetReadAllowed &&
+                !directoryWidgetWriteAllowed &&
                 options?.getAuthUserIdFromEvent) {
                 try {
                     authUserId = await options.getAuthUserIdFromEvent(event);
@@ -593,7 +689,8 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
             // token caller's actions execute under. Non-adapter callers keep the
             // original resolveOrgId-only behavior.
             let orgId;
-            if (directoryWidgetReadAllowed && embedSession) {
+            if ((directoryWidgetReadAllowed || directoryWidgetWriteAllowed) &&
+                embedSession) {
                 orgId = normalizeOrgId(embedSession.orgId);
             }
             else if (resolvedCaller) {
@@ -746,6 +843,8 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                             appId: options.mcpDirectoryWidgetAppId ?? options.appId,
                             resourceUri: options.mcpDirectoryWidgetResourceUri,
                             args: params,
+                            userEmail: embedSession?.email,
+                            orgId: embedSession?.orgId,
                             allowedArgumentNames: options.mcpDirectoryWidgetReadActionArguments?.[name],
                         });
                         if (!normalizedArgs) {
@@ -756,6 +855,42 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                         }
                         params = normalizedArgs;
                     }
+                    if (directoryWidgetWriteAllowed) {
+                        const normalizedArgs = normalizeMcpDirectoryWidgetWriteActionArguments(authCapability, {
+                            actionName: name,
+                            appId: options.mcpDirectoryWidgetAppId ?? options.appId,
+                            resourceUri: options.mcpDirectoryWidgetResourceUri,
+                            userEmail: embedSession?.email,
+                            orgId: embedSession?.orgId,
+                            args: params,
+                            allowedArgumentNames: options.mcpDirectoryWidgetWriteActionArguments?.[name],
+                        });
+                        directoryWidgetWriteResourceIds =
+                            getMcpDirectoryWidgetWriteCapabilityGrant(authCapability, {
+                                appId: options.mcpDirectoryWidgetAppId ?? options.appId ?? "",
+                                resourceUri: options.mcpDirectoryWidgetResourceUri ?? "",
+                                userEmail: embedSession?.email ?? "",
+                                orgId: embedSession?.orgId,
+                            })?.resourceIds;
+                        if (!normalizedArgs || !directoryWidgetWriteResourceIds) {
+                            const expired = isExpiredMcpDirectoryWidgetWriteCapability(authCapability, {
+                                appId: options.mcpDirectoryWidgetAppId ?? options.appId ?? "",
+                                resourceUri: options.mcpDirectoryWidgetResourceUri ?? "",
+                                userEmail: embedSession?.email ?? "",
+                                orgId: embedSession?.orgId,
+                            });
+                            if (expired) {
+                                setResponseHeader(event, MCP_DIRECTORY_WIDGET_SESSION_EXPIRED_HEADER, "1");
+                            }
+                            throw createError({
+                                statusCode: expired ? 401 : 403,
+                                statusMessage: expired
+                                    ? "Unauthorized"
+                                    : "This widget write capability is scoped to a different user, app resource, or action.",
+                            });
+                        }
+                        params = normalizedArgs;
+                    }
                     if (capabilityAllowed &&
                         !userEmail &&
                         !allowsWebMcpCapabilityResource(authCapability, params)) {
@@ -766,12 +901,14 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                     }
                     const caller = directoryWidgetReadAllowed
                         ? "mcp-widget"
-                        : (options?.caller ??
-                            (resolvedCaller
-                                ? "a2a"
-                                : isFrontendActionRequest(event)
-                                    ? "frontend"
-                                    : "http"));
+                        : directoryWidgetWriteAllowed
+                            ? "mcp-widget-write"
+                            : (options?.caller ??
+                                (resolvedCaller
+                                    ? "a2a"
+                                    : isFrontendActionRequest(event)
+                                        ? "frontend"
+                                        : "http"));
                     const runContext = {
                         userEmail,
                         orgId: orgId ?? null,
@@ -781,6 +918,18 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                         ...(directoryWidgetReadAllowed
                             ? { mcpDirectoryWidgetReadOnly: true }
                             : {}),
+                        ...(directoryWidgetWriteGrant &&
+                            (directoryWidgetWriteAllowed || directoryWidgetReadAllowed)
+                            ? {
+                                mcpDirectoryWidgetWrite: {
+                                    appId: options?.mcpDirectoryWidgetAppId ??
+                                        options?.appId ??
+                                        "",
+                                    resourceIds: directoryWidgetWriteGrant.resourceIds,
+                                    actionNames: directoryWidgetWriteGrant.actionNames,
+                                },
+                            }
+                            : {}),
                         ...(event.req?.signal ? { signal: event.req.signal } : {}),
                         actionName: name,
                         ...(resolvedCaller?.delegationJti
@@ -816,16 +965,23 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                             throw new ActionContractError(`"${name}" requires human approval for these arguments. WebMCP tool calls cannot grant that approval themselves — ask the user to confirm this action in chat, then call it there.`, { errorCode: "approval_required", statusCode: 409 });
                         }
                     }
-                    else if (directoryWidgetReadAllowed &&
-                        (options?.mcpDirectoryWidgetReadActionSchemaArguments?.[name]
-                            ?.length ?? 0) > 0) {
-                        const oversizedSchemaArgument = options?.mcpDirectoryWidgetReadActionSchemaArguments?.[name]?.find((argumentName) => {
+                    else if ((directoryWidgetReadAllowed || directoryWidgetWriteAllowed) &&
+                        ((directoryWidgetReadAllowed
+                            ? options?.mcpDirectoryWidgetReadActionSchemaArguments?.[name]
+                            : options?.mcpDirectoryWidgetWriteActionSchemaArguments?.[name])?.length ?? 0) > 0) {
+                        const schemaArguments = directoryWidgetReadAllowed
+                            ? options?.mcpDirectoryWidgetReadActionSchemaArguments?.[name]
+                            : options?.mcpDirectoryWidgetWriteActionSchemaArguments?.[name];
+                        const maxSchemaArgumentBytes = directoryWidgetWriteAllowed
+                            ? MAX_MCP_DIRECTORY_WIDGET_WRITE_SCHEMA_ARGUMENT_BYTES
+                            : MAX_MCP_DIRECTORY_WIDGET_SCHEMA_ARGUMENT_BYTES;
+                        const oversizedSchemaArgument = schemaArguments?.find((argumentName) => {
                             if (!Object.hasOwn(params, argumentName))
                                 return false;
                             const serialized = JSON.stringify(params[argumentName]);
                             return (typeof serialized !== "string" ||
                                 new TextEncoder().encode(serialized).byteLength >
-                                    MAX_MCP_DIRECTORY_WIDGET_SCHEMA_ARGUMENT_BYTES);
+                                    maxSchemaArgumentBytes);
                         });
                         if (oversizedSchemaArgument) {
                             throw new ActionContractError("MCP directory widget query arguments exceed the supported size.", {
@@ -836,7 +992,7 @@ function mountActionRoutesInternal(nitroApp, actions, options) {
                         if (!entry.schema ||
                             typeof entry.schema !== "object" ||
                             !("~standard" in entry.schema)) {
-                            throw new Error(`MCP directory widget read action "${name}" requires an input schema.`);
+                            throw new Error(`MCP directory widget action "${name}" requires an input schema.`);
                         }
                         params = await validateActionArgs(entry.schema, params, entry.tool.parameters, runContext);
                     }

package/dist/server/agent-chat/mcp-options.d.ts

@@ -1,4 +1,4 @@
-import type { McpDirectoryWidgetTarget } from "../../mcp/build-server.js";
+import type { MCPConfig, McpDirectoryWidgetTarget } from "../../mcp/build-server.js";
 import type { ExternalAgentPolicy } from "../../mcp/external-agent-policy.js";
 import type { McpDirectoryWidgetReadArgument } from "../../shared/embed-auth.js";
 export interface AgentChatMcpIcon {
@@ -16,7 +16,9 @@ export interface AgentChatMcpOptions {
         instructions?: string;
         widgets?: boolean;
         widgetTargets?: Record<string, (args: Record<string, unknown>, result: unknown) => McpDirectoryWidgetTarget | null>;
+        authorizeWidgetWrite?: NonNullable<MCPConfig["directoryProfile"]>["authorizeWidgetWrite"];
         widgetReadActionArguments?: Record<string, Record<string, McpDirectoryWidgetReadArgument>>;
+        widgetWriteActionArguments?: Record<string, Record<string, McpDirectoryWidgetReadArgument>>;
         /** Actions whose capability-backed `mcp-widget` execution is strictly read-only. */
         widgetReadOnlyActions?: readonly string[];
         /** Unlisted public reads that are available only through a scoped widget ticket. */

package/dist/server/agent-chat-plugin.js

@@ -2330,7 +2330,7 @@ export function createAgentChatPlugin(options) {
             };
             if (mcpOptions.enabled) {
                 // Mount MCP remote server — same action registry as A2A + agent chat
-                const { mountMCP, selectMcpDirectoryWidgetReadActions } = await import("../mcp/server.js");
+                const { mountMCP, selectMcpDirectoryWidgetReadActions, selectMcpDirectoryWidgetWriteActions, } = await import("../mcp/server.js");
                 mountMCP(nitroApp, {
                     name: mcpServerName,
                     title: mcpOptions.title,
@@ -2345,6 +2345,7 @@ export function createAgentChatPlugin(options) {
                     actions: externalActions,
                     productionActions: externalFullActions,
                     widgetReadActions: selectMcpDirectoryWidgetReadActions(mcpOptions.directoryProfile, templateScriptsAll),
+                    widgetWriteActions: selectMcpDirectoryWidgetWriteActions(mcpOptions.directoryProfile, templateScriptsAll),
                     ...(mcpOptions.catalog ? { catalogMode: mcpOptions.catalog } : {}),
                     ...(mcpOptions.builtinCrossAppTools !== undefined
                         ? { builtinCrossAppTools: mcpOptions.builtinCrossAppTools }
@@ -2605,6 +2606,29 @@ export function createAgentChatPlugin(options) {
                     mcpDirectoryWidgetResourceUri: getMcpDirectoryWidgetResourceUri(options?.appId ?? mcpServerName),
                 }
                 : {};
+            const mcpDirectoryWidgetWriteOptions = directoryProfile
+                ? {
+                    mcpDirectoryWidgetWriteActionArguments: Object.fromEntries(Object.entries(directoryProfile.widgetWriteActionArguments ?? {})
+                        .filter(([name]) => httpActions[name] &&
+                        httpActions[name]?.http !== false &&
+                        httpActions[name]?.http?.method !== "GET" &&
+                        httpActions[name]?.requiresAuth !== false &&
+                        httpActions[name]?.readOnly !== true)
+                        .map(([name, args]) => [name, Object.keys(args)])),
+                    mcpDirectoryWidgetWriteActionSchemaArguments: Object.fromEntries(Object.entries(directoryProfile.widgetWriteActionArguments ?? {})
+                        .map(([name, args]) => [
+                        name,
+                        Object.entries(args)
+                            .filter(([, argument]) => typeof argument !== "string" &&
+                            (argument.type === "actionSchema" ||
+                                argument.type === "actionSchemaResourceBound"))
+                            .map(([argumentName]) => argumentName),
+                    ])
+                        .filter(([, argumentNames]) => argumentNames.length > 0)),
+                    mcpDirectoryWidgetAppId: options?.appId ?? mcpServerName,
+                    mcpDirectoryWidgetResourceUri: getMcpDirectoryWidgetResourceUri(options?.appId ?? mcpServerName),
+                }
+                : {};
             if (Object.keys(httpActions).length > 0) {
                 if (options?.actionRoutePublicPaths?.length) {
                     registerAuthPublicPaths(options.actionRoutePublicPaths, getH3App(nitroApp));
@@ -2619,6 +2643,7 @@ export function createAgentChatPlugin(options) {
                     resolveOrgId: options?.resolveOrgId,
                     actionRouteAuth: options?.actionRouteAuth,
                     ...mcpDirectoryWidgetReadOptions,
+                    ...mcpDirectoryWidgetWriteOptions,
                 });
             }
             // Dev-only loopback endpoint `pnpm action` forwards to so it doesn't

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -1,9 +1,9 @@
 export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    models?: undefined;
     ok?: undefined;
+    models?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     models: string[];
-    error?: undefined;
 }>>;

package/dist/server/auth.js

@@ -3,9 +3,9 @@ import { defineEventHandler, getMethod, getQuery, setResponseHeader, setResponse
 import { getAppConfig, resolveAppHomePath } from "../app-config/index.js";
 import { acceptPendingInvitationsForEmail } from "../org/accept-pending.js";
 import { newOrgSelection, ORG_SELECTION_COOKIE, } from "../org/request-org-cache.js";
-import { isWorkspaceAppAccessAllowed, WORKSPACE_APP_ACCESS_UNAVAILABLE, WORKSPACE_APP_ACCESS_UNAVAILABLE_MESSAGE, } from "../org/workspace-app-access.js";
-import { resolveWorkspaceAccessAppId } from "../org/workspace-app-identity.js";
-import { EMBED_SESSION_COOKIE, EMBED_START_PATH, EMBED_TARGET_HEADER, isMcpDirectoryWidgetReadCapabilityScope, } from "../shared/embed-auth.js";
+import { checkWorkspaceAppAccessForRequest } from "../org/workspace-app-access-request.js";
+import { WORKSPACE_APP_ACCESS_UNAVAILABLE, WORKSPACE_APP_ACCESS_UNAVAILABLE_MESSAGE, } from "../org/workspace-app-access.js";
+import { EMBED_SESSION_COOKIE, EMBED_START_PATH, EMBED_TARGET_HEADER, isMcpDirectoryWidgetCapabilityScope, } from "../shared/embed-auth.js";
 import { FIRST_RUN_ONBOARDING_COOKIE, FIRST_RUN_ONBOARDING_MAX_AGE, } from "../shared/first-run-onboarding.js";
 import { isGoogleProfileImageUrl } from "../shared/google-profile-image.js";
 import { EMBED_TRANSPLANT_HEADER, isMcpEmbedCorsOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, shouldAllowMcpEmbedCredentials, } from "../shared/mcp-embed-headers.js";
@@ -3038,20 +3038,11 @@ function createAuthGuardFn(app) {
         }
         const session = await getSession(event);
         if (session) {
-            const workspaceAppId = resolveWorkspaceAccessAppId();
             const method = getMethod(event);
-            const sharedWorkspaceAccessPath = p === "/_agent-native/org/me" ||
-                p === "/_agent-native/actions/list-workspace-apps" ||
-                (method === "GET" &&
-                    p === "/_agent-native/actions/list-workspace-app-access") ||
-                (method === "POST" &&
-                    p === "/_agent-native/actions/set-workspace-app-access");
-            // Keep org-owned repair controls reachable when this app is disabled;
-            // each action or handler still enforces its org membership and role.
-            if (workspaceAppId &&
-                !sharedWorkspaceAccessPath &&
-                (p.startsWith("/api/") || p.startsWith("/_agent-native/"))) {
-                const workspaceAppAccess = await isWorkspaceAppAccessAllowed(workspaceAppId, {
+            if (p.startsWith("/api/") || p.startsWith("/_agent-native/")) {
+                const workspaceAppAccess = await checkWorkspaceAppAccessForRequest({
+                    path: p,
+                    method,
                     email: session.email,
                     orgId: session.orgId,
                 });
@@ -3059,7 +3050,7 @@ function createAuthGuardFn(app) {
                     setResponseStatus(event, 503);
                     return { error: WORKSPACE_APP_ACCESS_UNAVAILABLE_MESSAGE };
                 }
-                if (!workspaceAppAccess) {
+                if (workspaceAppAccess === false) {
                     setResponseStatus(event, 403);
                     return { error: "You do not have access to this workspace app." };
                 }
@@ -3416,7 +3407,7 @@ async function resolveSessionUncached(event, options = {}) {
     const cookieOnlyDesktopCheck = isDesktopSessionCookieOnlyCheck(event);
     if (!options.ignoreEmbedSession) {
         const embedSession = await resolveEmbedSessionFromRequest(event);
-        if (isMcpDirectoryWidgetReadCapabilityApplicationStateRequest(event, embedSession?.scope)) {
+        if (isMcpDirectoryWidgetCapabilityApplicationStateRequest(event, embedSession?.scope)) {
             return null;
         }
         if (embedSession && !isEmbedCapabilityScope(embedSession.scope)) {
@@ -3498,8 +3489,8 @@ async function resolveSessionUncached(event, options = {}) {
         return authDisabledSession;
     return null;
 }
-function isMcpDirectoryWidgetReadCapabilityApplicationStateRequest(event, scope) {
-    if (!isMcpDirectoryWidgetReadCapabilityScope(scope))
+function isMcpDirectoryWidgetCapabilityApplicationStateRequest(event, scope) {
+    if (!isMcpDirectoryWidgetCapabilityScope(scope))
         return false;
     const rawUrl = event.node?.req?.url ?? event.path ?? "/";
     const base = "http://agent-native.invalid";

package/dist/server/embed-route.js

@@ -1,6 +1,6 @@
 import { defineEventHandler, getHeader, getMethod, getQuery, setResponseHeader, } from "h3";
 import { withCollapsedAgentSidebarParam } from "../shared/agent-sidebar-url.js";
-import { EMBED_MODE_QUERY_PARAM, EMBED_START_PATH, EMBED_TOKEN_QUERY_PARAM, isMcpDirectoryWidgetReadCapabilityScope, MCP_APP_CHAT_BRIDGE_QUERY_PARAM, MCP_DIRECTORY_WIDGET_QUERY_PARAM, } from "../shared/embed-auth.js";
+import { EMBED_MODE_QUERY_PARAM, EMBED_START_PATH, EMBED_TOKEN_QUERY_PARAM, isMcpDirectoryWidgetCapabilityScope, MCP_APP_CHAT_BRIDGE_QUERY_PARAM, MCP_DIRECTORY_WIDGET_QUERY_PARAM, } from "../shared/embed-auth.js";
 import { isMcpEmbedTransplantOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, } from "../shared/mcp-embed-headers.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { readCorsAllowedOrigins } from "./cors-origins.js";
@@ -283,9 +283,11 @@ export function createEmbedStartRouteHandler(options = {}) {
             audienceHost: getForwardedRequestHostname(event),
             scope: consumed.scope,
             ...(consumed.ticketCreatedAtMs != null &&
-                !isEmbedCapabilityScope(consumed.scope)
+                (!isEmbedCapabilityScope(consumed.scope) ||
+                    isMcpDirectoryWidgetCapabilityScope(consumed.scope))
                 ? { ticketCreatedAtMs: consumed.ticketCreatedAtMs }
                 : {}),
+            ...(consumed.sessionId ? { sessionId: consumed.sessionId } : {}),
             ...(isEmbedCapabilityScope(consumed.scope)
                 ? {
                     ttlSeconds: Math.max(1, Math.floor((consumed.expiresAt - Date.now()) / 1000)),
@@ -298,7 +300,7 @@ export function createEmbedStartRouteHandler(options = {}) {
         // its document is a widget whether or not the start URL carried the flag.
         const chatBridgeActive = firstQueryValue(query[MCP_APP_CHAT_BRIDGE_QUERY_PARAM]) === "1" ||
             firstQueryValue(query[MCP_APP_CHAT_BRIDGE_QUERY_PARAM]) === "true" ||
-            isMcpDirectoryWidgetReadCapabilityScope(consumed.scope);
+            isMcpDirectoryWidgetCapabilityScope(consumed.scope);
         const location = withConfiguredBasePath(withCollapsedAgentSidebarParam(appendEmbedParams(target, token, chatBridgeActive)));
         const transplant = wantsTransplantLocationResponse(event);
         if (consumeDiagnostic) {

package/dist/server/embed-session.d.ts

@@ -7,12 +7,26 @@ export interface EmbedSessionTicketInput {
     targetPath: string;
     scope?: string | null;
     ttlSeconds?: number;
+    renewalExpiresAtMs?: number;
+    revocationAnchorCreatedAtMs?: number;
 }
 export interface EmbedSessionTicket {
     ticket: string;
     ticketHash: string;
     expiresAt: number;
 }
+export interface McpDirectoryWidgetRenewalTicket {
+    sessionId: string;
+    ownerEmail: string;
+    orgId?: string;
+    targetPath: string;
+    scope: string;
+    createdAtMs: number;
+    expiresAtMs: number;
+    consumedAtMs: number | null;
+    renewalExpiresAtMs: number;
+    sessionActiveUntilMs: number | null;
+}
 export type EmbedSessionTicketConsumeOutcome = "missing-ticket" | "not-found" | "already-consumed" | "expired" | "identity-mismatch" | "org-mismatch" | "consumption-race" | "invalid-row" | "revoked" | "consumed";
 export interface EmbedSessionTicketConsumeDiagnostic {
     outcome: EmbedSessionTicketConsumeOutcome;
@@ -38,6 +52,7 @@ export interface ConsumedEmbedSessionTicket {
     scope?: string;
     expiresAt: number;
     ticketCreatedAtMs: number;
+    sessionId?: string;
 }
 export interface EmbedSessionTokenClaims {
     kind: typeof TOKEN_KIND;
@@ -49,6 +64,7 @@ export interface EmbedSessionTokenClaims {
     iat: number;
     issuedAtMs?: number;
     ticketCreatedAtMs?: number;
+    sessionId?: string;
     exp: number;
 }
 export type VerifyEmbedSessionTokenResult = {
@@ -73,7 +89,16 @@ export declare function revokeEmbedSessionsForOwners(ownerEmails: string[], inTr
 export declare function requestMatchesEmbedTarget(event: H3Event, targetPath: string): boolean;
 export declare function normalizeEmbedTargetPath(raw: string | undefined | null, requestOrigin?: string): string | null;
 export declare function createEmbedSessionTicket(input: EmbedSessionTicketInput): Promise<EmbedSessionTicket>;
+export declare function readMcpDirectoryWidgetRenewalTicket(ticket: string): Promise<McpDirectoryWidgetRenewalTicket | null>;
+export declare function renewMcpDirectoryWidgetSession(input: {
+    sourceTicket: string;
+    ownerEmail: string;
+    orgId?: string | null;
+    expectedScope: string;
+    renewedScope: string;
+}): Promise<number | null>;
 export declare function resolveEmbedSessionTokenForHost(token: string | undefined, hostname: string): Promise<EmbedSessionTokenClaims | null>;
+export declare function isExpiredMcpDirectoryWidgetSessionRequest(event: H3Event): Promise<boolean>;
 export declare function resolveEmbedSessionCookieOwners(tokens: string[]): Promise<string[]>;
 export declare function consumeEmbedSessionTicket(ticket: string | undefined | null, options?: ConsumeEmbedSessionTicketOptions): Promise<ConsumedEmbedSessionTicket | null>;
 export declare function signEmbedSessionToken(input: {
@@ -83,11 +108,15 @@ export declare function signEmbedSessionToken(input: {
     audienceHost?: string;
     scope?: string | null;
     ticketCreatedAtMs?: number;
+    sessionId?: string;
     ttlSeconds?: number;
 }): string;
-export declare function verifyEmbedSessionToken(token: string | undefined | null): VerifyEmbedSessionTokenResult;
+export declare function verifyEmbedSessionToken(token: string | undefined | null, options?: {
+    allowExpired?: boolean;
+}): VerifyEmbedSessionTokenResult;
 export declare function setEmbedSessionCookie(event: H3Event, token: string): void;
 export declare function resolveEmbedSessionFromRequest(event: H3Event): Promise<ResolvedEmbedSession | null>;
+export declare function hasExplicitEmbedSessionCredential(event: H3Event): boolean;
 export declare function requestHasEmbedAuthMarker(event: H3Event): boolean;
 export declare function isEmbedModeRequest(event: H3Event): boolean;
 export {};