@agent-native/core 0.72.3 → 0.73.0

package/dist/shared/mcp-embed-headers.js

@@ -1,7 +1,13 @@
-export const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
+export const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
 export const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 const CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\.claudemcpcontent\.com$/i;
 const CHATGPT_MCP_SANDBOX_HOST_RE = /^(?:[^.]+\.)?web-sandbox\.oaiusercontent\.com$/i;
+const AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX = ".agent-native.com";
+const MCP_PRODUCT_HOST_ORIGINS = new Set([
+    "https://chat.openai.com",
+    "https://chatgpt.com",
+    "https://claude.ai",
+]);
 export function isLocalMcpEmbedOrigin(origin) {
     if (!origin)
         return false;
@@ -37,16 +43,47 @@ export function isChatGptMcpSandboxOrigin(origin) {
         return false;
     }
 }
+export function isMcpProductHostOrigin(origin) {
+    if (!origin)
+        return false;
+    try {
+        return MCP_PRODUCT_HOST_ORIGINS.has(new URL(origin).origin);
+    }
+    catch {
+        return false;
+    }
+}
+export function isAgentNativeFirstPartyAppOrigin(origin) {
+    if (!origin)
+        return false;
+    try {
+        const url = new URL(origin);
+        const hostname = url.hostname.toLowerCase();
+        return (url.protocol === "https:" &&
+            !url.username &&
+            !url.password &&
+            !url.port &&
+            hostname.endsWith(AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX) &&
+            hostname.length > AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX.length);
+    }
+    catch {
+        return false;
+    }
+}
 export function isMcpEmbedCorsOrigin(origin) {
     return (origin === "null" ||
         isLocalMcpEmbedOrigin(origin) ||
         isClaudeMcpContentOrigin(origin) ||
-        isChatGptMcpSandboxOrigin(origin));
+        isChatGptMcpSandboxOrigin(origin) ||
+        isMcpProductHostOrigin(origin) ||
+        isAgentNativeFirstPartyAppOrigin(origin));
 }
 export function shouldAllowMcpEmbedCredentials(origin) {
     return (origin !== "null" &&
         !isClaudeMcpContentOrigin(origin) &&
-        !isChatGptMcpSandboxOrigin(origin));
+        !isChatGptMcpSandboxOrigin(origin) &&
+        !isMcpProductHostOrigin(origin) &&
+        !isAgentNativeFirstPartyAppOrigin(origin));
 }
 export const MCP_EMBED_STATIC_ASSET_HEADERS = {
     "Access-Control-Allow-Origin": "*",

package/dist/shared/mcp-embed-headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-embed-headers.js","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GACvC,8JAA8J,CAAC;AACjK,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAEzE,MAAM,0BAA0B,GAAG,wCAAwC,CAAC;AAC5E,MAAM,2BAA2B,GAC/B,iDAAiD,CAAC;AAEpD,MAAM,UAAU,qBAAqB,CACnC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,OAAO;YACxB,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC3E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC/C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAiC;IAEjC,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,qBAAqB,CAAC,MAAM,CAAC;QAC7B,wBAAwB,CAAC,MAAM,CAAC;QAChC,yBAAyB,CAAC,MAAM,CAAC,CAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAiC;IAEjC,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,CAAC,wBAAwB,CAAC,MAAM,CAAC;QACjC,CAAC,yBAAyB,CAAC,MAAM,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,cAAc;CACtC,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B,YAAY;IACZ,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,qBAAqB;IACrB,qBAAqB;CACtB,CAAC;AAEF,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAGP,EAAE,CAAC;IACP,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC7D,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["export const MCP_EMBED_CORS_ALLOW_HEADERS =\n  \"Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant\";\nexport const EMBED_TRANSPLANT_HEADER = \"x-agent-native-embed-transplant\";\n\nconst CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\\.claudemcpcontent\\.com$/i;\nconst CHATGPT_MCP_SANDBOX_HOST_RE =\n  /^(?:[^.]+\\.)?web-sandbox\\.oaiusercontent\\.com$/i;\n\nexport function isLocalMcpEmbedOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"http:\" &&\n      [\"localhost\", \"127.0.0.1\", \"::1\", \"[::1]\"].includes(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isClaudeMcpContentOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"https:\" && CLAUDE_MCP_CONTENT_HOST_RE.test(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isChatGptMcpSandboxOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"https:\" &&\n      CHATGPT_MCP_SANDBOX_HOST_RE.test(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isMcpEmbedCorsOrigin(\n  origin: string | null | undefined,\n): boolean {\n  return (\n    origin === \"null\" ||\n    isLocalMcpEmbedOrigin(origin) ||\n    isClaudeMcpContentOrigin(origin) ||\n    isChatGptMcpSandboxOrigin(origin)\n  );\n}\n\nexport function shouldAllowMcpEmbedCredentials(\n  origin: string | null | undefined,\n): boolean {\n  return (\n    origin !== \"null\" &&\n    !isClaudeMcpContentOrigin(origin) &&\n    !isChatGptMcpSandboxOrigin(origin)\n  );\n}\n\nexport const MCP_EMBED_STATIC_ASSET_HEADERS = {\n  \"Access-Control-Allow-Origin\": \"*\",\n  \"Cross-Origin-Resource-Policy\": \"cross-origin\",\n} as const;\n\nconst STATIC_ASSET_PATTERNS = [\n  \"/assets/**\",\n  \"/favicon.ico\",\n  \"/favicon.svg\",\n  \"/manifest.json\",\n  \"/icon-*.svg\",\n  \"/agent-native-*.svg\",\n  \"/library-presets/**\",\n];\n\nfunction normalizeBasePath(basePath: string | undefined): string {\n  const base = (basePath ?? \"\").trim();\n  if (!base || base === \"/\") return \"\";\n  return base.startsWith(\"/\")\n    ? base.replace(/\\/+$/g, \"\")\n    : `/${base.replace(/\\/+$/g, \"\")}`;\n}\n\nexport function mcpEmbedStaticAssetRouteRules(\n  basePath?: string,\n): Record<string, { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }> {\n  const base = normalizeBasePath(basePath);\n  const rules: Record<\n    string,\n    { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }\n  > = {};\n  for (const pattern of STATIC_ASSET_PATTERNS) {\n    rules[pattern] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n    if (base) {\n      rules[`${base}${pattern}`] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n    }\n  }\n  return rules;\n}\n"]}
+{"version":3,"file":"mcp-embed-headers.js","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GACvC,sLAAsL,CAAC;AACzL,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAEzE,MAAM,0BAA0B,GAAG,wCAAwC,CAAC;AAC5E,MAAM,2BAA2B,GAC/B,iDAAiD,CAAC;AACpD,MAAM,wCAAwC,GAAG,mBAAmB,CAAC;AACrE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,yBAAyB;IACzB,qBAAqB;IACrB,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,OAAO;YACxB,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC3E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC/C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,wBAAwB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,IAAI;YACT,QAAQ,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAC3D,QAAQ,CAAC,MAAM,GAAG,wCAAwC,CAAC,MAAM,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAiC;IAEjC,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,qBAAqB,CAAC,MAAM,CAAC;QAC7B,wBAAwB,CAAC,MAAM,CAAC;QAChC,yBAAyB,CAAC,MAAM,CAAC;QACjC,sBAAsB,CAAC,MAAM,CAAC;QAC9B,gCAAgC,CAAC,MAAM,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAiC;IAEjC,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,CAAC,wBAAwB,CAAC,MAAM,CAAC;QACjC,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAClC,CAAC,sBAAsB,CAAC,MAAM,CAAC;QAC/B,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,cAAc;CACtC,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B,YAAY;IACZ,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,qBAAqB;IACrB,qBAAqB;CACtB,CAAC;AAEF,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAGP,EAAE,CAAC;IACP,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC7D,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["export const MCP_EMBED_CORS_ALLOW_HEADERS =\n  \"Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant\";\nexport const EMBED_TRANSPLANT_HEADER = \"x-agent-native-embed-transplant\";\n\nconst CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\\.claudemcpcontent\\.com$/i;\nconst CHATGPT_MCP_SANDBOX_HOST_RE =\n  /^(?:[^.]+\\.)?web-sandbox\\.oaiusercontent\\.com$/i;\nconst AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX = \".agent-native.com\";\nconst MCP_PRODUCT_HOST_ORIGINS = new Set([\n  \"https://chat.openai.com\",\n  \"https://chatgpt.com\",\n  \"https://claude.ai\",\n]);\n\nexport function isLocalMcpEmbedOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"http:\" &&\n      [\"localhost\", \"127.0.0.1\", \"::1\", \"[::1]\"].includes(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isClaudeMcpContentOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"https:\" && CLAUDE_MCP_CONTENT_HOST_RE.test(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isChatGptMcpSandboxOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"https:\" &&\n      CHATGPT_MCP_SANDBOX_HOST_RE.test(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isMcpProductHostOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    return MCP_PRODUCT_HOST_ORIGINS.has(new URL(origin).origin);\n  } catch {\n    return false;\n  }\n}\n\nexport function isAgentNativeFirstPartyAppOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    const hostname = url.hostname.toLowerCase();\n    return (\n      url.protocol === \"https:\" &&\n      !url.username &&\n      !url.password &&\n      !url.port &&\n      hostname.endsWith(AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX) &&\n      hostname.length > AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX.length\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isMcpEmbedCorsOrigin(\n  origin: string | null | undefined,\n): boolean {\n  return (\n    origin === \"null\" ||\n    isLocalMcpEmbedOrigin(origin) ||\n    isClaudeMcpContentOrigin(origin) ||\n    isChatGptMcpSandboxOrigin(origin) ||\n    isMcpProductHostOrigin(origin) ||\n    isAgentNativeFirstPartyAppOrigin(origin)\n  );\n}\n\nexport function shouldAllowMcpEmbedCredentials(\n  origin: string | null | undefined,\n): boolean {\n  return (\n    origin !== \"null\" &&\n    !isClaudeMcpContentOrigin(origin) &&\n    !isChatGptMcpSandboxOrigin(origin) &&\n    !isMcpProductHostOrigin(origin) &&\n    !isAgentNativeFirstPartyAppOrigin(origin)\n  );\n}\n\nexport const MCP_EMBED_STATIC_ASSET_HEADERS = {\n  \"Access-Control-Allow-Origin\": \"*\",\n  \"Cross-Origin-Resource-Policy\": \"cross-origin\",\n} as const;\n\nconst STATIC_ASSET_PATTERNS = [\n  \"/assets/**\",\n  \"/favicon.ico\",\n  \"/favicon.svg\",\n  \"/manifest.json\",\n  \"/icon-*.svg\",\n  \"/agent-native-*.svg\",\n  \"/library-presets/**\",\n];\n\nfunction normalizeBasePath(basePath: string | undefined): string {\n  const base = (basePath ?? \"\").trim();\n  if (!base || base === \"/\") return \"\";\n  return base.startsWith(\"/\")\n    ? base.replace(/\\/+$/g, \"\")\n    : `/${base.replace(/\\/+$/g, \"\")}`;\n}\n\nexport function mcpEmbedStaticAssetRouteRules(\n  basePath?: string,\n): Record<string, { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }> {\n  const base = normalizeBasePath(basePath);\n  const rules: Record<\n    string,\n    { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }\n  > = {};\n  for (const pattern of STATIC_ASSET_PATTERNS) {\n    rules[pattern] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n    if (base) {\n      rules[`${base}${pattern}`] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n    }\n  }\n  return rules;\n}\n"]}

package/dist/sharing/actions/list-resource-shares.d.ts

@@ -15,7 +15,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     ownerEmail: any;
     orgId: any;
     visibility: any;
-    role: "owner" | import("../schema.js").ShareRole;
+    role: import("../schema.js").ShareRole | "owner";
     shares: any;
     policy: {
         allowPublic: boolean;

package/dist/sharing/actions/set-resource-visibility.d.ts

@@ -1,10 +1,10 @@
 declare const _default: import("../../action.js").ActionDefinition<{
     resourceType: string;
     resourceId: string;
-    visibility: "public" | "private" | "org";
+    visibility: "private" | "org" | "public";
 }, {
     ok: boolean;
-    visibility: "public" | "private" | "org";
+    visibility: "private" | "org" | "public";
 }>;
 export default _default;
 //# sourceMappingURL=set-resource-visibility.d.ts.map

package/dist/sharing/actions/share-resource.d.ts

@@ -5,7 +5,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     resourceId: string;
     principalType: "org" | "user";
     principalId: string;
-    role?: "admin" | "viewer" | "editor";
+    role?: "viewer" | "editor" | "admin";
     notify?: boolean;
     resourceUrl?: string;
 }, {

package/dist/sharing/schema.d.ts

@@ -138,7 +138,7 @@ export declare function createSharesTable(tableName: string): import("drizzle-or
             tableName: string;
             dataType: "string";
             columnType: "SQLiteText";
-            data: "admin" | "viewer" | "editor";
+            data: "viewer" | "editor" | "admin";
             driverParam: string;
             notNull: true;
             hasDefault: true;

package/dist/templates/default/AGENTS.md

@@ -38,6 +38,10 @@ Read these local package docs before implementing advanced Agent Native
 features. Prefer this app's own `AGENTS.md` and `.agents/skills/` for
 app-specific rules, then use the corpus for reusable framework/template
 patterns.
+After updating `@agent-native/core`, run `pnpm skills:update` or
+`npx @agent-native/core@latest skills update scaffold --project` from the app
+root to refresh framework-provided `.agents/skills` and repair `CLAUDE.md` /
+`.claude/skills` compatibility links.
 
 ### Database Code
 

package/dist/templates/default/package.json

@@ -8,7 +8,8 @@
     "start": "agent-native start",
     "typecheck": "agent-native typecheck",
     "action": "agent-native action",
-    "script": "agent-native script"
+    "script": "agent-native script",
+    "skills:update": "agent-native skills update scaffold --project"
   },
   "dependencies": {
     "@agent-native/core": "latest",

package/dist/templates/headless/AGENTS.md

@@ -38,6 +38,10 @@ first-party template patterns ships in `node_modules/@agent-native/core/corpus`.
 Read these local package docs before implementing advanced Agent Native
 features. Prefer this app's own `AGENTS.md` for app-specific rules, then use
 the corpus for reusable framework/template patterns.
+After updating `@agent-native/core`, run `pnpm skills:update` or
+`npx @agent-native/core@latest skills update scaffold --project` from the app
+root to refresh framework-provided `.agents/skills` and repair `CLAUDE.md` /
+`.claude/skills` compatibility links.
 
 ## Actions
 

package/dist/templates/headless/package.json

@@ -6,6 +6,7 @@
     "action": "agent-native action",
     "agent": "agent-native agent",
     "script": "agent-native script",
+    "skills:update": "agent-native skills update scaffold --project",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {

package/dist/templates/workspace-root/AGENTS.md

@@ -27,6 +27,10 @@ first-party template patterns ships in `node_modules/@agent-native/core/corpus`.
 Use package docs for framework APIs, the package corpus for reusable
 framework/template patterns, and `packages/shared/AGENTS.md` plus
 `packages/shared/.agents/skills/` for workspace-specific conventions.
+After updating `@agent-native/core`, run `pnpm skills:update` or
+`npx @agent-native/core@latest skills update scaffold --project` from the
+workspace root to refresh framework-provided shared skills and repair
+`CLAUDE.md` / `.claude/skills` compatibility links.
 
 ## Core Agent Rule
 

package/dist/templates/workspace-root/README.md

@@ -35,6 +35,10 @@ the shared package (`@{{APP_NAME}}/shared`).
 
 The workspace root also links `.agents/skills` to the shared package so coding
 agents launched from the root can discover the same workspace-wide skills.
+Run `pnpm skills:update` (or
+`npx @agent-native/core@latest skills update scaffold --project`) after updating
+`@agent-native/core` to refresh framework-provided shared skills and repair
+Claude compatibility links.
 
 Runtime-editable global resources live in Dispatch, not in `packages/shared`.
 Use Dispatch **Resources** for company context and guardrails that admins should

package/dist/templates/workspace-root/package.json

@@ -7,6 +7,7 @@
     "build": "pnpm -r build",
     "typecheck": "pnpm -r typecheck",
     "repair:workspace-org": "tsx scripts/repair-workspace-org.ts",
+    "skills:update": "agent-native skills update scaffold --project",
     "fmt:check": "prettier --check .",
     "lint": "pnpm fmt:check"
   },

package/dist/vite/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/vite/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAU,UAAU,EAAE,MAAM,MAAM,CAAC;AAmB/C,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,kCAAkC,CAAC;AA0H1C;;;;;GAKG;AACH,iBAAS,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAgE9C;AAED;;;;;;GAMG;AACH,iBAAS,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkCvD;AAOD;;;;;GAKG;AACH,iBAAS,qBAAqB,CAC5B,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAc9C;AAoCD,iBAAS,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAmNrD;AAsKD,MAAM,WAAW,YAAY;IAC3B,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,YAAY,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9E,oGAAoG;IACpG,QAAQ,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,8BAA8B;IAC9B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,iDAAiD;IACjD,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iDAAiD;IACjD,YAAY,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IACvD,wCAAwC;IACxC,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,iCAAiC,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD;AA+dD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,GAAG,SAAS,CAMpB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAWT;AAsRD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,UAAU,CAuS1E;AAED,OAAO,EACL,eAAe,IAAI,gBAAgB,EACnC,sBAAsB,IAAI,uBAAuB,EACjD,mBAAmB,IAAI,oBAAoB,EAC3C,qBAAqB,IAAI,sBAAsB,GAChD,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/vite/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAU,UAAU,EAAE,MAAM,MAAM,CAAC;AAmB/C,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,kCAAkC,CAAC;AA0H1C;;;;;GAKG;AACH,iBAAS,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAgE9C;AAED;;;;;;GAMG;AACH,iBAAS,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkCvD;AAOD;;;;;GAKG;AACH,iBAAS,qBAAqB,CAC5B,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAc9C;AAoCD,iBAAS,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAmNrD;AAsKD,MAAM,WAAW,YAAY;IAC3B,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,YAAY,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9E,oGAAoG;IACpG,QAAQ,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,8BAA8B;IAC9B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,iDAAiD;IACjD,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iDAAiD;IACjD,YAAY,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IACvD,wCAAwC;IACxC,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,iCAAiC,CAAC;IAChD;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD;AAohBD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,GAAG,SAAS,CAMpB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAWT;AAsRD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,UAAU,CAuS1E;AAED,OAAO,EACL,eAAe,IAAI,gBAAgB,EACnC,sBAAsB,IAAI,uBAAuB,EACjD,mBAAmB,IAAI,oBAAoB,EAC3C,qBAAqB,IAAI,sBAAsB,GAChD,CAAC"}

package/dist/vite/client.js

@@ -721,6 +721,45 @@ const VITE_RUNTIME_PATH_PREFIXES = [
     "/packages/",
     "/src/",
 ];
+const EMBED_DEV_STATIC_ASSET_PATH_PREFIXES = [
+    ...VITE_RUNTIME_PATH_PREFIXES,
+    "/assets/",
+    "/library-presets/",
+];
+const EMBED_DEV_STATIC_ASSET_PATHS = new Set([
+    "/favicon.ico",
+    "/favicon.svg",
+    "/manifest.json",
+]);
+function mountedPathCandidates(reqUrl, base) {
+    if (!reqUrl)
+        return [];
+    let pathname;
+    try {
+        pathname = new URL(reqUrl, "http://agent-native.local").pathname;
+    }
+    catch {
+        return [];
+    }
+    if (base && base !== "/") {
+        const normalizedBase = base.endsWith("/") ? base : `${base}/`;
+        if (pathname.startsWith(normalizedBase)) {
+            return [pathname.slice(normalizedBase.length - 1) || "/"];
+        }
+    }
+    return [pathname];
+}
+function isEmbedDevStaticAssetRequest(reqUrl, base) {
+    return mountedPathCandidates(reqUrl, base).some((pathname) => {
+        if (EMBED_DEV_STATIC_ASSET_PATHS.has(pathname))
+            return true;
+        if (/^\/icon-[^/]+\.svg$/i.test(pathname))
+            return true;
+        if (/^\/agent-native-[^/]+\.svg$/i.test(pathname))
+            return true;
+        return EMBED_DEV_STATIC_ASSET_PATH_PREFIXES.some((prefix) => pathname.startsWith(prefix));
+    });
+}
 function cookieValue(req, name) {
     const header = req.headers.cookie;
     if (typeof header !== "string" || !header)
@@ -918,6 +957,11 @@ function embedDevFrameHeaders() {
         configureServer(server) {
             server.middlewares.use((req, res, next) => {
                 const origin = String(req.headers.origin ?? "");
+                if (isEmbedDevStaticAssetRequest(req.url, server.config?.base)) {
+                    for (const [name, value] of Object.entries(MCP_EMBED_STATIC_ASSET_HEADERS)) {
+                        res.setHeader(name, value);
+                    }
+                }
                 if (isMcpEmbedCorsOrigin(origin)) {
                     res.setHeader("Access-Control-Allow-Origin", origin);
                     res.setHeader("Vary", "Origin");