@agent-native/core 0.72.3 → 0.73.0

package/corpus/core/src/client/mcp-apps/McpAppRenderer.tsx

@@ -1,4 +1,11 @@
-import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import {
+  useCallback,
+  useEffect,
+  useLayoutEffect,
+  useMemo,
+  useRef,
+  useState,
+} from "react";
 import {
   AppBridge,
   PostMessageTransport,
@@ -8,8 +15,14 @@ import {
 } from "@modelcontextprotocol/ext-apps/app-bridge";
 import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 import { IconAlertTriangle, IconLoader2 } from "@tabler/icons-react";
+import {
+  AGENT_NATIVE_EMBED_MESSAGE_TYPES,
+  AGENT_NATIVE_EMBED_PROTOCOL,
+  AGENT_NATIVE_EMBED_VERSION,
+} from "../../embedding/protocol.js";
 import type { AgentMcpAppPayload } from "../../mcp-client/app-result.js";
 import { agentNativePath } from "../api-path.js";
+import { sendToAgentChat, type AgentChatRequestMode } from "../agent-chat.js";
 import { cn } from "../utils.js";
 
 export const DEFAULT_MCP_APP_IFRAME_HEIGHT = 650;
@@ -17,6 +30,8 @@ export const MCP_APP_INITIALIZE_TIMEOUT_MS = 8000;
 const MIN_IFRAME_HEIGHT = 220;
 const VIEWPORT_MARGIN = 16;
 const SANDBOX_FLAGS = "allow-scripts allow-forms allow-popups";
+const useBrowserLayoutEffect =
+  typeof window === "undefined" ? useEffect : useLayoutEffect;
 
 export interface McpAppRendererProps {
   app: AgentMcpAppPayload;
@@ -29,10 +44,24 @@ type ResourceUiMeta = {
   prefersBorder?: boolean;
 };
 
+type McpContentPart = {
+  type?: unknown;
+  text?: unknown;
+  data?: unknown;
+  mimeType?: unknown;
+  url?: unknown;
+};
+
+type McpAppModelContext = {
+  content?: unknown;
+  structuredContent?: unknown;
+};
+
 export function McpAppRenderer({ app, className }: McpAppRendererProps) {
   const iframeRef = useRef<HTMLIFrameElement | null>(null);
   const desiredHeightRef = useRef(DEFAULT_MCP_APP_IFRAME_HEIGHT);
-  const [loadedSrcDoc, setLoadedSrcDoc] = useState<string | null>(null);
+  const modelContextRef = useRef<McpAppModelContext | null>(null);
+  const readyRef = useRef(false);
   const [height, setHeight] = useState(DEFAULT_MCP_APP_IFRAME_HEIGHT);
   const [error, setError] = useState<string | null>(null);
   const [ready, setReady] = useState(false);
@@ -49,6 +78,23 @@ export function McpAppRenderer({ app, className }: McpAppRendererProps) {
   );
   const externalOpenUrl = useMemo(() => openUrlFromMcpApp(app), [app]);
 
+  // Keep the latest payload/permissions/csp reachable from the bridge effect
+  // without making them effect dependencies. The embedded resource identity is
+  // fully captured by `srcDoc`. The bridge effect must NOT re-run when a benign
+  // parent re-render hands us a new `app` object reference with identical
+  // content (common during chat streaming/polling): re-running tears down a
+  // live, already-initialized MCP App (teardownResource) and re-arms the
+  // initialize watchdog against a fresh host AppBridge that the embed shell
+  // will never re-handshake (its connect promise is memoized), surfacing a
+  // false "MCP App did not finish initializing." error after the app is
+  // visibly working.
+  const appRef = useRef(app);
+  const supportedPermissionsRef = useRef(supportedPermissions);
+  const uiCspRef = useRef(uiMeta.csp);
+  appRef.current = app;
+  supportedPermissionsRef.current = supportedPermissions;
+  uiCspRef.current = uiMeta.csp;
+
   useEffect(() => {
     desiredHeightRef.current = DEFAULT_MCP_APP_IFRAME_HEIGHT;
     setHeight(
@@ -57,11 +103,18 @@ export function McpAppRenderer({ app, className }: McpAppRendererProps) {
         availableMcpAppHeight(iframeRef.current),
       ),
     );
-    setLoadedSrcDoc(null);
+    readyRef.current = false;
     setReady(false);
     setError(null);
+    modelContextRef.current = null;
   }, [srcDoc]);
 
+  const markReady = useCallback(() => {
+    readyRef.current = true;
+    setReady(true);
+    setError(null);
+  }, []);
+
   const applyHeight = useCallback((desiredHeight?: number) => {
     if (
       typeof desiredHeight === "number" &&
@@ -114,11 +167,26 @@ export function McpAppRenderer({ app, className }: McpAppRendererProps) {
 
   useEffect(() => {
     const iframe = iframeRef.current;
-    if (!iframe?.contentWindow || !srcDoc || loadedSrcDoc !== srcDoc) return;
+    if (!iframe?.contentWindow || !srcDoc) return;
+    const frameWindow = iframe.contentWindow;
+    const listener = (event: MessageEvent) => {
+      if (event.source !== frameWindow) return;
+      if (isMcpAppReadyMessage(event.data)) {
+        markReady();
+      }
+    };
+    window.addEventListener("message", listener);
+    return () => window.removeEventListener("message", listener);
+  }, [markReady, srcDoc]);
+
+  useBrowserLayoutEffect(() => {
+    const iframe = iframeRef.current;
+    if (!iframe?.contentWindow || !srcDoc) return;
 
+    const currentApp = appRef.current;
     let closed = false;
     const initializeTimer = window.setTimeout(() => {
-      if (closed) return;
+      if (closed || readyRef.current) return;
       setReady(false);
       setError("MCP App did not finish initializing.");
     }, MCP_APP_INITIALIZE_TIMEOUT_MS);
@@ -131,13 +199,13 @@ export function McpAppRenderer({ app, className }: McpAppRendererProps) {
         serverResources: {},
         logging: {},
         sandbox: {
-          permissions: supportedPermissions,
-          csp: uiMeta.csp ?? {},
+          permissions: supportedPermissionsRef.current,
+          csp: uiCspRef.current ?? {},
         },
       },
       {
         hostContext: buildHostContext(
-          app,
+          currentApp,
           availableMcpAppHeight(iframe),
         ) as any,
       },
@@ -152,12 +220,9 @@ export function McpAppRenderer({ app, className }: McpAppRendererProps) {
     bridge.addEventListener("initialized", () => {
       if (closed) return;
       clearTimeout(initializeTimer);
-      setReady(true);
-      // Clear any error the initialize timeout may have set before a slow app
-      // finished — otherwise the error overlay stays stuck over a working app.
-      setError(null);
-      void bridge.sendToolInput({ arguments: app.toolInput });
-      void bridge.sendToolResult(app.toolResult as CallToolResult);
+      markReady();
+      void bridge.sendToolInput({ arguments: appRef.current.toolInput });
+      void bridge.sendToolResult(appRef.current.toolResult as CallToolResult);
     });
     bridge.addEventListener("loggingmessage", ({ level, data }) => {
       if (level === "error" || level === "critical" || level === "alert") {
@@ -170,13 +235,16 @@ export function McpAppRenderer({ app, className }: McpAppRendererProps) {
       return {};
     };
     bridge.oncalltool = async ({ name, arguments: toolArguments }) => {
-      const toolName = normalizeSameServerToolName(app.serverId, name);
+      const toolName = normalizeSameServerToolName(
+        appRef.current.serverId,
+        name,
+      );
       if (!toolName) {
         return errorToolResult("Cross-server MCP App tool calls are blocked.");
       }
       try {
         return await postMcpAppEndpoint<CallToolResult>("call-tool", {
-          serverId: app.serverId,
+          serverId: appRef.current.serverId,
           toolName,
           arguments:
             toolArguments && typeof toolArguments === "object"
@@ -188,22 +256,40 @@ export function McpAppRenderer({ app, className }: McpAppRendererProps) {
       }
     };
     (bridge as any).onlisttools = async () =>
-      postMcpAppEndpoint("list-tools", { serverId: app.serverId });
+      postMcpAppEndpoint("list-tools", { serverId: appRef.current.serverId });
     bridge.onreadresource = async ({ uri }) =>
-      postMcpAppEndpoint("read-resource", { serverId: app.serverId, uri });
+      postMcpAppEndpoint("read-resource", {
+        serverId: appRef.current.serverId,
+        uri,
+      });
     bridge.onlistresources = async () => ({ resources: [] });
     bridge.onlistresourcetemplates = async () => ({ resourceTemplates: [] });
     bridge.ondownloadfile = async () => ({ isError: true });
-    bridge.onmessage = async () => ({ isError: true });
-    bridge.onupdatemodelcontext = async () => ({});
+    bridge.onmessage = async (params) => {
+      const message = messageTextFromMcpUiMessage(params);
+      if (!message.trim()) return { isError: true };
+      const mode = requestModeFromMcpUiMessage(params);
+      sendToAgentChat({
+        message,
+        context: contextTextFromMcpModelContext(modelContextRef.current),
+        images: imageDataUrlsFromMcpContent(params.content),
+        submit: true,
+        openSidebar: true,
+        ...(mode ? { mode } : {}),
+      });
+      return {};
+    };
+    bridge.onupdatemodelcontext = async (params) => {
+      modelContextRef.current = params as McpAppModelContext;
+      return {};
+    };
 
     const transport = new PostMessageTransport(
       iframe.contentWindow,
       iframe.contentWindow,
     );
-    setReady(false);
     setError(null);
-    bridge.connect(transport).catch((err: any) => {
+    void bridge.connect(transport).catch((err: any) => {
       if (!closed) {
         clearTimeout(initializeTimer);
         setError(err?.message ?? "Failed to initialize MCP App.");
@@ -212,8 +298,8 @@ export function McpAppRenderer({ app, className }: McpAppRendererProps) {
 
     return () => {
       closed = true;
+      modelContextRef.current = null;
       clearTimeout(initializeTimer);
-      setReady(false);
       void bridge
         .teardownResource({}, { timeout: 500 })
         .catch(() => undefined)
@@ -221,14 +307,10 @@ export function McpAppRenderer({ app, className }: McpAppRendererProps) {
           void (bridge as any).close?.().catch?.(() => undefined);
         });
     };
-  }, [
-    app,
-    applyHeight,
-    loadedSrcDoc,
-    srcDoc,
-    supportedPermissions,
-    uiMeta.csp,
-  ]);
+    // The embedded resource identity is captured by `srcDoc`; `app`,
+    // `supportedPermissions`, and `uiMeta.csp` are read via refs so a
+    // new-but-equal `app` object reference does not tear down a live bridge.
+  }, [applyHeight, markReady, srcDoc]);
 
   if (!resourceHtml) {
     return (
@@ -277,12 +359,83 @@ export function McpAppRenderer({ app, className }: McpAppRendererProps) {
         sandbox={SANDBOX_FLAGS}
         allow={buildAllowAttribute(supportedPermissions)}
         style={{ height }}
-        onLoad={() => setLoadedSrcDoc(srcDoc)}
       />
     </div>
   );
 }
 
+function messageTextFromMcpUiMessage(params: { content?: unknown }): string {
+  return textPartsFromMcpContent(params.content).join("\n\n").trim();
+}
+
+function requestModeFromMcpUiMessage(
+  params: unknown,
+): AgentChatRequestMode | undefined {
+  const record =
+    params && typeof params === "object" && !Array.isArray(params)
+      ? (params as { mode?: unknown; requestMode?: unknown })
+      : {};
+  const mode = record.requestMode ?? record.mode;
+  return mode === "act" || mode === "plan" ? mode : undefined;
+}
+
+function contextTextFromMcpModelContext(
+  context: McpAppModelContext | null,
+): string | undefined {
+  if (!context) return undefined;
+  const parts = textPartsFromMcpContent(context.content);
+  if (context.structuredContent !== undefined) {
+    parts.push(JSON.stringify(context.structuredContent, null, 2));
+  }
+  const text = parts.join("\n\n").trim();
+  return text || undefined;
+}
+
+function textPartsFromMcpContent(content: unknown): string[] {
+  if (!Array.isArray(content)) return [];
+  return content
+    .map((part): string | null => {
+      const record = contentPartRecord(part);
+      if (
+        !record ||
+        record.type !== "text" ||
+        typeof record.text !== "string"
+      ) {
+        return null;
+      }
+      const text = record.text.trim();
+      return text || null;
+    })
+    .filter((text): text is string => Boolean(text));
+}
+
+function imageDataUrlsFromMcpContent(content: unknown): string[] | undefined {
+  if (!Array.isArray(content)) return undefined;
+  const images = content
+    .map((part): string | null => {
+      const record = contentPartRecord(part);
+      if (!record || record.type !== "image") return null;
+      if (typeof record.url === "string" && record.url.trim()) {
+        return record.url;
+      }
+      if (typeof record.data !== "string" || !record.data.trim()) return null;
+      const mimeType =
+        typeof record.mimeType === "string" &&
+        record.mimeType.startsWith("image/")
+          ? record.mimeType
+          : "image/png";
+      return `data:${mimeType};base64,${record.data}`;
+    })
+    .filter((image): image is string => Boolean(image));
+  return images.length ? images : undefined;
+}
+
+function contentPartRecord(part: unknown): McpContentPart | null {
+  return part && typeof part === "object" && !Array.isArray(part)
+    ? (part as McpContentPart)
+    : null;
+}
+
 function resourceUiMeta(app: AgentMcpAppPayload): ResourceUiMeta {
   const meta = app.resource?._meta;
   const ui =
@@ -341,8 +494,31 @@ export function supportedMcpAppPermissions(
   return permissions?.clipboardWrite ? { clipboardWrite: {} } : {};
 }
 
+export function isMcpAppReadyMessage(data: unknown): boolean {
+  if (!data || typeof data !== "object" || Array.isArray(data)) return false;
+  const record = data as {
+    protocol?: unknown;
+    version?: unknown;
+    type?: unknown;
+  };
+  if (
+    record.protocol === AGENT_NATIVE_EMBED_PROTOCOL &&
+    record.version === AGENT_NATIVE_EMBED_VERSION &&
+    record.type === AGENT_NATIVE_EMBED_MESSAGE_TYPES.READY
+  ) {
+    return true;
+  }
+  const type = record.type;
+  return (
+    type === "agentNative.embeddedAppReady" ||
+    type === "agentNative.frameOrigin"
+  );
+}
+
 export function buildMcpAppCsp(csp: McpUiResourceCsp | undefined): string {
-  const connect = sanitizeCspSources(csp?.connectDomains);
+  const connect = withLocalWebSocketSources(
+    sanitizeCspSources(csp?.connectDomains),
+  );
   const resources = sanitizeCspSources(csp?.resourceDomains);
   const frames = sanitizeCspSources(csp?.frameDomains);
   const base = sanitizeCspSources(csp?.baseUriDomains);
@@ -369,6 +545,24 @@ function sanitizeCspSources(values: string[] | undefined): string[] {
   return [...new Set(out)];
 }
 
+function withLocalWebSocketSources(sources: string[]): string[] {
+  const out = [...sources];
+  for (const source of sources) {
+    try {
+      const url = new URL(source);
+      if (
+        url.protocol === "http:" &&
+        ["localhost", "127.0.0.1", "::1"].includes(url.hostname)
+      ) {
+        out.push(`ws://${url.host}`);
+      }
+    } catch {
+      // Ignore non-URL CSP source expressions.
+    }
+  }
+  return [...new Set(out)];
+}
+
 function sanitizeCspSource(value: string): string | null {
   const source = value.trim();
   if (!source || source.includes("'") || /[\s;]/.test(source)) return null;

package/corpus/core/src/client/resources/use-mcp-servers.ts

@@ -20,6 +20,7 @@ export interface McpServer {
   url: string;
   headers?: Record<string, { set: true }>;
   description?: string;
+  firstParty?: boolean;
   createdAt: number;
   mergedId: string;
   status:

package/corpus/core/src/client/settings/DemoModeSection.tsx

@@ -33,7 +33,9 @@ export function DemoModeSection() {
   const { data } = useQuery({
     queryKey: ["agent-native", "demo-mode"],
     queryFn: async () => {
-      const res = await fetch(DEMO_STATUS_URL, { credentials: "include" });
+      const res = await fetch(DEMO_STATUS_URL, {
+        credentials: "same-origin",
+      });
       if (!res.ok) return null;
       return (await res.json()) as DemoStatus | null;
     },

package/corpus/core/src/demo/fetch-interceptor.ts

@@ -91,7 +91,7 @@ function methodOf(input: RequestInfo | URL, init?: RequestInit): string {
 async function refreshDemoFlag(): Promise<void> {
   const f = originalFetch ?? fetch;
   try {
-    const res = await f(STATUS_PATH, { credentials: "include" });
+    const res = await f(STATUS_PATH, { credentials: "same-origin" });
     if (!res.ok) return;
     const json = (await res.json()) as {
       enabled?: boolean;

package/corpus/core/src/embedding/agent.ts

@@ -1,4 +1,9 @@
-import { A2AClient, callAgent, type Message, type Task } from "../a2a/index.js";
+import {
+  A2AClient,
+  callAgent,
+  type Message,
+  type Task,
+} from "@agent-native/core/a2a";
 
 export interface AgentEndpointOptions {
   /**

package/corpus/core/src/embedding/bridge.ts

@@ -1,3 +1,7 @@
+import {
+  MCP_APP_CHAT_BRIDGE_QUERY_PARAM,
+  EMBED_MODE_QUERY_PARAM,
+} from "../shared/embed-auth.js";
 import {
   AGENT_NATIVE_EMBED_MESSAGE_TYPES,
   createAgentNativeEmbedEnvelope,
@@ -61,10 +65,38 @@ type PendingRequest = {
 
 function resolveParentOrigin(win: Window, explicit?: string): string | null {
   if (explicit) return explicit;
+  if (shouldUseOpaqueParentTarget(win)) return "*";
   const referrerOrigin = embeddedAppOrigin(win.document?.referrer ?? "");
   return referrerOrigin;
 }
 
+function shouldUseOpaqueParentTarget(win: Window): boolean {
+  try {
+    const url = new URL(win.location.href);
+    const chatBridge = url.searchParams.get(MCP_APP_CHAT_BRIDGE_QUERY_PARAM);
+    const embedMode = url.searchParams.get(EMBED_MODE_QUERY_PARAM);
+    return (
+      chatBridge === "1" ||
+      chatBridge === "true" ||
+      embedMode === "1" ||
+      embedMode === "true"
+    );
+  } catch {
+    return false;
+  }
+}
+
+function defaultAllowedOrigins(
+  parentOrigin: string | null,
+  referrerOrigin: string | null,
+): string[] {
+  if (!parentOrigin) return [];
+  if (parentOrigin === "*") {
+    return ["null", ...(referrerOrigin ? [referrerOrigin] : [])];
+  }
+  return [parentOrigin];
+}
+
 function postToParent(
   win: Window,
   parent: Window | null,
@@ -83,9 +115,10 @@ export function createEmbeddedAppBridge(
 ): EmbeddedAppBridge {
   const win = options.currentWindow ?? window;
   const parentOrigin = resolveParentOrigin(win, options.parentOrigin);
+  const referrerOrigin = embeddedAppOrigin(win.document?.referrer ?? "");
   const allowedOrigins =
     options.allowedOrigins ??
-    (parentOrigin && parentOrigin !== "*" ? [parentOrigin] : []);
+    defaultAllowedOrigins(parentOrigin, referrerOrigin);
   const pending = new Map<string, PendingRequest>();
   let destroyed = false;
 

package/corpus/core/src/mcp/build-server.ts

@@ -152,6 +152,8 @@ export interface MCPCallerIdentity {
   oauthScopes?: string[];
   /** Present only for standard remote MCP OAuth access tokens. */
   oauthClientId?: string;
+  /** Present only for framework-minted first-party MCP client tokens. */
+  firstPartyMcp?: boolean;
 }
 
 /** Per-request context used to turn an action's relative deep link into the
@@ -748,7 +750,7 @@ function safeUiSegment(value: string | undefined, fallback: string): string {
 
 // ChatGPT and Claude cache MCP App resource HTML by `ui://` URI. Bump this
 // when the shared shell changes in a way that must invalidate host caches.
-const MCP_APP_RESOURCE_SHELL_VERSION = "shell-v46";
+const MCP_APP_RESOURCE_SHELL_VERSION = "shell-v51";
 
 function legacyDefaultMcpAppUri(config: MCPConfig, actionName: string): string {
   const app = safeUiSegment(config.appId ?? config.name, "agent-native");
@@ -1785,6 +1787,7 @@ function addSecretCandidate(
 
 async function verifyA2AJwtForMcp(
   token: string,
+  resourceUrl?: string | string[],
 ): Promise<Record<string, unknown> | null> {
   const jose = await import("jose");
   let unverifiedPayload: Record<string, unknown> | null = null;
@@ -1813,21 +1816,43 @@ async function verifyA2AJwtForMcp(
     }
   }
 
+  const firstPartyMcp = unverifiedPayload.agent_native_first_party_mcp === true;
+  const audiences = firstPartyMcp ? mcpAudienceList(resourceUrl) : null;
+  if (firstPartyMcp && !audiences?.length) return null;
+
   for (const secret of candidateSecrets) {
-    try {
-      const { payload } = await jose.jwtVerify(
-        token,
-        new TextEncoder().encode(secret),
-      );
-      return payload as Record<string, unknown>;
-    } catch {
-      // Try the next candidate without exposing which secret matched.
+    const encodedSecret = new TextEncoder().encode(secret);
+    for (const audience of audiences ?? [undefined]) {
+      try {
+        const { payload } = await jose.jwtVerify(
+          token,
+          encodedSecret,
+          audience ? { audience } : undefined,
+        );
+        return payload as Record<string, unknown>;
+      } catch {
+        // Try the next candidate without exposing which secret matched.
+      }
     }
   }
 
   return null;
 }
 
+function mcpAudienceList(resource: string | string[] | undefined): string[] {
+  const raw = Array.isArray(resource) ? resource : resource ? [resource] : [];
+  const seen = new Set<string>();
+  const out: string[] = [];
+  for (const value of raw) {
+    const normalized = value.replace(/\/+$/, "");
+    if (normalized && !seen.has(normalized)) {
+      seen.add(normalized);
+      out.push(normalized);
+    }
+  }
+  return out;
+}
+
 async function isConnectTokenAllowed(
   jti: string | undefined,
 ): Promise<boolean> {
@@ -1941,7 +1966,7 @@ export async function verifyAuth(
 
   // Try an A2A JWT via the shared A2A_SECRET first, then the caller org's
   // synced A2A secret when the token carries org_domain.
-  const payload = await verifyA2AJwtForMcp(token);
+  const payload = await verifyA2AJwtForMcp(token, options.resourceUrl);
   if (payload) {
     const tokenScope =
       typeof payload.scope === "string" ? payload.scope : undefined;
@@ -1976,6 +2001,9 @@ export async function verifyAuth(
           typeof payload.org_domain === "string"
             ? (payload.org_domain as string)
             : undefined,
+        ...(payload.agent_native_first_party_mcp === true
+          ? { firstPartyMcp: true }
+          : {}),
       },
       // Verified JWT (connect-minted or A2A delegation) — a real caller.
       fullSurface: true,