@agent-native/core 0.6.1 → 0.7.1

package/dist/server/agents-bundle.js

@@ -18,7 +18,7 @@
  *
  * Result is cached in module scope so it's only computed once per cold start.
  */
-const EMPTY = { agentsMd: "", skills: {} };
+const EMPTY = { agentsMd: "", workspaceAgentsMd: "", skills: {} };
 let cached = null;
 /**
  * Parse the YAML frontmatter at the top of a skill file.
@@ -80,14 +80,75 @@ export function parseSkillFrontmatter(content) {
 }
 import fs from "node:fs";
 import path from "node:path";
+/**
+ * Read one skills directory into a `Record<string, Skill>`. Extracted so
+ * both the template and workspace-core paths can reuse it. `dirPrefix` is
+ * the display path that will be reported to the agent (e.g.
+ * `.agents/skills/<name>` for templates, or
+ * `<workspace-core-package>/skills/<name>` for the workspace core).
+ */
+function readSkillsDir(skillsDir, rootForRelative, out, skipExistingNames) {
+    if (!fs.existsSync(skillsDir))
+        return;
+    const entries = fs.readdirSync(skillsDir, { withFileTypes: true });
+    for (const entry of entries) {
+        if (!entry.isDirectory() && !entry.isSymbolicLink())
+            continue;
+        const skillDirAbs = path.join(skillsDir, entry.name);
+        const skillFile = path.join(skillDirAbs, "SKILL.md");
+        try {
+            const realSkillFile = fs.realpathSync(skillFile);
+            if (!fs.existsSync(realSkillFile))
+                continue;
+            const content = fs.readFileSync(realSkillFile, "utf-8");
+            const meta = parseSkillFrontmatter(content);
+            const name = meta.name ?? entry.name;
+            if (skipExistingNames && out[name])
+                continue; // Template wins
+            const extraFiles = [];
+            try {
+                const walk = (subdir, prefix) => {
+                    for (const e of fs.readdirSync(subdir, { withFileTypes: true })) {
+                        const abs = path.join(subdir, e.name);
+                        const rel = prefix ? `${prefix}/${e.name}` : e.name;
+                        if (e.isDirectory() || e.isSymbolicLink()) {
+                            try {
+                                const stat = fs.statSync(abs);
+                                if (stat.isDirectory())
+                                    walk(abs, rel);
+                            }
+                            catch { }
+                        }
+                        else if (e.isFile() && e.name !== "SKILL.md") {
+                            extraFiles.push(rel);
+                        }
+                    }
+                };
+                walk(skillDirAbs, "");
+            }
+            catch { }
+            extraFiles.sort();
+            out[name] = {
+                meta: { name, description: meta.description ?? "" },
+                content,
+                dir: path.relative(rootForRelative, skillDirAbs).replace(/\\/g, "/"),
+                extraFiles,
+            };
+        }
+        catch {
+            // Skip unreadable skills
+        }
+    }
+}
 /**
  * Read AGENTS.md + all skills directly from the filesystem rooted at `cwd`.
- * Returns an empty bundle if nothing is found. Used by both the Vite plugin
- * (at build time) and the runtime fallback (in dev / Node prod).
+ * Optionally also reads a workspace-core's AGENTS.md and skills directory
+ * and merges them in (template wins on name collisions). Used by both the
+ * Vite plugin (at build time) and the runtime fallback (in dev / Node prod).
  *
  * Synchronous — the Vite plugin's load hook calls it inline during the build.
  */
-export function readAgentsBundleFromFs(cwd) {
+export function readAgentsBundleFromFs(cwd, workspaceSource = null) {
     let agentsMd = "";
     try {
         const agentsMdPath = path.join(cwd, "AGENTS.md");
@@ -96,79 +157,46 @@ export function readAgentsBundleFromFs(cwd) {
         }
     }
     catch { }
+    let workspaceAgentsMd = "";
+    if (workspaceSource?.agentsMdPath) {
+        try {
+            if (fs.existsSync(workspaceSource.agentsMdPath)) {
+                workspaceAgentsMd = fs.readFileSync(workspaceSource.agentsMdPath, "utf-8");
+            }
+        }
+        catch { }
+    }
+    // Merge skills: template first (so its entries are authoritative), then
+    // workspace-core with skipExistingNames=true so same-named skills don't
+    // overwrite the template's.
     const skills = {};
     try {
         const skillsDir = path.join(cwd, ".agents", "skills");
-        if (fs.existsSync(skillsDir)) {
-            const entries = fs.readdirSync(skillsDir, { withFileTypes: true });
-            for (const entry of entries) {
-                if (!entry.isDirectory() && !entry.isSymbolicLink())
-                    continue;
-                const skillDirAbs = path.join(skillsDir, entry.name);
-                const skillFile = path.join(skillDirAbs, "SKILL.md");
-                try {
-                    // Follow symlinks to a real file — avoids double-counting if a skill
-                    // is symlinked from another location.
-                    const realSkillFile = fs.realpathSync(skillFile);
-                    if (!fs.existsSync(realSkillFile))
-                        continue;
-                    const content = fs.readFileSync(realSkillFile, "utf-8");
-                    const meta = parseSkillFrontmatter(content);
-                    const name = meta.name ?? entry.name;
-                    if (skills[name])
-                        continue; // First one wins
-                    // Walk the skill directory for supporting files (anything alongside
-                    // SKILL.md). Skills are folders — they may include extra markdown,
-                    // images, examples, etc. that the agent can read via shell in dev.
-                    const extraFiles = [];
-                    try {
-                        const walk = (subdir, prefix) => {
-                            for (const e of fs.readdirSync(subdir, { withFileTypes: true })) {
-                                const abs = path.join(subdir, e.name);
-                                const rel = prefix ? `${prefix}/${e.name}` : e.name;
-                                if (e.isDirectory() || e.isSymbolicLink()) {
-                                    try {
-                                        const stat = fs.statSync(abs);
-                                        if (stat.isDirectory())
-                                            walk(abs, rel);
-                                    }
-                                    catch { }
-                                }
-                                else if (e.isFile() && e.name !== "SKILL.md") {
-                                    extraFiles.push(rel);
-                                }
-                            }
-                        };
-                        walk(skillDirAbs, "");
-                    }
-                    catch { }
-                    extraFiles.sort();
-                    skills[name] = {
-                        meta: { name, description: meta.description ?? "" },
-                        content,
-                        dir: path.relative(cwd, skillDirAbs).replace(/\\/g, "/"),
-                        extraFiles,
-                    };
-                }
-                catch {
-                    // Skip unreadable skills
-                }
-            }
-        }
+        readSkillsDir(skillsDir, cwd, skills, false);
     }
     catch { }
-    return { agentsMd, skills };
+    if (workspaceSource?.skillsDir) {
+        try {
+            readSkillsDir(workspaceSource.skillsDir, workspaceSource.rootDir, skills, true);
+        }
+        catch { }
+    }
+    return { agentsMd, workspaceAgentsMd, skills };
 }
 /**
  * Load the agents bundle. Returns a cached result on subsequent calls.
  * Tries the virtual module first (works everywhere, including edge), then
- * falls back to filesystem reads from `process.cwd()`.
+ * falls back to filesystem reads from `process.cwd()` — which, when a
+ * workspace core is present, also merges in the workspace core's skills
+ * and AGENTS.md.
  */
 export async function loadAgentsBundle() {
     if (cached)
         return cached;
     // 1. Try the Vite-emitted virtual module. This is the path that works on
     //    every deployment target because the content is inlined at build time.
+    //    The Vite plugin itself is responsible for merging workspace-core
+    //    content into the bundle it emits.
     try {
         // @ts-expect-error — virtual module is resolved at build time by our
         // Vite plugin; nothing exists at this path on disk.
@@ -181,9 +209,25 @@ export async function loadAgentsBundle() {
     catch {
         // Virtual module not available — fall through to filesystem.
     }
-    // 2. Filesystem fallback — only works in dev / Node prod.
+    // 2. Filesystem fallback — works in dev / Node prod. If a workspace core
+    //    is present in the ancestor chain, merge its skills + AGENTS.md in.
     try {
-        cached = readAgentsBundleFromFs(process.cwd());
+        let workspaceSource = null;
+        try {
+            const { getWorkspaceCoreExports } = await import("../deploy/workspace-core.js");
+            const ws = await getWorkspaceCoreExports(process.cwd());
+            if (ws) {
+                workspaceSource = {
+                    skillsDir: ws.skillsDir,
+                    agentsMdPath: ws.agentsMdPath,
+                    rootDir: ws.packageDir,
+                };
+            }
+        }
+        catch {
+            // workspace-core discovery isn't available (e.g. edge runtime).
+        }
+        cached = readAgentsBundleFromFs(process.cwd(), workspaceSource);
         return cached;
     }
     catch {

package/dist/server/agents-bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents-bundle.js","sourceRoot":"","sources":["../../src/server/agents-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiCH,MAAM,KAAK,GAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEzD,IAAI,MAAM,GAAwB,IAAI,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAuB,EAAE,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QACrD,MAAM,SAAS,GAAG,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAEtD,IAAI,KAAa,CAAC;QAClB,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC1B,kEAAkE;YAClE,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACf,CAAC,EAAE,CAAC;oBACJ,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM;gBAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;gBACrC,CAAC,EAAE,CAAC;YACN,CAAC;YACD,4BAA4B;YAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;YACvE,KAAK,GAAG,QAAQ;gBACd,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACzC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,OAAO,CAAC;QAClB,CAAC;QAED,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;aAC5C,IAAI,GAAG,KAAK,aAAa,IAAI,KAAK;YAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;IACtE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;oBAAE,SAAS;gBAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;gBACrD,IAAI,CAAC;oBACH,qEAAqE;oBACrE,sCAAsC;oBACtC,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;oBACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;wBAAE,SAAS;oBAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;oBACxD,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;oBAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;oBACrC,IAAI,MAAM,CAAC,IAAI,CAAC;wBAAE,SAAS,CAAC,iBAAiB;oBAE7C,oEAAoE;oBACpE,mEAAmE;oBACnE,mEAAmE;oBACnE,MAAM,UAAU,GAAa,EAAE,CAAC;oBAChC,IAAI,CAAC;wBACH,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,EAAE;4BAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gCAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gCACtC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gCACpD,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;oCAC1C,IAAI,CAAC;wCACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;wCAC9B,IAAI,IAAI,CAAC,WAAW,EAAE;4CAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oCACzC,CAAC;oCAAC,MAAM,CAAC,CAAA,CAAC;gCACZ,CAAC;qCAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oCAC/C,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gCACvB,CAAC;4BACH,CAAC;wBACH,CAAC,CAAC;wBACF,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC,CAAA,CAAC;oBACV,UAAU,CAAC,IAAI,EAAE,CAAC;oBAElB,MAAM,CAAC,IAAI,CAAC,GAAG;wBACb,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE;wBACnD,OAAO;wBACP,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;wBACxD,UAAU;qBACX,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,yBAAyB;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,CAAC;QACH,qEAAqE;QACrE,oDAAoD;QACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAClD,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,CAAC,OAAuB,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,KAAK,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAoB;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,MAAM,GACV,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAChD,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,GAAG,MAAM,EAAE,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,OAAO;;;;;;;;EAQP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;UACR,CAAC;AACX,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}
+{"version":3,"file":"agents-bundle.js","sourceRoot":"","sources":["../../src/server/agents-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA8CH,MAAM,KAAK,GAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEhF,IAAI,MAAM,GAAwB,IAAI,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAuB,EAAE,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QACrD,MAAM,SAAS,GAAG,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAEtD,IAAI,KAAa,CAAC;QAClB,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC1B,kEAAkE;YAClE,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACf,CAAC,EAAE,CAAC;oBACJ,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM;gBAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;gBACrC,CAAC,EAAE,CAAC;YACN,CAAC;YACD,4BAA4B;YAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;YACvE,KAAK,GAAG,QAAQ;gBACd,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACzC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,OAAO,CAAC;QAClB,CAAC;QAED,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;aAC5C,IAAI,GAAG,KAAK,aAAa,IAAI,KAAK;YAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;IACtE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAe7B;;;;;;GAMG;AACH,SAAS,aAAa,CACpB,SAAiB,EACjB,eAAuB,EACvB,GAA0B,EAC1B,iBAA0B;IAE1B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IACtC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;YAAE,SAAS;QAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;gBAAE,SAAS;YAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;YACrC,IAAI,iBAAiB,IAAI,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS,CAAC,gBAAgB;YAE9D,MAAM,UAAU,GAAa,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,EAAE;oBAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;wBAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;wBACtC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;wBACpD,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;4BAC1C,IAAI,CAAC;gCACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gCAC9B,IAAI,IAAI,CAAC,WAAW,EAAE;oCAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;4BACzC,CAAC;4BAAC,MAAM,CAAC,CAAA,CAAC;wBACZ,CAAC;6BAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;4BAC/C,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBACvB,CAAC;oBACH,CAAC;gBACH,CAAC,CAAC;gBACF,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,UAAU,CAAC,IAAI,EAAE,CAAC;YAElB,GAAG,CAAC,IAAI,CAAC,GAAG;gBACV,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE;gBACnD,OAAO;gBACP,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;gBACpE,UAAU;aACX,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,kBAAgD,IAAI;IAEpD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,IAAI,iBAAiB,GAAG,EAAE,CAAC;IAC3B,IAAI,eAAe,EAAE,YAAY,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChD,iBAAiB,GAAG,EAAE,CAAC,YAAY,CACjC,eAAe,CAAC,YAAY,EAC5B,OAAO,CACR,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,4BAA4B;IAC5B,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtD,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,IAAI,eAAe,EAAE,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,aAAa,CACX,eAAe,CAAC,SAAS,EACzB,eAAe,CAAC,OAAO,EACvB,MAAM,EACN,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,uCAAuC;IACvC,IAAI,CAAC;QACH,qEAAqE;QACrE,oDAAoD;QACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAClD,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,CAAC,OAAuB,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IAED,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,CAAC;QACH,IAAI,eAAe,GAAiC,IAAI,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,EAAE,uBAAuB,EAAE,GAC/B,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAC9C,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACxD,IAAI,EAAE,EAAE,CAAC;gBACP,eAAe,GAAG;oBAChB,SAAS,EAAE,EAAE,CAAC,SAAS;oBACvB,YAAY,EAAE,EAAE,CAAC,YAAY;oBAC7B,OAAO,EAAE,EAAE,CAAC,UAAU;iBACvB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;QACD,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC,CAAC;QAChE,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,KAAK,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAoB;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,MAAM,GACV,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAChD,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,GAAG,MAAM,EAAE,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,OAAO;;;;;;;;EAQP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;UACR,CAAC;AACX,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}

package/dist/server/auth.d.ts

@@ -74,6 +74,7 @@ export declare function runAuthGuard(event: H3Event): Promise<Response | object
  * 5. Better Auth → check session via Better Auth API (cookie or Bearer)
  * 6. Legacy cookie → check an_session cookie in legacy sessions table
  * 7. Mobile _session query param → promote to cookie
+ * 8. Dev-mode fallback → local@localhost (never block in development)
  */
 export declare function getSession(event: H3Event): Promise<AuthSession | null>;
 /**

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAOhE,KAAK,KAAK,GAAG,SAAS,CAAC;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AASlE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAmHD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS7E;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiB3E;AAgCD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;AAkFD;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAyF5E;AA6fD;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAuIlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAEzE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAOhE,KAAK,KAAK,GAAG,SAAS,CAAC;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AASlE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAgHD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS7E;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiB3E;AAgCD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;AAqFD;;;;;;;;;;;;GAYG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAiG5E;AA6nBD;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAiJlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAEzE"}

package/dist/server/auth.js

@@ -24,38 +24,33 @@ import { readBody } from "../server/h3-helpers.js";
 // ---------------------------------------------------------------------------
 const COOKIE_NAME = "an_session";
 const DEFAULT_MAX_AGE = 60 * 60 * 24 * 30; // 30 days
+const LOCAL_MODE_MARKER_PATH = path.resolve(process.cwd(), ".agent-native", "auth-mode");
 // ---------------------------------------------------------------------------
 // AUTH_MODE detection
 // ---------------------------------------------------------------------------
 /**
  * Check if the app is in local-only mode (no auth).
  *
- * Returns true when:
- * - AUTH_MODE=local is explicitly set (escape hatch)
- * - In dev environment (NODE_ENV=development) with no explicit auth token
- *   configured (no ACCESS_TOKEN, no BYOA). This makes dev "just work"
- *   without requiring auth setup, while still respecting auth when configured.
+ * Returns true when AUTH_MODE=local is explicitly set or when the dev
+ * onboarding flow has enabled local mode for the current workspace via
+ * a runtime marker file.
  *
- * NOTE: GOOGLE_CLIENT_ID is intentionally NOT checked here — it is used for
- * Google Calendar / Gmail API access as well as Google Sign-In, and its
- * presence alone should not force authentication. Only ACCESS_TOKEN/ACCESS_TOKENS
- * (explicit token-based auth) or a custom getSession (BYOA) signal that the
- * developer has explicitly opted into requiring authentication.
- *
- * BYOA (customGetSession) opts out of dev auto-local — templates that provide
- * their own auth (e.g. Supabase) shouldn't be silently bypassed in dev.
+ * Local mode is an explicit escape hatch for when you want to guarantee
+ * no auth is used. In development, getSession() also falls back to
+ * local@localhost automatically if no other auth method succeeds, so
+ * apps are always usable without configuration in dev.
  */
-function isLocalMode() {
+async function isLocalModeEnabled() {
     if (process.env.AUTH_MODE === "local")
         return true;
-    // Default to local mode in dev when no explicit auth is configured
-    if (isDevEnvironment() &&
-        !process.env.ACCESS_TOKEN &&
-        !process.env.ACCESS_TOKENS &&
-        !customGetSession) {
-        return true;
+    try {
+        const fs = await getFs();
+        const mode = fs.readFileSync(LOCAL_MODE_MARKER_PATH, "utf-8").trim();
+        return mode === "local";
+    }
+    catch {
+        return false;
     }
-    return false;
 }
 /**
  * Check if we're in a development/test environment.
@@ -212,9 +207,12 @@ function createAuthGuardFn() {
         const { loginHtml, publicPaths } = config;
         const url = event.node?.req?.url ?? event.path ?? "/";
         const p = url.split("?")[0];
-        // Skip auth routes (all /_agent-native/auth/* and /_agent-native/google/*)
+        // Skip auth routes and specific Google OAuth endpoints that must be public
+        // (callback and auth-url). Other Google endpoints like /status require auth.
         if (p.startsWith("/_agent-native/auth/") ||
-            p.startsWith("/_agent-native/google/")) {
+            p === "/_agent-native/google/callback" ||
+            p === "/_agent-native/google/auth-url" ||
+            p === "/_agent-native/google/add-account/callback") {
             return;
         }
         // Skip static assets (Vite chunks, fonts, images, etc.)
@@ -267,10 +265,11 @@ function mapBetterAuthSession(baSession) {
  * 5. Better Auth → check session via Better Auth API (cookie or Bearer)
  * 6. Legacy cookie → check an_session cookie in legacy sessions table
  * 7. Mobile _session query param → promote to cookie
+ * 8. Dev-mode fallback → local@localhost (never block in development)
  */
 export async function getSession(event) {
     // 1. AUTH_MODE=local — explicit local-only mode
-    if (isLocalMode() || authDisabledMode) {
+    if ((await isLocalModeEnabled()) || authDisabledMode) {
         // Check for a real session cookie first (e.g. from Google OAuth)
         try {
             const cookie = getCookie(event, COOKIE_NAME);
@@ -357,6 +356,13 @@ export async function getSession(event) {
             return { email, token: qToken };
         }
     }
+    // 7. Dev-mode safety net — in development, always fall back to local@localhost
+    // so the app is usable without any auth configuration. This prevents 401
+    // errors when Better Auth isn't configured, the marker file is missing, or
+    // the user simply wants to play around locally.
+    if (isDevEnvironment()) {
+        return LOCAL_SESSION;
+    }
     return null;
 }
 // ---------------------------------------------------------------------------
@@ -373,7 +379,7 @@ const TOKEN_LOGIN_HTML = `<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
 <title>Sign in</title>
 <style>
   *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
@@ -458,21 +464,8 @@ const TOKEN_LOGIN_HTML = `<!DOCTYPE html>
 async function setAuthModeLocal() {
     try {
         const fs = await getFs();
-        const envPath = path.resolve(process.cwd(), ".env");
-        let content = "";
-        try {
-            content = fs.readFileSync(envPath, "utf-8");
-        }
-        catch {
-            // .env doesn't exist yet
-        }
-        if (content.includes("AUTH_MODE=")) {
-            content = content.replace(/AUTH_MODE=.*/g, "AUTH_MODE=local");
-        }
-        else {
-            content = content.trimEnd() + "\nAUTH_MODE=local\n";
-        }
-        fs.writeFileSync(envPath, content, "utf-8");
+        fs.mkdirSync(path.dirname(LOCAL_MODE_MARKER_PATH), { recursive: true });
+        fs.writeFileSync(LOCAL_MODE_MARKER_PATH, "local\n", "utf-8");
         process.env.AUTH_MODE = "local";
         return true;
     }
@@ -483,20 +476,12 @@ async function setAuthModeLocal() {
 async function removeAuthModeLocal() {
     try {
         const fs = await getFs();
-        const envPath = path.resolve(process.cwd(), ".env");
-        let content = "";
         try {
-            content = fs.readFileSync(envPath, "utf-8");
+            fs.unlinkSync(LOCAL_MODE_MARKER_PATH);
         }
         catch {
-            return true; // No .env file means nothing to remove
-        }
-        // Remove AUTH_MODE=local line entirely
-        content = content
-            .split("\n")
-            .filter((line) => !line.match(/^\s*AUTH_MODE\s*=/))
-            .join("\n");
-        fs.writeFileSync(envPath, content, "utf-8");
+            // Marker already absent
+        }
         delete process.env.AUTH_MODE;
         return true;
     }
@@ -549,7 +534,7 @@ async function mountBetterAuthRoutes(app, options) {
         const ok = await setAuthModeLocal();
         if (!ok) {
             setResponseStatus(event, 500);
-            return { error: "Failed to set AUTH_MODE=local in .env" };
+            return { error: "Failed to enable local mode" };
         }
         return { ok: true };
     }));
@@ -562,7 +547,7 @@ async function mountBetterAuthRoutes(app, options) {
         const ok = await removeAuthModeLocal();
         if (!ok) {
             setResponseStatus(event, 500);
-            return { error: "Failed to remove AUTH_MODE from .env" };
+            return { error: "Failed to disable local mode" };
         }
         return { ok: true };
     }));
@@ -770,10 +755,129 @@ function mountLocalModeRoutes(app) {
         const ok = await removeAuthModeLocal();
         if (!ok) {
             setResponseStatus(event, 500);
-            return { error: "Failed to remove AUTH_MODE from .env" };
+            return { error: "Failed to disable local mode" };
+        }
+        return { ok: true };
+    }));
+}
+// ---------------------------------------------------------------------------
+// mountAuthFallbackRoutes — minimal auth endpoints when Better Auth init fails
+// ---------------------------------------------------------------------------
+function mountAuthFallbackRoutes(app) {
+    app.use("/_agent-native/auth/login", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const body = await readBody(event);
+        const email = body?.email?.trim?.()?.toLowerCase?.();
+        const password = body?.password;
+        if (!email || !password) {
+            setResponseStatus(event, 400);
+            return { error: "Email and password are required" };
+        }
+        try {
+            const auth = await getBetterAuth();
+            const result = await auth.api.signInEmail({
+                body: { email, password },
+            });
+            if (result?.token) {
+                setCookie(event, COOKIE_NAME, result.token, {
+                    httpOnly: true,
+                    secure: !isDevEnvironment(),
+                    sameSite: "lax",
+                    path: "/",
+                    maxAge: sessionMaxAge,
+                });
+                await addSession(result.token, email);
+            }
+            return { ok: true };
+        }
+        catch (e) {
+            setResponseStatus(event, 401);
+            return { error: e?.message || "Invalid email or password" };
+        }
+    }));
+    app.use("/_agent-native/auth/register", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const body = await readBody(event);
+        const email = body?.email?.trim?.()?.toLowerCase?.();
+        const password = body?.password;
+        if (!email || typeof email !== "string" || !email.includes("@")) {
+            setResponseStatus(event, 400);
+            return { error: "Valid email is required" };
+        }
+        if (!password || typeof password !== "string" || password.length < 8) {
+            setResponseStatus(event, 400);
+            return { error: "Password must be at least 8 characters" };
+        }
+        try {
+            const auth = await getBetterAuth();
+            await auth.api.signUpEmail({
+                body: { email, password, name: email.split("@")[0] },
+            });
+            return { ok: true };
+        }
+        catch (e) {
+            setResponseStatus(event, 409);
+            return { error: e?.message || "Registration failed" };
+        }
+    }));
+    app.use("/_agent-native/auth/logout", defineEventHandler(async (event) => {
+        const cookie = getCookie(event, COOKIE_NAME);
+        if (cookie)
+            await removeSession(cookie);
+        deleteCookie(event, COOKIE_NAME, { path: "/" });
+        try {
+            const auth = await getBetterAuth();
+            await auth.api.signOut({ headers: event.headers });
+        }
+        catch {
+            // Ignore if Better Auth is still unavailable
+        }
+        return { ok: true };
+    }));
+    app.use("/_agent-native/auth/local-mode", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        if (!isDevEnvironment()) {
+            setResponseStatus(event, 403);
+            return {
+                error: "Local mode is not available in production. Create an account to continue.",
+            };
+        }
+        const ok = await setAuthModeLocal();
+        if (!ok) {
+            setResponseStatus(event, 500);
+            return { error: "Failed to enable local mode" };
+        }
+        return { ok: true };
+    }));
+    app.use("/_agent-native/auth/exit-local-mode", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const ok = await removeAuthModeLocal();
+        if (!ok) {
+            setResponseStatus(event, 500);
+            return { error: "Failed to disable local mode" };
         }
         return { ok: true };
     }));
+    app.use("/_agent-native/auth/session", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "GET") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const session = await getSession(event);
+        return session ?? { error: "Not authenticated" };
+    }));
 }
 // ---------------------------------------------------------------------------
 // autoMountAuth — the recommended entry point
@@ -815,7 +919,7 @@ export async function autoMountAuth(app, options = {}) {
         return true;
     }
     if (!app) {
-        if (isLocalMode() || isDevEnvironment()) {
+        if ((await isLocalModeEnabled()) || isDevEnvironment()) {
             authDisabledMode = false;
             customGetSession = null;
             return false;
@@ -831,11 +935,18 @@ export async function autoMountAuth(app, options = {}) {
         customGetSession = options.getSession;
     }
     // AUTH_MODE=local — explicit local-only mode (escape hatch)
-    if (isLocalMode()) {
-        mountLocalModeRoutes(app);
-        // Still init Better Auth in background so users can create accounts later
-        getBetterAuth(options.betterAuth).catch(() => { });
-        console.log("[agent-native] Auth mode: local (no auth required).");
+    if (await isLocalModeEnabled()) {
+        try {
+            // Mount the standard auth endpoints and guard even in local mode so the
+            // app can switch back to real auth immediately after AUTH_MODE is
+            // cleared, without waiting for a server restart/remount.
+            await mountBetterAuthRoutes(app, options);
+        }
+        catch (err) {
+            console.error("[agent-native] Failed to initialize Better Auth in local mode:", err);
+            mountLocalModeRoutes(app);
+        }
+        console.log("[agent-native] Auth mode: local (upgrade path enabled).");
         return false;
     }
     // BYOA — custom getSession provider
@@ -886,6 +997,7 @@ export async function autoMountAuth(app, options = {}) {
     }
     catch (err) {
         console.error("[agent-native] Failed to initialize Better Auth:", err);
+        mountAuthFallbackRoutes(app);
         // CRITICAL: Even if Better Auth fails, register the auth guard so
         // unauthenticated users can't access the app. They'll see the login
         // page but won't be able to sign in until the DB is available.