@agent-native/core 0.7.23 → 0.7.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (137) hide show
  1. package/README.md +2 -2
  2. package/dist/a2a/client.d.ts +10 -4
  3. package/dist/a2a/client.d.ts.map +1 -1
  4. package/dist/a2a/client.js +16 -1
  5. package/dist/a2a/client.js.map +1 -1
  6. package/dist/a2a/handlers.d.ts.map +1 -1
  7. package/dist/a2a/handlers.js +20 -17
  8. package/dist/a2a/handlers.js.map +1 -1
  9. package/dist/cli/create.d.ts +2 -1
  10. package/dist/cli/create.d.ts.map +1 -1
  11. package/dist/cli/create.js +13 -19
  12. package/dist/cli/create.js.map +1 -1
  13. package/dist/cli/index.js +23 -0
  14. package/dist/cli/index.js.map +1 -1
  15. package/dist/cli/workspace-dev.d.ts +3 -0
  16. package/dist/cli/workspace-dev.d.ts.map +1 -0
  17. package/dist/cli/workspace-dev.js +323 -0
  18. package/dist/cli/workspace-dev.js.map +1 -0
  19. package/dist/cli/workspacify.d.ts +3 -3
  20. package/dist/cli/workspacify.js +4 -4
  21. package/dist/cli/workspacify.js.map +1 -1
  22. package/dist/client/AgentPanel.d.ts.map +1 -1
  23. package/dist/client/AgentPanel.js +10 -9
  24. package/dist/client/AgentPanel.js.map +1 -1
  25. package/dist/client/AssistantChat.d.ts.map +1 -1
  26. package/dist/client/AssistantChat.js +2 -1
  27. package/dist/client/AssistantChat.js.map +1 -1
  28. package/dist/client/MultiTabAssistantChat.d.ts.map +1 -1
  29. package/dist/client/MultiTabAssistantChat.js +2 -1
  30. package/dist/client/MultiTabAssistantChat.js.map +1 -1
  31. package/dist/client/components/ui/tooltip.d.ts +8 -0
  32. package/dist/client/components/ui/tooltip.d.ts.map +1 -0
  33. package/dist/client/components/ui/tooltip.js +11 -0
  34. package/dist/client/components/ui/tooltip.js.map +1 -0
  35. package/dist/client/resources/ResourceTree.d.ts.map +1 -1
  36. package/dist/client/resources/ResourceTree.js +21 -17
  37. package/dist/client/resources/ResourceTree.js.map +1 -1
  38. package/dist/client/resources/ResourcesPanel.d.ts.map +1 -1
  39. package/dist/client/resources/ResourcesPanel.js +13 -11
  40. package/dist/client/resources/ResourcesPanel.js.map +1 -1
  41. package/dist/deploy/workspace-core.d.ts +1 -1
  42. package/dist/deploy/workspace-core.d.ts.map +1 -1
  43. package/dist/deploy/workspace-core.js +14 -11
  44. package/dist/deploy/workspace-core.js.map +1 -1
  45. package/dist/integrations/a2a-continuation-processor.d.ts +10 -0
  46. package/dist/integrations/a2a-continuation-processor.d.ts.map +1 -0
  47. package/dist/integrations/a2a-continuation-processor.js +150 -0
  48. package/dist/integrations/a2a-continuation-processor.js.map +1 -0
  49. package/dist/integrations/a2a-continuations-store.d.ts +41 -0
  50. package/dist/integrations/a2a-continuations-store.d.ts.map +1 -0
  51. package/dist/integrations/a2a-continuations-store.js +214 -0
  52. package/dist/integrations/a2a-continuations-store.js.map +1 -0
  53. package/dist/integrations/plugin.d.ts.map +1 -1
  54. package/dist/integrations/plugin.js +52 -0
  55. package/dist/integrations/plugin.js.map +1 -1
  56. package/dist/integrations/types.d.ts +5 -0
  57. package/dist/integrations/types.d.ts.map +1 -1
  58. package/dist/integrations/types.js.map +1 -1
  59. package/dist/integrations/webhook-handler.d.ts +6 -0
  60. package/dist/integrations/webhook-handler.d.ts.map +1 -1
  61. package/dist/integrations/webhook-handler.js +69 -15
  62. package/dist/integrations/webhook-handler.js.map +1 -1
  63. package/dist/org/handlers.d.ts.map +1 -1
  64. package/dist/org/handlers.js +22 -16
  65. package/dist/org/handlers.js.map +1 -1
  66. package/dist/scripts/call-agent.d.ts.map +1 -1
  67. package/dist/scripts/call-agent.js +91 -30
  68. package/dist/scripts/call-agent.js.map +1 -1
  69. package/dist/server/agent-discovery.d.ts.map +1 -1
  70. package/dist/server/agent-discovery.js +20 -105
  71. package/dist/server/agent-discovery.js.map +1 -1
  72. package/dist/server/agents-bundle.js +1 -1
  73. package/dist/server/agents-bundle.js.map +1 -1
  74. package/dist/server/auth.d.ts.map +1 -1
  75. package/dist/server/auth.js +29 -120
  76. package/dist/server/auth.js.map +1 -1
  77. package/dist/server/better-auth-instance.d.ts +1 -0
  78. package/dist/server/better-auth-instance.d.ts.map +1 -1
  79. package/dist/server/better-auth-instance.js.map +1 -1
  80. package/dist/server/builder-browser.d.ts.map +1 -1
  81. package/dist/server/builder-browser.js +7 -5
  82. package/dist/server/builder-browser.js.map +1 -1
  83. package/dist/server/framework-request-handler.js +1 -1
  84. package/dist/server/framework-request-handler.js.map +1 -1
  85. package/dist/server/onboarding-html.d.ts +1 -8
  86. package/dist/server/onboarding-html.d.ts.map +1 -1
  87. package/dist/server/onboarding-html.js +321 -152
  88. package/dist/server/onboarding-html.js.map +1 -1
  89. package/dist/server/request-context.d.ts +14 -3
  90. package/dist/server/request-context.d.ts.map +1 -1
  91. package/dist/server/request-context.js +3 -0
  92. package/dist/server/request-context.js.map +1 -1
  93. package/dist/templates/default/_gitignore +2 -0
  94. package/dist/templates/workspace-core/AGENTS.md +18 -71
  95. package/dist/templates/workspace-core/package.json +2 -20
  96. package/dist/templates/workspace-core/src/client/index.ts +2 -26
  97. package/dist/templates/workspace-core/src/index.ts +1 -21
  98. package/dist/templates/workspace-core/src/server/index.ts +3 -22
  99. package/dist/templates/workspace-root/README.md +17 -20
  100. package/dist/templates/workspace-root/_gitignore +3 -0
  101. package/dist/templates/workspace-root/package.json +6 -13
  102. package/dist/templates/workspace-root/pnpm-workspace.yaml +4 -2
  103. package/dist/vite/agents-bundle-plugin.js +2 -2
  104. package/dist/vite/agents-bundle-plugin.js.map +1 -1
  105. package/docs/content/authentication.md +3 -5
  106. package/docs/content/multi-app-workspace.md +38 -50
  107. package/package.json +1 -1
  108. package/src/templates/default/_gitignore +2 -0
  109. package/src/templates/workspace-core/AGENTS.md +18 -71
  110. package/src/templates/workspace-core/package.json +2 -20
  111. package/src/templates/workspace-core/src/client/index.ts +2 -26
  112. package/src/templates/workspace-core/src/index.ts +1 -21
  113. package/src/templates/workspace-core/src/server/index.ts +3 -22
  114. package/src/templates/workspace-root/README.md +17 -20
  115. package/src/templates/workspace-root/_gitignore +3 -0
  116. package/src/templates/workspace-root/package.json +6 -13
  117. package/src/templates/workspace-root/pnpm-workspace.yaml +4 -2
  118. package/dist/templates/default/.claude/settings.json +0 -100
  119. package/dist/templates/workspace-core/.agents/skills/company-policies/SKILL.md +0 -42
  120. package/dist/templates/workspace-core/actions/company-directory.ts +0 -38
  121. package/dist/templates/workspace-core/src/client/AuthenticatedLayout.tsx +0 -37
  122. package/dist/templates/workspace-core/src/credentials.ts +0 -67
  123. package/dist/templates/workspace-core/src/server/agent-chat-plugin.ts +0 -30
  124. package/dist/templates/workspace-core/src/server/auth-plugin.ts +0 -35
  125. package/dist/templates/workspace-core/styles/tokens.css +0 -22
  126. package/dist/templates/workspace-root/.github/workflows/ci.yml +0 -32
  127. package/dist/templates/workspace-root/scripts/workspace-dev.ts +0 -377
  128. package/src/templates/default/.claude/settings.json +0 -100
  129. package/src/templates/workspace-core/.agents/skills/company-policies/SKILL.md +0 -42
  130. package/src/templates/workspace-core/actions/company-directory.ts +0 -38
  131. package/src/templates/workspace-core/src/client/AuthenticatedLayout.tsx +0 -37
  132. package/src/templates/workspace-core/src/credentials.ts +0 -67
  133. package/src/templates/workspace-core/src/server/agent-chat-plugin.ts +0 -30
  134. package/src/templates/workspace-core/src/server/auth-plugin.ts +0 -35
  135. package/src/templates/workspace-core/styles/tokens.css +0 -22
  136. package/src/templates/workspace-root/.github/workflows/ci.yml +0 -32
  137. package/src/templates/workspace-root/scripts/workspace-dev.ts +0 -377
package/dist/server/auth.js CHANGED
@@ -1,14 +1,4 @@
1
1
  import crypto from "node:crypto";
2
- import path from "node:path";
3
- // Lazy fs — loaded via dynamic import() on first use.
4
- // Avoids static require() which crashes on CF Workers.
5
- let _fs;
6
- async function getFs() {
7
- if (!_fs) {
8
- _fs = await import("node:fs");
9
- }
10
- return _fs;
11
- }
12
2
  import { defineEventHandler, getMethod, getQuery, getRequestIP, sendRedirect, setResponseHeader, setResponseStatus, getCookie, setCookie, deleteCookie, } from "h3";
13
3
  // In h3 v2, `event.req` IS the web Request — but in Nitro's dev server (srvx
14
4
  // runtime), event.url and event.req share the same underlying URL object.
@@ -90,7 +80,6 @@ function getOAuthStateAppId() {
90
80
  return slug || undefined;
91
81
  }
92
82
  const DEFAULT_MAX_AGE = 60 * 60 * 24 * 30; // 30 days
93
- const LOCAL_MODE_MARKER_PATH = path.resolve(process.cwd(), ".agent-native", "auth-mode");
94
83
  // ---------------------------------------------------------------------------
95
84
  // AUTH_MODE detection
96
85
  // ---------------------------------------------------------------------------
@@ -98,9 +87,7 @@ let _warnedRemoteLocalMode = false;
98
87
  /**
99
88
  * Check if the app is in local-only mode (no auth).
100
89
  *
101
- * Returns true when AUTH_MODE=local is explicitly set or when the dev
102
- * onboarding flow has enabled local mode for the current workspace via
103
- * a runtime marker file.
90
+ * Returns true when AUTH_MODE=local is explicitly set.
104
91
  *
105
92
  * Local mode is an explicit escape hatch for when you want to guarantee
106
93
  * no auth is used. In development, getSession() also falls back to
@@ -112,24 +99,17 @@ let _warnedRemoteLocalMode = false;
112
99
  * a shared DB every developer would land on the same account and collide.
113
100
  */
114
101
  async function isLocalModeEnabled() {
102
+ if (process.env.AUTH_MODE !== "local")
103
+ return false;
115
104
  if (!isLocalDatabase()) {
116
- if (process.env.AUTH_MODE === "local" && !_warnedRemoteLocalMode) {
105
+ if (!_warnedRemoteLocalMode) {
117
106
  _warnedRemoteLocalMode = true;
118
107
  console.warn("[agent-native] AUTH_MODE=local ignored: database is not local SQLite. " +
119
108
  "local@localhost has no per-user scoping and would collide across developers on a shared DB.");
120
109
  }
121
110
  return false;
122
111
  }
123
- if (process.env.AUTH_MODE === "local")
124
- return true;
125
- try {
126
- const fs = await getFs();
127
- const mode = fs.readFileSync(LOCAL_MODE_MARKER_PATH, "utf-8").trim();
128
- return mode === "local";
129
- }
130
- catch {
131
- return false;
132
- }
112
+ return true;
133
113
  }
134
114
  /**
135
115
  * Check if we're in a development/test environment.
@@ -808,8 +788,8 @@ export async function getSession(event) {
808
788
  return querySession;
809
789
  // 7. Dev-mode safety net — in development on a local SQLite database, fall
810
790
  // back to local@localhost so the app is usable without any auth configuration.
811
- // This prevents 401 errors when Better Auth isn't configured, the marker file
812
- // is missing, or the user simply wants to play around locally.
791
+ // This prevents 401 errors when Better Auth isn't configured or the user
792
+ // simply wants to play around locally.
813
793
  //
814
794
  // Gated on isLocalDatabase() because local@localhost has no per-user scoping:
815
795
  // on a shared DB (Postgres, Turso, D1) this fallback would land every
@@ -1056,35 +1036,19 @@ const TOKEN_LOGIN_HTML = `<!DOCTYPE html>
1056
1036
  </body>
1057
1037
  </html>`;
1058
1038
  // ---------------------------------------------------------------------------
1059
- // setAuthModeLocal — write AUTH_MODE=local to .env for the escape hatch
1039
+ // Local mode route helpers
1060
1040
  // ---------------------------------------------------------------------------
1061
- async function setAuthModeLocal() {
1062
- try {
1063
- const fs = await getFs();
1064
- fs.mkdirSync(path.dirname(LOCAL_MODE_MARKER_PATH), { recursive: true });
1065
- fs.writeFileSync(LOCAL_MODE_MARKER_PATH, "local\n", "utf-8");
1066
- process.env.AUTH_MODE = "local"; // guard:allow-env-mutation — escape-hatch writes the local-mode marker file; mirrored into env so the in-flight process honors the change without restart
1067
- return true;
1068
- }
1069
- catch {
1070
- return false;
1071
- }
1041
+ function localModeMarkerDisabled(event) {
1042
+ setResponseStatus(event, 410);
1043
+ return {
1044
+ error: "The local-mode marker file has been removed. Set AUTH_MODE=local in your local shell or .env only for one-off local development.",
1045
+ };
1072
1046
  }
1073
- async function removeAuthModeLocal() {
1074
- try {
1075
- const fs = await getFs();
1076
- try {
1077
- fs.unlinkSync(LOCAL_MODE_MARKER_PATH);
1078
- }
1079
- catch {
1080
- // Marker already absent
1081
- }
1082
- delete process.env.AUTH_MODE; // guard:allow-env-mutation — escape-hatch removes the local-mode marker; mirrored into env so the in-flight process honors the change without restart
1083
- return true;
1084
- }
1085
- catch {
1086
- return false;
1087
- }
1047
+ function exitLocalMode(event) {
1048
+ // Mark the browser so getSession's dev-mode fallback won't silently
1049
+ // re-authenticate the user as local@localhost on the next request.
1050
+ setUpgradePendingCookie(event);
1051
+ return { ok: true };
1088
1052
  }
1089
1053
  /**
1090
1054
  * POST /_agent-native/auth/migrate-local-data handler. Exposed here (not
@@ -1489,31 +1453,14 @@ async function mountBetterAuthRoutes(app, options) {
1489
1453
  }
1490
1454
  return response;
1491
1455
  }));
1492
- // POST /_agent-native/auth/local-mode — switch to local mode (onboarding escape hatch)
1493
- // Only available in dev — production requires real accounts for usage tracking.
1456
+ // POST /_agent-native/auth/local-mode — legacy endpoint kept so old clients
1457
+ // receive an explicit error instead of creating a persistent local marker.
1494
1458
  app.use("/_agent-native/auth/local-mode", defineEventHandler(async (event) => {
1495
1459
  if (getMethod(event) !== "POST") {
1496
1460
  setResponseStatus(event, 405);
1497
1461
  return { error: "Method not allowed" };
1498
1462
  }
1499
- if (!isDevEnvironment()) {
1500
- setResponseStatus(event, 403);
1501
- return {
1502
- error: "Local mode is not available in production. Create an account to continue.",
1503
- };
1504
- }
1505
- if (!isLocalDatabase()) {
1506
- setResponseStatus(event, 400);
1507
- return {
1508
- error: "Local mode is only available on a local SQLite database. Your DATABASE_URL points at a shared database — create an account instead.",
1509
- };
1510
- }
1511
- const ok = await setAuthModeLocal();
1512
- if (!ok) {
1513
- setResponseStatus(event, 500);
1514
- return { error: "Failed to enable local mode" };
1515
- }
1516
- return { ok: true };
1463
+ return localModeMarkerDisabled(event);
1517
1464
  }));
1518
1465
  // POST /_agent-native/auth/exit-local-mode — switch back to real auth
1519
1466
  app.use("/_agent-native/auth/exit-local-mode", defineEventHandler(async (event) => {
@@ -1521,15 +1468,7 @@ async function mountBetterAuthRoutes(app, options) {
1521
1468
  setResponseStatus(event, 405);
1522
1469
  return { error: "Method not allowed" };
1523
1470
  }
1524
- const ok = await removeAuthModeLocal();
1525
- if (!ok) {
1526
- setResponseStatus(event, 500);
1527
- return { error: "Failed to disable local mode" };
1528
- }
1529
- // Mark the browser so getSession's dev-mode fallback won't silently
1530
- // re-authenticate the user as local@localhost on the next request.
1531
- setUpgradePendingCookie(event);
1532
- return { ok: true };
1471
+ return exitLocalMode(event);
1533
1472
  }));
1534
1473
  // Backward-compat: POST /_agent-native/auth/login
1535
1474
  app.use("/_agent-native/auth/login", defineEventHandler(async (event) => {
@@ -1606,6 +1545,9 @@ async function mountBetterAuthRoutes(app, options) {
1606
1545
  const body = await readBody(event);
1607
1546
  const email = body?.email?.trim?.()?.toLowerCase?.();
1608
1547
  const password = body?.password;
1548
+ const callbackURL = typeof body?.callbackURL === "string"
1549
+ ? safeReturnPath(body.callbackURL)
1550
+ : "/";
1609
1551
  if (!email || typeof email !== "string" || !email.includes("@")) {
1610
1552
  setResponseStatus(event, 400);
1611
1553
  return { error: "Valid email is required" };
@@ -1616,7 +1558,7 @@ async function mountBetterAuthRoutes(app, options) {
1616
1558
  }
1617
1559
  try {
1618
1560
  await auth.api.signUpEmail({
1619
- body: { email, password, name: email.split("@")[0] },
1561
+ body: { email, password, name: email.split("@")[0], callbackURL },
1620
1562
  });
1621
1563
  return { ok: true };
1622
1564
  }
@@ -1814,15 +1756,7 @@ function mountLocalModeRoutes(app) {
1814
1756
  setResponseStatus(event, 405);
1815
1757
  return { error: "Method not allowed" };
1816
1758
  }
1817
- const ok = await removeAuthModeLocal();
1818
- if (!ok) {
1819
- setResponseStatus(event, 500);
1820
- return { error: "Failed to disable local mode" };
1821
- }
1822
- // Mark the browser so getSession's dev-mode fallback won't silently
1823
- // re-authenticate the user as local@localhost on the next request.
1824
- setUpgradePendingCookie(event);
1825
- return { ok: true };
1759
+ return exitLocalMode(event);
1826
1760
  }));
1827
1761
  // Upgrade path: migrate-local-data must be reachable from local mode
1828
1762
  // because the user is still in local mode when they trigger the upgrade.
@@ -1925,39 +1859,14 @@ function mountAuthFallbackRoutes(app) {
1925
1859
  setResponseStatus(event, 405);
1926
1860
  return { error: "Method not allowed" };
1927
1861
  }
1928
- if (!isDevEnvironment()) {
1929
- setResponseStatus(event, 403);
1930
- return {
1931
- error: "Local mode is not available in production. Create an account to continue.",
1932
- };
1933
- }
1934
- if (!isLocalDatabase()) {
1935
- setResponseStatus(event, 400);
1936
- return {
1937
- error: "Local mode is only available on a local SQLite database. Your DATABASE_URL points at a shared database — create an account instead.",
1938
- };
1939
- }
1940
- const ok = await setAuthModeLocal();
1941
- if (!ok) {
1942
- setResponseStatus(event, 500);
1943
- return { error: "Failed to enable local mode" };
1944
- }
1945
- return { ok: true };
1862
+ return localModeMarkerDisabled(event);
1946
1863
  }));
1947
1864
  app.use("/_agent-native/auth/exit-local-mode", defineEventHandler(async (event) => {
1948
1865
  if (getMethod(event) !== "POST") {
1949
1866
  setResponseStatus(event, 405);
1950
1867
  return { error: "Method not allowed" };
1951
1868
  }
1952
- const ok = await removeAuthModeLocal();
1953
- if (!ok) {
1954
- setResponseStatus(event, 500);
1955
- return { error: "Failed to disable local mode" };
1956
- }
1957
- // Mark the browser so getSession's dev-mode fallback won't silently
1958
- // re-authenticate the user as local@localhost on the next request.
1959
- setUpgradePendingCookie(event);
1960
- return { ok: true };
1869
+ return exitLocalMode(event);
1961
1870
  }));
1962
1871
  app.use("/_agent-native/auth/session", defineEventHandler(async (event) => {
1963
1872
  if (!isReadMethod(event)) {