@agent-native/core 0.72.3 → 0.73.0

package/corpus/core/src/mcp/embed-app.ts

@@ -114,6 +114,7 @@ export function embedApp(
     const frameReadyMessageDelays = [0, 200, 500, 1500, 3000, 7000, 15000, 30000];
     const frameReadyTimeoutMs = 45000;
     const frameLoadTimeoutMs = 45000;
+    const maxEmbedSessionRefreshAttempts = 2;
     const defaultOpenAiBridgeWaitMs = 200;
     const chatGptOpenAiBridgeWaitMs = 5000;
     const openAiBridgePollMs = 50;
@@ -121,6 +122,7 @@ export function embedApp(
     const nativeBridgeRequestTimeoutMs = 30000;
     const wrapperRequestTimeoutMs = 5000;
     let app = null;
+    let appConnectPromise = null;
     let openAiBridge = null;
     let wrapperRequestId = 0;
     const wrapperRequests = new Map();
@@ -134,6 +136,7 @@ export function embedApp(
     let appFrameReadyTimer = null;
     let appFrameLoadTimer = null;
     let lastFrameSrc = "";
+    let embedSessionRefreshAttempts = 0;
 
     function esc(value) {
       return String(value ?? "")
@@ -269,9 +272,9 @@ export function embedApp(
         record.deepLinkUrl,
         record.deepLink,
         record.openUrl,
-        record.url,
         structuredOpenLinkUrl,
-        metaUrl
+        metaUrl,
+        record.url
       ]);
     }
 
@@ -324,6 +327,12 @@ export function embedApp(
       try { appFrame.contentWindow.postMessage(message, "*"); } catch {}
     }
 
+    function notifyOuterMcpAppReady() {
+      try {
+        window.parent.postMessage({ type: "agentNative.embeddedAppReady" }, "*");
+      } catch {}
+    }
+
     function nextWrapperRequestId() {
       wrapperRequestId += 1;
       return "mcp-wrapper-" + Date.now() + "-" + wrapperRequestId;
@@ -640,6 +649,21 @@ export function embedApp(
       );
     }
 
+    function importHeadChildrenWithBase(source, baseHref) {
+      const base = document.createElement("base");
+      base.href = baseHref;
+      const nodes = Array.from(source.childNodes).filter((node) => {
+        return !(
+          node.nodeType === 1 &&
+          String(node.nodeName || "").toLowerCase() === "base"
+        );
+      });
+      document.head.replaceChildren(
+        base,
+        ...nodes.map((node) => document.importNode(node, true))
+      );
+    }
+
     function isModuleScript(script) {
       return (script.getAttribute("type") || "").trim().toLowerCase() === "module";
     }
@@ -835,10 +859,7 @@ export function embedApp(
       );
       const scripts = Array.from(parsed.querySelectorAll("script"));
       copyDocumentElementAttributes(parsed.documentElement);
-      importChildren(parsed.head, document.head);
-      const base = document.createElement("base");
-      base.href = config.baseHref;
-      document.head.prepend(base);
+      importHeadChildrenWithBase(parsed.head, config.baseHref);
       importChildren(parsed.body, document.body);
       installExternalOpenControl(appUrl);
       for (const script of scripts) {
@@ -920,6 +941,7 @@ export function embedApp(
         window.history.replaceState(window.history.state, "", localPathFromUrl(appUrl, false));
       } catch {}
       await mountTransplantedHtml(html, appUrl);
+      embedSessionRefreshAttempts = 0;
       notifyHostHeightRepeatedly();
     }
 
@@ -1159,6 +1181,7 @@ export function embedApp(
       frame.addEventListener("load", () => {
         if (appFrame !== frame) return;
         clearFrameLoadTimer();
+        notifyOuterMcpAppReady();
         sendFrameReadyMessages(frame);
         startFrameReadyTimer(frame);
       });
@@ -1177,6 +1200,13 @@ export function embedApp(
         renderFrameFallback();
         return;
       }
+      if (embedSessionRefreshAttempts >= maxEmbedSessionRefreshAttempts) {
+        renderAppLaunchError(
+          "Embedded app session expired. Reopen the app to mint a fresh session."
+        );
+        return;
+      }
+      embedSessionRefreshAttempts += 1;
       openStartUrl = "";
       startedFor = "";
       lastFrameSrc = "";
@@ -1193,19 +1223,6 @@ export function embedApp(
       return true;
     }
 
-    // We have connected to a standards-track MCP Apps host (Codex, Cursor,
-    // Claude over the SDK, our own renderer, …) through the postMessage
-    // \`ui/*\` bridge rather than ChatGPT's \`window.openai\` global. These hosts
-    // render the resource in a strict sandboxed iframe (typically
-    // \`sandbox="allow-scripts"\`, opaque origin). Self-navigating that iframe to
-    // the real app origin tears down the host bridge and loses the opaque-origin
-    // auth context, which shows up as a permanent / flashing loading state.
-    // Transplanting the app document into the shell keeps the bridge alive and
-    // works under the opaque origin via embed-token auth, exactly like Claude.
-    function isNativeMcpAppsBridgeHost() {
-      return !!app && !openAiBridge;
-    }
-
     function shouldTransplantAppDocument() {
       const render = renderModeSource();
       const mode = render.mode;
@@ -1215,7 +1232,6 @@ export function embedApp(
       return (
         isClaudeMcpContentHost() ||
         isChatGptSandboxHost() ||
-        isNativeMcpAppsBridgeHost() ||
         mode === "transplant" ||
         render.frame === "transplant"
       );
@@ -1240,10 +1256,29 @@ export function embedApp(
     }
 
     function shouldRenderControlledAppFrame() {
-      return !!openAiBridge || isChatGptSandboxHost();
+      return !!openAiBridge || !!app || isChatGptSandboxHost();
+    }
+
+    function shouldDirectRenderKnownAppRoute(src) {
+      return !!app && !openAiBridge && !isEmbedStartUrl(src) && !shouldTransplantAppDocument();
+    }
+
+    function isCurrentFrameUrl(src) {
+      try {
+        return new URL(src, window.location.href).href === window.location.href;
+      } catch {
+        return false;
+      }
     }
 
     function navigateToAppFrame(src) {
+      if (isCurrentFrameUrl(src)) {
+        clearFrameReadyTimer();
+        clearFrameLoadTimer();
+        setMessage("App opened");
+        notifyHostHeightRepeatedly();
+        return;
+      }
       clearFrameReadyTimer();
       clearFrameLoadTimer();
       appFrame = null;
@@ -1257,6 +1292,24 @@ export function embedApp(
       }
     }
 
+    async function ensureHostAppConnected() {
+      if (!app || typeof app.connect !== "function") return;
+      if (!appConnectPromise) {
+        appConnectPromise = Promise.resolve(app.connect())
+          .then(async (value) => {
+            // Let the host process ui/notifications/initialized before follow-up calls.
+            await new Promise((resolve) => window.setTimeout(resolve, 0));
+            await new Promise((resolve) => window.setTimeout(resolve, 0));
+            return value;
+          })
+          .catch((err) => {
+            appConnectPromise = null;
+            throw err;
+          });
+      }
+      await appConnectPromise;
+    }
+
     async function updateHostModelContext(data) {
       const params = {};
       if (Array.isArray(data && data.content)) params.content = data.content;
@@ -1271,6 +1324,7 @@ export function embedApp(
         return { ok: true };
       }
       if (!app || typeof app.updateModelContext !== "function") return { ok: false };
+      await ensureHostAppConnected();
       await app.updateModelContext(params);
       return { ok: true };
     }
@@ -1356,6 +1410,7 @@ export function embedApp(
             agentNativeModelContext: modelContext
           });
         } else if (app && typeof app.updateModelContext === "function") {
+          await ensureHostAppConnected();
           await app.updateModelContext(modelContext);
         }
       } catch (err) {
@@ -1372,6 +1427,7 @@ export function embedApp(
         }
         let result = null;
         if (app && typeof app.sendMessage === "function") {
+          await ensureHostAppConnected();
           result = await app.sendMessage({
             role: "user",
             content
@@ -1412,8 +1468,10 @@ export function embedApp(
       const data = event.data.data || {};
       if (event.data.type === "agentNative.embeddedAppReady") {
         appFrameReady = true;
+        embedSessionRefreshAttempts = 0;
         clearFrameLoadTimer();
         clearFrameReadyTimer();
+        notifyOuterMcpAppReady();
         return;
       }
       if (event.data.type === "agentNative.embedSessionExpired") {
@@ -1454,7 +1512,7 @@ export function embedApp(
     }
 
     async function launchEmbed() {
-      const launchUrl = openStartUrl || openUrl;
+      let launchUrl = openStartUrl || openUrl;
       if (!launchUrl) {
         renderAppLaunchError("Open link was not available.");
         return;
@@ -1463,11 +1521,11 @@ export function embedApp(
         setMessage("Ready to open.");
         return;
       }
-      if (startedFor === launchUrl) return;
-      startedFor = launchUrl;
       setMessage("Loading app");
       try {
         const selfNavigate = shouldSelfNavigateToApp();
+        if (startedFor === launchUrl) return;
+        startedFor = launchUrl;
         const embedUrl = withChatBridgeParam(launchUrl);
         if (selfNavigate && isEmbedStartUrl(embedUrl)) {
           if (shouldTransplantAppDocument()) {
@@ -1483,6 +1541,10 @@ export function embedApp(
           renderFrame(embedUrl);
           return;
         }
+        if (shouldDirectRenderKnownAppRoute(embedUrl)) {
+          renderFrame(embedUrl);
+          return;
+        }
         const result = await callEmbedSessionTool(embedSessionArgsFor(embedUrl));
         const data = parseToolResult(result);
         if (typeof data.startUrl !== "string" || !data.startUrl) {
@@ -1640,7 +1702,7 @@ export function embedApp(
 
     function createNativeMcpAppsBridge() {
       let rpcId = 0;
-      let connected = false;
+      let connectPromise = null;
       let hostContext = {};
       const pendingRequests = new Map();
 
@@ -1708,26 +1770,32 @@ export function embedApp(
           return hostContext.protocolVersion || "mcp-apps-postmessage";
         },
         async connect() {
-          if (connected) return hostContext;
-          connected = true;
-          window.addEventListener("message", onMessage, { passive: true });
-          const result = await rpcRequest(
-            "ui/initialize",
-            {
-              appInfo: { name: "Agent Native Embed", version: "1.0.0" },
-              appCapabilities: {},
-              protocolVersion: "2026-01-26"
-            },
-            nativeBridgeInitializeTimeoutMs
-          );
-          hostContext = objectValue(result);
-          rpcNotify("ui/notifications/initialized", {});
-          if (typeof nativeApp.onhostcontextchanged === "function") {
-            nativeApp.onhostcontextchanged(hostContext);
-          }
-          return hostContext;
+          if (connectPromise) return await connectPromise;
+          connectPromise = (async () => {
+            window.addEventListener("message", onMessage, { passive: true });
+            const result = await rpcRequest(
+              "ui/initialize",
+              {
+                appInfo: { name: "Agent Native Embed", version: "1.0.0" },
+                appCapabilities: {},
+                protocolVersion: "2026-01-26"
+              },
+              nativeBridgeInitializeTimeoutMs
+            );
+            hostContext = objectValue(result);
+            rpcNotify("ui/notifications/initialized", {});
+            if (typeof nativeApp.onhostcontextchanged === "function") {
+              nativeApp.onhostcontextchanged(hostContext);
+            }
+            return hostContext;
+          })().catch((err) => {
+            connectPromise = null;
+            throw err;
+          });
+          return await connectPromise;
         },
         async callServerTool(request) {
+          await nativeApp.connect();
           const record = objectValue(request);
           return await rpcRequest("tools/call", {
             name: record.name,
@@ -1735,6 +1803,7 @@ export function embedApp(
           });
         },
         async updateModelContext(params) {
+          await nativeApp.connect();
           return await rpcRequest("ui/update-model-context", objectValue(params));
         },
         async openLink(params) {
@@ -1749,12 +1818,14 @@ export function embedApp(
           return opened ? { ok: true } : { isError: true };
         },
         async requestDisplayMode(params) {
+          await nativeApp.connect();
           return await rpcRequest("ui/request-display-mode", objectValue(params));
         },
         sendSizeChanged(params) {
           rpcNotify("ui/notifications/size-changed", objectValue(params));
         },
         async sendMessage(params) {
+          await nativeApp.connect();
           return await rpcRequest("ui/message", objectValue(params));
         }
       };
@@ -1798,6 +1869,7 @@ export function embedApp(
 
     async function startNativeMcpAppsBridge() {
       app = createNativeMcpAppsBridge();
+      appConnectPromise = null;
       app.ontoolinput = (params) => {
         toolInput = params.arguments || {};
       };
@@ -1815,7 +1887,8 @@ export function embedApp(
         notifyHostHeight();
         sendHostContext();
       };
-      await app.connect();
+      await ensureHostAppConnected();
+      notifyOuterMcpAppReady();
       updateDisplayButton();
       notifyHostHeight();
       sendHostContext();
@@ -1828,6 +1901,7 @@ export function embedApp(
         {},
         { autoResize: false }
       );
+      appConnectPromise = null;
       app.ontoolinput = (params) => {
         toolInput = params.arguments || {};
       };
@@ -1845,7 +1919,8 @@ export function embedApp(
         notifyHostHeight();
         sendHostContext();
       };
-      await app.connect();
+      await ensureHostAppConnected();
+      notifyOuterMcpAppReady();
       updateDisplayButton();
       notifyHostHeight();
       sendHostContext();

package/corpus/core/src/mcp/index.ts

@@ -37,3 +37,8 @@ export {
   findWorkspaceRoot,
 } from "./workspace-resolve.js";
 export type { ResolvedApp, ResolvedWorkspace } from "./workspace-resolve.js";
+export {
+  fetchOrgApps,
+  resolveOrgDirectoryOrigin,
+  type OrgApp,
+} from "./org-directory.js";

package/corpus/core/src/mcp/org-directory.ts

@@ -146,6 +146,10 @@ function scopedCacheKey(
   ].join("|");
 }
 
+function serviceScopedCacheKey(origin: string, orgId: string): string {
+  return [origin, `service-org:${orgId}`].join("|");
+}
+
 /**
  * Fetch the org's first-party sibling apps from the org directory.
  *
@@ -162,6 +166,7 @@ function scopedCacheKey(
 export async function fetchOrgApps(opts?: {
   selfId?: string;
   selfOrigin?: string;
+  serviceOrgId?: string;
   env?: NodeJS.ProcessEnv;
 }): Promise<OrgApp[]> {
   const env = opts?.env ?? process.env;
@@ -182,24 +187,32 @@ export async function fetchOrgApps(opts?: {
   let cacheKey: string | null = null;
   let apps: OrgApp[] = [];
   let ttl = EMPTY_TTL_MS;
+  const serviceOrgId = opts?.serviceOrgId?.trim();
+  if (serviceOrgId) {
+    const serviceCacheKey = serviceScopedCacheKey(origin, serviceOrgId);
+    const cached = cache.get(serviceCacheKey);
+    if (cached && cached.expiresAt > Date.now()) {
+      return stripSelf(cached.apps);
+    }
+    cacheKey = serviceCacheKey;
+  }
   try {
-    // Reuse the existing A2A caller-auth: it reads userEmail + orgId from the
-    // request context, loads the org A2A secret via getOrgA2ASecret (falling
-    // back to the global A2A_SECRET env), and signs the same bearer JWT A2A
-    // peers already use. No new secret loading is invented here.
-    const { resolveA2ACallerAuth } = await import("../a2a/caller-auth.js");
-    const auth = await resolveA2ACallerAuth();
+    const auth = serviceOrgId
+      ? await resolveOrgDirectoryServiceAuth(serviceOrgId)
+      : await resolveOrgDirectoryCallerAuth();
     if (!auth.apiKey) {
       // No signed token available (no A2A secret / no caller identity) — the
       // directory requires the org bearer, so degrade silently to local-only.
       return [];
     }
 
-    const now = Date.now();
-    cacheKey = scopedCacheKey(origin, auth);
-    const cached = cache.get(cacheKey);
-    if (cached && cached.expiresAt > now) {
-      return stripSelf(cached.apps);
+    if (!cacheKey) {
+      const now = Date.now();
+      cacheKey = scopedCacheKey(origin, auth);
+      const cached = cache.get(cacheKey);
+      if (cached && cached.expiresAt > now) {
+        return stripSelf(cached.apps);
+      }
     }
 
     const res = await fetch(`${origin}/_agent-native/org/apps`, {
@@ -236,3 +249,49 @@ export async function fetchOrgApps(opts?: {
 export function _resetOrgDirectoryCache(): void {
   cache.clear();
 }
+
+async function resolveOrgDirectoryCallerAuth(): Promise<{
+  apiKey?: string;
+  userEmail?: string;
+  orgId?: string;
+  orgDomain?: string;
+}> {
+  // Reuse the existing A2A caller-auth: it reads userEmail + orgId from the
+  // request context, loads the org A2A secret via getOrgA2ASecret (falling
+  // back to the global A2A_SECRET env), and signs the same bearer JWT A2A
+  // peers already use. No new secret loading is invented for normal callers.
+  const { resolveA2ACallerAuth } = await import("../a2a/caller-auth.js");
+  return resolveA2ACallerAuth();
+}
+
+async function resolveOrgDirectoryServiceAuth(orgId: string): Promise<{
+  apiKey?: string;
+  userEmail?: string;
+  orgId?: string;
+  orgDomain?: string;
+}> {
+  const trimmedOrgId = orgId.trim();
+  if (!trimmedOrgId) return {};
+  let orgDomain: string | undefined;
+  let orgSecret: string | undefined;
+  try {
+    const { getOrgDomain, getOrgA2ASecret } = await import("../org/context.js");
+    orgDomain = (await getOrgDomain(trimmedOrgId)) ?? undefined;
+    orgSecret = (await getOrgA2ASecret(trimmedOrgId)) ?? undefined;
+  } catch {}
+  try {
+    const [{ signA2AToken }, { serviceIdentityEmail }] = await Promise.all([
+      import("../a2a/client.js"),
+      import("./connect-store.js"),
+    ]);
+    const userEmail = serviceIdentityEmail("mcp-client", trimmedOrgId);
+    const apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {
+      expiresIn: "5m",
+      preferGlobalSecret: !orgSecret,
+      extraClaims: { org_id: trimmedOrgId },
+    });
+    return { apiKey, userEmail, orgId: trimmedOrgId, orgDomain };
+  } catch {
+    return { orgId: trimmedOrgId, orgDomain };
+  }
+}

package/corpus/core/src/mcp/server.ts

@@ -103,6 +103,14 @@ function deriveRequestMeta(event: H3Event): MCPRequestMeta {
     fullCatalogHeader === "1" ||
     fullCatalogHeader === "true" ||
     fullCatalogHeader === "yes";
+  const inlineAppsHeader = getRequestHeader(
+    event,
+    "x-agent-native-mcp-inline-apps",
+  )?.toLowerCase();
+  const inlineAppsRequested =
+    inlineAppsHeader === "1" ||
+    inlineAppsHeader === "true" ||
+    inlineAppsHeader === "yes";
   const basePath = getConfiguredAppBasePath();
   return {
     origin,
@@ -111,6 +119,7 @@ function deriveRequestMeta(event: H3Event): MCPRequestMeta {
     clientName,
     clientHint,
     ...(fullCatalog ? { fullCatalog } : {}),
+    ...(inlineAppsRequested ? { inlineMcpApps: true } : {}),
   };
 }
 
@@ -357,6 +366,11 @@ export async function handleMcpRequest(
   const server = await createMCPServerForRequest(config, authResult.identity, {
     ...requestMeta,
     fullSurface: authResult.fullSurface === true,
+    inlineMcpApps:
+      requestMeta.inlineMcpApps === true &&
+      authResult.identity?.firstPartyMcp === true
+        ? true
+        : undefined,
     // When the caller minted their token with --full-catalog (catalog_scope:
     // "full" JWT claim), bypass the connector-catalog tier filter.
     ...(authResult.fullCatalog === true ? { fullCatalog: true } : {}),

package/corpus/core/src/mcp-client/config.ts

@@ -45,6 +45,18 @@ export interface McpHttpServerConfig {
   url: string;
   /** Extra headers to send with every request (e.g. Authorization). */
   headers?: Record<string, string>;
+  /**
+   * Trusted first-party Agent-Native app. This is set only by framework-owned
+   * org-scoped registrations, not by raw file/env config.
+   */
+  firstParty?: boolean;
+  /** Canonical first-party app id from the org directory, e.g. `assets`. */
+  firstPartyAppId?: string;
+  /**
+   * Org id the first-party server is trusted for. Runtime-only metadata set by
+   * framework-owned registrations; raw file/env config cannot provide it.
+   */
+  firstPartyOrgId?: string;
   /** Human-readable description (optional, shown in /mcp/status) */
   description?: string;
 }

package/corpus/core/src/mcp-client/index.ts

@@ -24,6 +24,8 @@ export {
 export {
   listRemoteServers,
   addRemoteServer,
+  addFirstPartyRemoteServer,
+  isFirstPartyRemoteEndpointTrusted,
   removeRemoteServer,
   validateRemoteUrl,
   normalizeServerName,