@agent-native/core 0.206.0 → 0.206.1-nightly-20261009213000

package/dist/client/session-replay-endpoint.js

@@ -0,0 +1,35 @@
+const REPLAY_ENDPOINT_PATH = "/api/analytics/replay";
+const URL_BASE = "https://analytics-endpoint.invalid";
+const TRACKING_ENDPOINT_SUFFIXES = [
+    "/api/analytics/track",
+    "/ssr-track",
+    "/build-track",
+    "/config-track",
+    "/track",
+];
+export function replayEndpointFromAnalyticsEndpoint(endpoint, baseUrl = URL_BASE) {
+    const hasScheme = /^[a-z][a-z\d+.-]*:/i.test(endpoint);
+    const isProtocolRelative = endpoint.startsWith("//");
+    let url;
+    try {
+        url = new URL(endpoint, baseUrl);
+    }
+    catch (error) {
+        if (error instanceof TypeError)
+            return null;
+        throw error;
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return null;
+    const trackingSuffix = TRACKING_ENDPOINT_SUFFIXES.find((suffix) => url.pathname.endsWith(suffix));
+    url.pathname = trackingSuffix
+        ? `${url.pathname.slice(0, -trackingSuffix.length)}${REPLAY_ENDPOINT_PATH}`
+        : REPLAY_ENDPOINT_PATH;
+    url.hash = "";
+    if (hasScheme)
+        return url.toString();
+    if (isProtocolRelative) {
+        return `//${url.host}${url.pathname}${url.search}`;
+    }
+    return `${url.pathname}${url.search}`;
+}

package/dist/client/session-replay.js

@@ -3,6 +3,7 @@ import { resolveLaneEndpoint } from "../shared/environment-lanes.js";
 import { loadOptionalPeer, OptionalPeerDependencyError, } from "../shared/optional-peer.js";
 import { isSyntheticTrafficValue } from "../shared/test-traffic.js";
 import { getOrCreateAnalyticsAnonymousId, getOrCreateAnalyticsSessionId, } from "./analytics-session.js";
+import { replayEndpointFromAnalyticsEndpoint } from "./session-replay-endpoint.js";
 import { SESSION_REPLAY_BLOCK_ATTRIBUTE, SESSION_REPLAY_MASK_ATTRIBUTE, } from "./session-replay-privacy.js";
 import { decideReplayQuotaResponse, parseRetryAfterSeconds, } from "./session-replay-quota.js";
 import { scrubUrl } from "./url-scrub.js";
@@ -499,33 +500,10 @@ function readFirstEnvNumber(keys) {
     }
     return undefined;
 }
-function replayEndpointFromAnalyticsEndpoint(value) {
-    try {
-        const url = new URL(value);
-        if (url.pathname.endsWith("/api/analytics/track")) {
-            url.pathname = url.pathname.replace(/\/api\/analytics\/track$/, "/api/analytics/replay");
-            return url.toString();
-        }
-        if (url.pathname.endsWith("/track")) {
-            url.pathname = url.pathname.replace(/\/track$/, "/api/analytics/replay");
-            return url.toString();
-        }
-    }
-    catch {
-        // Fall through to the relative path cases below.
-    }
-    if (value.endsWith("/api/analytics/track")) {
-        return value.replace(/\/api\/analytics\/track$/, "/api/analytics/replay");
-    }
-    if (value.endsWith("/track")) {
-        return value.replace(/\/track$/, "/api/analytics/replay");
-    }
-    return null;
-}
 function defaultReplayEndpoint() {
     const analyticsEndpoint = readEnvString("VITE_AGENT_NATIVE_ANALYTICS_ENDPOINT");
     const derived = analyticsEndpoint
-        ? replayEndpointFromAnalyticsEndpoint(analyticsEndpoint)
+        ? replayEndpointFromAnalyticsEndpoint(analyticsEndpoint, typeof document === "undefined" ? undefined : document.baseURI)
         : null;
     if (derived)
         return derived;

package/dist/client/sharing/share-controller-helpers.d.ts

@@ -33,7 +33,7 @@ export declare const DEFAULT_MEMBER_SUGGESTION_LIMIT = 25;
 export declare const DEFAULT_MEMBER_SEARCH_DEBOUNCE_MS = 140;
 export declare function createShareQueryParams(resourceType: string, resourceId: string): ShareQueryParams;
 export declare function createShareQueryKey(params: ShareQueryParams): ShareQueryKey;
-export declare function useShareQuery<TResponse>(resourceType: string, resourceId: string, enabled?: boolean): {
+export declare function useShareQuery<TResponse>(resourceType: string, resourceId: string, enabled?: boolean, staleTime?: number): {
     params: ShareQueryParams;
     queryKey: ShareQueryKey;
     query: ReturnType<typeof useActionQuery<TResponse>>;

package/dist/client/sharing/share-controller-helpers.js

@@ -10,12 +10,13 @@ export function createShareQueryParams(resourceType, resourceId) {
 export function createShareQueryKey(params) {
     return ["action", "list-resource-shares", params];
 }
-export function useShareQuery(resourceType, resourceId, enabled = true) {
+export function useShareQuery(resourceType, resourceId, enabled = true, staleTime) {
     const queryClient = useQueryClient();
     const params = useMemo(() => createShareQueryParams(resourceType, resourceId), [resourceId, resourceType]);
     const queryKey = useMemo(() => createShareQueryKey(params), [params]);
     const query = useActionQuery("list-resource-shares", params, {
         enabled,
+        ...(staleTime === undefined ? {} : { staleTime }),
     });
     return { params, queryKey, query, queryClient };
 }

package/dist/client/sharing/useShareButtonController.js

@@ -10,7 +10,7 @@ export function useShareButtonController(options) {
     const [visibilityOverride, setVisibilityOverride] = useState(null);
     const visibilitySequenceStartRef = useRef(null);
     const appliedDefaultOpenRef = useRef(false);
-    const { queryKey: shareQueryKey, query: sharesQuery, queryClient, } = useShareQuery(options.resourceType, options.resourceId);
+    const { queryKey: shareQueryKey, query: sharesQuery, queryClient, } = useShareQuery(options.resourceType, options.resourceId, open, 0);
     const { setVisibility, share, unshare } = useShareMutations();
     const visibilityGuard = useShareMutationGuard();
     const data = sharesQuery.data;
@@ -24,10 +24,8 @@ export function useShareButtonController(options) {
         if (nextOpen) {
             setActiveShareTab(shareTabDefaultValue);
             options.shareTabs?.onValueChange?.(shareTabDefaultValue);
-            if (visibilityOverride === null)
-                void sharesQuery.refetch();
         }
-    }, [options, shareTabDefaultValue, sharesQuery, visibilityOverride]);
+    }, [options, shareTabDefaultValue]);
     useEffect(() => {
         setInviteEmail("");
         setSelectedGroup(null);
@@ -147,11 +145,6 @@ export function useShareButtonController(options) {
             return next;
         });
     }, []);
-    useEffect(() => {
-        void sharesQuery.refetch();
-        // The resource identity is intentionally stable for this controller.
-        // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, []);
     const memberSearch = useShareOrgMemberSearch(inviteEmail, canManage && suggestionsOpen, {
         limit: DEFAULT_MEMBER_SUGGESTION_LIMIT,
         debounceMs: DEFAULT_MEMBER_SEARCH_DEBOUNCE_MS,

package/dist/client/use-action.d.ts

@@ -110,5 +110,6 @@ export declare function useActionMutation<TData = undefined, TVariables = undefi
     method?: "POST" | "PUT" | "DELETE";
     skipActionQueryInvalidation?: boolean;
     timeoutMs?: number;
+    headers?: Record<string, string> | ((variables: TVariables extends undefined ? ActionParams<TName> : TVariables) => Record<string, string> | undefined);
 }): import("@tanstack/react-query").UseMutationResult<TData extends undefined ? ActionResult<TName> : TData, Error, TVariables extends undefined ? ActionParams<TName> : TVariables, unknown>;
 export {};

package/dist/client/use-action.js

@@ -782,12 +782,13 @@ export function useActionQuery(actionName, params, options) {
 }
 export function useActionMutation(actionName, options) {
     const queryClient = useQueryClient();
-    const { method: methodOpt, onSuccess, skipActionQueryInvalidation = false, timeoutMs, ...restOptions } = options ?? {};
+    const { method: methodOpt, onSuccess, skipActionQueryInvalidation = false, timeoutMs, headers, ...restOptions } = options ?? {};
     const method = methodOpt ?? "POST";
     return useMutation({
         ...restOptions,
         mutationFn: (params) => actionFetch(actionName, method, params, {
             timeoutMs,
+            headers: typeof headers === "function" ? headers(params) : headers,
         }),
         onSuccess: (...args) => {
             // A write that succeeded may have fixed whatever was failing reads.

package/dist/deploy/build.js

@@ -1910,7 +1910,7 @@ async function getHandler() {
         headers: {
           "Access-Control-Allow-Origin": "*",
           "Access-Control-Allow-Methods": "GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS",
-          "Access-Control-Allow-Headers": "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Session-Id,X-Agent-Native-Client-Platform,X-Agent-Native-Desktop-Verifier,X-Agent-Native-Test-Traffic,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-Agent-Native-Embed-Target",
+          "Access-Control-Allow-Headers": "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Content-Save-Origin,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Session-Id,X-Agent-Native-Client-Platform,X-Agent-Native-Desktop-Verifier,X-Agent-Native-Test-Traffic,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-Agent-Native-Embed-Target",
         },
       });
     }

package/dist/deploy/workspace-deploy.js

@@ -1,5 +1,6 @@
-import { execFileSync } from "child_process";
+import { spawn } from "child_process";
 import fs from "fs";
+import os from "os";
 import path from "path";
 import { AGENT_BACKGROUND_PROCESSOR_A2A, AGENT_BACKGROUND_PROCESSOR_AGENT_TEAM, AGENT_BACKGROUND_PROCESSOR_FIELD, AGENT_BACKGROUND_PROCESSOR_INTEGRATION, AGENT_BACKGROUND_PROCESSOR_ROUTE, AGENT_BACKGROUND_PROCESSOR_ROUTE_FIELD, AGENT_CHAT_PROCESS_RUN_PATH, AGENT_TEAM_PROCESS_RUN_PATH, isDurableBackgroundFlagExplicitlyDisabled, } from "../agent/durable-background.js";
 import { getAppConfig } from "../app-config/index.js";
@@ -210,10 +211,12 @@ export async function runWorkspaceDeploy(opts = {}) {
         fs.mkdirSync(functionsDir, { recursive: true });
     }
     console.log(`[workspace-deploy] Building ${apps.length} app(s) for preset=${preset}`);
-    const execFile = opts.execFile ?? execFileSync;
+    const concurrency = workspaceBuildConcurrency();
+    const runBuild = opts.execFile ?? spawnBuild;
+    await runWithConcurrency(apps, concurrency, (app) => buildOneApp(workspaceRoot, appsDir, app, preset, runBuild, workspaceApps, workspaceAuthMode, concurrency > 1 ? "pipe" : "inherit"));
+    // Copy in app order after all builds so shared outputs stay deterministic.
     const sweepCrons = [];
     for (const app of apps) {
-        buildOneApp(workspaceRoot, appsDir, app, preset, execFile, workspaceApps, workspaceAuthMode);
         moveAppBuildIntoWorkspaceOutput(workspaceRoot, appsDir, app, preset, distDir, vercelOutputDir, workspaceApps, workspaceAuthMode);
         if (preset === "vercel") {
             sweepCrons.push(readVercelSweepCron(path.join(appsDir, app, VERCEL_OUTPUT_DIR), `/${app}`));
@@ -245,7 +248,7 @@ export async function runWorkspaceDeploy(opts = {}) {
     }
     console.log(`All apps live at https://<origin>/<app-name>/*. Log in once on any app\nand the session is shared across the workspace.`);
 }
-function buildOneApp(workspaceRoot, appsDir, app, preset, execFile, workspaceApps, workspaceAuthMode) {
+async function buildOneApp(workspaceRoot, appsDir, app, preset, runBuild, workspaceApps, workspaceAuthMode, stdio) {
     const appDir = path.join(appsDir, app);
     const workspaceAppAudience = workspaceAppAudienceForApp(workspaceApps, app);
     const workspaceAppRouteAccess = workspaceAppRouteAccessForApp(workspaceApps, app);
@@ -306,10 +309,66 @@ function buildOneApp(workspaceRoot, appsDir, app, preset, execFile, workspaceApp
     }
     console.log(`[workspace-deploy] Building ${app} (base=/${app}, preset=${preset})`);
     cleanAppBuildOutputs(appDir);
-    execFile("pnpm", ["--filter", app, "build"], {
+    const startedAt = Date.now();
+    await runBuild("pnpm", ["--filter", app, "build"], {
         cwd: workspaceRoot,
         env,
-        stdio: "inherit",
+        stdio,
+    });
+    console.log(`[workspace-deploy] Built ${app} in ${((Date.now() - startedAt) / 1000).toFixed(1)}s`);
+}
+function workspaceBuildConcurrency() {
+    const raw = process.env.AGENT_NATIVE_DEPLOY_CONCURRENCY?.trim();
+    if (raw) {
+        const parsed = Number(raw);
+        if (!Number.isInteger(parsed) || parsed < 1) {
+            throw new Error(`AGENT_NATIVE_DEPLOY_CONCURRENCY must be a positive integer, got "${raw}"`);
+        }
+        return parsed;
+    }
+    // Each app build can use 1-2 GB, so stay well under typical CI memory limits.
+    return Math.min(3, os.availableParallelism());
+}
+async function runWithConcurrency(items, limit, fn) {
+    let next = 0;
+    const errors = [];
+    const worker = async () => {
+        while (errors.length === 0 && next < items.length) {
+            try {
+                await fn(items[next++]);
+            }
+            catch (error) {
+                errors.push(error);
+            }
+        }
+    };
+    // Let in-flight builds finish so none are orphaned when the CLI exits and
+    // every failure gets reported, not just the first.
+    await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+    if (errors.length === 1)
+        throw errors[0];
+    if (errors.length > 1) {
+        throw new Error(errors
+            .map((error) => error instanceof Error ? error.message : String(error))
+            .join("\n"));
+    }
+}
+function spawnBuild(cmd, args, options) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, options);
+        // Buffered so parallel builds print as whole blocks instead of interleaving.
+        const chunks = [];
+        child.stdout?.on("data", (chunk) => chunks.push(chunk));
+        child.stderr?.on("data", (chunk) => chunks.push(chunk));
+        child.on("error", reject);
+        child.on("close", (code, signal) => {
+            if (chunks.length)
+                process.stdout.write(Buffer.concat(chunks));
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`Command failed: ${cmd} ${args.join(" ")} (${signal ?? `exit code ${code}`})`));
+        });
     });
 }
 function moveAppBuildIntoWorkspaceOutput(workspaceRoot, appsDir, app, preset, distDir, vercelOutputDir, workspaceApps, workspaceAuthMode) {

package/dist/file-upload/actions/upload-image.d.ts

@@ -33,9 +33,9 @@ declare const _default: import("../../action.js").ActionDefinition<{
     idempotencyKey: string;
     deleted: boolean;
 } | {
-    id?: undefined;
     error: string;
     url?: undefined;
+    id?: undefined;
     provider?: undefined;
     configured?: undefined;
 } | {
@@ -45,8 +45,8 @@ declare const _default: import("../../action.js").ActionDefinition<{
     configured?: undefined;
     error?: undefined;
 } | {
-    id?: undefined;
     url?: undefined;
+    id?: undefined;
     provider?: undefined;
     error: string;
     configured: boolean;

package/dist/file-upload/registry.d.ts

@@ -2,7 +2,13 @@ import type { FileUploadDeleteInput, FileUploadInput, FileUploadProvider, FileUp
 export declare function registerFileUploadProvider(provider: FileUploadProvider): void;
 export declare function unregisterFileUploadProvider(id: string): void;
 export declare function listFileUploadProviders(): FileUploadProvider[];
-/** Resolve a public upload URL only through a provider that claims ownership. */
+/**
+ * Resolve a public upload URL only through a provider that claims ownership.
+ * Each provider is checked independently: one provider whose check throws
+ * (S3 reads its config from the DB) must not hide another's positive claim, so
+ * this throws only when no provider claims the URL and at least one could not
+ * answer — "unverifiable", never reported as "not owned".
+ */
 export declare function findFileUploadProviderOwningUrl(url: string): Promise<FileUploadProvider | null>;
 export declare function getActiveFileUploadProvider(): FileUploadProvider | null;
 /**

package/dist/file-upload/registry.js

@@ -11,17 +11,35 @@ export function unregisterFileUploadProvider(id) {
 export function listFileUploadProviders() {
     return [...providers.values()];
 }
-/** Resolve a public upload URL only through a provider that claims ownership. */
+/**
+ * Resolve a public upload URL only through a provider that claims ownership.
+ * Each provider is checked independently: one provider whose check throws
+ * (S3 reads its config from the DB) must not hide another's positive claim, so
+ * this throws only when no provider claims the URL and at least one could not
+ * answer — "unverifiable", never reported as "not owned".
+ */
 export async function findFileUploadProviderOwningUrl(url) {
-    const candidates = [...providers.values()];
-    if (!candidates.includes(builderFileUploadProvider)) {
-        candidates.push(builderFileUploadProvider);
-    }
+    const candidates = [
+        builderFileUploadProvider,
+        ...[...providers.values()].filter((p) => p !== builderFileUploadProvider),
+    ];
+    const failures = [];
+    const unverifiable = [];
     for (const provider of candidates) {
-        if (provider.isOwnedUrl && (await provider.isOwnedUrl(url))) {
-            return provider;
+        if (!provider.isOwnedUrl)
+            continue;
+        try {
+            if (await provider.isOwnedUrl(url))
+                return provider;
+        }
+        catch (error) {
+            failures.push(error);
+            unverifiable.push(provider.id);
         }
     }
+    if (failures.length > 0) {
+        throw new AggregateError(failures, `Upload URL ownership is unverifiable: ${unverifiable.join(", ")} failed its check`);
+    }
     return null;
 }
 export function getActiveFileUploadProvider() {

package/dist/mcp/build-server.d.ts

@@ -74,6 +74,12 @@ export interface MCPConfig {
         widgetReadPrivateActions?: readonly string[];
         /** Authenticated reads surfaced on other agent profiles, but only scoped here. */
         widgetReadAuthenticatedActions?: readonly string[];
+        /**
+         * Scoped reads minted only into a write capability, and only for a target
+         * that lists the mapped write action: `{ "list-resource-shares":
+         * "share-resource" }` keeps collaborator lists out of read-only tickets.
+         */
+        widgetReadActionWriteGates?: Record<string, string>;
         /** Omit the one shared resource title when tools have distinct invocation labels. */
         widgetResourceTitle?: string | false;
         keyToolNames?: readonly string[];

package/dist/mcp/build-server.js

@@ -356,6 +356,12 @@ export function validateMcpDirectoryProfile(config, sourceActions = config.produ
             throw new McpDirectoryProfileValidationError(`[agent-native] MCP directory widget read route "${name}" must be an explicitly scoped read-only GET action with valid resource arguments in the connector allowlist or hidden-read profiles.`);
         }
     }
+    for (const [readAction, writeAction] of Object.entries(profile?.widgetReadActionWriteGates ?? {})) {
+        if (!Object.hasOwn(profile?.widgetReadActionArguments ?? {}, readAction) ||
+            !Object.hasOwn(profile?.widgetWriteActionArguments ?? {}, writeAction)) {
+            throw new McpDirectoryProfileValidationError(`[agent-native] MCP directory widget read "${readAction}" is gated on "${writeAction}", which must both be declared widget actions.`);
+        }
+    }
     for (const [name, argumentMap] of Object.entries(profile?.widgetWriteActionArguments ?? {})) {
         const entry = actions[name] ?? config.widgetWriteActions?.[name];
         if (!entry ||
@@ -894,16 +900,6 @@ async function withServerMintedMcpAppEmbedStart(result, meta, directoryLinkUrl,
                 (ctx?.orgId ?? undefined))) {
         throw new Error("The widget write grant must match the authenticated MCP user and organization.");
     }
-    const scope = restrictDirectoryWidgetCapability
-        ? directoryWidget.capability.mode === "write"
-            ? createMcpDirectoryWidgetWriteCapability(directoryWidget.capability.value)
-            : createMcpDirectoryWidgetReadCapability(directoryWidget.capability.value)
-        : typeof out.chrome === "string"
-            ? out.chrome
-            : null;
-    if (restrictDirectoryWidgetCapability && !scope) {
-        throw new Error("Could not create a valid scoped capability for this MCP directory widget.");
-    }
     const revocationAnchorCandidate = ctx?.mcpCredentialIssuedAtMs;
     const revocationAnchorCreatedAtMs = typeof revocationAnchorCandidate === "number" &&
         Number.isSafeInteger(revocationAnchorCandidate)
@@ -913,18 +909,60 @@ async function withServerMintedMcpAppEmbedStart(result, meta, directoryLinkUrl,
         revocationAnchorCreatedAtMs === undefined) {
         throw new Error("Directory widget sessions require a trusted MCP credential issue time.");
     }
-    const ticket = await createEmbedSessionTicket({
-        ownerEmail,
-        orgId: ctx?.orgId,
-        targetPath,
-        scope,
-        ...(directoryWidget?.capability.mode === "write"
-            ? { ttlSeconds: 5 * 60 }
-            : {}),
-        ...(restrictDirectoryWidgetCapability
-            ? { revocationAnchorCreatedAtMs }
-            : {}),
-    });
+    const mintTicket = async (capability) => {
+        const scope = capability
+            ? capability.mode === "write"
+                ? createMcpDirectoryWidgetWriteCapability(capability.value)
+                : createMcpDirectoryWidgetReadCapability(capability.value)
+            : typeof out.chrome === "string"
+                ? out.chrome
+                : null;
+        // An oversize or invalid scope has no ticket; the caller degrades or
+        // returns the result without one. Throwing here would fail a tool call
+        // whose action already ran.
+        if (capability && !scope)
+            return null;
+        return createEmbedSessionTicket({
+            ownerEmail,
+            orgId: ctx?.orgId,
+            targetPath,
+            scope,
+            ...(capability?.mode === "write" ? { ttlSeconds: 5 * 60 } : {}),
+            ...(capability ? { revocationAnchorCreatedAtMs } : {}),
+        });
+    };
+    const writeCapability = directoryWidget?.capability.mode === "write"
+        ? directoryWidget.capability
+        : undefined;
+    let ticket = null;
+    let writeMintError = new Error("Could not create a valid scoped capability for this MCP directory widget.");
+    try {
+        ticket = await mintTicket(directoryWidget?.capability);
+    }
+    catch (error) {
+        if (!writeCapability)
+            throw error;
+        writeMintError = error;
+    }
+    if (!ticket && writeCapability) {
+        // The write grant is an upgrade over the read grant. Losing it must not
+        // also lose the widget's session ticket, which the shell cannot start without.
+        console.error("[mcp:directory] Could not mint the widget write grant; issuing a read-only widget session instead.", writeMintError);
+        const { appId, resourceUri, resourceIds, readActionArguments } = writeCapability.value;
+        ticket = await mintTicket({
+            mode: "read",
+            value: {
+                appId,
+                resourceUri,
+                resourceIds,
+                actionArguments: readActionArguments,
+            },
+        });
+    }
+    if (!ticket) {
+        console.error("[mcp:directory] Could not build a widget capability within the scope size limits; returning the result without a session ticket.", { targetPath });
+        return resultWithoutExistingEmbedTicket;
+    }
     const startPath = buildEmbedStartPath(ticket.ticket);
     const embedStartUrl = meta?.origin
         ? new URL(startPath, meta.origin).toString()
@@ -957,6 +995,7 @@ async function mcpDirectoryWidgetCapabilityForTool(config, resource, toolName, a
     if (!target)
         return undefined;
     const actionArguments = {};
+    const writeGatedReadArguments = {};
     for (const [actionName, argumentMap] of Object.entries(profile.widgetReadActionArguments ?? {})) {
         const scopedPublicRead = profile.widgetReadPublicActions?.includes(actionName);
         const scopedPrivateRead = profile.widgetReadPrivateActions?.includes(actionName);
@@ -992,7 +1031,13 @@ async function mcpDirectoryWidgetCapabilityForTool(config, resource, toolName, a
             }
         }
         if (Object.keys(scopedArguments).length === Object.keys(argumentMap).length) {
-            actionArguments[actionName] = scopedArguments;
+            const writeGate = profile.widgetReadActionWriteGates?.[actionName];
+            if (writeGate === undefined) {
+                actionArguments[actionName] = scopedArguments;
+            }
+            else if (target.writeActions?.includes(writeGate)) {
+                writeGatedReadArguments[actionName] = { writeGate, scopedArguments };
+            }
         }
     }
     const writeActionArguments = {};
@@ -1071,7 +1116,15 @@ async function mcpDirectoryWidgetCapabilityForTool(config, resource, toolName, a
             userEmail: identity.userEmail,
             ...(typeof requestOrgId === "string" ? { orgId: requestOrgId } : {}),
             expiresAtMs: Date.now() + MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_AGE_MS,
-            readActionArguments: actionArguments,
+            readActionArguments: {
+                ...actionArguments,
+                ...Object.fromEntries(Object.entries(writeGatedReadArguments)
+                    .filter(([, { writeGate }]) => Object.hasOwn(writeActionArguments, writeGate))
+                    .map(([actionName, { scopedArguments }]) => [
+                    actionName,
+                    scopedArguments,
+                ])),
+            },
             writeActionArguments,
         };
         return {
@@ -2441,11 +2494,24 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
                     mcpAppResourceCandidate !== null &&
                     directoryWidget === undefined;
                 const suppressDirectoryWidget = directoryCatalog && !hasVerifiedMcpUserIdentity(effectiveIdentity);
+                // The host mounts a widget for this tool from its descriptor, with or
+                // without a ticket in the result, so a withheld ticket must be visible.
+                if (missingDirectoryWidgetCapability &&
+                    !suppressDirectoryWidget &&
+                    !mcpResultIsError) {
+                    console.warn(`[mcp:directory] ${name} returned no widget session ticket: ${typeof trustedCredentialIssuedAtMs === "number"
+                        ? "the result has no widget target or scoped actions"
+                        : "the credential carries no issue time"}.`);
+                }
                 const rawResultForClient = missingDirectoryWidgetCapability || suppressDirectoryWidget
                     ? withoutMcpAppEmbedTicket(projectedRawResult)
                     : mcpAppResourceCandidate
                         ? await withServerMintedMcpAppEmbedStart(projectedRawResult, requestMeta, directoryLinkUrl, directoryWidget)
                         : projectedRawResult;
+                if (directoryWidget &&
+                    typeof metadataObject(rawResultForClient).embedStartUrl !== "string") {
+                    console.error(`[mcp:directory] ${name} built a widget capability but issued no session ticket.`);
+                }
                 const { value: actionResultForClient, images: resultImages, notes: resultImageNotes, } = extractAgentImagesFromActionResult(rawResultForClient);
                 const textResultForClient = mcpResult
                     ? projectedResultForClient
@@ -2996,12 +3062,15 @@ async function admitIssuedMcpCredential(credential, requestOrigin) {
         stored = lookup;
     }
     const orgId = credential.orgId !== undefined ? credential.orgId : stored?.orgId;
-    const credentialIssuedAtMs = credential.oauthClientId !== undefined
-        ? credential.grantCreatedAtMs
-        : typeof credential.issuedAt === "number" &&
+    // Access tokens signed before grant times existed carry no claim, and the
+    // directory widget refuses to mint a session without an issue time. Their
+    // signed `iat` is the only anchor they have. `iat` moves on every refresh, so
+    // it must stay the fallback and never outrank a signed grant time.
+    const credentialIssuedAtMs = credential.grantCreatedAtMs ??
+        (typeof credential.issuedAt === "number" &&
             Number.isSafeInteger(credential.issuedAt)
             ? credential.issuedAt * 1000
-            : undefined;
+            : undefined);
     const mcpCredentialIssuedAtMs = credentialIssuedAtMs !== undefined &&
         Number.isSafeInteger(credentialIssuedAtMs)
         ? credentialIssuedAtMs

package/dist/mcp/embed-app.js

@@ -128,6 +128,9 @@ export function embedApp(options = {}) {
     let toolResponseMetadata = {};
     let openUrl = "";
     let openStartUrl = "";
+    // Start URLs are single use. The host replays a saved one on every re-sync,
+    // so remember which one the server has already refused.
+    let spentStartUrl = "";
     let activeEmbedSessionTicket = "";
     let startedFor = "";
     let appFrame = null;
@@ -1503,7 +1506,7 @@ export function embedApp(options = {}) {
         return;
       }
       embedSessionRefreshAttempts += 1;
-      openStartUrl = "";
+      spentStartUrl = openStartUrl;
       startedFor = "";
       lastFrameSrc = "";
       setMessage("Refreshing app session");
@@ -2001,17 +2004,15 @@ export function embedApp(options = {}) {
         return;
       }
       if (message.type === "agentNative.embedSessionExpired") {
-        if (expiredSessionMessage) {
-          refreshExpiredEmbedSession();
-        } else if (typeof data.requestId === "string") {
+        if (!expiredSessionMessage && typeof data.requestId === "string") {
           void renewExpiredEmbedSession(
             data.requestId,
             appFrame,
             appFrameDocumentState.loadGeneration,
           );
-        } else if (body.dataset.catalogMode !== "directory") {
-          // Older app frames do not include a renewal id, so preserve their
-          // existing full-refresh fallback until they load the renewal client.
+        } else {
+          // The server's expiry page names no request: it answered in place of
+          // the app, so there is no mounted session to renew in place.
           refreshExpiredEmbedSession();
         }
         return;
@@ -2063,7 +2064,7 @@ export function embedApp(options = {}) {
         notifyHostHeight();
         return;
       }
-      let launchUrl = openStartUrl || openUrl;
+      let launchUrl = (openStartUrl !== spentStartUrl && openStartUrl) || openUrl;
       if (!launchUrl) {
         renderAppLaunchError("Open link was not available.");
         return;