@agent-native/core 0.6.1 → 0.7.2

package/dist/server/credential-provider.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Credential provider abstraction.
+ *
+ * Every feature that needs an external credential (Anthropic API key,
+ * Google OAuth tokens, OpenAI key, Slack bot token, etc.) should go through
+ * one of the resolve*() helpers here instead of reading `process.env`
+ * directly. That way the same feature can work in three modes:
+ *
+ *   1. User set their own key in .env              → use it directly
+ *   2. User connected Builder via `/cli-auth`      → route through Builder proxy
+ *   3. Neither                                      → throw FeatureNotConfigured
+ *
+ * Templates catch FeatureNotConfigured and show a "Connect Builder (1 click) /
+ * set up your own key (guide)" card.
+ *
+ * Today these helpers are used by the Builder-hosted LLM gateway, and the
+ * shape is meant to grow to cover future managed credential integrations
+ * (e.g. additional Builder-hosted services) without rewrites.
+ */
+export declare class FeatureNotConfiguredError extends Error {
+    readonly requiredCredential: string;
+    readonly builderConnectUrl?: string;
+    readonly byokDocsUrl?: string;
+    constructor(opts: {
+        requiredCredential: string;
+        message?: string;
+        builderConnectUrl?: string;
+        byokDocsUrl?: string;
+    });
+}
+/** True when a Builder private key is configured in this environment. */
+export declare function hasBuilderPrivateKey(): boolean;
+/** The origin for Builder-proxied API calls. Overridable for testing. */
+export declare function getBuilderProxyOrigin(): string;
+/** Authorization header value for Builder-proxied calls. */
+export declare function getBuilderAuthHeader(): string | null;
+//# sourceMappingURL=credential-provider.d.ts.map

package/dist/server/credential-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-provider.d.ts","sourceRoot":"","sources":["../../src/server/credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;gBAElB,IAAI,EAAE;QAChB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB;CAUF;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,IAAI,MAAM,CAO9C;AAED,4DAA4D;AAC5D,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAGpD"}

package/dist/server/credential-provider.js

@@ -0,0 +1,49 @@
+/**
+ * Credential provider abstraction.
+ *
+ * Every feature that needs an external credential (Anthropic API key,
+ * Google OAuth tokens, OpenAI key, Slack bot token, etc.) should go through
+ * one of the resolve*() helpers here instead of reading `process.env`
+ * directly. That way the same feature can work in three modes:
+ *
+ *   1. User set their own key in .env              → use it directly
+ *   2. User connected Builder via `/cli-auth`      → route through Builder proxy
+ *   3. Neither                                      → throw FeatureNotConfigured
+ *
+ * Templates catch FeatureNotConfigured and show a "Connect Builder (1 click) /
+ * set up your own key (guide)" card.
+ *
+ * Today these helpers are used by the Builder-hosted LLM gateway, and the
+ * shape is meant to grow to cover future managed credential integrations
+ * (e.g. additional Builder-hosted services) without rewrites.
+ */
+export class FeatureNotConfiguredError extends Error {
+    requiredCredential;
+    builderConnectUrl;
+    byokDocsUrl;
+    constructor(opts) {
+        super(opts.message ??
+            `Feature requires credential "${opts.requiredCredential}". Connect Builder or set your own key.`);
+        this.name = "FeatureNotConfiguredError";
+        this.requiredCredential = opts.requiredCredential;
+        this.builderConnectUrl = opts.builderConnectUrl;
+        this.byokDocsUrl = opts.byokDocsUrl;
+    }
+}
+/** True when a Builder private key is configured in this environment. */
+export function hasBuilderPrivateKey() {
+    return !!process.env.BUILDER_PRIVATE_KEY;
+}
+/** The origin for Builder-proxied API calls. Overridable for testing. */
+export function getBuilderProxyOrigin() {
+    return (process.env.BUILDER_PROXY_ORIGIN ||
+        process.env.AIR_HOST ||
+        process.env.BUILDER_API_HOST ||
+        "https://ai-services.builder.io");
+}
+/** Authorization header value for Builder-proxied calls. */
+export function getBuilderAuthHeader() {
+    const key = process.env.BUILDER_PRIVATE_KEY;
+    return key ? `Bearer ${key}` : null;
+}
+//# sourceMappingURL=credential-provider.js.map

package/dist/server/credential-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-provider.js","sourceRoot":"","sources":["../../src/server/credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,kBAAkB,CAAS;IAC3B,iBAAiB,CAAU;IAC3B,WAAW,CAAU;IAE9B,YAAY,IAKX;QACC,KAAK,CACH,IAAI,CAAC,OAAO;YACV,gCAAgC,IAAI,CAAC,kBAAkB,yCAAyC,CACnG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACtC,CAAC;CACF;AAED,yEAAyE;AACzE,MAAM,UAAU,oBAAoB;IAClC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,qBAAqB;IACnC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,oBAAoB;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ;QACpB,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5B,gCAAgC,CACjC,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAC5C,OAAO,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC"}

package/dist/server/desktop-sso.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Desktop SSO broker.
+ *
+ * In the Electron desktop app each template runs in its own persistent
+ * session partition with its own Nitro server and database. Cookies are
+ * isolated per partition, and session tokens don't federate across the
+ * per-template `session` tables — so signing into Mail leaves Calendar
+ * with a useless cookie (same value, but no matching row in Calendar's
+ * database), and Calendar reads as "logged out" on the next request.
+ *
+ * This module is a file-based broker that lives in the user's home
+ * directory. When a template creates a session, it writes the token +
+ * email here. When any template's `getSession` can't resolve its own
+ * cookie, it falls back to this record (but only for requests from
+ * Electron, so web deployments stay DB-backed).
+ *
+ * The file is user-owned (0600) and lives under the OS home directory,
+ * so the trust boundary is the local machine — same as the desktop app
+ * itself. It is intentionally not written or read outside of Electron
+ * requests; plain-web/serverless deployments never touch it.
+ */
+export interface DesktopSsoRecord {
+    email: string;
+    token: string;
+    expiresAt: number;
+}
+export declare function readDesktopSso(): Promise<DesktopSsoRecord | null>;
+export declare function writeDesktopSso(rec: DesktopSsoRecord): Promise<void>;
+export declare function clearDesktopSso(): Promise<void>;
+//# sourceMappingURL=desktop-sso.d.ts.map

package/dist/server/desktop-sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-sso.d.ts","sourceRoot":"","sources":["../../src/server/desktop-sso.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAWH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,wBAAsB,cAAc,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmBvE;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAW1E;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAOrD"}

package/dist/server/desktop-sso.js

@@ -0,0 +1,74 @@
+/**
+ * Desktop SSO broker.
+ *
+ * In the Electron desktop app each template runs in its own persistent
+ * session partition with its own Nitro server and database. Cookies are
+ * isolated per partition, and session tokens don't federate across the
+ * per-template `session` tables — so signing into Mail leaves Calendar
+ * with a useless cookie (same value, but no matching row in Calendar's
+ * database), and Calendar reads as "logged out" on the next request.
+ *
+ * This module is a file-based broker that lives in the user's home
+ * directory. When a template creates a session, it writes the token +
+ * email here. When any template's `getSession` can't resolve its own
+ * cookie, it falls back to this record (but only for requests from
+ * Electron, so web deployments stay DB-backed).
+ *
+ * The file is user-owned (0600) and lives under the OS home directory,
+ * so the trust boundary is the local machine — same as the desktop app
+ * itself. It is intentionally not written or read outside of Electron
+ * requests; plain-web/serverless deployments never touch it.
+ */
+import os from "node:os";
+import path from "node:path";
+let _fs;
+async function getFs() {
+    if (!_fs)
+        _fs = await import("node:fs");
+    return _fs;
+}
+function getSsoPath() {
+    return path.join(os.homedir(), ".agent-native", "desktop-sso.json");
+}
+export async function readDesktopSso() {
+    try {
+        const fs = await getFs();
+        const raw = fs.readFileSync(getSsoPath(), "utf-8");
+        const rec = JSON.parse(raw);
+        if (!rec ||
+            typeof rec.email !== "string" ||
+            typeof rec.token !== "string" ||
+            typeof rec.expiresAt !== "number" ||
+            rec.expiresAt <= 0 ||
+            rec.expiresAt < Date.now()) {
+            return null;
+        }
+        return rec;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeDesktopSso(rec) {
+    try {
+        const fs = await getFs();
+        const p = getSsoPath();
+        fs.mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
+        const tmp = `${p}.tmp`;
+        fs.writeFileSync(tmp, JSON.stringify(rec), { mode: 0o600 });
+        fs.renameSync(tmp, p);
+    }
+    catch {
+        // Best-effort: SSO is a desktop optimization, never fatal.
+    }
+}
+export async function clearDesktopSso() {
+    try {
+        const fs = await getFs();
+        fs.unlinkSync(getSsoPath());
+    }
+    catch {
+        // File didn't exist — fine.
+    }
+}
+//# sourceMappingURL=desktop-sso.js.map

package/dist/server/desktop-sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-sso.js","sourceRoot":"","sources":["../../src/server/desktop-sso.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,IAAI,GAAoC,CAAC;AACzC,KAAK,UAAU,KAAK;IAClB,IAAI,CAAC,GAAG;QAAE,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,SAAS,UAAU;IACjB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB,CAAC;QAChD,IACE,CAAC,GAAG;YACJ,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAC7B,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;YAC7B,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;YACjC,GAAG,CAAC,SAAS,IAAI,CAAC;YAClB,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAC1B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAqB;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,UAAU,EAAE,CAAC;QACvB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;QACvB,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QACzB,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;AACH,CAAC"}

package/dist/server/email.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Email transport for system emails (password resets, invitations, notifications).
+ *
+ * Providers are selected by env var:
+ *   RESEND_API_KEY    — https://resend.com
+ *   SENDGRID_API_KEY  — https://sendgrid.com
+ *   EMAIL_FROM        — "Name <addr@domain>" (optional; defaults to Resend's sandbox)
+ *
+ * With neither provider configured, `sendEmail` logs the message to the console
+ * so the reset-password flow still works end-to-end for local development.
+ */
+export type EmailProvider = "resend" | "sendgrid" | "dev";
+export interface SendEmailArgs {
+    to: string;
+    subject: string;
+    html: string;
+    text?: string;
+    from?: string;
+}
+export declare function isEmailConfigured(): boolean;
+export declare function getEmailProvider(): EmailProvider;
+export declare function sendEmail(args: SendEmailArgs): Promise<void>;
+//# sourceMappingURL=email.d.ts.map

package/dist/server/email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/server/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,GAAG,KAAK,CAAC;AAE1D,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAE3C;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CAIhD;AAeD,wBAAsB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAgElE"}

package/dist/server/email.js

@@ -0,0 +1,105 @@
+/**
+ * Email transport for system emails (password resets, invitations, notifications).
+ *
+ * Providers are selected by env var:
+ *   RESEND_API_KEY    — https://resend.com
+ *   SENDGRID_API_KEY  — https://sendgrid.com
+ *   EMAIL_FROM        — "Name <addr@domain>" (optional; defaults to Resend's sandbox)
+ *
+ * With neither provider configured, `sendEmail` logs the message to the console
+ * so the reset-password flow still works end-to-end for local development.
+ */
+export function isEmailConfigured() {
+    return !!(process.env.RESEND_API_KEY || process.env.SENDGRID_API_KEY);
+}
+export function getEmailProvider() {
+    if (process.env.RESEND_API_KEY)
+        return "resend";
+    if (process.env.SENDGRID_API_KEY)
+        return "sendgrid";
+    return "dev";
+}
+function getFromAddress(override, provider) {
+    const explicit = override || process.env.EMAIL_FROM;
+    if (explicit)
+        return explicit;
+    // Resend lets unverified accounts send from its sandbox domain; SendGrid
+    // does not, so falling back there would cause silent 403s at runtime.
+    if (provider === "sendgrid") {
+        throw new Error("EMAIL_FROM is required when using SendGrid — set it to a verified sender address.");
+    }
+    return "Agent Native <onboarding@resend.dev>";
+}
+export async function sendEmail(args) {
+    const provider = getEmailProvider();
+    const from = getFromAddress(args.from, provider);
+    if (provider === "resend") {
+        const res = await fetch("https://api.resend.com/emails", {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${process.env.RESEND_API_KEY}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                from,
+                to: args.to,
+                subject: args.subject,
+                html: args.html,
+                text: args.text,
+            }),
+        });
+        if (!res.ok) {
+            const body = await res.text().catch(() => "");
+            throw new Error(`Resend error ${res.status}: ${body}`);
+        }
+        return;
+    }
+    if (provider === "sendgrid") {
+        const res = await fetch("https://api.sendgrid.com/v3/mail/send", {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${process.env.SENDGRID_API_KEY}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                personalizations: [{ to: [{ email: args.to }] }],
+                from: parseSendGridFrom(from),
+                subject: args.subject,
+                content: [
+                    ...(args.text ? [{ type: "text/plain", value: args.text }] : []),
+                    { type: "text/html", value: args.html },
+                ],
+            }),
+        });
+        if (!res.ok) {
+            const body = await res.text().catch(() => "");
+            throw new Error(`SendGrid error ${res.status}: ${body}`);
+        }
+        return;
+    }
+    // Dev fallback — no provider configured. Logging the full body exposes
+    // reset tokens, so only do it outside production. In production, refuse
+    // to send rather than silently leaking secrets to logs.
+    if (process.env.NODE_ENV === "production") {
+        throw new Error("No email provider configured. Set RESEND_API_KEY or SENDGRID_API_KEY.");
+    }
+    console.log(`\n[agent-native:email] No email provider configured. ` +
+        `Set RESEND_API_KEY or SENDGRID_API_KEY to send real emails.\n` +
+        `---\nTo: ${args.to}\nFrom: ${from}\nSubject: ${args.subject}\n\n` +
+        `${args.text || stripHtml(args.html)}\n---\n`);
+}
+function parseSendGridFrom(from) {
+    const m = from.match(/^\s*(.*?)\s*<(.+)>\s*$/);
+    if (m && m[2])
+        return { name: m[1] || undefined, email: m[2] };
+    return { email: from.trim() };
+}
+function stripHtml(html) {
+    return html
+        .replace(/<br\s*\/?>/gi, "\n")
+        .replace(/<\/p>/gi, "\n\n")
+        .replace(/<[^>]+>/g, "")
+        .replace(/&nbsp;/g, " ")
+        .trim();
+}
+//# sourceMappingURL=email.js.map

package/dist/server/email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/server/email.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAYH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,QAAQ,CAAC;IAChD,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAAE,OAAO,UAAU,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,QAAiB,EAAE,QAAwB;IACjE,MAAM,QAAQ,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACpD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,yEAAyE;IACzE,sEAAsE;IACtE,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,sCAAsC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAmB;IACjD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+BAA+B,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE;gBACrD,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI;gBACJ,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,uCAAuC,EAAE;YAC/D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE;gBACvD,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;gBAChD,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC;gBAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE;oBACP,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;iBACxC;aACF,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO;IACT,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,wDAAwD;IACxD,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CACT,uDAAuD;QACrD,+DAA+D;QAC/D,YAAY,IAAI,CAAC,EAAE,WAAW,IAAI,cAAc,IAAI,CAAC,OAAO,MAAM;QAClE,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI;SACR,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,IAAI,EAAE,CAAC;AACZ,CAAC"}

package/dist/server/framework-request-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework-request-handler.d.ts","sourceRoot":"","sources":["../../src/server/framework-request-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,YAAY,EAAW,MAAM,IAAI,CAAC;AAKhD,QAAA,MAAM,gBAAgB,mBAAmB,CAAC;AAI1C;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,GAAG,GAAG,SAAS,CAiCjD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjE;AA0HD,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"framework-request-handler.d.ts","sourceRoot":"","sources":["../../src/server/framework-request-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,YAAY,EAAW,MAAM,IAAI,CAAC;AAMhD,QAAA,MAAM,gBAAgB,mBAAmB,CAAC;AAI1C;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,GAAG,GAAG,SAAS,CAiCjD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjE;AAuMD,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/server/framework-request-handler.js

@@ -1,3 +1,4 @@
+import { setResponseHeader, setResponseStatus } from "h3";
 import { getMissingDefaultPlugins } from "../deploy/route-discovery.js";
 const BOOTSTRAPPED = new WeakSet();
 const IN_BOOTSTRAP = new WeakSet();
@@ -103,6 +104,34 @@ function registerMiddleware(nitroApp, path, handler) {
             const result = await handler(event);
             return result === undefined ? next() : result;
         }
+        catch (err) {
+            // Log 500s to the server console so they're debuggable, and respond
+            // with JSON instead of the default HTML error page so clients can
+            // surface error messages. This only applies to routes mounted under
+            // the framework prefix (or middleware mounted at `/`, for which we
+            // still want visibility).
+            const reqPath = originalPathname ?? event.url?.pathname ?? "";
+            const e = err;
+            const status = typeof e?.statusCode === "number"
+                ? e.statusCode
+                : typeof e?.status === "number"
+                    ? e.status
+                    : 500;
+            console.error(`[agent-native] ${event.method ?? ""} ${reqPath} failed (${status}):`, e?.stack || e?.message || e);
+            try {
+                setResponseStatus(event, status);
+                setResponseHeader(event, "content-type", "application/json");
+            }
+            catch {
+                // Response already sent — best effort.
+            }
+            return {
+                error: e?.message || "Internal server error",
+                ...(process.env.NODE_ENV !== "production" && e?.stack
+                    ? { stack: e.stack }
+                    : {}),
+            };
+        }
         finally {
             // Restore the original pathname so downstream middleware sees the
             // full URL.
@@ -123,7 +152,10 @@ function registerMiddleware(nitroApp, path, handler) {
  *
  * Runs once per nitroApp on the first `getH3App()` call. Uses route-discovery
  * to find which default plugin stems are missing from `server/plugins/`, then
- * dynamically imports and mounts them.
+ * dynamically imports and mounts them. If a workspace core is present in the
+ * ancestor chain, plugin slots the workspace core exports are mounted from
+ * there instead of from @agent-native/core — this is the middle layer of the
+ * three-layer inheritance model (app local > workspace core > framework).
  */
 async function bootstrapDefaultPlugins(nitroApp) {
     IN_BOOTSTRAP.add(nitroApp);
@@ -137,19 +169,55 @@ async function bootstrapDefaultPlugins(nitroApp) {
         const terminalModule = await import("../terminal/terminal-plugin.js");
         const integrationsModule = await import("../integrations/plugin.js");
         const orgModule = await import("../org/plugin.js");
-        const impls = {
+        const onboardingModule = await import("../onboarding/plugin.js");
+        const frameworkImpls = {
             "agent-chat": serverModule.defaultAgentChatPlugin,
             auth: serverModule.defaultAuthPlugin,
             "core-routes": serverModule.defaultCoreRoutesPlugin,
             integrations: integrationsModule.defaultIntegrationsPlugin,
+            onboarding: onboardingModule.defaultOnboardingPlugin,
             org: orgModule.defaultOrgPlugin,
             resources: serverModule.defaultResourcesPlugin,
             terminal: terminalModule.defaultTerminalPlugin,
         };
+        // Workspace core layer: if the app is inside an enterprise monorepo with
+        // `agent-native.workspaceCore` configured, pull in any plugin slots the
+        // workspace core exports from its server entry. We dynamically import the
+        // workspace core package at runtime.
+        let workspaceImpls = {};
+        try {
+            const { getWorkspaceCoreExports } = await import("../deploy/workspace-core.js");
+            const ws = await getWorkspaceCoreExports(cwd);
+            if (ws && Object.keys(ws.plugins).length > 0) {
+                try {
+                    const wsServerModule = await import(
+                    /* @vite-ignore */ `${ws.packageName}/server`);
+                    for (const [slot, exportName] of Object.entries(ws.plugins)) {
+                        if (!exportName)
+                            continue;
+                        const impl = wsServerModule[exportName];
+                        if (typeof impl === "function") {
+                            workspaceImpls[slot] = impl;
+                        }
+                    }
+                    if (process.env.DEBUG) {
+                        console.log(`[agent-native] Workspace core ${ws.packageName} provides plugin slots: ${Object.keys(workspaceImpls).join(", ")}`);
+                    }
+                }
+                catch (e) {
+                    console.warn(`[agent-native] Failed to load workspace core ${ws.packageName}/server:`, e.message);
+                }
+            }
+        }
+        catch {
+            // Workspace core module isn't available (e.g. running on an edge
+            // runtime without fs). Silently fall through to framework defaults.
+        }
         if (process.env.DEBUG)
             console.log(`[agent-native] Auto-mounting ${missing.length} default plugin(s): ${missing.join(", ")}`);
         for (const stem of missing) {
-            const impl = impls[stem];
+            // Prefer workspace-core impl over framework default when both exist.
+            const impl = workspaceImpls[stem] ?? frameworkImpls[stem];
             if (typeof impl === "function") {
                 try {
                     await impl(nitroApp);

package/dist/server/framework-request-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"framework-request-handler.js","sourceRoot":"","sources":["../../src/server/framework-request-handler.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,YAAY,GAAG,IAAI,OAAO,EAAU,CAAC;AAC3C,MAAM,YAAY,GAAG,IAAI,OAAO,EAAU,CAAC;AAC3C,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAC1C,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AAW7D;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAa;IACpC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAEjE,8DAA8D;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAA0B,CAAC;IAC/D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,IAAI,GAAc;QACtB,GAAG,CAAC,IAA2B,EAAE,IAAmB;YAClD,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAiB,CAAC;YACzE,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;IAEF,QAAQ,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;IAE9B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,QAAQ,CAAC,qBAAqB,CAAC,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC,KAAK,CACvE,CAAC,GAAG,EAAE,EAAE;YACN,OAAO,CAAC,IAAI,CACV,sDAAsD,EACrD,GAAa,CAAC,OAAO,CACvB,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAa;IAChD,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACpD,qEAAqE;IACrE,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CACzB,QAAa,EACb,IAAY,EACZ,OAAqB;IAErB,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,EAAE,KAAc,EAAE,IAAe,EAAE,EAAE;QAC3D,IAAI,gBAAoC,CAAC;QACzC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC1C,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACxD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,CAAC;gBACH,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;gBAC5D,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,mEAAmE;YACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAChD,CAAC;gBAAS,CAAC;YACT,kEAAkE;YAClE,YAAY;YACZ,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,gBAAgB,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,EAAE,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,uBAAuB,CAAC,QAAa;IAClD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,+DAA+D;QAC/D,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACtE,MAAM,kBAAkB,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAEnD,MAAM,KAAK,GAGP;YACF,YAAY,EAAG,YAAoB,CAAC,sBAAsB;YAC1D,IAAI,EAAG,YAAoB,CAAC,iBAAiB;YAC7C,aAAa,EAAG,YAAoB,CAAC,uBAAuB;YAC5D,YAAY,EAAG,kBAA0B,CAAC,yBAAyB;YACnE,GAAG,EAAG,SAAiB,CAAC,gBAAgB;YACxC,SAAS,EAAG,YAAoB,CAAC,sBAAsB;YACvD,QAAQ,EAAG,cAAsB,CAAC,qBAAqB;SACxD,CAAC;QAEF,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;YACnB,OAAO,CAAC,GAAG,CACT,gCAAgC,OAAO,CAAC,MAAM,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1F,CAAC;QAEJ,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CACV,sDAAsD,IAAI,GAAG,EAC5D,CAAW,CAAC,OAAO,CACrB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"framework-request-handler.js","sourceRoot":"","sources":["../../src/server/framework-request-handler.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,YAAY,GAAG,IAAI,OAAO,EAAU,CAAC;AAC3C,MAAM,YAAY,GAAG,IAAI,OAAO,EAAU,CAAC;AAC3C,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAC1C,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AAW7D;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAa;IACpC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAEjE,8DAA8D;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAA0B,CAAC;IAC/D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,IAAI,GAAc;QACtB,GAAG,CAAC,IAA2B,EAAE,IAAmB;YAClD,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAiB,CAAC;YACzE,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;IAEF,QAAQ,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;IAE9B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,QAAQ,CAAC,qBAAqB,CAAC,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC,KAAK,CACvE,CAAC,GAAG,EAAE,EAAE;YACN,OAAO,CAAC,IAAI,CACV,sDAAsD,EACrD,GAAa,CAAC,OAAO,CACvB,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAa;IAChD,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACpD,qEAAqE;IACrE,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CACzB,QAAa,EACb,IAAY,EACZ,OAAqB;IAErB,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,EAAE,KAAc,EAAE,IAAe,EAAE,EAAE;QAC3D,IAAI,gBAAoC,CAAC;QACzC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC1C,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACxD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,sCAAsC;YACtC,IAAI,CAAC;gBACH,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;gBAC5D,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,mEAAmE;YACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,kEAAkE;YAClE,oEAAoE;YACpE,mEAAmE;YACnE,0BAA0B;YAC1B,MAAM,OAAO,GAAG,gBAAgB,IAAI,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC9D,MAAM,CAAC,GAAG,GAAU,CAAC;YACrB,MAAM,MAAM,GACV,OAAO,CAAC,EAAE,UAAU,KAAK,QAAQ;gBAC/B,CAAC,CAAC,CAAC,CAAC,UAAU;gBACd,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ;oBAC7B,CAAC,CAAC,CAAC,CAAC,MAAM;oBACV,CAAC,CAAC,GAAG,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,kBAAkB,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,IAAI,EACrE,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,OAAO,IAAI,CAAC,CAC5B,CAAC;YACF,IAAI,CAAC;gBACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACjC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,CAAC,EAAE,OAAO,IAAI,uBAAuB;gBAC5C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,EAAE,KAAK;oBACnD,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;oBACpB,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,kEAAkE;YAClE,YAAY;YACZ,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,gBAAgB,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,EAAE,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,uBAAuB,CAAC,QAAa;IAClD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,+DAA+D;QAC/D,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACtE,MAAM,kBAAkB,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnD,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAEjE,MAAM,cAAc,GAGhB;YACF,YAAY,EAAG,YAAoB,CAAC,sBAAsB;YAC1D,IAAI,EAAG,YAAoB,CAAC,iBAAiB;YAC7C,aAAa,EAAG,YAAoB,CAAC,uBAAuB;YAC5D,YAAY,EAAG,kBAA0B,CAAC,yBAAyB;YACnE,UAAU,EAAG,gBAAwB,CAAC,uBAAuB;YAC7D,GAAG,EAAG,SAAiB,CAAC,gBAAgB;YACxC,SAAS,EAAG,YAAoB,CAAC,sBAAsB;YACvD,QAAQ,EAAG,cAAsB,CAAC,qBAAqB;SACxD,CAAC;QAEF,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,qCAAqC;QACrC,IAAI,cAAc,GAGd,EAAE,CAAC;QACP,IAAI,CAAC;YACH,MAAM,EAAE,uBAAuB,EAAE,GAC/B,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAC9C,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC;oBACH,MAAM,cAAc,GAAG,MAAM,MAAM;oBACjC,kBAAkB,CAAC,GAAG,EAAE,CAAC,WAAW,SAAS,CAC9C,CAAC;oBACF,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC5D,IAAI,CAAC,UAAU;4BAAE,SAAS;wBAC1B,MAAM,IAAI,GAAI,cAAsB,CAAC,UAAU,CAAC,CAAC;wBACjD,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;4BAC/B,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;wBAC9B,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;wBACtB,OAAO,CAAC,GAAG,CACT,iCAAiC,EAAE,CAAC,WAAW,2BAA2B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnH,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CACV,gDAAgD,EAAE,CAAC,WAAW,UAAU,EACvE,CAAW,CAAC,OAAO,CACrB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,oEAAoE;QACtE,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;YACnB,OAAO,CAAC,GAAG,CACT,gCAAgC,OAAO,CAAC,MAAM,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1F,CAAC;QAEJ,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,qEAAqE;YACrE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CACV,sDAAsD,IAAI,GAAG,EAC5D,CAAW,CAAC,OAAO,CACrB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/server/google-auth-plugin.js

@@ -3,7 +3,7 @@ const GOOGLE_LOGIN_HTML = `<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="UTF-8">
-<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
 <title>Sign in</title>
 <style>
   *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }

package/dist/server/google-oauth.d.ts

@@ -66,7 +66,7 @@ export declare function oauthCallbackResponse(event: H3Event, email: string, opt
     sessionToken?: string;
     desktop?: boolean;
     addAccount?: boolean;
-}): Response | void | Promise<Response | void>;
+}): Response | string | void | Promise<Response | string | void>;
 /** HTML error page for OAuth failures. */
 export declare function oauthErrorPage(message: string): Response;
 //# sourceMappingURL=google-oauth.d.ts.map

package/dist/server/google-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-oauth.d.ts","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAwB,KAAK,OAAO,EAAE,MAAM,IAAI,CAAC;AAexD,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,qDAAqD;AACrD,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIhD;AAID,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAsBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,EACjB,UAAU,CAAC,EAAE,OAAO,EACpB,GAAG,CAAC,EAAE,MAAM,GACX,MAAM,CAgBR;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CA8BnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAY3B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,kBAAkB,CAAC,CAkB7B;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GACA,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyC5C;AAED,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAUxD"}
+{"version":3,"file":"google-oauth.d.ts","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAML,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAqBZ,6DAA6D;AAC7D,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAED,qDAAqD;AACrD,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIhD;AAID,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAsBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,EACjB,UAAU,CAAC,EAAE,OAAO,EACpB,GAAG,CAAC,EAAE,MAAM,GACX,MAAM,CAgBR;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CA8BnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,YAAY,EAAE,OAAO,CAAC;IACtB,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAY3B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,kBAAkB,CAAC,CAiC7B;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB,GACA,QAAQ,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,IAAI,CAAC,CA6C9D;AAED,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAUxD"}

package/dist/server/google-oauth.js

@@ -7,8 +7,9 @@
  * google-auth.ts handler.
  */
 import crypto from "node:crypto";
-import { getHeader, setCookie } from "h3";
-import { addSession, getSession } from "./auth.js";
+import { getHeader, setCookie, setResponseStatus, setResponseHeader, } from "h3";
+import { addSession, getSession, COOKIE_NAME, getSessionMaxAge, } from "./auth.js";
+import { writeDesktopSso } from "./desktop-sso.js";
 // ─── Platform Detection ─────────────────────────────────────────────────────
 /** Return an HTML response with the correct Content-Type.
  *  Uses a web-standard Response to ensure the header survives
@@ -116,11 +117,11 @@ export async function resolveOAuthOwner(event, stateOwner) {
     const existingSession = await getSession(event);
     const isDevSession = existingSession?.email === "local@localhost";
     const hasProductionSession = !!(existingSession?.email && !isDevSession);
-    const owner = isDevSession
-        ? "local@localhost"
-        : hasProductionSession
-            ? existingSession.email
-            : stateOwner || undefined;
+    // Never use "local@localhost" as a token owner — it creates shared-ownership
+    // bugs where multiple users can see the same tokens.
+    const owner = hasProductionSession
+        ? existingSession.email
+        : stateOwner || undefined;
     return { owner, isDevSession, hasProductionSession };
 }
 /**
@@ -134,17 +135,32 @@ export async function resolveOAuthOwner(event, stateOwner) {
 export async function createOAuthSession(event, email, opts) {
     const mobile = isMobile(event);
     const needsDeepLink = opts.desktop || mobile;
+    const maxAge = getSessionMaxAge();
     let sessionToken;
     if (!opts.hasProductionSession || needsDeepLink) {
         sessionToken = crypto.randomBytes(32).toString("hex");
         await addSession(sessionToken, email);
-        setCookie(event, "an_session", sessionToken, {
+        setCookie(event, COOKIE_NAME, sessionToken, {
             httpOnly: true,
             secure: process.env.NODE_ENV === "production",
             sameSite: "lax",
             path: "/",
-            maxAge: 60 * 60 * 24 * 30, // 30 days
+            maxAge,
         });
+        // Desktop SSO: record this session in the home-dir broker file so
+        // sibling templates (each with its own database) can resolve the
+        // same token without a DB row of their own. Only the PRIMARY
+        // sign-in writes the broker — if a production session already
+        // exists, this is an add-account flow (connecting a secondary
+        // Google account for scraping) and must never switch the active
+        // user across sibling templates.
+        if (opts.desktop && !opts.hasProductionSession) {
+            await writeDesktopSso({
+                email,
+                token: sessionToken,
+                expiresAt: Date.now() + maxAge * 1000,
+            });
+        }
     }
     return { sessionToken };
 }
@@ -162,7 +178,7 @@ export function oauthCallbackResponse(event, email, opts) {
         const deepLink = opts.sessionToken
             ? `agentnative://oauth-complete?token=${opts.sessionToken}`
             : `agentnative://oauth-complete`;
-        return htmlResponse(`<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Connected</title></head><body style="background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><p>Connected! Returning to app…</p><script>window.location.href=${JSON.stringify(deepLink)};setTimeout(function(){window.location.href="/"},1500)</script></body></html>`);
+        return htmlResponse(`<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>Connected</title></head><body style="background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0"><p>Connected! Returning to app…</p><script>window.location.href=${JSON.stringify(deepLink)};setTimeout(function(){window.location.href="/"},1500)</script></body></html>`);
     }
     // Desktop add-account: close-tab page (must come before general desktop check
     // to ensure no deep link fires and the existing session is never switched).
@@ -185,8 +201,12 @@ export function oauthCallbackResponse(event, email, opts) {
         document.body.appendChild(p);
       </script></body></html>`);
     }
-    // Web: redirect to app home
-    return new Response(null, { status: 302, headers: { Location: "/" } });
+    // Web: redirect to app home.
+    // Use h3's native redirect (not web Response) to preserve Set-Cookie headers
+    // from createOAuthSession — a raw `new Response()` drops them.
+    setResponseStatus(event, 302);
+    setResponseHeader(event, "Location", "/");
+    return "";
 }
 /** HTML error page for OAuth failures. */
 export function oauthErrorPage(message) {
@@ -202,7 +222,8 @@ function desktopSuccessPage(_event, email, sessionToken) {
     const msg = email ? `Connected ${email}!` : "Connected!";
     if (sessionToken) {
         const deepLink = `agentnative://oauth-complete?token=${sessionToken}`;
-        return htmlResponse(`<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connected</title></head><body style="background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;gap:12px"><p style="font-size:16px">${msg}</p><a href=${JSON.stringify(deepLink)} style="display:inline-block;margin-top:8px;padding:10px 24px;background:#fff;color:#000;border-radius:8px;text-decoration:none;font-size:14px;font-weight:500">Open Agent Native</a><p style="font-size:12px;color:#666;margin-top:4px">If the app didn\u2019t open automatically, click the button above.</p><script>window.location.href=${JSON.stringify(deepLink)}</script></body></html>`);
+        const deepLinkJson = JSON.stringify(deepLink);
+        return htmlResponse(`<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connected</title><style>@keyframes spin{to{transform:rotate(360deg)}}@keyframes fadeIn{from{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}.spinner{width:28px;height:28px;border:2px solid #333;border-top-color:#fff;border-radius:50%;animation:spin .8s linear infinite}.fallback{display:none;flex-direction:column;align-items:center;gap:8px;animation:fadeIn .2s ease-out}.fallback.show{display:flex}</style></head><body style="background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;gap:16px"><p style="font-size:16px;margin:0">${msg}</p><div id="loading" class="spinner"></div><div id="fallback" class="fallback"><a href=${deepLinkJson} style="display:inline-block;padding:10px 24px;background:#fff;color:#000;border-radius:8px;text-decoration:none;font-size:14px;font-weight:500">Open Agent Native</a><p style="font-size:12px;color:#666;margin:0">If the app didn\u2019t open automatically, click the button above.</p></div><script>window.location.href=${deepLinkJson};setTimeout(function(){document.getElementById("loading").style.display="none";document.getElementById("fallback").classList.add("show")},3000)</script></body></html>`);
     }
     return htmlResponse(`<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connected</title></head><body style="background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;gap:8px"><p style="font-size:16px">${msg}</p><p style="font-size:13px;color:#888">You can close this tab and return to Agent Native.</p></body></html>`);
 }