@agent-native/core 0.227.0 → 0.228.0-nightly-20261111004142

package/dist/mcp/server.js

@@ -1,13 +1,13 @@
 import { defineEventHandler, setResponseStatus, setResponseHeader, getMethod, getRequestHeader, } from "h3";
 import { getAppConfig } from "../app-config/store.js";
 import { getConfiguredAppBasePath } from "../server/app-base-path.js";
-import { isLoopbackRequest } from "../server/auth.js";
 import { describeBearerCredentialRefusal, } from "../server/bearer-credential-refusal.js";
 import { CREDENTIAL_MEMBERSHIP_UNAVAILABLE_MESSAGE } from "../server/credential-membership-unavailable.js";
 import { resolveEmbedRequestOrigin } from "../server/embed-request-origin.js";
 import { getH3App } from "../server/framework-request-handler.js";
 import { getOrigin } from "../server/google-oauth.js";
 import { readBody } from "../server/h3-helpers.js";
+import { isDirectLoopbackRequest } from "../server/loopback.js";
 import { registerMcpAppCardsLab } from "./app-cards-lab.js";
 import { mcpApprovalRoute, mountMcpApprovalRoute } from "./approval-route.js";
 import { mcpApprovalAppId } from "./approval-store.js";
@@ -55,21 +55,6 @@ function deriveRequestMeta(event) {
         ...(inlineAppsRequested ? { inlineMcpApps: true } : {}),
     };
 }
-function isLoopbackOrigin(origin) {
-    if (!origin)
-        return false;
-    try {
-        const hostname = new URL(origin).hostname;
-        return (hostname === "localhost" ||
-            hostname === "127.0.0.1" ||
-            hostname === "::1" ||
-            hostname === "[::1]" ||
-            hostname.startsWith("127."));
-    }
-    catch {
-        return false;
-    }
-}
 function buildWebRequest(event, method, routePath = MCP_PUBLIC_ROUTE_PREFIX) {
     const src = event.req;
     const headers = new Headers();
@@ -232,7 +217,11 @@ async function handleMcpRequestInternal(event, config, routePath, approvalRoute,
     const authHeader = getRequestHeader(event, "authorization");
     const ownerEmailHeader = getRequestHeader(event, "x-agent-native-owner-email");
     const requestMeta = deriveRequestMeta(event);
-    const hasLocalOwnerHint = Boolean(ownerEmailHeader?.trim());
+    const requestOrigin = getRequestHeader(event, "origin");
+    const directLocalRequest = isDirectLoopbackRequest(event) &&
+        (requestOrigin === undefined || requestOrigin === requestMeta.origin);
+    const localOwnerHint = directLocalRequest ? ownerEmailHeader : undefined;
+    const hasLocalOwnerHint = Boolean(localOwnerHint?.trim());
     const directoryProfile = routePath === MCP_DIRECTORY_ROUTE_PREFIX &&
         config.directoryProfile?.directoryRoute !== false
         ? config.directoryProfile
@@ -255,9 +244,9 @@ async function handleMcpRequestInternal(event, config, routePath, approvalRoute,
         : config;
     let authResult;
     try {
-        authResult = await verifyAuth(authHeader, ownerEmailHeader, {
-            allowDevOpen: isLoopbackRequest(event) &&
-                isLoopbackOrigin(requestMeta.origin) &&
+        authResult = await verifyAuth(authHeader, localOwnerHint, {
+            allowLocalOwnerHint: hasLocalOwnerHint,
+            allowDevOpen: directLocalRequest &&
                 (hasLocalOwnerHint || getAppConfig().mcp.allowDevOpen),
             resourceUrl: getMcpOAuthAudiences(event, routePath),
             requestOrigin: getOrigin(event),

package/dist/mcp-client/config.d.ts

@@ -15,6 +15,8 @@ export interface McpHttpServerConfig {
     type: "http";
     url: string;
     headers?: Record<string, string>;
+    /** Exact runtime origin for requests carrying a substituted vault key. */
+    secretRequestOrigin?: string;
     oauthAccessRefresh?: McpOAuthAccessRefresh;
     /** Internal failure marker for a server whose saved settings could not be materialized. */
     configurationError?: Error;

package/dist/mcp-client/manager.js

@@ -1,4 +1,5 @@
 import { MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, noteExternalWrite, } from "../action.js";
+import { ssrfSafeFetch } from "../extensions/url-safety.js";
 import { isJsonSchemaObject } from "../json-schema/subschemas.js";
 import { plainJsonSnapshot, UnusableSchemaError, } from "../json-schema/unusable-schema.js";
 import { assertUsableSchema } from "../json-schema/usable-schema.js";
@@ -102,6 +103,7 @@ function sameServerConfig(a, b) {
         };
         return (a.url === b.url &&
             JSON.stringify(a.headers ?? {}) === JSON.stringify(b.headers ?? {}) &&
+            a.secretRequestOrigin === b.secretRequestOrigin &&
             a.oauthAccessRefresh?.identity === b.oauthAccessRefresh?.identity &&
             errorIdentity(a.configurationError) ===
                 errorIdentity(b.configurationError) &&
@@ -357,6 +359,27 @@ export class McpClientManager {
                     transportOptions.fetch = async (input, init) => nativeFetch(input, await buildFirstPartyRequestInit(staticHeaders, init, this.firstPartyTrust(entry)));
                 }
             }
+            else if (cfg.secretRequestOrigin) {
+                requestInit.headers = staticHeaders;
+                transportOptions.fetch = async (input, init) => {
+                    const request = new Request(input, init);
+                    const requestOptions = {
+                        method: request.method,
+                        headers: request.headers,
+                        body: request.body,
+                        signal: request.signal,
+                        ...(request.body ? { duplex: "half" } : {}),
+                    };
+                    return ssrfSafeFetch(request.url, requestOptions, {
+                        followRedirects: false,
+                        assertUrlAllowed: (candidate) => {
+                            if (new URL(candidate).origin !== cfg.secretRequestOrigin) {
+                                throw new Error("Workspace MCP destination changed origin");
+                            }
+                        },
+                    });
+                };
+            }
             else if (Object.keys(staticHeaders).length > 0) {
                 requestInit.headers = staticHeaders;
             }

package/dist/mcp-client/workspace-servers.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import { getDbExec } from "../db/client.js";
 import { readAppSecret } from "../secrets/storage.js";
+import { getResolvedKeyAllowlist, validateUrlAllowlist, } from "../secrets/substitution.js";
 import { getRequestOrgId, getRequestUserEmail, } from "../server/request-context.js";
 import { hashEmail, normalizeServerName, validateRemoteUrl, } from "./remote-store.js";
 const WORKSPACE_MCP_KIND = "mcp-server";
@@ -56,10 +57,13 @@ function secretCandidates(row) {
 async function resolveKeyReferencesForRow(text, row) {
     const matches = Array.from(text.matchAll(KEY_REFERENCE_REGEX));
     if (matches.length === 0)
-        return text;
+        return { value: text, refs: [] };
     const values = new Map();
+    const refs = [];
     for (const match of matches) {
         const key = match[1];
+        if (!key)
+            throw new Error("Invalid workspace MCP key reference");
         if (values.has(key))
             continue;
         let value = null;
@@ -67,6 +71,7 @@ async function resolveKeyReferencesForRow(text, row) {
             const secret = await readAppSecret({ key, ...ref });
             if (secret) {
                 value = secret.value;
+                refs.push({ name: key, ...ref });
                 break;
             }
         }
@@ -75,13 +80,14 @@ async function resolveKeyReferencesForRow(text, row) {
         }
         values.set(key, value);
     }
-    return text.replace(KEY_REFERENCE_REGEX, (_match, key) => {
+    const value = text.replace(KEY_REFERENCE_REGEX, (_match, key) => {
         const value = values.get(key);
         if (value === undefined) {
             throw new Error(`Referenced key "${key}" was not resolved.`);
         }
         return value;
     });
+    return { value, refs };
 }
 function objectRecord(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
@@ -142,18 +148,27 @@ async function normalizeWorkspaceMcpConfig(row, parsed) {
     if (typeof rawUrl !== "string" || !rawUrl.trim()) {
         throw new Error("Workspace MCP server resource is missing a URL.");
     }
-    const url = await resolveKeyReferencesForRow(rawUrl, row);
-    const urlCheck = validateRemoteUrl(url);
-    if (!urlCheck.ok) {
+    const resolvedUrl = await resolveKeyReferencesForRow(rawUrl, row);
+    const urlCheck = validateRemoteUrl(resolvedUrl.value);
+    if (!urlCheck.ok || !urlCheck.url) {
         throw new Error(urlCheck.error ?? "Workspace MCP server URL is not allowed.");
     }
     const headersInput = objectRecord(parsed.config.headers);
     const headers = {};
+    const refs = [...resolvedUrl.refs];
     if (headersInput) {
         for (const [name, value] of Object.entries(headersInput)) {
             if (typeof value !== "string")
                 continue;
-            headers[name] = await resolveKeyReferencesForRow(value, row);
+            const resolved = await resolveKeyReferencesForRow(value, row);
+            headers[name] = resolved.value;
+            refs.push(...resolved.refs);
+        }
+    }
+    for (const ref of refs) {
+        const allowlist = await getResolvedKeyAllowlist(ref);
+        if (!validateUrlAllowlist(urlCheck.url.href, allowlist)) {
+            throw new Error(`Workspace MCP destination is not approved for key "${ref.name}".`);
         }
     }
     const description = typeof parsed.config.description === "string"
@@ -162,6 +177,7 @@ async function normalizeWorkspaceMcpConfig(row, parsed) {
     return {
         type: "http",
         url: urlCheck.url.toString(),
+        ...(refs.length > 0 ? { secretRequestOrigin: urlCheck.url.origin } : {}),
         headers: Object.keys(headers).length > 0 ? headers : undefined,
         description,
     };
@@ -272,16 +288,32 @@ export async function loadWorkspaceMcpServers(options) {
     }
     const servers = {};
     for (const row of rows) {
+        let parsedServers;
         try {
-            for (const parsed of parseWorkspaceMcpServers(row)) {
+            parsedServers = parseWorkspaceMcpServers(row);
+        }
+        catch (error) {
+            servers[resourceServerKey(row, defaultNameFromPath(row.path))] = {
+                type: "http",
+                url: "https://invalid.invalid",
+                configurationError: error instanceof Error ? error : new Error(String(error)),
+            };
+            continue;
+        }
+        for (const parsed of parsedServers) {
+            try {
                 const config = await normalizeWorkspaceMcpConfig(row, parsed);
                 if (!config)
                     continue;
                 servers[resourceServerKey(row, parsed.name)] = config;
             }
-        }
-        catch (error) {
-            console.warn(`[mcp-client] Skipping workspace MCP server resource ${row.path}: ${error?.message ?? String(error)}`);
+            catch (error) {
+                servers[resourceServerKey(row, parsed.name)] = {
+                    type: "http",
+                    url: "https://invalid.invalid",
+                    configurationError: error instanceof Error ? error : new Error(String(error)),
+                };
+            }
         }
     }
     return servers;

package/dist/notifications/routes.d.ts

@@ -1,12 +1,12 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
+    error?: undefined;
     count: number;
     updated?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated: number;
-    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -14,8 +14,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/org/handlers.d.ts

@@ -90,9 +90,9 @@ export declare const setWorkspaceAppDefaultVisibilityHandler: import("h3").Event
     visibility: WorkspaceAppDefaultVisibility;
 }>>;
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    name?: undefined;
     success: boolean;
     id?: undefined;
-    name?: undefined;
     role?: undefined;
 } | {
     success?: undefined;

package/dist/org/handlers.js

@@ -139,6 +139,16 @@ function requireAuthEmail(session) {
     }
     return email;
 }
+function requireVerifiedEmail(session) {
+    const email = requireAuthEmail(session);
+    if (session?.emailVerified !== true) {
+        throw createError({
+            statusCode: 403,
+            message: "Verify your email before joining an organization.",
+        });
+    }
+    return email;
+}
 async function getSessionForEvent(event) {
     const { getSession } = await import("../server/auth.js");
     return getSession(event);
@@ -147,6 +157,8 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
     const ctx = await getOrgContext(event);
     const requestContext = getRequestContext();
     const delegatedOrgMember = requestContext?.a2aIdentityAssurance === "org-member";
+    const emailVerified = !delegatedOrgMember &&
+        (await getSessionForEvent(event))?.emailVerified === true;
     const delegatedEmail = requestContext?.userEmail?.trim().toLowerCase();
     const delegatedOrgId = delegatedOrgMember
         ? requestContext.orgId?.trim()
@@ -218,9 +230,9 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
         orgName: String(r.orgName ?? r.org_name),
     }));
     let domainMatches = [];
-    const domain = delegatedOrgMember
-        ? undefined
-        : ctx.email.split("@")[1]?.toLowerCase();
+    const domain = emailVerified
+        ? ctx.email.split("@")[1]?.toLowerCase()
+        : undefined;
     if (domain) {
         try {
             const dmRes = await e.execute({
@@ -278,23 +290,15 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
         const setting = await getOrgSetting(visibleOrgId, WORKSPACE_APP_DEFAULT_VISIBILITY_KEY);
         workspaceAppDefaultVisibility = normalizeWorkspaceAppDefaultVisibility(setting?.visibility);
     }
-    const invitesRes = delegatedOrgMember
-        ? scopedDelegatedOrgId
-            ? await e.execute({
-                sql: `SELECT i.id AS id, i.org_id AS "orgId", o.name AS "orgName", i.invited_by AS "invitedBy"
-                FROM org_invitations i
-                INNER JOIN organizations o ON i.org_id = o.id
-                WHERE LOWER(i.email) = ? AND i.org_id = ? AND i.status = 'pending'`,
-                args: [ctx.email.toLowerCase(), scopedDelegatedOrgId],
-            })
-            : { rows: [] }
-        : await e.execute({
+    const invitesRes = emailVerified
+        ? await e.execute({
             sql: `SELECT i.id AS id, i.org_id AS "orgId", o.name AS "orgName", i.invited_by AS "invitedBy"
               FROM org_invitations i
               INNER JOIN organizations o ON i.org_id = o.id
               WHERE LOWER(i.email) = ? AND i.status = 'pending'`,
             args: [ctx.email.toLowerCase()],
-        });
+        })
+        : { rows: [] };
     const pendingInvitations = invitesRes.rows.map((r) => ({
         id: String(r.id),
         orgId: String(r.orgId ?? r.org_id),
@@ -836,7 +840,7 @@ export const listInvitationsHandler = defineEventHandler(async (event) => {
 });
 export const acceptInvitationHandler = defineEventHandler(async (event) => {
     const session = await getSessionForEvent(event);
-    const email = requireAuthEmail(session);
+    const email = requireVerifiedEmail(session);
     const invitationId = extractInvitationId(event);
     if (!invitationId) {
         throw createError({
@@ -1449,7 +1453,7 @@ export const switchOrgHandler = defineEventHandler(async (event) => {
 });
 export const joinByDomainHandler = defineEventHandler(async (event) => {
     const session = await getSessionForEvent(event);
-    const email = requireAuthEmail(session);
+    const email = requireVerifiedEmail(session);
     const body = await readBody(event);
     const orgId = body?.orgId;
     if (!orgId) {

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -76,7 +76,7 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     }>>;
 }, z.core.$strip>>, {
     id?: undefined;
-    message?: undefined;
+    deleted?: undefined;
     providers: {
         id: string;
         label: string;
@@ -89,45 +89,45 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     count: number;
     provider?: undefined;
     found?: undefined;
-    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
     id?: undefined;
-    count?: undefined;
-    message?: undefined;
+    deleted?: undefined;
     providers?: undefined;
+    count?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
-    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
-} | {
-    count?: undefined;
     message?: undefined;
+} | {
+    deleted?: undefined;
     providers?: undefined;
+    count?: undefined;
     provider?: undefined;
     found: boolean;
     id: string;
-    deleted?: undefined;
     registered?: undefined;
     label?: undefined;
-} | {
-    count?: undefined;
     message?: undefined;
+} | {
     providers?: undefined;
+    count?: undefined;
     provider?: undefined;
     found?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
-    count?: undefined;
+    deleted?: undefined;
     providers?: undefined;
+    count?: undefined;
     provider?: undefined;
     found?: undefined;
-    deleted?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -318,6 +318,7 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
     }, {
         id?: undefined;
         provider?: undefined;
+        deleted?: undefined;
         message?: undefined;
         providers: {
             id: string;
@@ -330,34 +331,33 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         }[];
         count: number;
         found?: undefined;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
     } | {
         id?: undefined;
+        deleted?: undefined;
+        count?: undefined;
         message?: undefined;
         providers?: undefined;
-        count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
     } | {
         provider?: undefined;
+        deleted?: undefined;
+        count?: undefined;
         message?: undefined;
         providers?: undefined;
-        count?: undefined;
         found: boolean;
         id: string;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
     } | {
         provider?: undefined;
+        count?: undefined;
         message?: undefined;
         providers?: undefined;
-        count?: undefined;
         found?: undefined;
         deleted: boolean;
         id: string;
@@ -365,10 +365,10 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
     } | {
         provider?: undefined;
-        providers?: undefined;
+        deleted?: undefined;
         count?: undefined;
+        providers?: undefined;
         found?: undefined;
-        deleted?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/provider-api/corpus-jobs.d.ts

@@ -73,7 +73,6 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
     offset?: unknown;
     limit?: unknown;
 }, {
-    deleted?: undefined;
     jobs: {
         id: string;
         name: string;
@@ -84,6 +83,7 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
         updatedAt: string;
     }[];
     total: number;
+    deleted?: undefined;
     jobId?: undefined;
 } | {
     jobs?: undefined;
@@ -91,9 +91,9 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
     deleted: boolean;
     jobId: string;
 } | {
-    deleted?: undefined;
     jobs?: undefined;
     total?: undefined;
+    deleted?: undefined;
     jobId?: undefined;
     hits: Record<string, unknown>[];
     offset: number;

package/dist/provider-api/index.js

@@ -4728,7 +4728,10 @@ async function fetchWithTimeout(optionsUrl, options) {
         const method = options.method ?? "GET";
         const secretValues = options.secretValues ?? [];
         try {
-            const dispatcher = (await createSsrfSafeDispatcher()) ?? undefined;
+            const dispatcher = await createSsrfSafeDispatcher();
+            if (!dispatcher) {
+                throw new Error("SSRF protection is unavailable because the server dispatcher is empty.");
+            }
             const fetchOptions = {
                 method,
                 headers: options.headers,
@@ -4738,29 +4741,19 @@ async function fetchWithTimeout(optionsUrl, options) {
                     : controller.signal,
                 redirect: "manual",
             };
-            if (dispatcher)
-                fetchOptions.dispatcher = dispatcher;
-            try {
-                return await fetchProviderResponse(optionsUrl, fetchOptions, {
-                    maxBytes: options.maxBytes,
-                    maxResponseBytes: options.maxResponseBytes,
-                    secretValues,
-                    discardRedirectBody: options.discardRedirectBody,
-                });
-            }
-            catch (error) {
-                if (dispatcher && isDispatcherCompatibilityError(error)) {
-                    const fallbackOptions = { ...fetchOptions };
-                    delete fallbackOptions.dispatcher;
-                    return await fetchProviderResponse(optionsUrl, fallbackOptions, {
-                        maxBytes: options.maxBytes,
-                        maxResponseBytes: options.maxResponseBytes,
-                        secretValues,
-                        discardRedirectBody: options.discardRedirectBody,
-                    });
-                }
-                throw error;
-            }
+            fetchOptions.dispatcher = dispatcher;
+            return await fetchProviderResponse(optionsUrl, fetchOptions, {
+                ...(options.maxBytes !== undefined
+                    ? { maxBytes: options.maxBytes }
+                    : {}),
+                ...(options.maxResponseBytes !== undefined
+                    ? { maxResponseBytes: options.maxResponseBytes }
+                    : {}),
+                secretValues,
+                ...(options.discardRedirectBody !== undefined
+                    ? { discardRedirectBody: options.discardRedirectBody }
+                    : {}),
+            });
         }
         catch (error) {
             throw normalizeFetchError(error, {
@@ -4898,18 +4891,6 @@ async function fetchProviderResponse(url, fetchOptions, options) {
         json: parsed,
     };
 }
-function isDispatcherCompatibilityError(error) {
-    const err = error;
-    const code = typeof err?.cause?.code === "string" ? err.cause.code : "";
-    const detail = [
-        typeof err?.message === "string" ? err.message : "",
-        typeof err?.cause?.message === "string" ? err.cause.message : "",
-    ]
-        .join(" ")
-        .toLowerCase();
-    return (code === "UND_ERR_INVALID_ARG" &&
-        detail.includes("invalid onrequeststart method"));
-}
 function normalizeFetchError(error, options) {
     const target = describeProviderRequestTarget(options.url, options.secretValues);
     const err = error;

package/dist/review/actions/create-review-comment.d.ts

@@ -3,8 +3,11 @@ declare const _default: import("../../action.js").ActionDefinition<{
     resourceType: string;
     resourceId: string;
     targetId?: string | null | undefined;
+    surfaceId?: string | null | undefined;
     kind?: "annotation" | "comment" | "correction" | "decision" | "question" | "review" | undefined;
     anchor?: unknown;
+    anchorKind?: string | null | undefined;
+    anchorVersion?: number | null | undefined;
     body: string;
     authorName?: string | null | undefined;
     resolutionTarget?: "agent" | "human" | null | undefined;
@@ -22,9 +25,13 @@ declare const _default: import("../../action.js").ActionDefinition<{
     threadId: string;
     parentCommentId: string | null;
     targetId: string | null;
+    surfaceId?: string | null;
     kind: ReviewCommentKind;
     status: import("../types.js").ReviewCommentStatus;
     anchor: unknown;
+    anchorKind?: string | null;
+    anchorVersion?: number | null;
+    revision?: number;
     body: string;
     authorEmail: string | null;
     authorName: string | null;