@agent-native/core 0.225.0-nightly-20261105212332 → 0.225.0

package/dist/extensions/url-safety.d.ts

@@ -2,6 +2,7 @@ export declare function isBlockedExtensionUrl(url: string): boolean;
 export declare function isBlockedExtensionUrlWithDns(url: string): Promise<boolean>;
 export declare function createSsrfSafeDispatcher(allowedPrivateOrigins?: readonly string[], destinationUrl?: string, options?: {
     required?: boolean;
+    loopbackOnly?: boolean;
 }): Promise<unknown>;
 /**
  * SSRF-safe `fetch` for any server-side request to a user/agent-supplied URL.
@@ -29,6 +30,8 @@ export declare function createSsrfSafeDispatcher(allowedPrivateOrigins?: readonl
  * example, a credential's origin allowlist) on top of the SSRF checks. It runs
  * before the initial request and before every redirect hop, so sensitive
  * headers and bodies are never forwarded to a destination the caller rejects.
+ * `allowedLocalhostOrigin` permits only that exact localhost origin and requires
+ * a dispatcher that rejects every non-loopback DNS result at connect time.
  */
 export declare function ssrfSafeFetch(url: string, init?: RequestInit, options?: {
     maxRedirects?: number;
@@ -37,6 +40,7 @@ export declare function ssrfSafeFetch(url: string, init?: RequestInit, options?:
     httpsOnly?: boolean;
     assertUrlAllowed?: (url: string) => void | Promise<void>;
     allowedPrivateOrigins?: readonly string[];
+    allowedLocalhostOrigin?: string;
 }): Promise<Response>;
 export { isBlockedExtensionUrl as isBlockedToolUrl };
 export { isBlockedExtensionUrlWithDns as isBlockedToolUrlWithDns };

package/dist/extensions/url-safety.js

@@ -237,7 +237,7 @@ async function createSsrfSafeDispatcherUncached(allowedPrivateOrigins = [], dest
     }
     return new Agent({
         connect: {
-            lookup: (hostname, options, callback) => {
+            lookup: (hostname, lookupOptions, callback) => {
                 lookup(hostname, { all: true, verbatim: true }, (err, addresses) => {
                     if (err)
                         return callback(err);
@@ -246,13 +246,16 @@ async function createSsrfSafeDispatcherUncached(allowedPrivateOrigins = [], dest
                         : [{ address: addresses, family: 4 }];
                     for (const record of list) {
                         const allowedOrigin = allowedPrivateOriginKeys.has(`${normalizeLookupHostname(hostname)}:${destinationPort}`);
-                        if (isPrivateHost(record.address) && !allowedOrigin) {
-                            const e = new Error(`Connect blocked: ${hostname} resolved to private address ${record.address}`);
+                        const loopback = record.address === "127.0.0.1" || record.address === "::1";
+                        if (options.loopbackOnly
+                            ? !loopback
+                            : isPrivateHost(record.address) && !allowedOrigin) {
+                            const e = new Error(`Connect blocked: ${hostname} resolved to ${options.loopbackOnly ? "non-loopback" : "private"} address ${record.address}`);
                             e.code = "EAI_BLOCKED";
                             return callback(e);
                         }
                     }
-                    if (options && options.all) {
+                    if (lookupOptions.all) {
                         return callback(null, list);
                     }
                     const first = list[0];
@@ -264,6 +267,14 @@ async function createSsrfSafeDispatcherUncached(allowedPrivateOrigins = [], dest
 }
 export async function createSsrfSafeDispatcher(allowedPrivateOrigins = [], destinationUrl, options = {}) {
     const allowedPrivateOrigin = allowedPrivateOriginForDestination(destinationUrl, allowedPrivateOrigins);
+    if (options.loopbackOnly) {
+        if (!allowedPrivateOrigin ||
+            new URL(allowedPrivateOrigin).hostname !== "localhost" ||
+            !allowedPrivateOrigins.includes(allowedPrivateOrigin)) {
+            throw new Error("SSRF protection requires an exact localhost origin for loopback-only dispatch.");
+        }
+        options = { ...options, required: true };
+    }
     if (!allowedPrivateOrigin) {
         sharedSsrfDispatcher ??= createSsrfSafeDispatcherUncached();
         const dispatcher = await sharedSsrfDispatcher;
@@ -274,6 +285,7 @@ export async function createSsrfSafeDispatcher(allowedPrivateOrigins = [], desti
     const cacheKey = JSON.stringify([
         allowedPrivateOrigin,
         options.required === true,
+        options.loopbackOnly === true,
     ]);
     let dispatcher = privateSsrfDispatchers.get(cacheKey);
     if (!dispatcher) {
@@ -320,6 +332,8 @@ export async function createSsrfSafeDispatcher(allowedPrivateOrigins = [], desti
  * example, a credential's origin allowlist) on top of the SSRF checks. It runs
  * before the initial request and before every redirect hop, so sensitive
  * headers and bodies are never forwarded to a destination the caller rejects.
+ * `allowedLocalhostOrigin` permits only that exact localhost origin and requires
+ * a dispatcher that rejects every non-loopback DNS result at connect time.
  */
 export async function ssrfSafeFetch(url, init = {}, options = {}) {
     const maxRedirects = options.maxRedirects ?? 3;
@@ -339,11 +353,22 @@ export async function ssrfSafeFetch(url, init = {}, options = {}) {
     };
     let currentUrl = url;
     for (let hop = 0; hop <= maxRedirects; hop++) {
+        const allowedLocalhostOrigin = (() => {
+            if (!options.allowedLocalhostOrigin || !URL.canParse(currentUrl))
+                return undefined;
+            const parsed = new URL(currentUrl);
+            return parsed.hostname === "localhost" &&
+                (parsed.protocol === "http:" || parsed.protocol === "https:") &&
+                options.allowedLocalhostOrigin === parsed.origin
+                ? parsed.origin
+                : undefined;
+        })();
         await options.assertUrlAllowed?.(currentUrl);
         if (options.httpsOnly && new URL(currentUrl).protocol !== "https:") {
             throw new Error(`SSRF blocked: refusing to fetch non-HTTPS address (${currentUrl})`);
         }
-        if (!isAllowedPrivateOrigin(currentUrl) &&
+        if (!allowedLocalhostOrigin &&
+            !isAllowedPrivateOrigin(currentUrl) &&
             (await isBlockedExtensionUrlWithDns(currentUrl))) {
             throw new Error(`SSRF blocked: refusing to fetch private/internal address (${currentUrl})`);
         }
@@ -351,7 +376,12 @@ export async function ssrfSafeFetch(url, init = {}, options = {}) {
             ...currentInit,
             redirect: "manual",
         };
-        const dispatcher = await createSsrfSafeDispatcher(options.allowedPrivateOrigins, currentUrl, { required: options.requireDispatcher });
+        const dispatcher = await createSsrfSafeDispatcher(allowedLocalhostOrigin
+            ? [allowedLocalhostOrigin]
+            : options.allowedPrivateOrigins, currentUrl, {
+            required: Boolean(allowedLocalhostOrigin || options.requireDispatcher),
+            loopbackOnly: Boolean(allowedLocalhostOrigin),
+        });
         if (dispatcher)
             fetchOpts.dispatcher = dispatcher;
         const response = await fetch(currentUrl, fetchOpts);

package/dist/framework-package-versions.json

@@ -1,17 +1,17 @@
 {
-  "@agent-native/agentkit": "0.225.0-nightly-20261105212332",
+  "@agent-native/agentkit": "0.225.0",
   "@agent-native/code-agents-ui": "0.1.75",
-  "@agent-native/core": "0.225.0-nightly-20261105212332",
-  "@agent-native/core-corpus": "0.225.0-nightly-20261105212332",
-  "@agent-native/creative-context": "0.8.65",
-  "@agent-native/dispatch": "0.42.1-nightly-20261105212332",
+  "@agent-native/core": "0.225.0",
+  "@agent-native/core-corpus": "0.225.0",
+  "@agent-native/creative-context": "0.8.66",
+  "@agent-native/dispatch": "0.42.1",
   "@agent-native/embedding": "0.2.0",
   "@agent-native/migrate": "0.0.7",
-  "@agent-native/otel": "0.1.32",
-  "@agent-native/pinpoint": "0.1.108",
-  "@agent-native/recap-cli": "0.5.96",
-  "@agent-native/scheduling": "0.2.53-nightly-20261105212332",
+  "@agent-native/otel": "0.1.33",
+  "@agent-native/pinpoint": "0.1.109",
+  "@agent-native/recap-cli": "0.5.97",
+  "@agent-native/scheduling": "0.2.53",
   "@agent-native/shared-app-config": "0.1.2",
-  "@agent-native/skills": "0.4.1-nightly-20261105212332",
-  "@agent-native/toolkit": "0.225.0-nightly-20261105212332"
+  "@agent-native/skills": "0.4.1",
+  "@agent-native/toolkit": "0.225.0"
 }

package/dist/org/handlers.js

@@ -20,7 +20,9 @@ function extractMemberEmail(event) {
 }
 const nanoid = () => globalThis.crypto?.randomUUID?.().replace(/-/g, "") ??
     Math.random().toString(36).slice(2) + Date.now().toString(36);
+import { workspacePrivateOrigins } from "../a2a/workspace-private-origins.js";
 import { warnAgent } from "../agent/action-warnings.js";
+import { isFirstPartyApp } from "../app-config/app-identity.js";
 import { getAppConfig } from "../app-config/index.js";
 import { routeAuditAttribution } from "../audit/attribution.js";
 import { recordOrgAdminAuditEvent } from "../audit/org-admin.js";
@@ -31,6 +33,7 @@ import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import { evaluateFeatureFlagStrict } from "../feature-flags/store.js";
 import { verifyFederatedWorkspaceIconOwner } from "../icon-assets/workspace-transport.js";
 import { offboardMember } from "../identity/offboard.js";
+import { normalizeAppBasePath } from "../server/app-base-path.js";
 import { getAppProductionUrl, resolveAppRuntimeUrl, } from "../server/app-url.js";
 import { isTrustedSelfHostedRuntime, resolveVercelDeploymentProtectionHeaders, } from "../server/credential-provider.js";
 import { sendEmail, isEmailConfigured } from "../server/email.js";
@@ -1796,10 +1799,26 @@ export const syncA2ASecretHandler = defineEventHandler(async (event) => {
     ]);
     // Only first-party built-ins and apps mounted on this deployment may receive
     // the organization secret. A workspace manifest can contain external URLs.
-    const [discoveredAgents, builtins, workspaceApps] = await Promise.all([
-        discoverAgents(),
+    const app = getAppConfig().app;
+    // Use one strict workspace snapshot for both sender identity and discovery.
+    // Other agent sources remain best-effort; they are not workspace recipients.
+    const workspaceApps = await loadWorkspaceAppsManifest(true);
+    const matchingMounts = app.basePath
+        ? (workspaceApps ?? []).filter((entry) => typeof entry.path === "string" &&
+            entry.path.startsWith("/") &&
+            !entry.path.startsWith("//") &&
+            normalizeAppBasePath(entry.path) ===
+                normalizeAppBasePath(app.basePath))
+        : [];
+    const selfAppId = app.workspaceId ??
+        (matchingMounts.length === 1 ? matchingMounts[0]?.id : undefined) ??
+        (!workspaceApps?.length && isFirstPartyApp(app) ? app.slug : undefined);
+    const [discoveredAgents, builtins] = await Promise.all([
+        discoverAgents(selfAppId, {
+            workspaceAppsManifest: workspaceApps,
+            requireResolvableWorkspaceUrls: true,
+        }),
         Promise.resolve(getBuiltinAgentsForSeeding()),
-        loadWorkspaceAppsManifest(),
     ]);
     const registeredBuiltins = new Map(builtins.map((agent) => [agent.id, agent.url]));
     const registeredWorkspacePaths = new Map();
@@ -1830,6 +1849,8 @@ export const syncA2ASecretHandler = defineEventHandler(async (event) => {
     };
     const agents = discoveredAgents.filter((agent) => {
         if (agent.source === "builtin") {
+            if (isFirstPartyApp(app) && agent.id === app.slug)
+                return false;
             const trustedUrl = registeredBuiltins.get(agent.id);
             return Boolean(trustedUrl && matchesPath(agent.url, trustedUrl));
         }
@@ -1839,6 +1860,12 @@ export const syncA2ASecretHandler = defineEventHandler(async (event) => {
         const registeredPath = registeredWorkspacePaths.get(agent.id);
         return Boolean(registeredPath && matchesPath(agent.url, registeredPath));
     });
+    if (!selfAppId && agents.some((agent) => agent.source === "workspace")) {
+        throw createError({
+            statusCode: 503,
+            message: "Cannot sync workspace A2A secrets without a workspace app ID or a unique configured app base path",
+        });
+    }
     const results = [];
     await Promise.all(agents.map(async (agent) => {
         try {
@@ -1848,6 +1875,20 @@ export const syncA2ASecretHandler = defineEventHandler(async (event) => {
                 audience: canonicalA2AAudience(agent.url),
             });
             const protectionHeaders = resolveVercelDeploymentProtectionHeaders(target);
+            const recipient = new URL(agent.url);
+            const recipientOrigin = recipient.origin;
+            const loopbackHost = /^https?:\/\/(?:127\.0\.0\.1|\[::1\]|localhost)(?=[:/?#]|$)/i;
+            const configuredLoopback = agent.source === "workspace" &&
+                loopbackHost.test(agent.url) &&
+                workspacePrivateOrigins().some((configured) => loopbackHost.test(configured) &&
+                    URL.canParse(configured) &&
+                    new URL(configured).origin === recipientOrigin);
+            const allowedLocalhostOrigin = configuredLoopback && recipient.hostname === "localhost"
+                ? recipientOrigin
+                : undefined;
+            const allowedPrivateOrigins = configuredLoopback && !allowedLocalhostOrigin
+                ? [recipientOrigin]
+                : [];
             const res = await ssrfSafeFetch(target, {
                 method: "POST",
                 headers: {
@@ -1857,10 +1898,11 @@ export const syncA2ASecretHandler = defineEventHandler(async (event) => {
                 },
                 body: JSON.stringify({ secret, orgDomain }),
             }, {
-                maxRedirects: 3,
-                ...(protectionHeaders["x-vercel-protection-bypass"]
-                    ? { followRedirects: false }
-                    : {}),
+                maxRedirects: 0,
+                followRedirects: false,
+                requireDispatcher: true,
+                allowedPrivateOrigins,
+                ...(allowedLocalhostOrigin ? { allowedLocalhostOrigin } : {}),
             });
             if (!res.ok) {
                 const text = await res.text().catch(() => "");

package/dist/server/agent-discovery.d.ts

@@ -20,7 +20,10 @@ export interface DiscoveredAgent {
 export interface DiscoverAgentsOptions {
     preferLocalUrls?: boolean;
     requireReadableAgentSources?: boolean;
+    requireResolvableWorkspaceUrls?: boolean;
     includePersonalAgents?: boolean;
+    /** Reuse a previously loaded manifest for consistent workspace discovery. */
+    workspaceAppsManifest?: WorkspaceAppManifestEntry[] | null;
 }
 export interface DiscoverOrgDirectoryAgentsOptions {
     preferLocalUrls?: boolean;

package/dist/server/agent-discovery.js

@@ -998,7 +998,20 @@ async function readWorkspaceAppsFromFilesystem(strict = false) {
         .readdirSync(appsDir, { withFileTypes: true })
         .filter((entry) => entry.isDirectory())) {
         const appDir = path.join(appsDir, entry.name);
-        const pkg = readJson(path.join(appDir, "package.json"));
+        const packagePath = path.join(appDir, "package.json");
+        if (strict) {
+            try {
+                fs.lstatSync(packagePath);
+            }
+            catch (error) {
+                if (error instanceof Error &&
+                    "code" in error &&
+                    error.code === "ENOENT")
+                    continue;
+                throw error;
+            }
+        }
+        const pkg = readJson(packagePath);
         if (!pkg) {
             if (strict)
                 throw new Error(`Invalid workspace package: ${entry.name}`);
@@ -1092,7 +1105,9 @@ function workspaceAppUrl(app, hostedLoopbackFallbackUrl) {
     }
 }
 async function discoverWorkspaceAgents(selfAppId, options, strict = false) {
-    const workspaceApps = await loadWorkspaceAppsManifest(strict);
+    const workspaceApps = options?.workspaceAppsManifest !== undefined
+        ? options.workspaceAppsManifest
+        : await loadWorkspaceAppsManifest(strict);
     if (!workspaceApps)
         return [];
     const metadataSettings = await readWorkspaceAppMetadataSettingsInternal(strict);
@@ -1105,7 +1120,10 @@ async function discoverWorkspaceAgents(selfAppId, options, strict = false) {
         const url = options?.preferLocalUrls && builtin
             ? resolveAgentUrl(builtin, true)
             : workspaceAppUrl(withOverride, builtin?.url);
-        if (strict && (!url || !isAbsoluteHttpUrl(url))) {
+        if ((strict || options?.requireResolvableWorkspaceUrls) &&
+            (!url ||
+                !isAbsoluteHttpUrl(url) ||
+                (options?.requireResolvableWorkspaceUrls && /[?#]/.test(url)))) {
             throw new Error(`Invalid workspace app URL: ${withOverride.id}`);
         }
         if (!url)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.225.0-nightly-20261105212332",
+  "version": "0.225.0",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -760,8 +760,8 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/recap-cli": "^0.5.96",
-    "@agent-native/agentkit": "^0.225.0-nightly-20261105212332"
+    "@agent-native/agentkit": "^0.225.0",
+    "@agent-native/recap-cli": "^0.5.97"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",
@@ -833,7 +833,7 @@
     "xlsx": "^0.18.5"
   },
   "peerDependencies": {
-    "@agent-native/core-corpus": "0.225.0-nightly-20261105212332",
+    "@agent-native/core-corpus": ">=0.196.0",
     "@ai-sdk/anthropic": ">=3",
     "@ai-sdk/cohere": ">=3",
     "@ai-sdk/google": ">=3",