@agent-native/core 0.81.1 → 0.81.3

package/corpus/README.md

@@ -28,4 +28,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 ## Generated Counts
 
 - core files: 2043
-- template files: 4801
+- template files: 4804

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @agent-native/core
 
+## 0.81.3
+
+### Patch Changes
+
+- 3807702: Fix MCP App embed rendering in ChatGPT/Codex hosts:
+  - Stop the `openai:set_globals` storm that left embeds stuck blanking by
+    guarding the bridge sync on a signature that ignores host `maxHeight`, and
+    by not re-blanking once the app frame has launched.
+  - Size embeds to their content: the embedded app reports its real
+    `scrollHeight` via `agentNative.contentHeight` and the shell sizes the iframe
+    to that (plus chrome) instead of the host max, so plans no longer render far
+    too tall or too short.
+  - Suppress empty embeds: when a tool whose descriptor declares an embed widget
+    produces no embeddable content, the result is marked `isError` so the host
+    shows the text result without an empty widget box. This also keeps read-only
+    and comment-mutation tools from rendering an embed for results that produce
+    no plan surface.
+  - Bump the embed shell resource version so hosts refetch the updated shell.
+
+## 0.81.2
+
+### Patch Changes
+
+- ea1cc47: Keep OAuth state and environment status checks aligned with scoped workspace credentials.
+
 ## 0.81.1
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.81.1",
+  "version": "0.81.3",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/client/frame.ts

@@ -83,6 +83,60 @@ export function isTrustedFrameMessage(event: MessageEvent): boolean {
   return event.source === window.parent || event.source === window;
 }
 
+// ---------------------------------------------------------------------------
+// Content-height reporting (for MCP App embeds)
+// ---------------------------------------------------------------------------
+//
+// The embed shell renders this app in a cross-origin iframe and can't measure
+// its content, so we post the real content height for the shell to size to.
+// Only shrinks when the document flows to its natural height — embed layouts
+// must not force `100vh`/`h-screen` on the root, or scrollHeight just equals
+// the iframe height.
+let _contentHeightReportingStarted = false;
+let _lastReportedContentHeight = 0;
+
+function measureContentHeight(): number {
+  if (typeof document === "undefined") return 0;
+  const doc = document.documentElement;
+  const body = document.body;
+  return Math.ceil(
+    Math.max(doc ? doc.scrollHeight : 0, body ? body.scrollHeight : 0),
+  );
+}
+
+function reportContentHeight(): void {
+  if (typeof window === "undefined" || window.parent === window) return;
+  const height = measureContentHeight();
+  if (!height || Math.abs(height - _lastReportedContentHeight) < 2) return;
+  _lastReportedContentHeight = height;
+  sendToFrame("agentNative.contentHeight", { height });
+}
+
+function startContentHeightReporting(): void {
+  if (_contentHeightReportingStarted || typeof window === "undefined") return;
+  if (window.parent === window) return;
+  _contentHeightReportingStarted = true;
+  let scheduled = false;
+  const schedule = () => {
+    if (scheduled) return;
+    scheduled = true;
+    window.requestAnimationFrame(() => {
+      scheduled = false;
+      reportContentHeight();
+    });
+  };
+  schedule();
+  for (const delay of [100, 300, 800, 1500]) window.setTimeout(schedule, delay);
+  try {
+    const observer = new ResizeObserver(schedule);
+    if (document.documentElement) observer.observe(document.documentElement);
+    if (document.body) observer.observe(document.body);
+  } catch {
+    window.addEventListener("resize", schedule, { passive: true });
+  }
+  window.addEventListener("load", schedule, { passive: true });
+}
+
 // Listen for frame origin message and cache it.
 // Only accept from the direct parent frame, and only set once.
 if (typeof window !== "undefined") {
@@ -102,6 +156,7 @@ if (typeof window !== "undefined") {
         { type: "agentNative.embeddedAppReady" },
         getFramePostMessageTargetOrigin() ?? window.location.origin,
       );
+      startContentHeightReporting();
     }
   });
 }

package/corpus/core/src/mcp/build-server.ts

@@ -448,6 +448,18 @@ function purgeEmbedStartUrls(value: unknown, depth = 0): unknown {
   return value;
 }
 
+// True when a tool result carries SOME content. An errored/no-plan result comes
+// back empty (`{}` / null) and would render an empty embed box. We gate on "has
+// content", not "has a URL" — valid embeds often carry data but no URL (the
+// shell mints the embed-start itself).
+function mcpResultHasContent(result: unknown): boolean {
+  if (result == null) return false;
+  if (typeof result === "string") return result.trim().length > 0;
+  if (Array.isArray(result)) return result.length > 0;
+  if (typeof result === "object") return Object.keys(result).length > 0;
+  return Boolean(result);
+}
+
 function mcpAppEmbedOpenLinkMeta(
   result: unknown,
   resource: ResolvedMcpAppResource,
@@ -750,7 +762,7 @@ function safeUiSegment(value: string | undefined, fallback: string): string {
 
 // ChatGPT and Claude cache MCP App resource HTML by `ui://` URI. Bump this
 // when the shared shell changes in a way that must invalidate host caches.
-const MCP_APP_RESOURCE_SHELL_VERSION = "shell-v54";
+const MCP_APP_RESOURCE_SHELL_VERSION = "shell-v64";
 
 function legacyDefaultMcpAppUri(config: MCPConfig, actionName: string): string {
   const app = safeUiSegment(config.appId ?? config.name, "agent-native");
@@ -1546,12 +1558,24 @@ export async function createMCPServerForRequest(
         // branch below degrades to the plain deep-link artifacts the tool would
         // otherwise return — no `openai/outputTemplate`, no minted embed-start,
         // no embed structuredContent — so the host shows a link, not an iframe.
-        const mcpAppResource = requestMeta?.inlineMcpApps
+        const mcpAppResourceCandidate = requestMeta?.inlineMcpApps
           ? await resolveMcpAppResourceSafely(config, name, entry, requestMeta)
           : null;
-        const rawResultForClient = mcpAppResource
+        const rawResultForClient = mcpAppResourceCandidate
           ? await withServerMintedMcpAppEmbedStart(rawResult, requestMeta)
           : rawResult;
+        // Only attach the embed widget for a non-error result that has content.
+        const embedHasContent = mcpResultHasContent(rawResultForClient);
+        const mcpAppResource =
+          mcpAppResourceCandidate && !mcpResultIsError && embedHasContent
+            ? mcpAppResourceCandidate
+            : null;
+        // `openai/outputTemplate` is declared at the tool level, so the host
+        // renders a widget for every call regardless of result _meta. The only
+        // per-result signal it honors is `isError` (shows error text, no widget),
+        // so treat an embed tool that produced nothing as an error.
+        const embedProducedNothing =
+          !!mcpAppResourceCandidate && !mcpResultIsError && !embedHasContent;
         const { block, _meta } = buildLinkArtifacts(
           entry,
           (args as Record<string, any>) ?? {},
@@ -1590,7 +1614,9 @@ export async function createMCPServerForRequest(
         if (block) content.push(block);
         return {
           content,
-          ...(mcpResultIsError ? { isError: true } : {}),
+          ...(mcpResultIsError || embedProducedNothing
+            ? { isError: true }
+            : {}),
           ...(structuredContent ? { structuredContent } : {}),
           ...(Object.keys(responseMeta).length > 0
             ? { _meta: responseMeta }

package/corpus/core/src/mcp/embed-app.ts

@@ -138,6 +138,7 @@ export function embedApp(
     let appFrameLoadTimer = null;
     let lastFrameSrc = "";
     let embedSessionRefreshAttempts = 0;
+    let reportedContentHeight = 0;
 
     function esc(value) {
       return String(value ?? "")
@@ -174,10 +175,18 @@ export function embedApp(
     function visibleIntrinsicHeight() {
       const context = hostState().context || {};
       const hostMaxHeight = contextMaxHeight(context);
+      // Size to the app-reported content height (the shell can't measure the
+      // cross-origin frame). Don't clamp to the host maxHeight — on Codex it's a
+      // small inline hint (~360) that clips the plan; applyIntrinsicHeight still
+      // caps at defaultIntrinsicHeight.
+      if (reportedContentHeight > 0) {
+        return Math.floor(reportedContentHeight + chromeHeight);
+      }
       if (hostMaxHeight) return Math.floor(hostMaxHeight);
-      const viewportHeight = finiteNumber(window.visualViewport && window.visualViewport.height) ||
-        finiteNumber(window.innerHeight);
-      return Math.floor(viewportHeight || defaultIntrinsicHeight);
+      // No host maxHeight and no content height yet: use the CONFIGURED height,
+      // never window.innerHeight. Echoing the iframe's own size pins us to the
+      // current frame height (circular) and locks the embed at the cap forever.
+      return Math.floor(defaultIntrinsicHeight);
     }
 
     function applyIntrinsicHeight(nextHeight) {
@@ -1356,7 +1365,8 @@ export function embedApp(
     }
 
     function notifyHostHeight() {
-      const height = applyIntrinsicHeight(visibleIntrinsicHeight());
+      const intrinsic = visibleIntrinsicHeight();
+      const height = applyIntrinsicHeight(intrinsic);
       if (!openAiBridge || typeof openAiBridge.notifyIntrinsicHeight !== "function") {
         if (app && typeof app.sendSizeChanged === "function") {
           try {
@@ -1487,6 +1497,14 @@ export function embedApp(
         notifyOuterMcpAppReady();
         return;
       }
+      if (event.data.type === "agentNative.contentHeight") {
+        const next = finiteNumber(data && data.height);
+        if (next && Math.abs(next - reportedContentHeight) >= 1) {
+          reportedContentHeight = next;
+          notifyHostHeightSoon();
+        }
+        return;
+      }
       if (event.data.type === "agentNative.embedSessionExpired") {
         refreshExpiredEmbedSession();
         return;
@@ -1538,12 +1556,9 @@ export function embedApp(
         const selfNavigate = shouldSelfNavigateToApp();
         if (startedFor === launchUrl) return;
         startedFor = launchUrl;
-        // Only show the loading message when no frame is mounted yet. ChatGPT
-        // fires openai:set_globals (and thus re-launch) constantly; calling
-        // setMessage() unconditionally here wiped the just-mounted iframe out of
-        // the stage on every redundant launch, so the app rendered and was
-        // instantly blanked back to "Loading app" forever. renderFrame()/
-        // transplant replace the stage themselves when they actually (re)mount.
+        // Only show "Loading app" when no frame is mounted. set_globals
+        // re-launches constantly, so calling it every time would wipe the
+        // just-mounted iframe; renderFrame/transplant own the stage on (re)mount.
         if (!appFrame) {
           setMessage("Loading app");
         }
@@ -1671,14 +1686,11 @@ export function embedApp(
       toolResultData = objectValue(data);
       openUrl = openLinkFrom(params, data);
       openStartUrl = embedStartUrlFrom(params, data);
-      // ChatGPT/Codex fire openai:set_globals extremely often, and the listener
-      // that calls this re-syncs on each one. Because this function calls
-      // notifyHostHeight()/sendHostContext() (which the host reflects back as a
-      // fresh set_globals), an unguarded sync becomes an infinite feedback storm
-      // that starves the host until it shows its sad-face placeholder. Only do
-      // the host round-trips + (re)launch when something we care about changed.
-      // Deliberately EXCLUDE bridge.maxHeight: the host mutates it on every
-      // set_globals as it echoes our height back, which would defeat the guard.
+      // set_globals fires constantly, and this sync calls notifyHostHeight/
+      // sendHostContext which the host echoes back as another set_globals — an
+      // infinite storm. Only do the host round-trips + (re)launch when something
+      // we care about changed. Exclude maxHeight: the host mutates it every
+      // event, which would defeat the guard.
       let signature;
       try {
         signature = JSON.stringify([
@@ -1704,6 +1716,9 @@ export function embedApp(
       if (openUrl || openStartUrl) {
         void launchEmbed();
       } else if (!appFrame) {
+        // No open URL yet — a content-less result no longer reaches the host as
+        // a widget (build-server marks it isError), so this is the transient
+        // "waiting for the embed to resolve" state, not an empty box.
         setMessage("Waiting for app result");
       }
       return true;

package/corpus/core/src/server/core-routes-plugin.ts

@@ -2316,11 +2316,10 @@ export function createCoreRoutesPlugin(
             }
             return Promise.all(
               envKeys.map(async (cfg) => {
-                const configured =
-                  Boolean(process.env[cfg.key]) ||
-                  (await runWithRequestContext({ userEmail, orgId }, () =>
-                    resolveSecret(cfg.key).then(Boolean),
-                  ));
+                const configured = await runWithRequestContext(
+                  { userEmail, orgId },
+                  () => resolveSecret(cfg.key).then(Boolean),
+                );
                 return {
                   key: cfg.key,
                   label: cfg.label,

package/corpus/core/src/server/create-server.ts

@@ -221,11 +221,9 @@ export function createServer(
             key: cfg.key,
             label: cfg.label,
             required: cfg.required ?? false,
-            configured:
-              Boolean(process.env[cfg.key]) ||
-              (await runWithRequestContext({ userEmail, orgId }, () =>
-                resolveSecret(cfg.key).then(Boolean),
-              )),
+            configured: await runWithRequestContext({ userEmail, orgId }, () =>
+              resolveSecret(cfg.key).then(Boolean),
+            ),
             ...(cfg.helpText ? { helpText: cfg.helpText } : {}),
           })),
         );

package/corpus/core/src/server/google-oauth.ts

@@ -442,6 +442,7 @@ export function resolveOAuthRedirectUri(
 export interface OAuthStatePayload {
   redirectUri: string;
   owner?: string;
+  orgId?: string;
   desktop?: boolean;
   addAccount?: boolean;
   app?: string;
@@ -512,6 +513,7 @@ function getStateSigningKey(): string {
 export interface EncodeOAuthStateOptions {
   redirectUri: string;
   owner?: string;
+  orgId?: string;
   desktop?: boolean;
   addAccount?: boolean;
   app?: string;
@@ -585,6 +587,7 @@ export function encodeOAuthState(
     r: opts.redirectUri,
   };
   if (opts.owner) payload.o = opts.owner;
+  if (opts.orgId) payload.g = opts.orgId;
   if (opts.desktop) payload.d = true;
   if (opts.addAccount) payload.a = true;
   if (opts.app) payload.app = opts.app;
@@ -631,6 +634,7 @@ export function decodeOAuthState(
       return {
         redirectUri: parsed.r || fallbackUri,
         owner: parsed.o || undefined,
+        orgId: typeof parsed.g === "string" ? parsed.g : undefined,
         desktop: !!parsed.d,
         addAccount: !!parsed.a,
         app: typeof parsed.app === "string" ? parsed.app : undefined,

package/corpus/templates/calendar/actions/create-event.ts

@@ -1,6 +1,10 @@
 import { defineAction } from "@agent-native/core";
 import { emit } from "@agent-native/core/event-bus";
-import { getRequestUserEmail, buildDeepLink } from "@agent-native/core/server";
+import {
+  buildDeepLink,
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
 import { z } from "zod";
 
 import { prepareZoomMeetingPatch } from "../server/lib/event-video-conferencing.js";
@@ -151,7 +155,10 @@ export default defineAction({
     // Resolve account email
     let acctEmail = email;
     if (args.accountEmail && args.accountEmail !== email) {
-      const status = await googleCalendar.getAuthStatus(email);
+      const status = await googleCalendar.getAuthStatus(
+        email,
+        getRequestOrgId(),
+      );
       const isOwned = status.accounts.some(
         (a) => a.email === args.accountEmail,
       );

package/corpus/templates/calendar/actions/event-action-helpers.ts

@@ -1,4 +1,7 @@
-import { getRequestUserEmail } from "@agent-native/core/server";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
 import { z } from "zod";
 
 import * as googleCalendar from "../server/lib/google-calendar.js";
@@ -71,7 +74,10 @@ export async function resolveOwnedAccountEmail(
   requestedAccountEmail: string | undefined,
   ownerEmail: string,
 ): Promise<string> {
-  const status = await googleCalendar.getAuthStatus(ownerEmail);
+  const status = await googleCalendar.getAuthStatus(
+    ownerEmail,
+    getRequestOrgId(),
+  );
   if (!requestedAccountEmail) {
     if (status.accounts.length === 1) {
       return status.accounts[0].email;

package/corpus/templates/calendar/app/components/calendar/GoogleConnectBanner.tsx

@@ -189,6 +189,17 @@ export function GoogleConnectBanner({
     }
   }, [authUrl.error, fetchStatus]);
 
+  useEffect(() => {
+    if (
+      desktopAuthIssue?.code !== "missing_credentials" &&
+      desktopAuthIssue?.error !== "missing_credentials"
+    ) {
+      return;
+    }
+    setShowWizard(true);
+    fetchStatus();
+  }, [desktopAuthIssue, fetchStatus]);
+
   const allConfigured =
     envStatus.length > 0 && envStatus.every((k) => k.configured);
 

package/corpus/templates/calendar/app/components/layout/Sidebar.tsx

@@ -44,6 +44,7 @@ import {
 } from "date-fns";
 import { useState, useEffect, useMemo } from "react";
 import { Link, useLocation, useNavigate } from "react-router";
+import { toast } from "sonner";
 
 import { ThemeToggle } from "@/components/ThemeToggle";
 import { Button } from "@/components/ui/button";
@@ -322,6 +323,8 @@ function GoogleConnectSidebarButton() {
     isGoogleDesktopAuthPending,
     startDesktopGoogleAuth,
   } = useGoogleDesktopAuth({
+    onError: (issue) =>
+      toast.error(issue.message || issue.error || t("settings.googleFailed")),
     onSuccess: () => window.location.reload(),
   });
 
@@ -331,6 +334,12 @@ function GoogleConnectSidebarButton() {
     window.open(authUrl.data.url, "_blank");
   }, [wantAuthUrl, authUrl.data]);
 
+  useEffect(() => {
+    if (!authUrl.error) return;
+    toast.error(authUrl.error.message);
+    setWantAuthUrl(false);
+  }, [authUrl.error]);
+
   function handleConnect() {
     if (isDesktopGoogleAuth) {
       startDesktopGoogleAuth({ previousAccountCount: 0 });
@@ -435,6 +444,8 @@ function GoogleAccountsSection({
     isGoogleDesktopAuthPending,
     startDesktopGoogleAuth,
   } = useGoogleDesktopAuth({
+    onError: (issue) =>
+      toast.error(issue.message || issue.error || t("settings.googleFailed")),
     onSuccess: () => window.location.reload(),
   });
 
@@ -444,6 +455,12 @@ function GoogleAccountsSection({
     setWantAddAccount(false);
   }, [wantAddAccount, addAccountUrl.data]);
 
+  useEffect(() => {
+    if (!addAccountUrl.error) return;
+    toast.error(addAccountUrl.error.message);
+    setWantAddAccount(false);
+  }, [addAccountUrl.error]);
+
   function handleAddAccount() {
     if (isDesktopGoogleAuth) {
       startDesktopGoogleAuth({

package/corpus/templates/calendar/app/hooks/use-google-auth.ts

@@ -45,6 +45,23 @@ function bodyError(
     `${fallback} (HTTP ${res.status})`;
   const error = new Error(message);
   (error as any).status = res.status;
+  if (body && typeof body === "object") {
+    const record = body as Record<string, unknown>;
+    for (const key of [
+      "error",
+      "code",
+      "accountId",
+      "existingOwner",
+      "attemptedOwner",
+    ]) {
+      if (typeof record[key] === "string") {
+        (error as any)[key] = record[key];
+      }
+    }
+    if (!(error as any).code && typeof record.error === "string") {
+      (error as any).code = record.error;
+    }
+  }
   return error;
 }
 
@@ -204,6 +221,33 @@ export function useGoogleDesktopAuth(options: DesktopAuthOptions = {}) {
         setIsPending(false);
         onError?.(issue);
       };
+      const authStartIssue = (err: unknown): DesktopAuthIssue => {
+        const source = err as Partial<DesktopAuthIssue> | undefined;
+        const message =
+          err instanceof Error
+            ? err.message
+            : "Could not start Google sign-in.";
+        return {
+          code:
+            typeof source?.code === "string"
+              ? source.code
+              : "desktop_auth_start_failed",
+          error: typeof source?.error === "string" ? source.error : undefined,
+          message,
+          accountId:
+            typeof source?.accountId === "string"
+              ? source.accountId
+              : undefined,
+          existingOwner:
+            typeof source?.existingOwner === "string"
+              ? source.existingOwner
+              : undefined,
+          attemptedOwner:
+            typeof source?.attemptedOwner === "string"
+              ? source.attemptedOwner
+              : undefined,
+        };
+      };
       const openAuthUrl = (url: string) => {
         if (popup && !popup.closed) {
           popup.location.href = url;
@@ -220,50 +264,37 @@ export function useGoogleDesktopAuth(options: DesktopAuthOptions = {}) {
         await onSuccess?.(result);
       };
 
-      if (startOptions.addAccount) {
-        popup = window.open("about:blank", "_blank");
-        void (async () => {
-          try {
-            const { url } = await fetchJson<{ url: string }>(
-              agentNativePath(
-                `/_agent-native/google/add-account/auth-url?${params.toString()}`,
-              ),
-              { credentials: "include" },
-            );
-            if (!openAuthUrl(url)) {
-              reportError({
-                code: "popup_blocked",
-                message:
-                  "Calendar could not open Google sign-in. Allow popups and try again.",
-              });
-            }
-          } catch (err) {
-            popup?.close();
+      popup = window.open("about:blank", "_blank");
+      if (!popup) {
+        reportError({
+          code: "popup_blocked",
+          message:
+            "Calendar could not open Google sign-in. Allow popups and try again.",
+        });
+        return true;
+      }
+
+      void (async () => {
+        try {
+          const path = startOptions.addAccount
+            ? "/_agent-native/google/add-account/auth-url"
+            : "/_agent-native/google/auth-url";
+          const { url } = await fetchJson<{ url: string }>(
+            agentNativePath(`${path}?${params.toString()}`),
+            { credentials: "include" },
+          );
+          if (!openAuthUrl(url)) {
             reportError({
-              code: "desktop_auth_start_failed",
+              code: "popup_blocked",
               message:
-                err instanceof Error
-                  ? err.message
-                  : "Could not start Google sign-in.",
+                "Calendar could not open Google sign-in. Allow popups and try again.",
             });
           }
-        })();
-      } else {
-        params.set("redirect", "1");
-        const opened = openAuthUrl(
-          `${window.location.origin}${agentNativePath(
-            "/_agent-native/google/auth-url",
-          )}?${params.toString()}`,
-        );
-        if (!opened) {
-          reportError({
-            code: "popup_blocked",
-            message:
-              "Calendar could not open Google sign-in. Allow popups and try again.",
-          });
-          return true;
+        } catch (err) {
+          popup?.close();
+          reportError(authStartIssue(err));
         }
-      }
+      })();
 
       pollRef.current = setInterval(async () => {
         try {

package/corpus/templates/calendar/changelog/2026-06-30-google-calendar-connection-errors-now-stay-in-the-app-instea.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-06-30
+---
+
+Google Calendar connection errors now stay in the app instead of opening a blank sign-in window.