@agent-native/core 0.68.1 → 0.68.3

package/corpus/core/src/client/index.ts

@@ -707,6 +707,8 @@ export {
   openAgentSidebar,
   submitToAgent,
   type CommandMenuProps,
+  type CommandMenuDoc,
+  type CommandDocsGroupProps,
   type CommandGroupProps,
   type CommandItemProps,
   type CommandShortcutProps,

package/corpus/core/src/extensions/content-patch.ts

@@ -116,13 +116,23 @@ export async function applyExtensionContentUpdate(
 export async function formatExtensionHtml(content: string): Promise<string> {
   try {
     const prettier = await import("prettier");
-    return await prettier.format(content, {
+    const formatted = await prettier.format(content, {
       parser: "html",
       htmlWhitespaceSensitivity: "ignore",
     });
+    return typeof formatted === "string" ? formatted : content;
   } catch (err: any) {
+    const message = String(err?.message ?? err);
+    if (
+      message.includes("Cannot find package 'prettier'") ||
+      message.includes('Cannot find package "prettier"') ||
+      message.includes("Cannot find module 'prettier'") ||
+      message.includes('Cannot find module "prettier"')
+    ) {
+      return content;
+    }
     throw new Error(
-      `Unable to format extension HTML with Prettier: ${err?.message ?? err}`,
+      `Unable to format extension HTML with Prettier: ${message}`,
     );
   }
 }

package/corpus/core/src/oauth-tokens/google-refresh.ts

@@ -12,6 +12,7 @@
  */
 
 import { listOAuthAccounts, saveOAuthTokens } from "./store.js";
+import { resolveGoogleProviderCredentialCandidates } from "../server/google-oauth-credentials.js";
 
 const GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
 
@@ -31,29 +32,43 @@ interface RefreshResponse {
 }
 
 async function refreshOne(refreshToken: string): Promise<RefreshResponse> {
-  const clientId = process.env.GOOGLE_CLIENT_ID;
-  const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
-  if (!clientId || !clientSecret) {
+  const credentialCandidates = resolveGoogleProviderCredentialCandidates();
+  if (!credentialCandidates.length) {
     throw new Error("GOOGLE_CLIENT_ID/SECRET not set");
   }
-  const res = await fetch(GOOGLE_TOKEN_URL, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      refresh_token: refreshToken,
-      client_id: clientId,
-      client_secret: clientSecret,
-      grant_type: "refresh_token",
-    }),
-  });
-  const data = (await res.json()) as Record<string, unknown>;
-  if (!res.ok) {
+
+  let data: Record<string, unknown> | null = null;
+  let lastStatusText = "refresh failed";
+  for (const credentials of credentialCandidates) {
+    const res = await fetch(GOOGLE_TOKEN_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        refresh_token: refreshToken,
+        client_id: credentials.clientId,
+        client_secret: credentials.clientSecret,
+        grant_type: "refresh_token",
+      }),
+    });
+    lastStatusText = res.statusText;
+    data = (await res.json()) as Record<string, unknown>;
+    if (res.ok) return data as unknown as RefreshResponse;
+    if (
+      data.error !== "invalid_grant" &&
+      data.error !== "unauthorized_client" &&
+      data.error !== "invalid_client"
+    ) {
+      break;
+    }
+  }
+
+  if (data) {
     const err = (data.error_description ||
       data.error ||
-      res.statusText) as string;
+      lastStatusText) as string;
     throw new Error(err);
   }
-  return data as unknown as RefreshResponse;
+  throw new Error(lastStatusText);
 }
 
 /**

package/corpus/core/src/provider-api/index.ts

@@ -19,6 +19,7 @@ import {
   saveOAuthTokens,
 } from "../oauth-tokens/index.js";
 import { getCredentialContext } from "../server/request-context.js";
+import { resolveGoogleProviderCredentialCandidates } from "../server/google-oauth-credentials.js";
 import { resolveWorkspaceConnectionCredentialForApp } from "../workspace-connections/credentials.js";
 import type { WorkspaceConnectionTemplateUse } from "../connections/catalog.js";
 import type {
@@ -3432,36 +3433,55 @@ async function refreshGoogleOAuthToken(
   },
   refreshToken: string,
 ): Promise<string> {
-  const clientId = process.env.GOOGLE_CLIENT_ID;
-  const clientSecret = process.env.GOOGLE_CLIENT_SECRET;
-  if (!clientId || !clientSecret) {
+  const credentialCandidates = resolveGoogleProviderCredentialCandidates();
+  if (!credentialCandidates.length) {
     throw new Error(
       "GOOGLE_CLIENT_ID/SECRET not set for Google OAuth refresh.",
     );
   }
-  const res = await fetch("https://oauth2.googleapis.com/token", {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      refresh_token: refreshToken,
-      client_id: clientId,
-      client_secret: clientSecret,
-      grant_type: "refresh_token",
-    }),
-  });
-  const data = (await res.json()) as {
+
+  let data: {
     access_token?: string;
     expires_in?: number;
     token_type?: string;
     scope?: string;
     error?: string;
     error_description?: string;
-  };
-  if (!res.ok || !data.access_token) {
+  } | null = null;
+  let lastStatusText = "refresh failed";
+  for (const credentials of credentialCandidates) {
+    const res = await fetch("https://oauth2.googleapis.com/token", {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        refresh_token: refreshToken,
+        client_id: credentials.clientId,
+        client_secret: credentials.clientSecret,
+        grant_type: "refresh_token",
+      }),
+    });
+    lastStatusText = res.statusText;
+    data = (await res.json()) as {
+      access_token?: string;
+      expires_in?: number;
+      token_type?: string;
+      scope?: string;
+      error?: string;
+      error_description?: string;
+    };
+    if (res.ok && data.access_token) break;
     if (data.error && PERMANENT_GOOGLE_OAUTH_REFRESH_ERRORS.has(data.error)) {
+      continue;
+    }
+    const detail = data.error_description ?? data.error ?? lastStatusText;
+    throw new Error(`Google OAuth refresh failed: ${detail}`);
+  }
+
+  if (!data?.access_token) {
+    if (data?.error && PERMANENT_GOOGLE_OAUTH_REFRESH_ERRORS.has(data.error)) {
       await deleteOAuthTokens(options.oauthProvider, options.accountId);
     }
-    const detail = data.error_description ?? data.error ?? res.statusText;
+    const detail = data?.error_description ?? data?.error ?? lastStatusText;
     throw new Error(`Google OAuth refresh failed: ${detail}`);
   }
   const merged: OAuthTokens = {

package/corpus/core/src/server/auth.ts

@@ -72,6 +72,7 @@ import {
 } from "../db/client.js";
 import { getBetterAuth, getBetterAuthSync } from "./better-auth-instance.js";
 import type { BetterAuthConfig } from "./better-auth-instance.js";
+import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
 import {
   getAllowedCorsOrigin,
   readCorsAllowedOrigins,
@@ -2462,11 +2463,8 @@ async function mountBetterAuthRoutes(
   // Auto-add Google OAuth routes when credentials are configured. Templates
   // that need broader product scopes (mail/calendar) opt out and provide
   // their own Nitro routes at these paths.
-  if (
-    process.env.GOOGLE_CLIENT_ID &&
-    process.env.GOOGLE_CLIENT_SECRET &&
-    options.mountGoogleOAuthRoutes !== false
-  ) {
+  const googleSignInCredentials = resolveGoogleSignInCredentials();
+  if (googleSignInCredentials && options.mountGoogleOAuthRoutes !== false) {
     setGenericGoogleOAuthRoutesEnabled(app, true);
     for (const gp of [
       "/_agent-native/google/callback",
@@ -2535,7 +2533,7 @@ async function mountBetterAuthRoutes(
             process.env.VITE_AGENT_NATIVE_WORKSPACE === "1",
         });
         const params = new URLSearchParams({
-          client_id: process.env.GOOGLE_CLIENT_ID!,
+          client_id: googleSignInCredentials.clientId,
           redirect_uri: redirectUri,
           response_type: "code",
           scope: googleScopes,
@@ -2647,8 +2645,8 @@ async function mountBetterAuthRoutes(
             },
             body: new URLSearchParams({
               code,
-              client_id: process.env.GOOGLE_CLIENT_ID!,
-              client_secret: process.env.GOOGLE_CLIENT_SECRET!,
+              client_id: googleSignInCredentials.clientId,
+              client_secret: googleSignInCredentials.clientSecret,
               redirect_uri: redirectUri,
               grant_type: "authorization_code",
             }),

package/corpus/core/src/server/better-auth-instance.ts

@@ -26,6 +26,7 @@ import { flushTracking, identify, track } from "../tracking/index.js";
 import { TEMPLATES } from "../cli/templates-meta.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
+import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
 import {
   getDialect,
   getDatabaseUrl,
@@ -802,7 +803,17 @@ async function createBetterAuthInstance(
     ...config?.socialProviders,
   };
 
-  if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
+  const extraScopes = config?.googleScopes ?? [];
+  const googleCredentials =
+    extraScopes.length > 0
+      ? process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET
+        ? {
+            clientId: process.env.GOOGLE_CLIENT_ID,
+            clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+          }
+        : null
+      : resolveGoogleSignInCredentials();
+  if (googleCredentials) {
     // When the template requests broader scopes (Gmail, Calendar, etc.)
     // ask for them on the primary sign-in flow so a separate "Connect
     // Google" round-trip isn't needed. `accessType: "offline"` plus
@@ -810,12 +821,11 @@ async function createBetterAuthInstance(
     // Google only re-issues a refresh token on consent, so re-signing in
     // (e.g. after switching machines) would otherwise leave us with an
     // access token that can't be refreshed.
-    const extraScopes = config?.googleScopes ?? [];
     const baseScopes = ["openid", "email", "profile"];
     const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));
     socialProviders.google = {
-      clientId: process.env.GOOGLE_CLIENT_ID,
-      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+      clientId: googleCredentials.clientId,
+      clientSecret: googleCredentials.clientSecret,
       ...(extraScopes.length > 0
         ? {
             scope: mergedScopes,
@@ -843,6 +853,9 @@ async function createBetterAuthInstance(
   const requireEmailVerification =
     isEmailConfigured() && !shouldSkipEmailVerification();
 
+  const shouldMirrorGoogleAccountTokens =
+    (config?.googleScopes?.length ?? 0) > 0;
+
   const auth = betterAuth({
     basePath,
     baseURL: appUrl,
@@ -969,6 +982,7 @@ async function createBetterAuthInstance(
         // mirroring work; failures never block sign-in.
         create: {
           after: async (account: any) => {
+            if (!shouldMirrorGoogleAccountTokens) return;
             await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {
               console.error(
                 "[auth] failed to mirror Google account tokens to oauth_tokens (create)",
@@ -979,6 +993,7 @@ async function createBetterAuthInstance(
         },
         update: {
           after: async (account: any) => {
+            if (!shouldMirrorGoogleAccountTokens) return;
             await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {
               console.error(
                 "[auth] failed to mirror Google account tokens to oauth_tokens (update)",

package/corpus/core/src/server/core-routes-plugin.ts

@@ -158,6 +158,24 @@ import {
 export const FRAMEWORK_ROUTE_PREFIX = "/_agent-native";
 export const FRAMEWORK_EVENTS_ROUTE = `${FRAMEWORK_ROUTE_PREFIX}/events`;
 export const LEGACY_FRAMEWORK_EVENTS_ROUTE = `${FRAMEWORK_ROUTE_PREFIX}/poll-events`;
+const DEFAULT_BUILDER_WAITLIST_FORM_ID = "DYTHuM0jlV";
+const DEFAULT_BUILDER_WAITLIST_FORMS_ORIGIN = "https://forms.agent-native.com";
+const BUILDER_WAITLIST_FORM_SOURCE = "connect_builder_card";
+const BUILDER_WAITLIST_FORM_TIMEOUT_MS = 8000;
+const BUILDER_WAITLIST_TEXT_LIMIT = 4000;
+
+interface BuilderWaitlistFormTarget {
+  formId: string;
+  formsOrigin: string;
+}
+
+interface BuilderWaitlistBody {
+  prompt?: unknown;
+  orgName?: unknown;
+  appUrl?: unknown;
+  pageUrl?: unknown;
+  source?: unknown;
+}
 
 export function resolveFrameworkSseRoutes(sseRoute?: string): string[] {
   return Array.from(
@@ -171,6 +189,112 @@ export function resolveFrameworkSseRoutes(sseRoute?: string): string[] {
 
 registerBuiltinEngines();
 
+function cleanBuilderWaitlistText(
+  value: unknown,
+  maxLength = BUILDER_WAITLIST_TEXT_LIMIT,
+): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  if (!trimmed) return undefined;
+  return trimmed.slice(0, maxLength);
+}
+
+function normalizeHttpOrigin(value: string): string | null {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+
+function isAgentNativeHostedRequest(event: H3Event): boolean {
+  const hostname = getRequestURL(event).hostname.toLowerCase();
+  return (
+    hostname === "agent-native.com" || hostname.endsWith(".agent-native.com")
+  );
+}
+
+export function resolveBuilderWaitlistFormTargetForRequest(
+  event: H3Event,
+): BuilderWaitlistFormTarget | null {
+  if (process.env.AGENT_NATIVE_DISABLE_BUILDER_WAITLIST_FORM === "1") {
+    return null;
+  }
+
+  const envFormId = process.env.AGENT_NATIVE_BUILDER_WAITLIST_FORM_ID?.trim();
+  const envFormsOrigin =
+    process.env.AGENT_NATIVE_BUILDER_WAITLIST_FORMS_ORIGIN?.trim();
+  const hasExplicitTarget = Boolean(envFormId || envFormsOrigin);
+  if (!hasExplicitTarget && !isAgentNativeHostedRequest(event)) {
+    return null;
+  }
+
+  const formId = envFormId || DEFAULT_BUILDER_WAITLIST_FORM_ID;
+  const formsOrigin = normalizeHttpOrigin(
+    envFormsOrigin || DEFAULT_BUILDER_WAITLIST_FORMS_ORIGIN,
+  );
+  if (!formsOrigin) {
+    throw new Error("Invalid Builder waitlist Forms origin");
+  }
+
+  return { formId, formsOrigin };
+}
+
+async function submitBuilderWaitlistForm(
+  event: H3Event,
+  sessionEmail: string,
+  body: BuilderWaitlistBody,
+): Promise<{ submitted: boolean; formId?: string }> {
+  const target = resolveBuilderWaitlistFormTargetForRequest(event);
+  if (!target) return { submitted: false };
+
+  const appUrl =
+    cleanBuilderWaitlistText(body.pageUrl ?? body.appUrl, 2000) ??
+    cleanBuilderWaitlistText(getHeader(event, "referer"), 2000) ??
+    getOrigin(event);
+  const source =
+    cleanBuilderWaitlistText(body.source, 100) ?? BUILDER_WAITLIST_FORM_SOURCE;
+
+  const controller = new AbortController();
+  const timeout = setTimeout(
+    () => controller.abort(),
+    BUILDER_WAITLIST_FORM_TIMEOUT_MS,
+  );
+
+  try {
+    const res = await fetch(
+      `${target.formsOrigin}/api/submit/${encodeURIComponent(target.formId)}`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          data: {
+            email: sessionEmail,
+            orgName: cleanBuilderWaitlistText(body.orgName, 500),
+            appUrl,
+            prompt: cleanBuilderWaitlistText(body.prompt),
+            source,
+          },
+          _hp: "",
+          _meta: {
+            submitterEmail: sessionEmail,
+            pageUrl: appUrl,
+          },
+        }),
+        signal: controller.signal,
+      },
+    );
+    if (!res.ok) {
+      throw new Error(`Forms waitlist submission failed (${res.status})`);
+    }
+    return { submitted: true, formId: target.formId };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
 function parseBuilderCallbackBoolean(
   value: string | null | undefined,
 ): boolean | null {
@@ -1405,10 +1529,10 @@ export function createCoreRoutesPlugin(
       );
 
       // Branch-creation waitlist signup. Used by ConnectBuilderCard when the
-      // current request has no Builder branch project configured — instead of
-      // the raw 403 from /builder/run, the card surfaces a waitlist CTA that
-      // POSTs here. Recorded as a tracking event so PostHog/Mixpanel/etc.
-      // capture demand without us standing up new storage.
+      // current request has no Builder branch project configured. Hosted
+      // Agent Native deployments submit into the Builder-org Forms waitlist;
+      // local/self-hosted deployments keep the analytics signal without
+      // sending private workspace data to Agent Native.
       getH3App(nitroApp).use(
         `${P}/builder/branch-waitlist`,
         defineEventHandler(async (event: H3Event) => {
@@ -1421,15 +1545,43 @@ export function createCoreRoutesPlugin(
             setResponseStatus(event, 401);
             return { error: "Authentication required" };
           }
+          const body = ((await readBody(event).catch(() => ({}))) ??
+            {}) as BuilderWaitlistBody;
+          let formSubmission: { submitted: boolean; formId?: string };
+          try {
+            formSubmission = await submitBuilderWaitlistForm(
+              event,
+              session.email,
+              body,
+            );
+          } catch (err) {
+            await trackBuilderLifecycle(
+              event,
+              "builder branch waitlist form failed",
+              session.email,
+              {
+                reason:
+                  err instanceof Error ? err.message : "unknown_waitlist_error",
+                stage: "waitlist",
+              },
+            );
+            setResponseStatus(event, 502);
+            return {
+              error:
+                "Couldn't join the waitlist. Please try again in a moment.",
+            };
+          }
           await trackBuilderLifecycle(
             event,
             "builder branch waitlist joined",
             session.email,
             {
+              formId: formSubmission.formId ?? null,
+              formSubmitted: formSubmission.submitted,
               stage: "waitlist",
             },
           );
-          return { ok: true };
+          return { ok: true, formSubmitted: formSubmission.submitted };
         }),
       );
 

package/corpus/core/src/server/google-oauth-credentials.ts

@@ -0,0 +1,51 @@
+export interface GoogleOAuthCredentials {
+  clientId: string;
+  clientSecret: string;
+}
+
+function readCredentialPair(
+  clientIdKey: string,
+  clientSecretKey: string,
+): GoogleOAuthCredentials | null {
+  const clientId = process.env[clientIdKey];
+  const clientSecret = process.env[clientSecretKey];
+  if (!clientId || !clientSecret) return null;
+  return { clientId, clientSecret };
+}
+
+/**
+ * Credentials for identity-only Google sign-in. Deploys that also use Google
+ * product APIs can set these separately from GOOGLE_CLIENT_ID/SECRET, which
+ * remain the backwards-compatible provider OAuth credentials.
+ */
+export function resolveGoogleSignInCredentials(): GoogleOAuthCredentials | null {
+  return (
+    readCredentialPair(
+      "GOOGLE_SIGN_IN_CLIENT_ID",
+      "GOOGLE_SIGN_IN_CLIENT_SECRET",
+    ) ?? readCredentialPair("GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET")
+  );
+}
+
+export function hasGoogleSignInCredentials(): boolean {
+  return resolveGoogleSignInCredentials() !== null;
+}
+
+export function resolveGoogleProviderCredentials(): GoogleOAuthCredentials | null {
+  return readCredentialPair("GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET");
+}
+
+export function resolveGoogleLegacyProviderCredentials(): GoogleOAuthCredentials | null {
+  return readCredentialPair(
+    "GOOGLE_LEGACY_CLIENT_ID",
+    "GOOGLE_LEGACY_CLIENT_SECRET",
+  );
+}
+
+export function resolveGoogleProviderCredentialCandidates(): GoogleOAuthCredentials[] {
+  const primary = resolveGoogleProviderCredentials();
+  const legacy = resolveGoogleLegacyProviderCredentials();
+  if (!primary) return legacy ? [legacy] : [];
+  if (!legacy || legacy.clientId === primary.clientId) return [primary];
+  return [primary, legacy];
+}

package/corpus/core/src/server/index.ts

@@ -264,6 +264,14 @@ export {
   type SpawnTaskOptions,
 } from "./agent-teams.js";
 export { isOAuthConnected, getOAuthAccounts } from "./oauth-helpers.js";
+export {
+  hasGoogleSignInCredentials,
+  resolveGoogleLegacyProviderCredentials,
+  resolveGoogleProviderCredentialCandidates,
+  resolveGoogleProviderCredentials,
+  resolveGoogleSignInCredentials,
+  type GoogleOAuthCredentials,
+} from "./google-oauth-credentials.js";
 export { wrapWithAnalytics } from "./analytics.js";
 export {
   getH3App,

package/corpus/core/src/server/onboarding-html.ts

@@ -28,9 +28,10 @@ import {
   withAgentNativeSocialImageCacheBuster,
 } from "../shared/social-meta.js";
 import { normalizeAppBasePath } from "./app-base-path.js";
+import { hasGoogleSignInCredentials } from "./google-oauth-credentials.js";
 
 function hasGoogleOAuth(): boolean {
-  return !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
+  return hasGoogleSignInCredentials();
 }
 
 function getConnectionLabel(): string {

package/corpus/core/src/server/social-og-image.ts

@@ -330,7 +330,12 @@ export function renderAgentNativeOgImageSvg(
 export async function renderAgentNativeOgImagePng(
   input: AgentNativeOgImageInput = {},
 ): Promise<Uint8Array> {
-  const { Resvg } = await import(/* @vite-ignore */ "@resvg/resvg-js");
+  const overridePackage =
+    typeof process !== "undefined"
+      ? process.env.AGENT_NATIVE_RESVG_PACKAGE
+      : undefined;
+  const resvgPackage = overridePackage || "@resvg/resvg-js";
+  const { Resvg } = await import(/* @vite-ignore */ resvgPackage);
   // Feed resvg the embedded Liberation Sans font explicitly. System fonts can't
   // be relied on: Linux serverless runtimes (Netlify/Lambda) ship neither Arial
   // nor Inter, so without a bundled font every `<text>` rendered blank.