@agent-native/core 0.227.0 → 0.228.0-nightly-20261111004142

package/dist/server/dev-action-bridge.js

@@ -29,7 +29,7 @@ import { actionCallIntent, preparedCallArguments, preparedCallNeedsApproval, rec
 import { getAppConfig } from "../app-config/index.js";
 import { runApprovedCliAction } from "../cli/action-approval.js";
 import { getRuntimeDatabaseUrl } from "../db/client.js";
-import { resolveDevUserEmail } from "../scripts/dev-session.js";
+import { resolveDevOrgScope, resolveDevUserEmail, } from "../scripts/dev-session.js";
 import { notifyActionChange } from "./action-change.js";
 import { resolveDeployEnvironment } from "./deploy-environment.js";
 import { DEV_ACTION_DISCOVERY_PATH, readDevActionDiscoveryFile, } from "./dev-action-discovery.js";
@@ -42,7 +42,31 @@ export const DEV_DB_MIGRATE_ROUTE = "/_agent-native/dev/db-migrate";
 export const DEV_ACTION_TOKEN_HEADER = "x-agent-native-dev-token";
 export const DEV_ACTION_USER_HEADER = "x-agent-native-dev-user";
 export const DEV_ACTION_ORG_HEADER = "x-agent-native-dev-org";
+/** "personal" when the CLI caller acts in no org; see AGENT_ORG_SCOPE_ENV. */
+export const DEV_ACTION_ORG_SCOPE_HEADER = "x-agent-native-dev-org-scope";
 export { readDevActionDiscoveryFile } from "./dev-action-discovery.js";
+function devOrgChoiceFromHeaders(event) {
+    return {
+        orgId: getHeader(event, DEV_ACTION_ORG_HEADER) || undefined,
+        personal: getHeader(event, DEV_ACTION_ORG_SCOPE_HEADER) === "personal",
+    };
+}
+/**
+ * The caller's org scope, or the route's usual error response when the org
+ * lookup fails, so the CLI shows the database's message.
+ */
+async function resolveDevOrgScopeForRoute(event, userEmail) {
+    try {
+        return await resolveDevOrgScope(userEmail, devOrgChoiceFromHeaders(event));
+    }
+    catch (error) {
+        setResponseStatus(event, 500);
+        return {
+            ok: false,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}
 export function hashDatabaseKey(databaseUrl) {
     return crypto.createHash("sha256").update(databaseUrl).digest("hex");
 }
@@ -268,10 +292,12 @@ export function mountDevActionForwardRoute(nitroApp, actions, options) {
         const params = (body?.input ?? {});
         const userEmail = getHeader(event, DEV_ACTION_USER_HEADER) ||
             (await resolveDevUserEmail());
-        const orgId = getHeader(event, DEV_ACTION_ORG_HEADER) || undefined;
+        const orgScope = await resolveDevOrgScopeForRoute(event, userEmail);
+        if ("error" in orgScope)
+            return orgScope;
         const context = {
             userEmail,
-            orgId,
+            ...orgScope,
             requestOrigin: getForwardedRequestOrigin(event),
         };
         return runWithRequestContext(context, async () => {
@@ -379,8 +405,11 @@ export function mountDevDbQueryForwardRoute(nitroApp) {
         const limit = typeof body?.limit === "number" ? body.limit : undefined;
         const userEmail = getHeader(event, DEV_ACTION_USER_HEADER) ||
             (await resolveDevUserEmail());
-        const orgId = getHeader(event, DEV_ACTION_ORG_HEADER) || undefined;
-        return runWithRequestContext({ userEmail, orgId }, async () => {
+        const orgScope = await resolveDevOrgScopeForRoute(event, userEmail);
+        if ("error" in orgScope)
+            return orgScope;
+        const context = { ...(userEmail ? { userEmail } : {}), ...orgScope };
+        return runWithRequestContext(context, async () => {
             try {
                 const { runDbQuery } = await import("../scripts/db/query.js");
                 const databaseUrl = getRuntimeDatabaseUrl("pglite:./data/pglite");

package/dist/server/first-touch-route.d.ts

@@ -17,8 +17,8 @@ export type FirstTouchSyncResult = {
  * browser's `an_ft` and `an_lt` again, so Safari keeps them their 30 days.
  */
 export declare function createFirstTouchHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     reason?: undefined;
+    error: string;
     stored?: undefined;
     firstTouch?: undefined;
 } | {

package/dist/server/http-response-telemetry.js

@@ -4,6 +4,7 @@ import { claimStartupDatabaseTelemetry, createDatabaseRequestTelemetry, enterDat
 import { flushObservability, recordHttpServerHandoff, recordHttpServerRequest, } from "../observability/metrics.js";
 import { createTrackingEventScope, endAgentSpan, flushTrackingEvents, startAgentSpan, } from "../observability/tracing.js";
 import { trackingIdentityProperties } from "../observability/tracking-identity.js";
+import { flushTrackingSendsForResponse } from "../tracking/providers.js";
 import { getAppBasePathFromViteEnv, stripAppBasePath, } from "./app-base-path.js";
 import { platformWaitUntil, runInBackground } from "./background-work.js";
 import { httpRouteForRequest } from "./http-route.js";
@@ -220,6 +221,9 @@ async function emitTelemetry(event, state, response, durationMs) {
     });
     const flush = async () => {
         await flushTrackingEvents(state.trackingScope);
+        // After the scope's tracking work, so the events it queues as it finishes
+        // are sent along with those still under way when the reply goes out.
+        await flushTrackingSendsForResponse();
         await flushObservability();
     };
     const exported = flush().catch((error) => {

package/dist/server/loopback.js

@@ -27,8 +27,9 @@ export function isDirectLoopbackRequest(event) {
             normalizedName.startsWith("x-forwarded-"));
     });
     if (!isLoopbackRequest(event) ||
+        !isLoopbackAddress(socket?.remoteAddress) ||
         typeof host !== "string" ||
-        !/^127\.0\.0\.1(?::\d{1,5})?$/.test(host) ||
+        !/^127\.0\.0\.1:\d{1,5}$/.test(host) ||
         hasForwardedHeader ||
         !socket ||
         ("encrypted" in socket && socket.encrypted) ||
@@ -41,6 +42,7 @@ export function isDirectLoopbackRequest(event) {
         return false;
     const origin = new URL(originValue);
     return (origin.hostname === "127.0.0.1" &&
+        Number(origin.port) === socket.localPort &&
         origin.port !== "0" &&
         origin.pathname === "/" &&
         origin.search === "" &&

package/dist/server/request-context.d.ts

@@ -4,10 +4,36 @@ import type { ContextStatus } from "../shared/context-status.js";
 import type { FirstRunBuilderCreditsV2RequestAssignment } from "../shared/first-run-builder-credits-experiment.js";
 import type { ReasoningEffort } from "../shared/reasoning-effort.js";
 import type { SignupAttributionContext } from "./attribution.js";
+/**
+ * The tab a request from no browser tab acts on for tab-scoped app state:
+ * the tab of this app the user used last, or none used recently.
+ */
+export type BrowserTabTarget = {
+    kind: "last-used";
+    tabId: string;
+    usedAt: number;
+} | {
+    kind: "unavailable";
+};
+export interface BrowserTabTargetSlot {
+    /** Looks the tab up once; later calls get the same answer. */
+    resolve(): Promise<BrowserTabTarget>;
+    /** Set once something in the request has asked for the tab. */
+    resolved?: BrowserTabTarget;
+}
 export interface RequestRunContext {
     waitUntil?: (promise: Promise<unknown>) => void;
     requestOrigin?: string;
+    /** The browser tab the request came from. */
     browserTabId?: string;
+    /**
+     * For an MCP tool call by a signed-in user, which came from no tab: the tab
+     * whose tab-scoped app state (navigation, navigate commands, selection) the
+     * call reads and writes. Unlike `browserTabId`, it doesn't make the call
+     * that tab's own, so the tab still sees the call's changes as someone
+     * else's.
+     */
+    browserTabTarget?: BrowserTabTargetSlot;
     chatScope?: {
         type: string;
         id: string;

package/dist/shared/app-state-routes.d.ts

@@ -18,3 +18,10 @@ export declare const APP_STATE_BATCH_ROUTE_HEADER = "X-Agent-Native-App-State-Ba
  */
 export declare const APP_STATE_WRITER_HEADER = "X-Agent-Native-App-State-Writer";
 export declare const APP_STATE_SEQ_HEADER = "X-Agent-Native-App-State-Seq";
+/**
+ * A browser tab writes this key when someone uses it (it gains focus, or
+ * changes route while focused) and deletes it when the page goes away. The
+ * server stores it once per app and tab, so a call that came from no tab,
+ * such as an MCP tool call, can act on the tab of this app used last.
+ */
+export declare const BROWSER_TAB_USED_APP_STATE_KEY = "browser-tab-used";

package/dist/shared/app-state-routes.js

@@ -25,3 +25,10 @@ export const APP_STATE_BATCH_ROUTE_HEADER = "X-Agent-Native-App-State-Batch";
  */
 export const APP_STATE_WRITER_HEADER = "X-Agent-Native-App-State-Writer";
 export const APP_STATE_SEQ_HEADER = "X-Agent-Native-App-State-Seq";
+/**
+ * A browser tab writes this key when someone uses it (it gains focus, or
+ * changes route while focused) and deletes it when the page goes away. The
+ * server stores it once per app and tab, so a call that came from no tab,
+ * such as an MCP tool call, can act on the tab of this app used last.
+ */
+export const BROWSER_TAB_USED_APP_STATE_KEY = "browser-tab-used";

package/dist/shared/mcp-client-connections.d.ts

@@ -0,0 +1,41 @@
+import { z } from "zod";
+export declare const mcpClientConnectionSchema: z.ZodObject<{
+    client: z.ZodEnum<{
+        chatgpt: "chatgpt";
+        claude: "claude";
+        "claude-code": "claude-code";
+        codex: "codex";
+        cursor: "cursor";
+        grok: "grok";
+        other: "other";
+        vscode: "vscode";
+    }>;
+    status: z.ZodEnum<{
+        connected: "connected";
+        disconnected: "disconnected";
+        unknown: "unknown";
+    }>;
+    lastUsedAt: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
+export declare const mcpClientConnectionsSchema: z.ZodObject<{
+    connections: z.ZodArray<z.ZodObject<{
+        client: z.ZodEnum<{
+            chatgpt: "chatgpt";
+            claude: "claude";
+            "claude-code": "claude-code";
+            codex: "codex";
+            cursor: "cursor";
+            grok: "grok";
+            other: "other";
+            vscode: "vscode";
+        }>;
+        status: z.ZodEnum<{
+            connected: "connected";
+            disconnected: "disconnected";
+            unknown: "unknown";
+        }>;
+        lastUsedAt: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type McpClientConnection = z.infer<typeof mcpClientConnectionSchema>;
+export type McpClientConnections = z.infer<typeof mcpClientConnectionsSchema>;

package/dist/shared/mcp-client-connections.js

@@ -0,0 +1,18 @@
+import { z } from "zod";
+export const mcpClientConnectionSchema = z.object({
+    client: z.enum([
+        "claude",
+        "chatgpt",
+        "cursor",
+        "vscode",
+        "claude-code",
+        "codex",
+        "grok",
+        "other",
+    ]),
+    status: z.enum(["connected", "disconnected", "unknown"]),
+    lastUsedAt: z.number().int().nonnegative().nullable(),
+});
+export const mcpClientConnectionsSchema = z.object({
+    connections: z.array(mcpClientConnectionSchema),
+});

package/dist/shared/mcp-connect-content.d.ts

@@ -41,6 +41,9 @@ export interface McpConnectGuide {
     label: string;
     install?: readonly McpConnectInstallOption[];
     steps?: readonly string[];
+    urlStep?: number;
+    nameStep?: number;
+    stepKinds?: readonly ("open" | "add" | "configure" | "authorize" | "enable")[];
     intro?: string;
     commandTemplate?: string;
     configTemplate?: string;
@@ -50,6 +53,7 @@ export interface McpConnectGuide {
         href?: string;
     };
     note?: string;
+    docsHref?: string;
 }
 export declare const MCP_CONNECT_MCP_URL_TEMPLATE = "{appUrl}/mcp";
 export declare const MCP_CONNECT_GUIDES: readonly McpConnectGuide[];
@@ -57,6 +61,20 @@ export declare const MCP_CONNECT_HOSTS: readonly McpConnectHost[];
 export declare const MCP_CONNECT_HOST_SEARCH_TEXT: string;
 export declare function resolveMcpConnectGuideId(query: string | null | undefined): McpConnectGuideId;
 export declare function resolveMcpConnectHostId(query: string): string | undefined;
+/**
+ * The host an MCP client says it is: from the name it reported in
+ * `clientInfo`, or else its User-Agent, which clients that send `clientInfo`
+ * only when they connect (Codex) still send on every call. Both are the
+ * client's own claim, so use the result to label its work, never to grant
+ * anything. Only whole words count: a typed search may match "cur" to
+ * Cursor, a reported name may not.
+ */
+export declare function resolveMcpClientHostId(client: {
+    name?: string;
+    userAgent?: string;
+} | undefined): string | undefined;
+/** A host's display name, such as "Claude Code", for a host id. */
+export declare function mcpConnectHostLabel(id: string | null | undefined): string | undefined;
 export declare function matchesMcpConnectHost(query: string): boolean;
 export declare function getMcpConnectGuides(locale: LocaleCode): readonly McpConnectGuide[];
 export declare const MCP_STATIC_TOKEN_FALLBACK: {