@agent-native/core 0.7.13 → 0.7.15

package/dist/server/auth.js

@@ -9,10 +9,40 @@ async function getFs() {
     }
     return _fs;
 }
-import { defineEventHandler, getMethod, getQuery, setResponseHeader, setResponseStatus, getCookie, setCookie, deleteCookie, } from "h3";
-// In h3 v2, `event.req` IS the web Request — no conversion needed.
+import { defineEventHandler, getMethod, getQuery, getRequestIP, sendRedirect, setResponseHeader, setResponseStatus, getCookie, setCookie, deleteCookie, } from "h3";
+// In h3 v2, `event.req` IS the web Request — but in Nitro's dev server (srvx
+// runtime), event.url and event.req share the same underlying URL object.
+// When registerMiddleware strips the mount prefix from event.url.pathname, it
+// also mutates event.req.url (NodeRequestURL setter updates nodeReq.url).
+// Better Auth's router uses new URL(request.url).pathname to extract the
+// sub-route, so it must receive the original full URL — not the stripped one.
+// registerMiddleware saves the original pathname in event.context so we can
+// reconstruct a fresh Request with the correct URL here.
 function toWebRequest(event) {
-    return event.req;
+    const req = event.req;
+    const ctx = event.context;
+    if (ctx?._mountedPathname && ctx._mountPrefix) {
+        try {
+            const url = new URL(req.url);
+            const mountedPathname = stripAppBasePath(ctx._mountedPathname);
+            if (url.pathname !== mountedPathname) {
+                url.pathname = mountedPathname;
+                const method = req.method.toUpperCase();
+                const hasBody = method !== "GET" && method !== "HEAD";
+                return new Request(url.href, {
+                    method: req.method,
+                    headers: req.headers,
+                    // Body may already be partially consumed; pass through as-is.
+                    // GET/HEAD cannot have a body — omit to avoid spec errors.
+                    ...(hasBody ? { body: req.body, duplex: "half" } : {}),
+                });
+            }
+        }
+        catch {
+            // URL reconstruction failed — fall through and use original req.
+        }
+    }
+    return req;
 }
 import { getDbExec, isPostgres, intType, isLocalDatabase, retryOnDdlRace, } from "../db/client.js";
 import { getBetterAuth, getBetterAuthSync } from "./better-auth-instance.js";
@@ -20,7 +50,7 @@ import { getOnboardingHtml, getResetPasswordHtml } from "./onboarding-html.js";
 import { migrateLocalUserData } from "./local-migration.js";
 import { readBody } from "../server/h3-helpers.js";
 import { readDesktopSso, writeDesktopSso, clearDesktopSso, } from "./desktop-sso.js";
-import { isElectron as isElectronRequest, getOrigin, encodeOAuthState, decodeOAuthState, createOAuthSession, oauthCallbackResponse, oauthErrorPage, } from "./google-oauth.js";
+import { isElectron as isElectronRequest, getAppBasePath, getAppUrl, encodeOAuthState, decodeOAuthState, createOAuthSession, oauthCallbackResponse, oauthErrorPage, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, } from "./google-oauth.js";
 /**
  * Get the configured session max age. Desktop SSO broker writes from
  * OAuth flows read this so expiration stays consistent with the cookie.
@@ -95,10 +125,106 @@ async function isLocalModeEnabled() {
  * Check if we're in a development/test environment.
  * Used for cookie security settings, not for auth bypass.
  */
-function isDevEnvironment() {
+export function isDevEnvironment() {
     const env = process.env.NODE_ENV;
     return env === "development" || env === "test";
 }
+/**
+ * Validate a `?return=` URL for the /_agent-native/sign-in entrypoint.
+ *
+ * Parses the candidate against a sentinel base origin; any input that
+ * resolves to a different origin (network-path references, absolute URLs,
+ * `data:` / `javascript:` schemes, backslash-bypass tricks WHATWG normalises
+ * to `//`) gets rejected and falls back to "/". Control characters are
+ * stripped up front to defend against header-injection. Returns the
+ * normalised path the parser produced — never the raw input.
+ *
+ * Exported for unit tests.
+ */
+export function safeReturnPath(raw) {
+    if (!raw)
+        return "/";
+    if (/[\x00-\x1f]/.test(raw))
+        return "/";
+    try {
+        const parsed = new URL(raw, "http://safe-base.invalid");
+        if (parsed.origin !== "http://safe-base.invalid")
+            return "/";
+        return parsed.pathname + parsed.search + parsed.hash;
+    }
+    catch {
+        return "/";
+    }
+}
+/**
+ * Read the desktop-SSO broker file, but only if the request is plausibly
+ * from the Electron desktop app *and* coming from the local machine.
+ *
+ * The broker file lives in the user's home directory and trusts the local
+ * trust boundary — a non-loopback request that pretends to be Electron
+ * via User-Agent must NEVER be allowed to read it. We additionally refuse
+ * any read in production builds: the desktop app launches with
+ * `NODE_ENV=development` (or unset), and any web-hosted production deploy
+ * has no business consulting a per-user file on the server's homedir
+ * even if one exists.
+ *
+ * Returns null when the safety checks fail or the file isn't present.
+ */
+async function readDesktopSsoSafely(event) {
+    if (process.env.NODE_ENV === "production")
+        return null;
+    if (!isElectronRequest(event))
+        return null;
+    // Loopback-only: 127.0.0.1, ::1, and the IPv4-mapped form.
+    let ip;
+    try {
+        ip = getRequestIP(event) ?? undefined;
+    }
+    catch {
+        ip = undefined;
+    }
+    // Strip an optional zone id (e.g. "fe80::1%en0") before comparing.
+    const normalised = (ip ?? "").split("%")[0];
+    const isLoopback = normalised === "127.0.0.1" ||
+        normalised === "::1" ||
+        normalised === "::ffff:127.0.0.1" ||
+        normalised.startsWith("127.");
+    if (!isLoopback)
+        return null;
+    return await readDesktopSso();
+}
+/**
+ * Extract the framework session token from a Better Auth response's
+ * Set-Cookie headers, if any. Used by the password-reset path to skip
+ * the freshly-minted session when revoking sibling sessions for the
+ * user. Returns undefined if no session cookie was minted (the common
+ * case — Better Auth's reset doesn't auto-sign-in by default).
+ */
+function extractSessionTokenFromSetCookies(response) {
+    try {
+        // Headers may have multiple Set-Cookie entries; iterate via getSetCookie
+        // when available (Node 20+ / undici), else fall back to comma split.
+        const headers = response.headers;
+        const setCookies = typeof headers.getSetCookie === "function"
+            ? headers.getSetCookie()
+            : (headers.get("set-cookie") ?? "")
+                .split(/,(?=[^;]+=)/)
+                .map((s) => s.trim())
+                .filter(Boolean);
+        for (const sc of setCookies) {
+            // Better Auth's session cookie name is configurable but defaults to
+            // `<prefix>.session_token`. Match either the Better Auth default or
+            // our COOKIE_NAME (`an_session`) on the same line.
+            const match = sc.match(/(?:^|\s|;)(an_session|[\w.-]*session_token)=([^;]+)/i);
+            if (match)
+                return match[2];
+        }
+    }
+    catch {
+        // Best-effort; treat as no token.
+    }
+    return undefined;
+}
 // ---------------------------------------------------------------------------
 // ACCESS_TOKEN resolution
 // ---------------------------------------------------------------------------
@@ -233,6 +359,83 @@ export async function getSessionEmail(token) {
 let customGetSession = null;
 let authDisabledMode = false;
 let _authGuardConfig = null;
+// Desktop OAuth exchange store — holds session tokens keyed by a unique flow
+// ID so native apps (Tauri, Electron) that open OAuth in the system browser
+// can retrieve the token after the callback completes on the server.
+//
+// Primary: in-memory Map (fast, works for single-instance dev/preview builds).
+// Fallback: sessions table with a "dex:" prefixed key for cross-instance
+// durability (Cloudflare Workers, multi-region deployments). The value stored
+// in the `email` column is "{realToken}::{userEmail}" so both can be recovered
+// from a single DB lookup.
+const _desktopExchanges = new Map();
+// 5-minute TTL for exchange entries (short — single-use tokens).
+const DESKTOP_EXCHANGE_TTL_MS = 5 * 60 * 1000;
+export function setDesktopExchange(flowId, token, email) {
+    _desktopExchanges.set(flowId, {
+        token,
+        email,
+        expiresAt: Date.now() + DESKTOP_EXCHANGE_TTL_MS,
+    });
+    // Persist to DB so the token survives cross-instance routing (e.g. when
+    // templates call this helper directly instead of going through the OAuth
+    // callback path).
+    void persistDesktopExchangeToDB(flowId, token, email);
+}
+/**
+ * Persist a desktop exchange entry to the sessions table so it survives
+ * cross-instance routing (e.g. Cloudflare Workers). Stored under a synthetic
+ * token key "dex:{flowId}"; the `email` column packs both the real session
+ * token and the user email so they can be recovered in one query.
+ * Non-fatal — if the DB isn't ready yet the in-memory Map still works for
+ * same-instance requests.
+ */
+async function persistDesktopExchangeToDB(flowId, token, email) {
+    try {
+        await addSession(`dex:${flowId}`, `${token}::${email}`);
+    }
+    catch {
+        // non-fatal — in-memory Map is the primary path
+    }
+}
+/**
+ * Retrieve and consume a desktop exchange entry from the DB fallback.
+ * Returns null if not found or already consumed.
+ */
+async function consumeDesktopExchangeFromDB(flowId) {
+    try {
+        // Atomic DELETE...RETURNING prevents token replay: two concurrent polls
+        // cannot both retrieve the token because only one DELETE will match the row.
+        // SQLite ≥3.35 and PostgreSQL both support this syntax.
+        // The created_at predicate enforces the 5-minute TTL so stale DB entries
+        // (e.g. the desktop app never polled) are rejected rather than silently
+        // redeemed with the session table's default 30-day TTL.
+        const client = getDbExec();
+        const { rows } = await client.execute({
+            sql: `DELETE FROM sessions WHERE token = ? AND created_at > ? RETURNING email`,
+            args: [`dex:${flowId}`, Date.now() - DESKTOP_EXCHANGE_TTL_MS],
+        });
+        if (rows.length === 0)
+            return null;
+        const packed = (rows[0].email ?? rows[0][0]);
+        if (!packed)
+            return null;
+        const sepIdx = packed.indexOf("::");
+        if (sepIdx === -1)
+            return null;
+        return { token: packed.slice(0, sepIdx), email: packed.slice(sepIdx + 2) };
+    }
+    catch {
+        return null;
+    }
+}
+setInterval(() => {
+    const now = Date.now();
+    for (const [k, v] of _desktopExchanges) {
+        if (v.expiresAt < now)
+            _desktopExchanges.delete(k);
+    }
+}, 60_000).unref?.();
 /**
  * Module-level auth guard function. Set by autoMountAuth() when auth is active.
  * Called by the server middleware to enforce auth on ALL requests (not just
@@ -260,7 +463,17 @@ export async function runAuthGuard(event) {
         return; // Auth not mounted (local mode, etc.)
     return _authGuardFn(event);
 }
-const LOCAL_SESSION = { email: "local@localhost" };
+/**
+ * The framework's dev-mode bypass identity. When `AUTH_MODE=local` (or
+ * dev-mode falls back), `getSession()` returns `{ email: DEV_MODE_USER_EMAIL }`.
+ * Production code that needs to check whether the current request is the
+ * dev-mode user (or filter it out of mailers, dashboards, etc.) should
+ * compare against this constant instead of inlining the literal —
+ * `guard-no-localhost-fallback.mjs` blocks the literal everywhere except
+ * `auth.ts` and a handful of dev-mode helpers.
+ */
+export const DEV_MODE_USER_EMAIL = "local@localhost";
+const LOCAL_SESSION = { email: DEV_MODE_USER_EMAIL };
 // ---------------------------------------------------------------------------
 // Auth guard factory
 // ---------------------------------------------------------------------------
@@ -283,7 +496,7 @@ function applyCorsHeaders(event) {
     const originRaw = reqHeaders["origin"];
     const origin = Array.isArray(originRaw) ? originRaw[0] : originRaw;
     if (!origin)
-        return;
+        return { hasOrigin: false, allowed: true };
     // Dev convenience: always allow localhost origins across ports (Tauri
     // tray apps, the frame, docs). In prod, the CORS_ALLOWED_ORIGINS env
     // var is the safe-list.
@@ -292,15 +505,16 @@ function applyCorsHeaders(event) {
         .map((s) => s.trim())
         .filter(Boolean);
     const allowed = allowlist.length === 0
-        ? /^https?:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin)
+        ? /^(https?|tauri):\/\/(localhost|127\.0\.0\.1|tauri\.localhost)(:\d+)?$/.test(origin)
         : allowlist.includes(origin);
     if (!allowed)
-        return;
+        return { hasOrigin: true, allowed: false };
     setResponseHeader(event, "Access-Control-Allow-Origin", origin);
     setResponseHeader(event, "Vary", "Origin");
     setResponseHeader(event, "Access-Control-Allow-Credentials", "true");
-    setResponseHeader(event, "Access-Control-Allow-Methods", "GET,POST,PUT,PATCH,DELETE,OPTIONS");
-    setResponseHeader(event, "Access-Control-Allow-Headers", "Content-Type,Authorization,X-Requested-With");
+    setResponseHeader(event, "Access-Control-Allow-Methods", "GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS");
+    setResponseHeader(event, "Access-Control-Allow-Headers", "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF");
+    return { hasOrigin: true, allowed: true };
 }
 function createAuthGuardFn() {
     return async (event) => {
@@ -309,13 +523,20 @@ function createAuthGuardFn() {
             return;
         const { loginHtml, publicPaths } = config;
         const url = event.node?.req?.url ?? event.path ?? "/";
-        const p = url.split("?")[0];
+        const queryStart = url.indexOf("?");
+        const rawPath = queryStart >= 0 ? url.slice(0, queryStart) : url;
+        const p = stripAppBasePath(rawPath);
+        const normalizedUrl = queryStart >= 0 ? `${p}${url.slice(queryStart)}` : p;
         // Emit CORS headers on every request the guard sees so that even
         // error responses (401) reach the browser.
-        applyCorsHeaders(event);
+        const cors = applyCorsHeaders(event);
         // Preflight short-circuit: the browser sends OPTIONS before the real
         // credentialed request. Must return success without invoking auth.
         if (getMethod(event) === "OPTIONS") {
+            if (cors.hasOrigin && !cors.allowed) {
+                setResponseStatus(event, 403);
+                return "";
+            }
             setResponseStatus(event, 204);
             return "";
         }
@@ -327,6 +548,71 @@ function createAuthGuardFn() {
             p === "/_agent-native/google/add-account/callback") {
             return;
         }
+        // Integration webhook endpoints verify authenticity via platform-specific
+        // signature verification (Slack HMAC, Telegram token, etc.), not sessions.
+        if (/^\/_agent-native\/integrations\/[^/]+\/webhook$/.test(p)) {
+            return;
+        }
+        // Internal processor endpoint for the integration webhook fanout. The
+        // webhook handler enqueues a task to SQL and dispatches a fresh HTTP POST
+        // to this endpoint so the agent loop runs in its own function execution
+        // (cross-platform serverless-safe — see `integrations/webhook-handler.ts`).
+        // Authenticity is verified via an HMAC token signed with A2A_SECRET, plus
+        // an atomic SQL claim that prevents duplicate processing.
+        if (p === "/_agent-native/integrations/process-task") {
+            return;
+        }
+        // A2A endpoint verifies authenticity via JWT signed with the org's A2A
+        // secret (or the global A2A_SECRET fallback), not via session cookies.
+        if (p === "/_agent-native/a2a") {
+            return;
+        }
+        // Internal processor endpoint for the A2A async-mode fanout. Mirrors the
+        // integration webhook fanout: when `message/send` is called with
+        // `async: true`, the JSON-RPC handler enqueues to a2a_tasks and self-
+        // fires a POST here so the handler runs in a fresh function execution.
+        // Authenticity is verified via an HMAC token signed with A2A_SECRET
+        // (same scheme as /_agent-native/integrations/process-task).
+        if (p === "/_agent-native/a2a/_process-task") {
+            return;
+        }
+        // A2A secret receive endpoint — verifies authenticity via JWT signed
+        // with the calling app's A2A secret, not via session cookies. Used to
+        // sync the org A2A secret across connected apps.
+        if (p === "/_agent-native/org/a2a-secret/receive") {
+            return;
+        }
+        // Force-sign-in entrypoint. Templates send viewers from public pages
+        // (share links, embeds) here with a `?return=<path>` query — anonymous
+        // visitors get the loginHtml, and once they sign in the loginHtml's
+        // post-login reload re-hits this same URL with a session cookie set,
+        // so we 302 them to the original page.
+        //
+        // `return` is validated by parsing it against a sentinel base origin
+        // and checking the resolved origin still matches. This rejects every
+        // open-redirect shape — `//evil.com/...` (network-path reference),
+        // `/\evil.com/...` (WHATWG URL parser normalises `\` to `/` in HTTP
+        // URLs, so a naive prefix check on `//` misses this), absolute URLs
+        // like `https://evil.com`, and `data:` / `javascript:` schemes. The
+        // reconstructed path comes from the parsed segments so any leftover
+        // quirks get normalised. Control chars (incl. CR/LF for header
+        // injection) are rejected up front.
+        //
+        if (p === "/_agent-native/sign-in") {
+            const queryStr = queryStart >= 0 ? url.slice(queryStart + 1) : "";
+            const safeReturn = safeReturnPath(new URLSearchParams(queryStr).get("return"));
+            const session = await getSession(event);
+            if (session) {
+                return new Response("", {
+                    status: 302,
+                    headers: { Location: safeReturn },
+                });
+            }
+            return new Response(loginHtml, {
+                status: 200,
+                headers: { "Content-Type": "text/html; charset=utf-8" },
+            });
+        }
         // Skip static assets (Vite chunks, fonts, images, etc.)
         if (p.startsWith("/assets/") ||
             p.startsWith("/_build/") ||
@@ -340,7 +626,7 @@ function createAuthGuardFn() {
             p.endsWith(".woff")) {
             return;
         }
-        if (isPublicPath(url, publicPaths))
+        if (isPublicPath(normalizedUrl, publicPaths))
             return;
         const session = await getSession(event);
         if (session)
@@ -429,12 +715,12 @@ export async function getSession(event) {
             return session;
         // Desktop SSO broker: even with BYOA auth, fall back to the broker
         // for Electron requests so cross-template SSO works for custom-auth
-        // templates too.
-        if (isElectronRequest(event)) {
-            const sso = await readDesktopSso();
-            if (sso?.email)
-                return { email: sso.email, token: sso.token };
-        }
+        // templates too. Gated on `readDesktopSsoSafely` so a non-loopback
+        // request that spoofs `User-Agent: ... Electron/...` cannot read the
+        // home-dir broker file (and so production builds never consult it).
+        const sso = await readDesktopSsoSafely(event);
+        if (sso?.email)
+            return { email: sso.email, token: sso.token };
         // Fall through to mobile _session check
     }
     else {
@@ -453,8 +739,8 @@ export async function getSession(event) {
                 }
             }
         }
-        catch {
-            // Better Auth not ready
+        catch (e) {
+            console.error("[auth] ba.api.getSession error:", e);
         }
         // 5. Legacy cookie fallback (for sessions created before migration)
         const cookie = getCookie(event, COOKIE_NAME);
@@ -470,14 +756,14 @@ export async function getSession(event) {
         // a session token created by one template doesn't resolve in another.
         // When an Electron request has no resolvable session, trust the
         // home-dir SSO record written by whichever template the user signed
-        // into. Gated on Electron user-agent so no non-desktop code path
-        // consults the file.
-        if (isElectronRequest(event)) {
-            const sso = await readDesktopSso();
-            if (sso?.email) {
-                clearUpgradePendingCookie(event);
-                return { email: sso.email, token: sso.token };
-            }
+        // into. Gated on `readDesktopSsoSafely`: requires Electron User-Agent,
+        // a loopback (127.0.0.1 / ::1) source IP, and a non-production NODE_ENV
+        // — anything else is rejected so a hostile network request cannot
+        // impersonate whichever email last signed into the desktop app.
+        const sso = await readDesktopSsoSafely(event);
+        if (sso?.email) {
+            clearUpgradePendingCookie(event);
+            return { email: sso.email, token: sso.token };
         }
     }
     // 6. Mobile WebView bridge — _session query param
@@ -504,11 +790,18 @@ export async function getSession(event) {
     // on a shared DB (Postgres, Turso, D1) this fallback would land every
     // developer on the same account and expose each other's data.
     //
+    // STRICT NODE_ENV check: this used to read `isDevEnvironment()` which
+    // also accepted `NODE_ENV=test`, meaning a misconfigured prod deploy
+    // started with `NODE_ENV=test` (or undefined NODE_ENV in some CI/build
+    // contexts) would silently bypass auth entirely. Limiting to the literal
+    // string "development" closes that footgun. Tests that need this branch
+    // to fire stub NODE_ENV explicitly to "development".
+    //
     // EXCEPTION: if the user has explicitly exited local mode (clicked "Upgrade
     // to real account"), they've signaled they want real auth. The upgrade
     // cookie suppresses this fallback so the onboarding/sign-in page is served
     // instead of silently re-authenticating them as local@localhost.
-    if (isDevEnvironment() &&
+    if (process.env.NODE_ENV === "development" &&
         isLocalDatabase() &&
         !isUpgradePending(event) &&
         !hasSignInFlag(event)) {
@@ -554,6 +847,10 @@ function hasSignInFlag(event) {
         return false;
     }
 }
+function isReadMethod(event) {
+    const method = getMethod(event);
+    return method === "GET" || method === "HEAD";
+}
 /**
  * Cookie attributes that work in both same-site and third-party iframe
  * contexts. Over HTTPS we emit `SameSite=None; Secure` (required by browsers
@@ -609,6 +906,17 @@ function isPublicPath(url, publicPaths) {
     const p = url.split("?")[0];
     return publicPaths.some((pp) => p === pp || p.startsWith(pp + "/"));
 }
+function stripAppBasePath(pathname) {
+    const basePath = getAppBasePath();
+    if (!basePath)
+        return pathname;
+    if (pathname === basePath)
+        return "/";
+    if (pathname.startsWith(`${basePath}/`)) {
+        return pathname.slice(basePath.length) || "/";
+    }
+    return pathname;
+}
 // ---------------------------------------------------------------------------
 // Login page HTML (ACCESS_TOKEN mode)
 // ---------------------------------------------------------------------------
@@ -678,10 +986,18 @@ const TOKEN_LOGIN_HTML = `<!DOCTYPE html>
   </form>
 </div>
 <script>
+  function __anBasePath() {
+    var marker = '/_agent-native';
+    var idx = window.location.pathname.indexOf(marker);
+    return idx > 0 ? window.location.pathname.slice(0, idx) : '';
+  }
+  function __anPath(path) {
+    return __anBasePath() + path;
+  }
   document.getElementById('form').addEventListener('submit', async (e) => {
     e.preventDefault();
     const token = document.getElementById('token').value;
-    const res = await fetch('/_agent-native/auth/login', {
+    const res = await fetch(__anPath('/_agent-native/auth/login'), {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ token }),
@@ -703,7 +1019,7 @@ async function setAuthModeLocal() {
         const fs = await getFs();
         fs.mkdirSync(path.dirname(LOCAL_MODE_MARKER_PATH), { recursive: true });
         fs.writeFileSync(LOCAL_MODE_MARKER_PATH, "local\n", "utf-8");
-        process.env.AUTH_MODE = "local";
+        process.env.AUTH_MODE = "local"; // guard:allow-env-mutation — escape-hatch writes the local-mode marker file; mirrored into env so the in-flight process honors the change without restart
         return true;
     }
     catch {
@@ -719,7 +1035,7 @@ async function removeAuthModeLocal() {
         catch {
             // Marker already absent
         }
-        delete process.env.AUTH_MODE;
+        delete process.env.AUTH_MODE; // guard:allow-env-mutation — escape-hatch removes the local-mode marker; mirrored into env so the in-flight process honors the change without restart
         return true;
     }
     catch {
@@ -754,7 +1070,11 @@ const migrateLocalDataHandler = defineEventHandler(async (event) => {
         setResponseStatus(event, 500);
         return {
             error: e?.message || "Migration failed",
-            stack: isDevEnvironment() ? e?.stack : undefined,
+            // Only surface the stack when explicitly enabled. `isDevEnvironment()`
+            // returns true on preview deploys and Lambda contexts that forget
+            // NODE_ENV=production, which leaked stack traces to clients. Use
+            // AGENT_NATIVE_DEBUG_ERRORS=1 for opt-in debug visibility.
+            stack: process.env.AGENT_NATIVE_DEBUG_ERRORS === "1" ? e?.stack : undefined,
         };
     }
 });
@@ -786,17 +1106,31 @@ async function mountBetterAuthRoutes(app, options) {
             "https://www.googleapis.com/auth/userinfo.profile",
         ].join(" ");
         app.use("/_agent-native/google/auth-url", defineEventHandler((event) => {
-            if (event.context.matchedRoute &&
-                event.context.matchedRoute.path !== "/**:page")
-                return undefined;
             if (getMethod(event) !== "GET") {
                 setResponseStatus(event, 405);
                 return { error: "Method not allowed" };
             }
-            const redirectUri = getQuery(event).redirect_uri ||
-                `${getOrigin(event)}/_agent-native/google/callback`;
-            const desktop = isElectronRequest(event);
-            const state = encodeOAuthState(redirectUri, undefined, desktop, false);
+            // Validate the user-supplied `redirect_uri` against the framework's
+            // server-side allowlist (must be same-origin and under
+            // `/_agent-native/...`). Reject anything else so an attacker can't
+            // smuggle a different already-registered redirect URI past Google's
+            // host-prefix matching. See HIGH-1 in 09-oauth-session.md.
+            const redirectUri = resolveOAuthRedirectUri(event);
+            if (redirectUri === null) {
+                setResponseStatus(event, 400);
+                return { error: "Invalid redirect_uri" };
+            }
+            const q = getQuery(event);
+            const desktop = isElectronRequest(event) || q.desktop === "1" || q.desktop === "true";
+            const flowId = desktop ? q.flow_id || undefined : undefined;
+            // Validate the caller's return param up front and only embed it
+            // into the OAuth state when it normalises to a non-root path —
+            // skip embedding "/" (the default fallback) so the state stays
+            // small for the common case.
+            const returnQuery = q.return;
+            const validated = typeof returnQuery === "string" ? safeReturnPath(returnQuery) : "/";
+            const returnUrl = validated !== "/" ? validated : undefined;
+            const state = encodeOAuthState(redirectUri, undefined, desktop, false, undefined, returnUrl, flowId);
             const params = new URLSearchParams({
                 client_id: process.env.GOOGLE_CLIENT_ID,
                 redirect_uri: redirectUri,
@@ -806,14 +1140,13 @@ async function mountBetterAuthRoutes(app, options) {
                 prompt: "select_account",
                 state,
             });
-            return {
-                url: `https://accounts.google.com/o/oauth2/v2/auth?${params}`,
-            };
+            const authUrl = `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
+            if (q.redirect === "1") {
+                return sendRedirect(event, authUrl, 302);
+            }
+            return { url: authUrl };
         }));
         app.use("/_agent-native/google/callback", defineEventHandler(async (event) => {
-            if (event.context.matchedRoute &&
-                event.context.matchedRoute.path !== "/**:page")
-                return undefined;
             if (getMethod(event) !== "GET") {
                 setResponseStatus(event, 405);
                 return { error: "Method not allowed" };
@@ -825,7 +1158,16 @@ async function mountBetterAuthRoutes(app, options) {
                     setResponseStatus(event, 400);
                     return { error: "Missing authorization code" };
                 }
-                const { redirectUri, desktop } = decodeOAuthState(query.state, `${getOrigin(event)}/_agent-native/google/callback`);
+                const { redirectUri, desktop, returnUrl, flowId } = decodeOAuthState(query.state, getAppUrl(event, "/_agent-native/google/callback"));
+                // Defence in depth: the state is HMAC-signed, but if the signing
+                // key ever leaked an attacker could mint state with their own
+                // redirect_uri. Re-validate against the same allowlist used at
+                // auth-url time so the token exchange is always sent to a URI we
+                // own.
+                if (!isAllowedOAuthRedirectUri(redirectUri, event)) {
+                    setResponseStatus(event, 400);
+                    return { error: "Invalid redirect_uri in state" };
+                }
                 const tokenRes = await fetch("https://oauth2.googleapis.com/token", {
                     method: "POST",
                     headers: {
@@ -850,13 +1192,37 @@ async function mountBetterAuthRoutes(app, options) {
                 const email = user.email;
                 if (!email)
                     throw new Error("Could not get email from Google");
+                // Reject unverified Google addresses. Google returns
+                // `verified_email: false` for accounts where ownership of the
+                // address hasn't been proven (rare on consumer accounts but
+                // reachable on Workspace tenants that allow it). Without this
+                // check, an attacker could sign up as `victim@example.com` on
+                // Google without controlling the inbox and take over a local
+                // password account that already exists at that address (Better
+                // Auth's accountLinking auto-merges trusted-provider sign-ins).
+                if (user.verified_email !== true) {
+                    throw new Error("Google account email is not verified. Please verify your email with Google and try again.");
+                }
                 const { sessionToken } = await createOAuthSession(event, email, {
                     hasProductionSession: false,
                     desktop,
                 });
+                if (flowId && sessionToken) {
+                    _desktopExchanges.set(flowId, {
+                        token: sessionToken,
+                        email,
+                        expiresAt: Date.now() + DESKTOP_EXCHANGE_TTL_MS,
+                    });
+                    // Also persist to DB for cross-instance durability (Cloudflare
+                    // Workers, multi-region). Fire-and-forget — in-memory Map is
+                    // still the primary fast path for same-instance requests.
+                    void persistDesktopExchangeToDB(flowId, sessionToken, email);
+                }
                 return oauthCallbackResponse(event, email, {
                     sessionToken,
                     desktop,
+                    returnUrl,
+                    flowId,
                 });
             }
             catch (error) {
@@ -865,6 +1231,40 @@ async function mountBetterAuthRoutes(app, options) {
             }
         }));
     }
+    // Desktop OAuth exchange — native apps (Tauri tray, Electron) open OAuth
+    // in the system browser but need a way to retrieve the session token
+    // afterwards since they don't share a cookie jar with the browser.
+    app.use("/_agent-native/auth/desktop-exchange", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "GET") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const flowId = getQuery(event).flow_id;
+        if (!flowId) {
+            setResponseStatus(event, 400);
+            return { error: "Missing flow_id" };
+        }
+        let entry = _desktopExchanges.get(flowId);
+        if (!entry || entry.expiresAt < Date.now()) {
+            // In-memory miss — fall back to the DB-persisted entry. This handles
+            // cross-instance routing (Cloudflare Workers, multi-region) where the
+            // OAuth callback and the polling request may hit different isolates.
+            const fromDb = await consumeDesktopExchangeFromDB(flowId);
+            if (!fromDb) {
+                return { pending: true };
+            }
+            entry = {
+                token: fromDb.token,
+                email: fromDb.email,
+                expiresAt: Date.now() + 1, // already consumed from DB
+            };
+        }
+        _desktopExchanges.delete(flowId);
+        // Also wipe the DB-persisted entry so it cannot be replayed via the
+        // DB fallback path after in-memory consumption.
+        void removeSession(`dex:${flowId}`);
+        return { token: entry.token, email: entry.email };
+    }));
     const accessTokens = getAccessTokens();
     // Initialize Better Auth
     const auth = await getBetterAuth(options.betterAuth);
@@ -872,24 +1272,55 @@ async function mountBetterAuthRoutes(app, options) {
     app.use("/_agent-native/auth/ba", defineEventHandler(async (event) => {
         const reqPath = event.url?.pathname ?? event.path ?? "";
         const isResetPassword = reqPath.includes("reset-password") && getMethod(event) === "POST";
-        // Pre-read the body for reset-password so we can extract the
-        // token after Better Auth consumes the stream.
+        // Pre-read the body for reset-password so we can auto-verify the
+        // user's email after they save the new password. CRUCIAL: clone
+        // the Request first — h3 v2 `event.req` is the live web Request,
+        // and `.text()`/`.json()` consume the stream. The same `event.req`
+        // is handed to Better Auth below; without the clone, Better Auth
+        // sees an empty body, fails Zod validation, and returns 400 —
+        // which the reset page renders as "the link may have expired".
         let resetToken;
+        let resetUserId;
         if (isResetPassword) {
             try {
-                const body = await readBody(event);
+                const cloned = event.req.clone();
+                const body = (await cloned.json().catch(() => undefined));
                 resetToken = body?.token;
             }
             catch {
                 // ignore — Better Auth will handle validation
             }
+            // Look up userId BEFORE calling auth.handler — Better Auth deletes
+            // the verification row as part of the reset, so by the time the
+            // handler returns 200 the row is gone and we can't recover the user.
+            if (resetToken) {
+                try {
+                    const { getDbExec } = await import("../db/client.js");
+                    const db = getDbExec();
+                    const rows = await db.execute({
+                        sql: "SELECT value FROM verification WHERE identifier = ?",
+                        args: [`reset-password:${resetToken}`],
+                    });
+                    resetUserId = rows.rows[0]?.value;
+                }
+                catch {
+                    // Best-effort — if we can't read the verification row we just
+                    // skip auto-verify; the user can verify normally.
+                }
+            }
         }
         const response = await auth.handler(toWebRequest(event));
         const isResponse = response != null &&
             typeof response.status === "number" &&
             typeof response.headers?.get === "function";
-        // After email verification, add ?verified to the redirect so the
-        // login page can show a "Email verified!" success message.
+        // After email verification, add ?verified=1 to the redirect so the
+        // login page can show "Email verified!". MUTATE the response in
+        // place — `new Response(null, { headers: new Headers(response.headers) })`
+        // collapses multiple Set-Cookie headers into one comma-joined value,
+        // which browsers reject. With `autoSignInAfterVerification: true`
+        // Better Auth emits 2–3 Set-Cookie headers (session token + cookie
+        // cache + dontRememberToken); losing them strands the user on the
+        // login page even though verification succeeded.
         if (reqPath.includes("verify-email") &&
             isResponse &&
             response.status >= 300 &&
@@ -897,38 +1328,83 @@ async function mountBetterAuthRoutes(app, options) {
             const loc = response.headers.get("location");
             if (loc && !/[?&]verified=/.test(loc)) {
                 const sep = loc.includes("?") ? "&" : "?";
-                const newResponse = new Response(null, {
-                    status: response.status,
-                    headers: new Headers(response.headers),
-                });
-                newResponse.headers.set("location", loc + sep + "verified=1");
-                return newResponse;
+                response.headers.set("location", loc + sep + "verified=1");
             }
         }
         // Auto-verify email after a successful password reset. The user
-        // proved email ownership by receiving and using the reset link.
+        // proved email ownership by receiving and using the reset link, so
+        // we don't want them stuck behind `requireEmailVerification` after
+        // resetting — that's the exact escape hatch they just used.
         if (isResetPassword &&
-            resetToken &&
+            resetUserId &&
             isResponse &&
             response.status >= 200 &&
             response.status < 300) {
             try {
                 const { getDbExec } = await import("../db/client.js");
                 const db = getDbExec();
-                // Better Auth stores the reset token in its `verification`
-                // table with the user's identifier. Look up the user via the
-                // token and mark their email as verified — they proved
-                // ownership by receiving and using the email-delivered link.
-                const rows = await db.execute({
-                    sql: "SELECT identifier FROM verification WHERE value = ?",
-                    args: [resetToken],
+                // Use boolean literals for cross-dialect portability: Postgres
+                // stores `email_verified` as BOOLEAN and rejects integer 1/0,
+                // SQLite accepts TRUE/FALSE as aliases for 1/0 (since 3.23).
+                // Quote `"user"` because it's a reserved keyword in Postgres.
+                await db.execute({
+                    sql: 'UPDATE "user" SET email_verified = TRUE WHERE id = ? AND (email_verified = FALSE OR email_verified IS NULL)',
+                    args: [resetUserId],
                 });
-                const email = rows.rows[0]?.identifier;
-                if (email) {
+                // Revoke every existing session for this user so a stolen
+                // cookie doesn't outlive the password it was paired with. We
+                // do this AFTER Better Auth's response has been generated so
+                // the freshly-minted post-reset session (if any) is captured
+                // by the response's Set-Cookie header — but `auth.handler` for
+                // reset-password does not auto-sign-in by default, so the
+                // common path is "wipe everything; user signs in with new
+                // password." The legacy `sessions` table is also wiped by
+                // joining through the `user.email` column.
+                //
+                // Skip the freshly-minted Better Auth session id when present
+                // (auto-sign-in plugins / future config). Reading it from the
+                // response avoids racing against Better Auth's own writes.
+                const newSessionToken = extractSessionTokenFromSetCookies(response);
+                // 1. Better Auth `session` table — keyed by user_id.
+                if (newSessionToken) {
                     await db.execute({
-                        sql: "UPDATE user SET email_verified = 1 WHERE email = ? AND (email_verified = 0 OR email_verified IS NULL)",
-                        args: [email],
+                        sql: 'DELETE FROM "session" WHERE user_id = ? AND token <> ?',
+                        args: [resetUserId, newSessionToken],
+                    });
+                }
+                else {
+                    await db.execute({
+                        sql: 'DELETE FROM "session" WHERE user_id = ?',
+                        args: [resetUserId],
+                    });
+                }
+                // 2. Legacy `sessions` table — keyed by `email` column. The
+                // reset-password verification row holds the user's id, not
+                // their email, so we look up the email first. Best-effort —
+                // skip silently if the lookup fails so the response still ships.
+                try {
+                    const { rows } = await db.execute({
+                        sql: 'SELECT email FROM "user" WHERE id = ?',
+                        args: [resetUserId],
                     });
+                    const userEmail = (rows[0]?.email ?? rows[0]?.[0]);
+                    if (userEmail) {
+                        if (newSessionToken) {
+                            await db.execute({
+                                sql: "DELETE FROM sessions WHERE email = ? AND token <> ?",
+                                args: [userEmail, newSessionToken],
+                            });
+                        }
+                        else {
+                            await db.execute({
+                                sql: "DELETE FROM sessions WHERE email = ?",
+                                args: [userEmail],
+                            });
+                        }
+                    }
+                }
+                catch {
+                    // Best-effort — don't block the response
                 }
             }
             catch {
@@ -1089,9 +1565,77 @@ async function mountBetterAuthRoutes(app, options) {
             await clearDesktopSso();
         return { ok: true };
     }));
+    // POST /_agent-native/auth/logout-all — revoke every session row for
+    // the authenticated user across both auth tables. Companion to the
+    // password-reset session-revocation logic; lets a user sign out
+    // everywhere from one device. Requires an authenticated session.
+    app.use("/_agent-native/auth/logout-all", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const session = await getSession(event);
+        if (!session?.email) {
+            setResponseStatus(event, 401);
+            return { error: "Not authenticated" };
+        }
+        try {
+            const db = getDbExec();
+            // 1. Resolve user_id from email so we can wipe Better Auth sessions
+            // by their FK column.
+            let userId;
+            try {
+                const { rows } = await db.execute({
+                    sql: 'SELECT id FROM "user" WHERE email = ?',
+                    args: [session.email],
+                });
+                userId = (rows[0]?.id ?? rows[0]?.[0]);
+            }
+            catch {
+                // User table may not exist on token-only deployments — skip.
+            }
+            if (userId) {
+                try {
+                    await db.execute({
+                        sql: 'DELETE FROM "session" WHERE user_id = ?',
+                        args: [userId],
+                    });
+                }
+                catch {
+                    // Best-effort.
+                }
+            }
+            // 2. Legacy `sessions` table — keyed by `email` column.
+            try {
+                await db.execute({
+                    sql: "DELETE FROM sessions WHERE email = ?",
+                    args: [session.email],
+                });
+            }
+            catch {
+                // Best-effort.
+            }
+            // 3. Drop the current request's cookie and best-effort sign out
+            // of Better Auth (so the response sets the proper expiry header).
+            deleteCookie(event, COOKIE_NAME, { path: "/" });
+            try {
+                await auth.api.signOut({ headers: event.headers });
+            }
+            catch {
+                // Ignore — sessions are already gone in DB.
+            }
+            if (isElectronRequest(event))
+                await clearDesktopSso();
+            return { ok: true };
+        }
+        catch (e) {
+            setResponseStatus(event, 500);
+            return { error: e?.message || "Failed to revoke sessions" };
+        }
+    }));
     // GET /_agent-native/auth/session
     app.use("/_agent-native/auth/session", defineEventHandler(async (event) => {
-        if (getMethod(event) !== "GET") {
+        if (!isReadMethod(event)) {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };
         }
@@ -1106,7 +1650,7 @@ async function mountBetterAuthRoutes(app, options) {
     // reset link in their email. Reads ?token=... and POSTs to Better Auth's
     // /reset-password endpoint on submit.
     app.use("/_agent-native/auth/reset", defineEventHandler((event) => {
-        if (getMethod(event) !== "GET") {
+        if (!isReadMethod(event)) {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };
         }
@@ -1162,7 +1706,7 @@ function mountTokenOnlyRoutes(app, accessTokens, publicPaths = []) {
         return { ok: true };
     }));
     app.use("/_agent-native/auth/session", defineEventHandler(async (event) => {
-        if (getMethod(event) !== "GET") {
+        if (!isReadMethod(event)) {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };
         }
@@ -1180,7 +1724,7 @@ function mountTokenOnlyRoutes(app, accessTokens, publicPaths = []) {
 // ---------------------------------------------------------------------------
 function mountLocalModeRoutes(app) {
     app.use("/_agent-native/auth/session", defineEventHandler(async (event) => {
-        if (getMethod(event) !== "GET") {
+        if (!isReadMethod(event)) {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };
         }
@@ -1340,7 +1884,7 @@ function mountAuthFallbackRoutes(app) {
         return { ok: true };
     }));
     app.use("/_agent-native/auth/session", defineEventHandler(async (event) => {
-        if (getMethod(event) !== "GET") {
+        if (!isReadMethod(event)) {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };
         }
@@ -1443,7 +1987,7 @@ export async function autoMountAuth(app, options = {}) {
     // BYOA — custom getSession provider
     if (customGetSession) {
         app.use("/_agent-native/auth/session", defineEventHandler(async (event) => {
-            if (getMethod(event) !== "GET") {
+            if (!isReadMethod(event)) {
                 setResponseStatus(event, 405);
                 return { error: "Method not allowed" };
             }
@@ -1466,7 +2010,8 @@ export async function autoMountAuth(app, options = {}) {
         const guardFn = createAuthGuardFn();
         _authGuardFn = guardFn;
         app.use(defineEventHandler(guardFn));
-        console.log("[agent-native] Auth enabled — custom getSession provider.");
+        if (process.env.DEBUG)
+            console.log("[agent-native] Auth enabled — custom getSession provider.");
         return true;
     }
     // AUTH_DISABLED — skip auth (infrastructure-level auth)
@@ -1481,13 +2026,15 @@ export async function autoMountAuth(app, options = {}) {
     const tokens = getAccessTokens();
     if (tokens.length > 0) {
         mountTokenOnlyRoutes(app, tokens, publicPaths);
-        console.log(`[agent-native] Auth enabled — ${tokens.length} access token(s) configured.`);
+        if (process.env.DEBUG)
+            console.log(`[agent-native] Auth enabled — ${tokens.length} access token(s) configured.`);
         return true;
     }
     // Default: Better Auth (account-first)
     try {
         await mountBetterAuthRoutes(app, options);
-        console.log("[agent-native] Auth enabled — Better Auth (accounts + organizations).");
+        if (process.env.DEBUG)
+            console.log("[agent-native] Auth enabled — Better Auth (accounts + organizations).");
     }
     catch (err) {
         console.error("[agent-native] Failed to initialize Better Auth:", err);