@agent-native/core 0.84.18 → 0.84.21

package/corpus/core/src/integrations/a2a-continuation-processor.ts

@@ -150,11 +150,11 @@ async function processClaimedContinuation(
     return;
   }
 
-  const client = new A2AClient(
-    continuation.agentUrl,
-    await signContinuationToken(continuation),
-    { requestTimeoutMs: POLL_REQUEST_TIMEOUT_MS },
-  );
+  const auth = await signContinuationToken(continuation);
+  const client = new A2AClient(continuation.agentUrl, auth.apiKey, {
+    requestTimeoutMs: POLL_REQUEST_TIMEOUT_MS,
+    ...(auth.apiKeyFallbacks ? { fallbackApiKeys: auth.apiKeyFallbacks } : {}),
+  });
   const deadline = Date.now() + PROCESSOR_WAIT_MS;
   let task: Task | null = null;
 
@@ -438,28 +438,35 @@ function sanitizeFailureReason(reason: string): string {
 
 async function signContinuationToken(
   continuation: A2AContinuation,
-): Promise<string | undefined> {
+): Promise<{ apiKey?: string; apiKeyFallbacks?: string[] }> {
   if (continuation.a2aAuthToken === "") {
-    return undefined;
+    return {};
   }
 
   const storedToken = continuation.a2aAuthToken;
-  if (storedToken && !isLikelyJwt(storedToken)) return storedToken;
-
-  const freshToken = await signFreshContinuationToken(continuation);
-  if (freshToken) return freshToken;
-  if (!storedToken) return undefined;
+  if (storedToken && !isLikelyJwt(storedToken)) return { apiKey: storedToken };
+
+  const freshTokens = await signFreshContinuationTokens(continuation);
+  if (freshTokens.length > 0) {
+    return {
+      apiKey: freshTokens[0],
+      ...(freshTokens.length > 1
+        ? { apiKeyFallbacks: freshTokens.slice(1) }
+        : {}),
+    };
+  }
+  if (!storedToken) return {};
 
   // Older continuations may have persisted the initial short-lived JWT. Avoid
   // replaying it forever after expiry; opaque legacy bearer keys can still be
   // reused because we cannot re-mint those.
-  if (isLikelyJwt(storedToken)) return undefined;
-  return storedToken;
+  if (isLikelyJwt(storedToken)) return {};
+  return { apiKey: storedToken };
 }
 
-async function signFreshContinuationToken(
+async function signFreshContinuationTokens(
   continuation: A2AContinuation,
-): Promise<string | undefined> {
+): Promise<string[]> {
   let orgDomain: string | undefined;
   let orgSecret: string | undefined;
   if (continuation.orgId) {
@@ -472,17 +479,35 @@ async function signFreshContinuationToken(
   }
 
   if (!continuation.ownerEmail || !(orgSecret || process.env.A2A_SECRET)) {
-    return undefined;
+    return [];
   }
 
-  try {
-    return await signA2AToken(continuation.ownerEmail, orgDomain, orgSecret, {
-      expiresIn: "30m",
-      preferGlobalSecret: !orgSecret,
-    });
-  } catch {
-    return undefined;
+  const tokens: string[] = [];
+  const add = (token: string | undefined) => {
+    if (token && !tokens.includes(token)) tokens.push(token);
+  };
+
+  if (process.env.A2A_SECRET?.trim()) {
+    try {
+      add(
+        await signA2AToken(continuation.ownerEmail, orgDomain, orgSecret, {
+          expiresIn: "30m",
+          preferGlobalSecret: true,
+        }),
+      );
+    } catch {}
+  }
+  if (orgSecret) {
+    try {
+      add(
+        await signA2AToken(continuation.ownerEmail, orgDomain, orgSecret, {
+          expiresIn: "30m",
+          preferGlobalSecret: false,
+        }),
+      );
+    } catch {}
   }
+  return tokens;
 }
 
 function isLikelyJwt(token: string): boolean {

package/corpus/core/src/mcp/builtin-tools.ts

@@ -260,6 +260,9 @@ async function createA2AClientForAskApp(origin: string): Promise<{
   return {
     client: new A2AClient(origin, auth.apiKey, {
       requestTimeoutMs: ASK_APP_A2A_REQUEST_TIMEOUT_MS,
+      ...(auth.apiKeyFallbacks
+        ? { fallbackApiKeys: auth.apiKeyFallbacks }
+        : {}),
     }),
     metadata,
   };

package/corpus/core/src/mcp/org-directory.ts

@@ -146,6 +146,15 @@ function scopedCacheKey(
   ].join("|");
 }
 
+function authTokenAttempts(auth: {
+  apiKey?: string;
+  apiKeyFallbacks?: string[];
+}): string[] {
+  return [auth.apiKey, ...(auth.apiKeyFallbacks ?? [])].filter(
+    (token): token is string => typeof token === "string" && token.length > 0,
+  );
+}
+
 function serviceScopedCacheKey(origin: string, orgId: string): string {
   return [origin, `service-org:${orgId}`].join("|");
 }
@@ -200,7 +209,8 @@ export async function fetchOrgApps(opts?: {
     const auth = serviceOrgId
       ? await resolveOrgDirectoryServiceAuth(serviceOrgId)
       : await resolveOrgDirectoryCallerAuth();
-    if (!auth.apiKey) {
+    const attempts = authTokenAttempts(auth);
+    if (attempts.length === 0) {
       // No signed token available (no A2A secret / no caller identity) — the
       // directory requires the org bearer, so degrade silently to local-only.
       return [];
@@ -215,19 +225,23 @@ export async function fetchOrgApps(opts?: {
       }
     }
 
-    const res = await fetch(`${origin}/_agent-native/org/apps`, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${auth.apiKey}`,
-        Accept: "application/json",
-      },
-      signal: AbortSignal.timeout(4000),
-    });
-    if (res.ok) {
-      const json = (await res.json()) as { apps?: unknown };
-      const list = Array.isArray(json?.apps) ? json.apps : [];
-      apps = list.map(normalizeApp).filter((a): a is OrgApp => a !== null);
-      ttl = SUCCESS_TTL_MS;
+    for (let i = 0; i < attempts.length; i++) {
+      const res = await fetch(`${origin}/_agent-native/org/apps`, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${attempts[i]}`,
+          Accept: "application/json",
+        },
+        signal: AbortSignal.timeout(4000),
+      });
+      if (res.ok) {
+        const json = (await res.json()) as { apps?: unknown };
+        const list = Array.isArray(json?.apps) ? json.apps : [];
+        apps = list.map(normalizeApp).filter((a): a is OrgApp => a !== null);
+        ttl = SUCCESS_TTL_MS;
+        break;
+      }
+      if (res.status !== 401 || i >= attempts.length - 1) break;
     }
     // Non-2xx ⇒ leave apps=[] with the short EMPTY_TTL (silent degrade).
   } catch {
@@ -252,6 +266,7 @@ export function _resetOrgDirectoryCache(): void {
 
 async function resolveOrgDirectoryCallerAuth(): Promise<{
   apiKey?: string;
+  apiKeyFallbacks?: string[];
   userEmail?: string;
   orgId?: string;
   orgDomain?: string;
@@ -266,6 +281,7 @@ async function resolveOrgDirectoryCallerAuth(): Promise<{
 
 async function resolveOrgDirectoryServiceAuth(orgId: string): Promise<{
   apiKey?: string;
+  apiKeyFallbacks?: string[];
   userEmail?: string;
   orgId?: string;
   orgDomain?: string;
@@ -285,12 +301,42 @@ async function resolveOrgDirectoryServiceAuth(orgId: string): Promise<{
       import("./connect-store.js"),
     ]);
     const userEmail = serviceIdentityEmail("mcp-client", trimmedOrgId);
-    const apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {
-      expiresIn: "5m",
-      preferGlobalSecret: !orgSecret,
-      extraClaims: { org_id: trimmedOrgId },
-    });
-    return { apiKey, userEmail, orgId: trimmedOrgId, orgDomain };
+    const apiKeyAttempts: string[] = [];
+    const addApiKeyAttempt = (token: string | undefined) => {
+      if (!token || apiKeyAttempts.includes(token)) return;
+      apiKeyAttempts.push(token);
+    };
+    if (process.env.A2A_SECRET?.trim()) {
+      try {
+        addApiKeyAttempt(
+          await signA2AToken(userEmail, orgDomain, orgSecret, {
+            expiresIn: "5m",
+            preferGlobalSecret: true,
+            extraClaims: { org_id: trimmedOrgId },
+          }),
+        );
+      } catch {}
+    }
+    if (orgSecret) {
+      try {
+        addApiKeyAttempt(
+          await signA2AToken(userEmail, orgDomain, orgSecret, {
+            expiresIn: "5m",
+            preferGlobalSecret: false,
+            extraClaims: { org_id: trimmedOrgId },
+          }),
+        );
+      } catch {}
+    }
+    return {
+      apiKey: apiKeyAttempts[0],
+      ...(apiKeyAttempts.length > 1
+        ? { apiKeyFallbacks: apiKeyAttempts.slice(1) }
+        : {}),
+      userEmail,
+      orgId: trimmedOrgId,
+      orgDomain,
+    };
   } catch {
     return { orgId: trimmedOrgId, orgDomain };
   }

package/corpus/core/src/scripts/call-agent.ts

@@ -1,6 +1,11 @@
 import { createHash } from "node:crypto";
 
-import { A2ATaskTimeoutError, callAgent, signA2AToken } from "../a2a/client.js";
+import {
+  A2ATaskTimeoutError,
+  callAgent,
+  shouldPreferGlobalA2ASecret,
+  signA2AToken,
+} from "../a2a/client.js";
 import {
   formatLlmCredentialErrorMessage,
   isLlmCredentialError,
@@ -162,7 +167,7 @@ export async function run(
             callerOrgSecret,
             {
               expiresIn: INTEGRATION_A2A_TOKEN_TTL,
-              preferGlobalSecret: !callerOrgSecret,
+              preferGlobalSecret: shouldPreferGlobalA2ASecret(callerOrgSecret),
             },
           );
         } catch {}

package/corpus/templates/analytics/actions/provider-api-request.ts

@@ -213,7 +213,14 @@ export default defineAction({
         "Enable cursor-based pagination. After each response, reads cursorPath from the JSON body and re-issues the request with cursorParam or cursorBodyPath set, accumulating items from itemsPath (or whole bodies) until cursor is empty or maxPages is reached. Combine with saveToFile to write the full dataset to a workspace file; use scratch/... for temporary staging.",
       ),
   }),
-  http: false,
+  // Mounted over HTTP (POST) so the agent and frontend (`useActionMutation`)
+  // can reach it, consistent with provider-api-catalog / provider-api-docs.
+  // toolCallable: false blocks the extension iframe bridge — this action
+  // accepts arbitrary methods (PUT/DELETE/etc.) against provider APIs, so
+  // allowing shared extensions to call it would let malicious extension authors
+  // mutate provider data under the opener's credentials.
+  http: { method: "POST" },
+  toolCallable: false,
   run: async (args) => {
     if (args.stageAs) {
       const ctx = requireRequestCredentialContext("provider-api staging");

package/corpus/templates/analytics/app/components/layout/Sidebar.tsx

@@ -7,6 +7,7 @@ import {
   IconStar,
   IconPencil,
   IconSettings,
+  IconFilter,
   IconGripVertical,
   IconBook2,
   IconDatabase,
@@ -251,7 +252,7 @@ function SidebarSectionSettingsPopover({
               className="flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-muted-foreground/65 opacity-0 transition-all hover:bg-sidebar-accent hover:text-foreground focus:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring group-hover/section:opacity-100 data-[state=open]:opacity-100"
               aria-label={settingsLabel}
             >
-              <IconSettings className="h-3.5 w-3.5" />
+              <IconFilter className="h-3.5 w-3.5" />
             </button>
           </PopoverTrigger>
         </TooltipTrigger>

package/corpus/templates/analytics/app/pages/adhoc/sql-dashboard/SqlChartCard.tsx

@@ -3,6 +3,7 @@ import { useDraggable } from "@dnd-kit/core";
 import {
   IconGripVertical,
   IconDotsVertical,
+  IconExternalLink,
   IconMaximize,
   IconPencil,
   IconRefresh,
@@ -12,6 +13,7 @@ import {
 } from "@tabler/icons-react";
 import { useIsFetching, useQueryClient } from "@tanstack/react-query";
 import { memo, useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useNavigate } from "react-router";
 
 import { ChartFillHeight, SqlChart } from "@/components/dashboard/SqlChart";
 import {
@@ -119,6 +121,8 @@ export function SqlChartCard({
 
   const [confirmOpen, setConfirmOpen] = useState(false);
   const [expanded, setExpanded] = useState(false);
+  const [extRefreshKey, setExtRefreshKey] = useState(0);
+  const navigate = useNavigate();
   const [exportCsv, setExportCsv] = useState<(() => void) | null>(null);
   const [shouldLoadData, setShouldLoadData] = useState(
     eagerLoad ||
@@ -291,10 +295,12 @@ export function SqlChartCard({
   }
 
   // Extension panels render their sandboxed iframe full-bleed with no card chrome
-  // or title — the extension owns its own UI. Editable dashboards still get a
-  // hover overlay for delete/drag. Editing routes through the agent (the manual
-  // panel editor has no extension picker), so no inline edit action here.
+  // or title — the extension owns its own UI. All viewers get the read-only
+  // actions (full screen, refresh, open extension); editable dashboards also get
+  // delete and drag.
   if (panel.chartType === "extension") {
+    const extensionId = (panel.config as Record<string, unknown> | undefined)
+      ?.extensionId as string | undefined;
     return (
       <div
         ref={setCardNodeRef}
@@ -302,45 +308,97 @@ export function SqlChartCard({
         data-dragging={isDragSource ? "true" : undefined}
         className="dashboard-extension-card group relative h-full"
       >
-        <SqlChart panel={panel} resolvedSql={resolvedSql} loadData />
-        {editable ? (
-          <div className="absolute right-1 top-1 flex items-center gap-1 opacity-0 group-hover:opacity-100">
-            <DropdownMenu>
-              <Tooltip>
-                <TooltipTrigger asChild>
-                  <DropdownMenuTrigger asChild>
-                    <button
-                      className="p-1 rounded bg-background/80 text-muted-foreground hover:text-foreground"
-                      aria-label={t("sqlDashboard.panelOptions")}
-                    >
-                      <IconDotsVertical className="h-3.5 w-3.5" />
-                    </button>
-                  </DropdownMenuTrigger>
-                </TooltipTrigger>
-                <TooltipContent>
-                  {t("sqlDashboard.panelOptions")}
-                </TooltipContent>
-              </Tooltip>
-              <DropdownMenuContent align="end" className="w-40">
+        {!expanded && (
+          <SqlChart
+            key={extRefreshKey}
+            panel={panel}
+            resolvedSql={resolvedSql}
+            loadData
+          />
+        )}
+        <div className="absolute right-1 top-1 flex items-center gap-1 opacity-0 group-hover:opacity-100">
+          <DropdownMenu>
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <DropdownMenuTrigger asChild>
+                  <button
+                    className="p-1 rounded bg-background/80 text-muted-foreground hover:text-foreground"
+                    aria-label={t("sqlDashboard.panelOptions")}
+                  >
+                    <IconDotsVertical className="h-3.5 w-3.5" />
+                  </button>
+                </DropdownMenuTrigger>
+              </TooltipTrigger>
+              <TooltipContent>{t("sqlDashboard.panelOptions")}</TooltipContent>
+            </Tooltip>
+            <DropdownMenuContent align="end" className="w-44">
+              <DropdownMenuItem onSelect={() => setExpanded(true)}>
+                <IconMaximize className="h-4 w-4 mr-2" />
+                {t("sqlDashboard.fullScreen")}
+              </DropdownMenuItem>
+              {extensionId ? (
                 <DropdownMenuItem
-                  onSelect={(e) => {
-                    e.preventDefault();
-                    setConfirmOpen(true);
-                  }}
+                  onSelect={() =>
+                    navigate(
+                      `/extensions/${extensionId}/${encodeURIComponent(
+                        (panel.title ?? "extension")
+                          .toLowerCase()
+                          .replace(/[^a-z0-9]+/g, "-"),
+                      )}`,
+                    )
+                  }
                 >
-                  <IconTrash className="h-4 w-4 mr-2" />
-                  {t("sidebar.delete")}
+                  <IconExternalLink className="h-4 w-4 mr-2" />
+                  Open extension {/* i18n-ignore */}
                 </DropdownMenuItem>
-              </DropdownMenuContent>
-            </DropdownMenu>
+              ) : null}
+              <DropdownMenuSeparator />
+              <DropdownMenuItem onSelect={() => setExtRefreshKey((k) => k + 1)}>
+                <IconRefresh className="h-4 w-4 mr-2" />
+                {t("sqlDashboard.refresh")}
+              </DropdownMenuItem>
+              {editable ? (
+                <>
+                  <DropdownMenuSeparator />
+                  <DropdownMenuItem
+                    onSelect={(e) => {
+                      e.preventDefault();
+                      setConfirmOpen(true);
+                    }}
+                  >
+                    <IconTrash className="h-4 w-4 mr-2" />
+                    {t("sidebar.delete")}
+                  </DropdownMenuItem>
+                </>
+              ) : null}
+            </DropdownMenuContent>
+          </DropdownMenu>
+          {editable ? (
             <PanelDragHandle
               panelId={panel.id}
               label={t("sqlDashboard.dragToReorder")}
               className="p-1 rounded bg-background/80 cursor-grab active:cursor-grabbing text-muted-foreground/50 hover:text-muted-foreground"
               iconClassName="h-3.5 w-3.5"
             />
-          </div>
-        ) : null}
+          ) : null}
+        </div>
+        <Dialog open={expanded} onOpenChange={setExpanded}>
+          <DialogContent className="flex h-[90vh] w-[95vw] max-w-[1400px] flex-col gap-4">
+            <DialogHeader className="shrink-0 pr-8 text-left">
+              <DialogTitle className="truncate">{panel.title}</DialogTitle>
+            </DialogHeader>
+            <div className="flex min-h-0 flex-1 flex-col overflow-auto">
+              <ChartFillHeight>
+                <SqlChart
+                  key={extRefreshKey}
+                  panel={panel}
+                  resolvedSql={resolvedSql}
+                  loadData
+                />
+              </ChartFillHeight>
+            </div>
+          </DialogContent>
+        </Dialog>
         {editable ? (
           <AlertDialog open={confirmOpen} onOpenChange={setConfirmOpen}>
             <AlertDialogContent>