@agent-native/core 0.221.0 → 0.221.1-nightly-20261028032829

package/dist/deploy/build.js

@@ -1747,6 +1747,14 @@ function getAppOriginClientConfigScript() {
   const workspaceAppPath =
     workspaceAppMountConfig?.currentPath ??
     (workspaceRuntime ? configuredWorkspaceAppPath : "");
+  const explicitRootPath =
+    workspaceAppMountConfig?.currentPath === "/" ||
+    (typeof appConfig.app.basePath === "string" &&
+      appConfig.app.basePath.trim().length > 0 &&
+      normalizeAppBasePath(appConfig.app.basePath) === "");
+  const frameworkRoutePrefix = (
+    process.env.AGENT_NATIVE_CONFIG_RUNTIME_FRAMEWORK_ROUTE_PREFIX || ""
+  ).trim();
   const config = {
     ...(appConfig.app.id ? { appId: appConfig.app.id } : {}),
     ...(appConfig.app.workspaceId
@@ -1764,6 +1772,8 @@ function getAppOriginClientConfigScript() {
     ...(workspaceAppMountConfig?.paths
       ? { workspaceAppMountPaths: workspaceAppMountConfig.paths }
       : {}),
+    ...(explicitRootPath ? { explicitRootPath: true } : {}),
+    ...(frameworkRoutePrefix ? { frameworkRoutePrefix } : {}),
   };
   const toUnicodeEscape = (character) =>
     String.fromCharCode(92) +

package/dist/mcp/embed-app.js

@@ -1,5 +1,6 @@
 import { MCP_APP_CHAT_BRIDGE_QUERY_PARAM } from "../shared/embed-auth.js";
 import { MCP_APP_HOST_FILL_ATTRIBUTE, MCP_APP_PANE_FILL_MAX_HEIGHT, } from "../shared/mcp-app-display.js";
+import { EMBED_TOKEN_STORAGE_KEY, MCP_CHAT_BRIDGE_STORAGE_KEY, resolveMcpAppEmbedBasePath, } from "../shared/mcp-app-widget-embed.js";
 import { EXTERNAL_EMBED_WINDOW_KEY } from "../shared/route-chunk-recovery-bootstrap.js";
 import { HIDDEN_EMBED_URL } from "./embed-redaction.js";
 const MCP_APP_IMPORT = "https://esm.sh/@modelcontextprotocol/ext-apps@1.7.5/app-with-deps";
@@ -656,7 +657,28 @@ export function embedApp(options = {}) {
       );
     }
 
-    function embedConfigForAppUrl(appUrl) {
+    function appOriginConfigForDocument(parsed) {
+      const script = parsed.querySelector("script[data-agent-native-app-origin-config]");
+      if (!script) return {};
+      const source = script.textContent || "";
+      const prefix = "window.__AGENT_NATIVE_CONFIG__=Object.assign({},window.__AGENT_NATIVE_CONFIG__,";
+      const suffix = ");";
+      if (!source.startsWith(prefix) || !source.endsWith(suffix)) {
+        throw new Error("Embedded app origin config is malformed.");
+      }
+      let appConfig;
+      try {
+        appConfig = JSON.parse(source.slice(prefix.length, -suffix.length));
+      } catch (_err) {
+        throw new Error("Embedded app origin config is not valid JSON.");
+      }
+      if (!appConfig || typeof appConfig !== "object" || Array.isArray(appConfig)) {
+        throw new Error("Embedded app origin config must be an object.");
+      }
+      return appConfig;
+    }
+
+    function embedConfigForAppUrl(appUrl, appConfig) {
       const sanitizedTarget = localPathFromUrl(appUrl, false);
       return {
         origin: appUrl.origin,
@@ -667,7 +689,8 @@ export function embedApp(options = {}) {
         chatBridgeActive: appUrl.searchParams.get(chatBridgeParam) === "1",
         chatBridgeParam,
         embedTokenParam: "__an_embed_token",
-        embedTargetHeader: "x-agent-native-embed-target"
+        embedTargetHeader: "x-agent-native-embed-target",
+        appConfig
       };
     }
 
@@ -736,27 +759,108 @@ export function embedApp(options = {}) {
           window.history.replaceState(window.history.state, "", config.target);
         }
       } catch (_err) {}
+      // Keep transplanted auth storage on the same mount resolver as its reader.
+      var resolveMcpAppEmbedBasePath = ${resolveMcpAppEmbedBasePath.toString()};
+      function activeConfig() {
+        return window[${JSON.stringify(EXTERNAL_EMBED_WINDOW_KEY)}] || config;
+      }
+      function workspaceMountOptions(active) {
+        var appConfig = active.appConfig || {};
+        return {
+          workspaceRuntime: true,
+          routerBasePath: window.__reactRouterContext && window.__reactRouterContext.basename,
+          workspaceAppPath: appConfig.workspaceAppPath,
+          workspaceAppMountPaths: appConfig.workspaceAppMountPaths,
+          explicitRootPath: appConfig.explicitRootPath === true,
+          frameworkRoutePrefix: appConfig.frameworkRoutePrefix
+        };
+      }
+      function embedStorageKey(key) {
+        var active = activeConfig();
+        var appConfig = active.appConfig || {};
+        if (appConfig.workspaceRuntime !== true) return key;
+        var basePath = resolveMcpAppEmbedBasePath(
+          "external-target",
+          active.target || location.pathname,
+          workspaceMountOptions(active)
+        );
+        if (typeof basePath !== "string") return undefined;
+        return key + ":" + (basePath || "/");
+      }
       try {
         if (config.token) {
-          sessionStorage.setItem("agent-native:embed-auth-token", config.token);
+          var tokenStorageKey = embedStorageKey(${JSON.stringify(EMBED_TOKEN_STORAGE_KEY)});
+          if (tokenStorageKey) sessionStorage.setItem(tokenStorageKey, config.token);
         }
         if (config.chatBridgeActive && config.token) {
-          sessionStorage.setItem("agent-native:mcp-chat-bridge", config.token);
+          var bridgeStorageKey = embedStorageKey(${JSON.stringify(MCP_CHAT_BRIDGE_STORAGE_KEY)});
+          if (bridgeStorageKey) sessionStorage.setItem(bridgeStorageKey, config.token);
         }
       } catch (_err) {}
       if (window.__agentNativeExternalEmbedRuntimeInstalled) return;
       window.__agentNativeExternalEmbedRuntimeInstalled = true;
       function appOrigin() {
         try {
-          return new URL(config.origin).origin;
+          return new URL(activeConfig().origin).origin;
         } catch (_err) {
           return "";
         }
       }
       function targetPath() {
-        return config.target || location.pathname + location.search;
+        var active = activeConfig();
+        return active.target || location.pathname + location.search;
+      }
+      function authorizedTargetPath() {
+        var active = activeConfig();
+        var appConfig = active.appConfig || {};
+        var target = targetPath();
+        if (appConfig.workspaceRuntime !== true) return target;
+        var options = workspaceMountOptions(active);
+        var targetMount = resolveMcpAppEmbedBasePath(
+          "external-target",
+          active.target || location.pathname,
+          options
+        );
+        var currentMount = resolveMcpAppEmbedBasePath(
+          "workspace-path",
+          location.pathname,
+          Object.assign({}, options, { preferDeclaredMounts: true })
+        );
+        if (typeof targetMount !== "string" || targetMount !== currentMount) {
+          return null;
+        }
+        return target;
+      }
+      function requestBelongsToTargetMount(value, target) {
+        var active = activeConfig();
+        var appConfig = active.appConfig || {};
+        if (appConfig.workspaceRuntime !== true) return true;
+        var options = workspaceMountOptions(active);
+        var targetMount = resolveMcpAppEmbedBasePath(
+          "external-target",
+          target,
+          options
+        );
+        if (typeof targetMount !== "string") return false;
+        var parsedUrl;
+        try {
+          parsedUrl = { url: new URL(value, location.href) };
+        } catch (error) {
+          parsedUrl = { error: error };
+        }
+        if (!("url" in parsedUrl)) return false;
+        var url = parsedUrl.url;
+        const origin = appOrigin();
+        if (url.origin !== location.origin && url.origin !== origin) return false;
+        var requestMount = resolveMcpAppEmbedBasePath(
+          "workspace-path",
+          url.pathname,
+          Object.assign({}, options, { preferDeclaredMounts: true })
+        );
+        return typeof requestMount === "string" && requestMount === targetMount;
       }
       function rewrittenUrl(value, appendToken) {
+        var active = activeConfig();
         const origin = appOrigin();
         if (!origin) return null;
         let url;
@@ -771,20 +875,49 @@ export function embedApp(options = {}) {
           url.protocol = app.protocol;
           url.host = app.host;
         }
-        if (appendToken && config.token && url.pathname === "/_agent-native/events") {
-          url.searchParams.set(config.embedTokenParam, config.token);
+        const appConfig = active.appConfig || {};
+        var frameworkRoutePrefix = appConfig.frameworkRoutePrefix || "/_agent-native";
+        if (frameworkRoutePrefix.endsWith("/")) {
+          frameworkRoutePrefix = frameworkRoutePrefix.slice(0, -1);
+        }
+        const eventsPath = frameworkRoutePrefix + "/events";
+        const authorizedTarget = authorizedTargetPath();
+        if (
+          appendToken &&
+          authorizedTarget !== null &&
+          requestBelongsToTargetMount(value, authorizedTarget) &&
+          active.token &&
+          url.pathname.endsWith(eventsPath)
+        ) {
+          url.searchParams.set(active.embedTokenParam, active.token);
         }
         return url.toString();
       }
       function authHeaders(input, init) {
+        var active = activeConfig();
+        var authorizedTarget = authorizedTargetPath();
+        var requestUrl = input instanceof Request ? input.url : input;
+        if (
+          authorizedTarget !== null &&
+          !requestBelongsToTargetMount(requestUrl, authorizedTarget)
+        ) {
+          authorizedTarget = null;
+        }
         const headers = new Headers(
           init && init.headers ? init.headers : input instanceof Request ? input.headers : undefined
         );
-        if (config.token && !headers.has("Authorization")) {
-          headers.set("Authorization", "Bearer " + config.token);
+        if (
+          authorizedTarget !== null &&
+          active.token &&
+          !headers.has("Authorization")
+        ) {
+          headers.set("Authorization", "Bearer " + active.token);
         }
-        if (!headers.has(config.embedTargetHeader)) {
-          headers.set(config.embedTargetHeader, targetPath());
+        if (
+          authorizedTarget !== null &&
+          !headers.has(active.embedTargetHeader)
+        ) {
+          headers.set(active.embedTargetHeader, authorizedTarget);
         }
         return headers;
       }
@@ -810,6 +943,7 @@ export function embedApp(options = {}) {
         XMLHttpRequest.prototype.open = function(method, url) {
           const rewritten = rewrittenUrl(url, false);
           this.__agentNativeExternalEmbed = !!rewritten;
+          this.__agentNativeExternalEmbedUrl = url;
           return originalOpen.call(
             this,
             method,
@@ -822,8 +956,20 @@ export function embedApp(options = {}) {
         XMLHttpRequest.prototype.send = function(body) {
           if (this.__agentNativeExternalEmbed) {
             try {
-              if (config.token) this.setRequestHeader("Authorization", "Bearer " + config.token);
-              this.setRequestHeader(config.embedTargetHeader, targetPath());
+              var active = activeConfig();
+              var authorizedTarget = authorizedTargetPath();
+              if (
+                authorizedTarget !== null &&
+                requestBelongsToTargetMount(
+                  this.__agentNativeExternalEmbedUrl,
+                  authorizedTarget
+                )
+              ) {
+                if (active.token) {
+                  this.setRequestHeader("Authorization", "Bearer " + active.token);
+                }
+                this.setRequestHeader(active.embedTargetHeader, authorizedTarget);
+              }
             } catch (_err) {}
           }
           return originalSend.call(this, body);
@@ -1056,12 +1202,15 @@ export function embedApp(options = {}) {
     }
 
     async function mountTransplantedHtml(html, appUrl) {
-      const config = embedConfigForAppUrl(appUrl);
-      installExternalEmbedRuntime(config);
       const parsed = new DOMParser().parseFromString(
         rewriteRootRelativeHtmlUrls(removeHtmlCspMeta(html), appUrl.origin),
         "text/html"
       );
+      const config = embedConfigForAppUrl(
+        appUrl,
+        appOriginConfigForDocument(parsed)
+      );
+      installExternalEmbedRuntime(config);
       const scripts = Array.from(parsed.querySelectorAll("script"));
       copyDocumentElementAttributes(parsed.documentElement);
       importHeadChildrenWithBase(parsed.head, config.baseHref);

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -76,8 +76,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     }>>;
 }, z.core.$strip>>, {
     id?: undefined;
-    deleted?: undefined;
     provider?: undefined;
+    deleted?: undefined;
     message?: undefined;
     providers: {
         id: string;
@@ -103,8 +103,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     label?: undefined;
 } | {
-    deleted?: undefined;
     provider?: undefined;
+    deleted?: undefined;
     count?: undefined;
     message?: undefined;
     providers?: undefined;
@@ -123,8 +123,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     label?: undefined;
 } | {
-    deleted?: undefined;
     provider?: undefined;
+    deleted?: undefined;
     count?: undefined;
     providers?: undefined;
     found?: undefined;

package/dist/provider-api/actions/provider-api.d.ts

@@ -316,6 +316,7 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
+        message?: undefined;
         deleted?: undefined;
         id?: undefined;
         providers: {
@@ -332,8 +333,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         found?: undefined;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
+        message?: undefined;
         deleted?: undefined;
         id?: undefined;
         providers?: undefined;
@@ -342,8 +343,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
+        message?: undefined;
         deleted?: undefined;
         providers?: undefined;
         count?: undefined;
@@ -352,8 +353,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         id: string;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
+        message?: undefined;
         providers?: undefined;
         count?: undefined;
         provider?: undefined;
@@ -362,7 +363,6 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         id: string;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
         deleted?: undefined;
         providers?: undefined;

package/dist/server/app-origin-config.d.ts

@@ -8,5 +8,7 @@ export declare function resolvePublicAppOriginConfig(): {
     workspaceOAuthOrigin?: string;
     workspaceRuntime?: boolean;
     workspaceAppMountPaths?: string[];
+    frameworkRoutePrefix?: string;
+    explicitRootPath?: boolean;
 } | null;
 export declare function getAppOriginClientConfigScript(): string | null;

package/dist/server/app-origin-config.js

@@ -1,6 +1,7 @@
 import { getAppConfig, resolveAppHomePath } from "../app-config/index.js";
 import { safeJsonForHtml } from "../shared/agent-readable-resource.js";
 import { normalizeAppBasePath } from "./app-base-path.js";
+import { FRAMEWORK_INTERNAL_ROUTE_PREFIX, getFrameworkRoutePrefix, } from "./framework-route-prefix.js";
 function workspaceAppMountConfigFromJson(value, workspaceAppId) {
     if (!value?.trim())
         return undefined;
@@ -50,6 +51,7 @@ function workspaceAppMountConfigFromJson(value, workspaceAppId) {
 }
 export function resolvePublicAppOriginConfig() {
     const config = getAppConfig();
+    const frameworkRoutePrefix = getFrameworkRoutePrefix();
     const workspaceRuntime = config.workspace.isWorkspace === true ||
         typeof config.workspace.appsJson === "string";
     const workspaceAppMountConfig = workspaceAppMountConfigFromJson(config.workspace.appsJson, config.app.workspaceId);
@@ -58,6 +60,10 @@ export function resolvePublicAppOriginConfig() {
         : undefined;
     const workspaceAppPath = workspaceAppMountConfig?.currentPath ??
         (workspaceRuntime ? configuredWorkspaceAppPath : undefined);
+    const explicitRootPath = workspaceAppMountConfig?.currentPath === "/" ||
+        (typeof config.app.basePath === "string" &&
+            config.app.basePath.trim().length > 0 &&
+            normalizeAppBasePath(config.app.basePath) === "");
     const resolved = {
         ...(config.app.id ? { appId: config.app.id } : {}),
         ...(config.app.workspaceId
@@ -76,6 +82,10 @@ export function resolvePublicAppOriginConfig() {
         ...(workspaceAppMountConfig?.paths
             ? { workspaceAppMountPaths: workspaceAppMountConfig.paths }
             : {}),
+        ...(explicitRootPath ? { explicitRootPath: true } : {}),
+        ...(frameworkRoutePrefix !== FRAMEWORK_INTERNAL_ROUTE_PREFIX
+            ? { frameworkRoutePrefix }
+            : {}),
     };
     return Object.keys(resolved).length > 0 ? resolved : null;
 }

package/dist/shared/mcp-app-widget-embed.d.ts

@@ -1,5 +1,27 @@
 export declare const EMBED_TOKEN_STORAGE_KEY = "agent-native:embed-auth-token";
 export declare const MCP_CHAT_BRIDGE_STORAGE_KEY = "agent-native:mcp-chat-bridge";
+export interface WorkspaceAppMountPathOptions {
+    explicitRootPath?: boolean;
+    fallbackPath?: string;
+    frameworkRoutePrefix?: string;
+    preferDeclaredMounts?: boolean;
+    routerBasePath?: unknown;
+    workspaceAppMountPaths?: unknown;
+    workspaceAppPath?: unknown;
+}
+/**
+ * Self-contained so its source can safely be embedded in browser scripts.
+ * Keep both paths here: a serialized function cannot close over module locals.
+ */
+export declare function resolveMcpAppEmbedBasePath(mode: "workspace-path" | "external-target", value: unknown, options?: WorkspaceAppMountPathOptions & {
+    workspaceRuntime?: boolean;
+}): string | undefined;
+export declare function resolveWorkspaceAppMountPath(pathname: string, options?: WorkspaceAppMountPathOptions): string | undefined;
+export declare function resolveExternalEmbedTargetBasePath(target: unknown, options?: WorkspaceAppMountPathOptions & {
+    workspaceRuntime?: boolean;
+}): string | undefined;
+export declare function embedTokenStorageKey(basePath: string | undefined, workspaceRuntime: boolean): string;
+export declare function mcpChatBridgeStorageKey(basePath: string | undefined, workspaceRuntime: boolean): string;
 /**
  * Set on `<html>` for the life of a document that is an app nested in an MCP
  * App widget (a ChatGPT, Codex, or Claude card or side pane). Layout reads it
@@ -15,4 +37,4 @@ export declare const MCP_APP_WIDGET_EMBED_ATTRIBUTE = "data-agent-native-mcp-wid
  * embed credential in the URL, stored, or `embedded=1`); `mcp-app-host.spec.ts`
  * runs both over one table so they cannot drift.
  */
-export declare function getMcpAppWidgetEmbedBootScriptBody(): string;
+export declare function getMcpAppWidgetEmbedBootScriptBody(basePath?: string, workspaceRuntime?: boolean): string;

package/dist/shared/mcp-app-widget-embed.js

@@ -1,7 +1,140 @@
 import { safeJsonForHtml } from "./agent-readable-resource.js";
 import { EMBED_MODE_QUERY_PARAM, EMBED_TOKEN_QUERY_PARAM, MCP_APP_CHAT_BRIDGE_QUERY_PARAM, } from "./embed-auth.js";
+import { EXTERNAL_EMBED_WINDOW_KEY } from "./route-chunk-recovery-bootstrap.js";
 export const EMBED_TOKEN_STORAGE_KEY = "agent-native:embed-auth-token";
 export const MCP_CHAT_BRIDGE_STORAGE_KEY = "agent-native:mcp-chat-bridge";
+/**
+ * Self-contained so its source can safely be embedded in browser scripts.
+ * Keep both paths here: a serialized function cannot close over module locals.
+ */
+export function resolveMcpAppEmbedBasePath(mode, value, options = {}) {
+    const resolveWorkspacePath = (pathname, options) => {
+        const normalize = (value) => {
+            if (typeof value !== "string")
+                return "";
+            const trimmed = value.trim();
+            if (!trimmed || trimmed === "/")
+                return "";
+            return `/${trimmed.replace(/^\/+/, "").replace(/\/+$/, "")}`;
+        };
+        const matches = (basePath) => Boolean(basePath) &&
+            (pathname === basePath || pathname.startsWith(`${basePath}/`));
+        const configuredPath = normalize(options.workspaceAppPath);
+        const explicitRootPath = options.explicitRootPath === true ||
+            (typeof options.workspaceAppPath === "string" &&
+                options.workspaceAppPath.trim().length > 0 &&
+                configuredPath === "");
+        const fallbackPath = normalize(options.fallbackPath);
+        const routerBasePath = normalize(options.routerBasePath);
+        const matchingHostPaths = [routerBasePath, configuredPath]
+            .filter((basePath) => basePath && matches(basePath))
+            .sort((left, right) => right.length - left.length);
+        const matchingHostPath = matchingHostPaths[0];
+        if (matchingHostPath && !options.preferDeclaredMounts) {
+            return matchingHostPath;
+        }
+        const declaredMounts = (Array.isArray(options.workspaceAppMountPaths)
+            ? options.workspaceAppMountPaths
+            : [])
+            .filter((value) => typeof value === "string")
+            .map(normalize)
+            .filter(Boolean);
+        const matchingMount = declaredMounts
+            .filter((basePath) => matches(basePath))
+            .sort((left, right) => right.length - left.length)[0];
+        if (matchingHostPath && options.preferDeclaredMounts) {
+            return [matchingHostPath, matchingMount]
+                .filter((basePath) => Boolean(basePath))
+                .sort((left, right) => right.length - left.length)[0];
+        }
+        const segment = pathname.split("/").find(Boolean);
+        if (!segment) {
+            if (explicitRootPath)
+                return "";
+            return fallbackPath || undefined;
+        }
+        const frameworkRoutePrefix = normalize(options.frameworkRoutePrefix) || "/_agent-native";
+        if (`/${segment}` === "/_agent-native" ||
+            `/${segment}` === frameworkRoutePrefix ||
+            segment === "api") {
+            if (options.preferDeclaredMounts) {
+                return explicitRootPath ? "" : undefined;
+            }
+            return fallbackPath;
+        }
+        if (matchingMount)
+            return matchingMount;
+        if (explicitRootPath)
+            return "";
+        if (options.preferDeclaredMounts &&
+            Array.isArray(options.workspaceAppMountPaths)) {
+            return undefined;
+        }
+        return fallbackPath || undefined;
+    };
+    if (mode === "workspace-path") {
+        return typeof value === "string"
+            ? resolveWorkspacePath(value, options)
+            : undefined;
+    }
+    if (typeof value !== "string" || !value.startsWith("/"))
+        return undefined;
+    const url = new URL(value, "http://agent-native.invalid");
+    const markers = [
+        options.frameworkRoutePrefix || "/_agent-native",
+        "/_agent-native",
+    ];
+    for (const marker of markers) {
+        for (let index = url.pathname.indexOf(marker); index > 0; index = url.pathname.indexOf(marker, index + 1)) {
+            const end = index + marker.length;
+            if (end === url.pathname.length || url.pathname[end] === "/") {
+                const prefix = url.pathname.slice(0, index).trim();
+                return prefix ? `/${prefix.replace(/^\/+|\/+$/g, "")}` : "";
+            }
+        }
+    }
+    if (!options.workspaceRuntime)
+        return undefined;
+    const segments = url.pathname.split("/").filter(Boolean);
+    const segment = segments[0];
+    const frameworkRoutePrefix = options.frameworkRoutePrefix || "/_agent-native";
+    const fallbackPath = segments.length > 1 &&
+        segment &&
+        `/${segment}` !== "/_agent-native" &&
+        `/${segment}` !== frameworkRoutePrefix &&
+        segment !== "api"
+        ? `/${segment}`
+        : "";
+    return resolveWorkspacePath(url.pathname, {
+        ...options,
+        fallbackPath,
+        preferDeclaredMounts: true,
+    });
+}
+export function resolveWorkspaceAppMountPath(pathname, options = {}) {
+    return resolveMcpAppEmbedBasePath("workspace-path", pathname, options);
+}
+export function resolveExternalEmbedTargetBasePath(target, options = {}) {
+    return resolveMcpAppEmbedBasePath("external-target", target, options);
+}
+function normalizedStorageBasePath(basePath) {
+    const trimmed = basePath?.trim();
+    if (!trimmed || trimmed === "/")
+        return "";
+    return `/${trimmed.replace(/^\/+/, "").replace(/\/+$/, "")}`;
+}
+function appScopedStorageKey(key, basePath, workspaceRuntime) {
+    if (!workspaceRuntime)
+        return key;
+    const normalizedBasePath = normalizedStorageBasePath(basePath);
+    return `${key}:${normalizedBasePath || "/"}`;
+}
+export function embedTokenStorageKey(basePath, workspaceRuntime) {
+    return appScopedStorageKey(EMBED_TOKEN_STORAGE_KEY, basePath, workspaceRuntime);
+}
+export function mcpChatBridgeStorageKey(basePath, workspaceRuntime) {
+    return appScopedStorageKey(MCP_CHAT_BRIDGE_STORAGE_KEY, basePath, workspaceRuntime);
+}
 /**
  * Set on `<html>` for the life of a document that is an app nested in an MCP
  * App widget (a ChatGPT, Codex, or Claude card or side pane). Layout reads it
@@ -17,22 +150,62 @@ export const MCP_APP_WIDGET_EMBED_ATTRIBUTE = "data-agent-native-mcp-widget";
  * embed credential in the URL, stored, or `embedded=1`); `mcp-app-host.spec.ts`
  * runs both over one table so they cannot drift.
  */
-export function getMcpAppWidgetEmbedBootScriptBody() {
+export function getMcpAppWidgetEmbedBootScriptBody(basePath, workspaceRuntime = false) {
+    const dynamicWorkspaceBasePath = workspaceRuntime && basePath === undefined;
+    const tokenStorageKey = dynamicWorkspaceBasePath
+        ? EMBED_TOKEN_STORAGE_KEY
+        : embedTokenStorageKey(basePath ?? "", workspaceRuntime);
+    const bridgeStorageKey = dynamicWorkspaceBasePath
+        ? MCP_CHAT_BRIDGE_STORAGE_KEY
+        : mcpChatBridgeStorageKey(basePath ?? "", workspaceRuntime);
     return `(function __anMcpWidgetBoot() {
   try {
     var w = window;
     if (w.parent === w) return;
+    var tokenStorageKey = ${safeJsonForHtml(tokenStorageKey)};
+    var bridgeStorageKey = ${safeJsonForHtml(bridgeStorageKey)};
+    var external = w[${safeJsonForHtml(EXTERNAL_EMBED_WINDOW_KEY)}];
+    var storageScopeAvailable = true;
+    ${dynamicWorkspaceBasePath
+        ? `var appConfig = w.__AGENT_NATIVE_CONFIG__ || {};
+    var runtimeConfig = appConfig.runtime && typeof appConfig.runtime === "object"
+      ? appConfig.runtime
+      : {};
+    var resolveMcpAppEmbedBasePath = ${resolveMcpAppEmbedBasePath.toString()};
+    var workspaceOptions = {
+      workspaceAppPath: appConfig.workspaceAppPath,
+      workspaceAppMountPaths: appConfig.workspaceAppMountPaths,
+      explicitRootPath: appConfig.explicitRootPath === true,
+      routerBasePath: w.__reactRouterContext && w.__reactRouterContext.basename,
+      frameworkRoutePrefix: runtimeConfig.frameworkRoutePrefix || appConfig.frameworkRoutePrefix
+    };
+    var basePath = external && typeof external.target === "string"
+      ? resolveMcpAppEmbedBasePath("external-target", external.target, Object.assign({ workspaceRuntime: true }, workspaceOptions))
+      : resolveMcpAppEmbedBasePath("workspace-path", w.location.pathname, workspaceOptions);
+    if (typeof basePath !== "string") {
+      storageScopeAvailable = false;
+    } else {
+      var normalizedBasePath = basePath.trim();
+      normalizedBasePath = !normalizedBasePath || normalizedBasePath === "/"
+        ? ""
+        : "/" + normalizedBasePath.replace(/^\\/+/, "").replace(/\\/+$/, "");
+      tokenStorageKey += ":" + (normalizedBasePath || "/");
+      bridgeStorageKey += ":" + (normalizedBasePath || "/");
+    }`
+        : ""}
     var params = new URLSearchParams(w.location.search);
     var stored = function (key) {
+      if (!storageScopeAvailable) return null;
       // coercion-ok: denied storage reads as absent, exactly as isEmbedMcpChatBridgeActive does.
       try { return w.sessionStorage.getItem(key); } catch (e) { return null; }
     };
-    var token = params.get(${safeJsonForHtml(EMBED_TOKEN_QUERY_PARAM)}) || stored(${safeJsonForHtml(EMBED_TOKEN_STORAGE_KEY)});
+    var token = params.get(${safeJsonForHtml(EMBED_TOKEN_QUERY_PARAM)}) || stored(tokenStorageKey) || (external && typeof external.token === "string" ? external.token : "");
     var mode = params.get(${safeJsonForHtml(EMBED_MODE_QUERY_PARAM)});
-    if (!token && mode !== "1" && mode !== "true") return;
     var flag = params.get(${safeJsonForHtml(MCP_APP_CHAT_BRIDGE_QUERY_PARAM)});
-    var scope = stored(${safeJsonForHtml(MCP_CHAT_BRIDGE_STORAGE_KEY)});
-    if (flag === "1" || flag === "true" || (scope && (!token || scope === token))) {
+    var externalBridgeActive = external && external.chatBridgeActive === true;
+    if (!token && mode !== "1" && mode !== "true" && !externalBridgeActive) return;
+    var scope = stored(bridgeStorageKey);
+    if (flag === "1" || flag === "true" || externalBridgeActive || (scope && (!token || scope === token))) {
       document.documentElement.setAttribute(${safeJsonForHtml(MCP_APP_WIDGET_EMBED_ATTRIBUTE)}, "1");
     }
   // coercion-ok: the attribute is a first-paint hint; isMcpAppWidgetEmbed sets it again once the app runs.