@agent-native/core 0.97.0 → 0.98.0

package/corpus/core/src/server/agent-teams.ts

@@ -23,7 +23,10 @@ import type {
   ActionEntry,
   AgentLoopFinalResponseGuard,
 } from "../agent/production-agent.js";
-import { actionsToEngineTools } from "../agent/production-agent.js";
+import {
+  actionsToEngineTools,
+  filterInitialEngineTools,
+} from "../agent/production-agent.js";
 import {
   runAgentLoop,
   appendAgentLoopContinuation,
@@ -43,6 +46,7 @@ import {
   foldAssistantTurn,
   threadDataToEngineMessages,
 } from "../agent/thread-data-builder.js";
+import { attachToolSearch } from "../agent/tool-search.js";
 import type { AgentChatEvent } from "../agent/types.js";
 import type { RunEvent } from "../agent/types.js";
 import {
@@ -1600,6 +1604,16 @@ export interface AgentTeamRunConfig {
   actions: Record<string, ActionEntry>;
   engine: AgentEngine;
   model: string;
+  /**
+   * Tool names to expose on the FIRST engine request for this sub-agent
+   * chunk. See `SchedulerDeps.getInitialToolNames` (`jobs/scheduler.ts`) —
+   * same semantics: when provided, every other action in `actions` is
+   * deferred behind an attached `tool-search` entry instead of being
+   * serialized on every chunk; `runAgentLoop`'s mid-run tool expansion still
+   * lets the model discover and call them after a search. Omit to keep the
+   * full `actions` set visible up front (current behavior).
+   */
+  initialToolNames?: string[];
 }
 
 export interface ProcessAgentTeamRunOptions {
@@ -1710,11 +1724,19 @@ export async function processAgentTeamRun(
         ];
       }
 
+      const initialToolNames = config.initialToolNames;
+      // Only attach tool-search (and pay its schema cost) when the caller
+      // actually supplied an initial subset to filter down to — otherwise
+      // this is byte-for-byte the prior unfiltered behavior.
+      const baseActions = initialToolNames
+        ? attachToolSearch({ ...config.actions })
+        : config.actions;
       const messageAwareActions = createMessageAwareActions(
         opts.taskId,
-        config.actions,
+        baseActions,
       );
-      const tools = actionsToEngineTools(messageAwareActions);
+      const availableTools = actionsToEngineTools(messageAwareActions);
+      const tools = filterInitialEngineTools(availableTools, initialToolNames);
 
       // Fresh runId per chunk (avoids agent_runs PK collisions); stable turnId so
       // the durable assistant message folds across chunks.
@@ -1815,6 +1837,7 @@ export async function processAgentTeamRun(
                     model: config.model,
                     systemPrompt,
                     tools,
+                    availableTools,
                     messages,
                     actions: messageAwareActions,
                     send: wrappedSend,

package/corpus/core/src/server/auth.ts

@@ -1860,56 +1860,38 @@ function createAuthGuardFn(): (
     }
 
     // Force-sign-in entrypoint. Templates send viewers from public pages
-    // (share links, embeds) here with a `?return=<path>` query — anonymous
-    // visitors get the loginHtml, and once they sign in the loginHtml's
-    // post-login reload re-hits this same URL with a session cookie set,
-    // so we 302 them to the original page.
-    //
-    // `return` is validated by parsing it against a sentinel base origin
-    // and checking the resolved origin still matches. This rejects every
-    // open-redirect shape — `//evil.com/...` (network-path reference),
-    // `/\evil.com/...` (WHATWG URL parser normalises `\` to `/` in HTTP
-    // URLs, so a naive prefix check on `//` misses this), absolute URLs
-    // like `https://evil.com`, and `data:` / `javascript:` schemes. The
-    // reconstructed path comes from the parsed segments so any leftover
-    // quirks get normalised. Control chars (incl. CR/LF for header
-    // injection) are rejected up front.
-    //
+    // (share links, embeds) here with a `?return=<path>` query. The cached
+    // login document validates that return path in the browser and redirects
+    // there after sign-in or when its client-side session check finds an
+    // existing session.
     if (p === "/_agent-native/sign-in") {
-      const queryStr = queryStart >= 0 ? url.slice(queryStart + 1) : "";
-      const safeReturn = safeReturnPath(
-        new URLSearchParams(queryStr).get("return"),
-      );
-      const session = await getSession(event);
-      if (session) {
-        return new Response("", {
-          status: 302,
-          headers: { Location: safeReturn },
-        });
-      }
-      return loginHtmlResponse(loginHtml, event);
-    }
-
-    // Auth entry pages are framework-owned pages, not app routes. When a user
-    // already has a session, redirect them back to the mounted app instead of
-    // letting React Router try to render /login.
-    if (p === "/login" || p === "/signup") {
-      const session = await getSession(event);
-      if (session) {
+      // Preserve the zero-setup localhost experience without putting a
+      // session lookup back on the cacheable app-shell URL. The client gate
+      // reaches this explicit entrypoint after discovering there is no
+      // session; only a fresh local development DB can take this redirect.
+      if (getMethod(event) === "GET") {
         const queryStr = queryStart >= 0 ? url.slice(queryStart + 1) : "";
         const safeReturn = safeReturnPath(
           new URLSearchParams(queryStr).get("return"),
         );
-        return new Response("", {
-          status: 302,
-          headers: {
-            Location: safeReturn === "/" ? getAppBasePath() || "/" : safeReturn,
-          },
-        });
+        const autoSession = await maybeAutoCreateDevSession(
+          event,
+          safeReturn === "/" ? getAppBasePath() || "/" : safeReturn,
+        );
+        if (autoSession) return autoSession;
       }
       return loginHtmlResponse(loginHtml, event);
     }
 
+    // Auth entry pages are framework-owned pages, not app routes. Always serve
+    // the same public, cacheable login document here. Its client-side session
+    // check redirects signed-in visitors to the validated return path. Keeping
+    // session-dependent decisions out of this server response prevents the CDN
+    // from caching two different representations for the same URL.
+    if (p === "/login" || p === "/signup") {
+      return loginHtmlResponse(loginHtml, event);
+    }
+
     // Skip static assets (Vite chunks, fonts, images, etc.)
     if (
       p.startsWith("/assets/") ||
@@ -1950,6 +1932,36 @@ function createAuthGuardFn(): (
       return;
     }
 
+    // Normal app documents and React Router page-data requests are an
+    // impersonal SSR shell. `createH3SSRHandler` renders both under an
+    // explicitly anonymous request context and gives them one shared public
+    // cache policy, so production requests must not vary either response by
+    // cookie. `AppProviders` resolves the browser session and gates private UI
+    // after hydration.
+    const isAppPageRequest =
+      p !== "/api" &&
+      !p.startsWith("/api/") &&
+      p !== "/_agent-native" &&
+      !p.startsWith("/_agent-native/") &&
+      (isHtmlDocumentRequest(event, p) ||
+        (isReadMethod(event) && p.endsWith(".data")));
+    if (isAppPageRequest) {
+      // A freshly scaffolded, loopback-only development app needs its initial
+      // session before Vite starts optimizing and potentially reloading the
+      // client. Waiting for the hydrated client gate to reach sign-in can lose
+      // that one-time redirect after the dev account is created, leaving the
+      // browser at the login page with no way to recreate its random password.
+      // `maybeAutoCreateDevSession` is strictly development + loopback scoped,
+      // does not read an existing session, and returns null for every existing
+      // dev account, so production SSR remains one cacheable anonymous shell
+      // and explicit sign-out still works.
+      if (getMethod(event) === "GET") {
+        const autoSession = await maybeAutoCreateDevSession(event, url);
+        if (autoSession) return autoSession;
+      }
+      return;
+    }
+
     const session = await getSession(event);
     if (session) return;
 
@@ -1958,22 +1970,8 @@ function createAuthGuardFn(): (
       return { error: "Unauthorized" };
     }
 
-    if (!isHtmlDocumentRequest(event, p)) {
-      setResponseStatus(event, 401);
-      return { error: "Unauthorized" };
-    }
-
-    // Local-dev convenience: on the first page GET of a freshly-scaffolded
-    // app, transparently create + sign in `dev@local.test` instead of
-    // showing the sign-up form. Gated on NODE_ENV=development AND no real users in the
-    // DB, so production and any app that has ever had a real signup are
-    // unaffected. See maybeAutoCreateDevSession for full conditions.
-    if (getMethod(event) === "GET") {
-      const autoSession = await maybeAutoCreateDevSession(event, url);
-      if (autoSession) return autoSession;
-    }
-
-    return loginHtmlResponse(loginHtml, event);
+    setResponseStatus(event, 401);
+    return { error: "Unauthorized" };
   };
 }
 

package/corpus/core/src/server/credential-provider.ts

@@ -257,30 +257,27 @@ export function isBuilderPrivateKey(value: string | null | undefined): boolean {
 }
 
 async function readBuilderCredentialScope(
-  readAppSecret: typeof import("../secrets/storage.js").readAppSecret,
+  readAppSecrets: typeof import("../secrets/storage.js").readAppSecrets,
   scope: "user" | "org" | "workspace",
   scopeId: string,
 ): Promise<BuilderResolvedCredentials> {
-  const values = await Promise.all(
-    BUILDER_CREDENTIAL_KEYS.map(async (key) => {
-      const secret = await readAppSecret({ key, scope, scopeId });
-      return [key, secret?.value ?? null] as const;
-    }),
-  );
-  const map = new Map<string, string | null>(values);
+  const secrets = await readAppSecrets({
+    keys: BUILDER_CREDENTIAL_KEYS,
+    scope,
+    scopeId,
+  });
+  const value = (key: string): string | null => secrets.get(key)?.value ?? null;
   return {
-    privateKey: map.get("BUILDER_PRIVATE_KEY") ?? null,
-    publicKey: map.get("BUILDER_PUBLIC_KEY") ?? null,
-    userId: map.get("BUILDER_USER_ID") ?? null,
-    orgName: map.get("BUILDER_ORG_NAME") ?? null,
-    orgKind: map.get("BUILDER_ORG_KIND") ?? null,
-    subscription: map.get("BUILDER_SUBSCRIPTION") ?? null,
-    subscriptionLevel: map.get("BUILDER_SUBSCRIPTION_LEVEL") ?? null,
-    subscriptionName: map.get("BUILDER_SUBSCRIPTION_NAME") ?? null,
-    isEnterprise: readOptionalBuilderBoolean(map.get("BUILDER_IS_ENTERPRISE")),
-    isFreeAccount: readOptionalBuilderBoolean(
-      map.get("BUILDER_IS_FREE_ACCOUNT"),
-    ),
+    privateKey: value("BUILDER_PRIVATE_KEY"),
+    publicKey: value("BUILDER_PUBLIC_KEY"),
+    userId: value("BUILDER_USER_ID"),
+    orgName: value("BUILDER_ORG_NAME"),
+    orgKind: value("BUILDER_ORG_KIND"),
+    subscription: value("BUILDER_SUBSCRIPTION"),
+    subscriptionLevel: value("BUILDER_SUBSCRIPTION_LEVEL"),
+    subscriptionName: value("BUILDER_SUBSCRIPTION_NAME"),
+    isEnterprise: readOptionalBuilderBoolean(value("BUILDER_IS_ENTERPRISE")),
+    isFreeAccount: readOptionalBuilderBoolean(value("BUILDER_IS_FREE_ACCOUNT")),
     source: scope === "workspace" ? "workspace" : scope,
   };
 }
@@ -397,7 +394,7 @@ async function resolveScopedBuilderCredentials(): Promise<BuilderResolvedCredent
   const traceLookup = shouldTraceCredentialResolve();
   let scopeAttempted = "user";
   try {
-    const { readAppSecret } = await import("../secrets/storage.js");
+    const { readAppSecrets } = await import("../secrets/storage.js");
     const traceScope = (creds: BuilderResolvedCredentials, scopeId: string) => {
       if (!traceLookup) return;
       console.log(
@@ -406,7 +403,7 @@ async function resolveScopedBuilderCredentials(): Promise<BuilderResolvedCredent
     };
 
     const userCreds = await readBuilderCredentialScope(
-      readAppSecret,
+      readAppSecrets,
       "user",
       email,
     );
@@ -417,7 +414,7 @@ async function resolveScopedBuilderCredentials(): Promise<BuilderResolvedCredent
     if (orgId) {
       scopeAttempted = "org";
       const orgCreds = await readBuilderCredentialScope(
-        readAppSecret,
+        readAppSecrets,
         "org",
         orgId,
       );
@@ -426,7 +423,7 @@ async function resolveScopedBuilderCredentials(): Promise<BuilderResolvedCredent
 
       scopeAttempted = "workspace";
       const workspaceCreds = await readBuilderCredentialScope(
-        readAppSecret,
+        readAppSecrets,
         "workspace",
         orgId,
       );
@@ -436,7 +433,7 @@ async function resolveScopedBuilderCredentials(): Promise<BuilderResolvedCredent
       scopeAttempted = "workspace-solo";
       const scopeId = `solo:${email}`;
       const workspaceCreds = await readBuilderCredentialScope(
-        readAppSecret,
+        readAppSecrets,
         "workspace",
         scopeId,
       );

package/corpus/core/src/server/edge.ts

@@ -66,3 +66,4 @@ export {
   markDefaultPluginProvided,
   type H3AppShim,
 } from "./framework-request-handler.js";
+export { runWithRequestContext } from "./request-context.js";

package/corpus/core/src/server/onboarding-html.ts

@@ -15,7 +15,6 @@ import {
   SUPPORTED_LOCALES,
   type LocaleCode,
 } from "../localization/shared.js";
-import { AUTH_REDIRECT_QUERY_PARAM } from "../shared/auth-redirect-url.js";
 import {
   AGENT_NATIVE_SOCIAL_IMAGE_ALT,
   AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT,
@@ -2917,22 +2916,8 @@ ${signupLocalModeNoteHtml}
       if (__anIsAuthEntryPath(window.location.pathname)) return __anPath('/');
       return __anCurrentReturnPath();
     }
-    function __anWithAuthCacheBypass(ret) {
-      try {
-        var url = new URL(ret || __anPath('/'), window.location.origin);
-        url.searchParams.set('${AUTH_REDIRECT_QUERY_PARAM}', Date.now().toString(36));
-        return url.pathname + url.search + url.hash;
-      } catch(e) {
-        var fallback = ret || __anPath('/');
-        var hashIndex = fallback.indexOf('#');
-        var beforeHash = hashIndex === -1 ? fallback : fallback.slice(0, hashIndex);
-        var hash = hashIndex === -1 ? '' : fallback.slice(hashIndex);
-        var sep = beforeHash.indexOf('?') === -1 ? '?' : '&';
-        return beforeHash + sep + '${AUTH_REDIRECT_QUERY_PARAM}=' + Date.now().toString(36) + hash;
-      }
-    }
     function __anRedirectToSignedInApp(ret) {
-      window.location.replace(__anWithAuthCacheBypass(ret || __anGetSignedInReturnPath()));
+      window.location.replace(ret || __anGetSignedInReturnPath());
     }
     function __anMaybeRedirectSignedIn(ret) {
       return fetch(__anPath('/_agent-native/auth/session'), {

package/corpus/core/src/server/realtime-voice.ts

@@ -34,6 +34,9 @@ export const REALTIME_VOICE_TOOL_PATH = "/_agent-native/realtime-voice/tool";
 export const REALTIME_VOICE_MAX_SDP_BYTES = 64 * 1024;
 export const REALTIME_VOICE_MAX_TOOL_BODY_BYTES = 64 * 1024;
 export const REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS = 16_000;
+export const REALTIME_VOICE_MAX_TOOLS = 32;
+export const REALTIME_VOICE_MAX_TOOL_SCHEMA_BYTES = 32_000;
+export const REALTIME_VOICE_MAX_SESSION_BYTES = 64_000;
 
 const OPENAI_REALTIME_CALLS_URL = "https://api.openai.com/v1/realtime/calls";
 const DEFAULT_MODEL = "gpt-realtime-2.1";
@@ -42,7 +45,6 @@ const DEFAULT_INSTRUCTIONS =
   "You are the live voice interface for this Agent Native app. Speak naturally, briefly, and conversationally. Use the available function tools when the user asks you to navigate or take an action. Never claim an action succeeded until its tool result confirms success. If a tool requires approval, explain that the user must approve it in chat.";
 const MAX_INSTRUCTIONS_CHARS = 16_000;
 const MAX_TOOL_DESCRIPTION_CHARS = 2_000;
-const MAX_TOOL_SCHEMA_CHARS = 64 * 1024;
 const MAX_APPROVAL_KEY_CHARS = 1_024;
 const REALTIME_TOOL_NAME = /^[A-Za-z0-9_-]{1,64}$/;
 const CALL_ID = /^[A-Za-z0-9_-]{1,256}$/;
@@ -181,7 +183,13 @@ function normalizeToolSchema(
 ): Record<string, unknown> | null {
   try {
     const serialized = JSON.stringify(inputSchema);
-    if (!serialized || serialized.length > MAX_TOOL_SCHEMA_CHARS) return null;
+    if (
+      !serialized ||
+      Buffer.byteLength(serialized, "utf8") >
+        REALTIME_VOICE_MAX_TOOL_SCHEMA_BYTES
+    ) {
+      return null;
+    }
     const parsed = JSON.parse(serialized) as unknown;
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
       return null;
@@ -213,6 +221,28 @@ function buildRealtimeTools(
   return tools;
 }
 
+function packRealtimeTools(
+  session: Record<string, unknown>,
+  eligibleTools: RealtimeFunctionTool[],
+): RealtimeFunctionTool[] {
+  const packed: RealtimeFunctionTool[] = [];
+  for (const tool of eligibleTools.slice(0, REALTIME_VOICE_MAX_TOOLS)) {
+    const candidate = [...packed, tool];
+    const candidateSession = {
+      ...session,
+      tools: candidate,
+      tool_choice: "auto",
+    };
+    if (
+      Buffer.byteLength(JSON.stringify(candidateSession), "utf8") <=
+      REALTIME_VOICE_MAX_SESSION_BYTES
+    ) {
+      packed.push(tool);
+    }
+  }
+  return packed;
+}
+
 function declaredBodyBytes(event: H3Event): number | undefined {
   const raw = readSafeHeader(event, "content-length");
   if (!raw) return undefined;
@@ -364,7 +394,7 @@ function createSessionHandler(
         }
 
         const instructions = await buildInstructions(auth, options);
-        const session = {
+        const sessionBase = {
           type: "realtime",
           model: configuredIdentifier(options.model, DEFAULT_MODEL),
           instructions,
@@ -383,7 +413,10 @@ function createSessionHandler(
               voice: configuredIdentifier(options.voice, DEFAULT_VOICE),
             },
           },
-          tools,
+        };
+        const session = {
+          ...sessionBase,
+          tools: packRealtimeTools(sessionBase, tools),
           tool_choice: "auto",
         };
 
@@ -632,7 +665,9 @@ export function mountRealtimeVoiceRoutes(
   }
 
   const tools = buildRealtimeTools(actions);
-  const allowedToolNames = new Set(tools.map((tool) => tool.name));
+  const allowedToolNames = new Set(
+    tools.slice(0, REALTIME_VOICE_MAX_TOOLS).map((tool) => tool.name),
+  );
   const app = getH3App(nitroApp);
   app.use(REALTIME_VOICE_SESSION_PATH, createSessionHandler(tools, options));
   app.use(

package/corpus/core/src/server/request-origin.ts

@@ -12,6 +12,12 @@ function isLoopbackHost(host: string): boolean {
  * back to `Sec-Fetch-Site` so Safari's fetch-spec behavior still works.
  */
 export function isSameOriginRequest(event: H3Event): boolean {
+  // Fetch metadata is browser-controlled and describes the relationship
+  // before a reverse proxy rewrites Host (dev-lazy maps :8080 to :8088).
+  // Reject an explicit cross-site signal before consulting forgeable headers.
+  const fetchSite = getRequestHeader(event, "sec-fetch-site");
+  if (fetchSite) return fetchSite === "same-origin" || fetchSite === "none";
+
   const host = getRequestHeader(event, "host");
   const origin = getRequestHeader(event, "origin");
   if (origin && host) {
@@ -55,8 +61,6 @@ export function isSameOriginRequest(event: H3Event): boolean {
       return false;
     }
   }
-  const fetchSite = getRequestHeader(event, "sec-fetch-site");
-  if (fetchSite) return fetchSite === "same-origin" || fetchSite === "none";
   // No Origin and no Sec-Fetch-Site: likely a non-browser client (curl,
   // server-side) — safe to allow, CSRF requires a browser with ambient cookies.
   return true;

package/corpus/core/src/server/ssr-handler.ts

@@ -98,6 +98,22 @@ function requestWithPathname(
   return new Request(url, init);
 }
 
+function requestForAnonymousSsr(request: Request): Request {
+  const headers = new Headers(request.headers);
+  headers.delete("cookie");
+  headers.delete("authorization");
+  const init: RequestInit & { duplex?: "half" } = {
+    method: request.method,
+    headers,
+    signal: request.signal,
+  };
+  if (request.body && !["GET", "HEAD"].includes(request.method.toUpperCase())) {
+    init.body = request.body;
+    init.duplex = "half";
+  }
+  return new Request(request.url, init);
+}
+
 function prefixMountedPath(path: string, basePath: string): string {
   if (!basePath || !path.startsWith("/") || path.startsWith("//")) return path;
   if (path === basePath || path.startsWith(`${basePath}/`)) return path;
@@ -106,7 +122,7 @@ function prefixMountedPath(path: string, basePath: string): string {
 
 function prefixMountedHtml(html: string, basePath: string): string {
   if (!basePath) return html;
-  return html
+  const prefixedHtml = html
     .replace(
       /\b(href|src|action|formaction|poster)=(["'])(\/(?!\/)[^"']*)\2/g,
       (_match, attr: string, quote: string, path: string) =>
@@ -116,6 +132,20 @@ function prefixMountedHtml(html: string, basePath: string): string {
       const q = quote || "";
       return `url(${q}${prefixMountedPath(path, basePath)}${q})`;
     });
+
+  // React Router serializes the server-side basename into its hydration
+  // context. The request above is deliberately rendered mount-relative, so
+  // that value is normally "/" even though the browser URL is mounted at a
+  // workspace prefix such as "/analytics". If the client hydrates that
+  // context unchanged, the mounted pathname no longer matches the route tree:
+  // index redirects can stall and child pages can fall through to the 404.
+  // Keep the serialized router state consistent with the URLs we just
+  // prefixed. Template entry clients also set this defensively for older
+  // responses, but the initial hydration state must be correct at the source.
+  return prefixedHtml.replace(
+    /(window\.__reactRouterContext\s*=\s*\{\s*"basename"\s*:\s*)"(?:\\.|[^"\\])*"/,
+    `$1${JSON.stringify(basePath)}`,
+  );
 }
 
 function injectHeadScript(html: string, script: string | null): string {
@@ -219,6 +249,27 @@ function applyDefaultSsrCacheHeader(
 ) {
   if (!isSsrHtmlOrDataResponse(headers, status, pathname)) return;
 
+  // A public shell must never set a viewer cookie or vary by credentials.
+  // Preserve harmless content-negotiation dimensions such as Accept-Encoding.
+  headers.delete("set-cookie");
+  const vary = headers.get("vary");
+  if (vary) {
+    const publicVary = vary
+      .split(",")
+      .map((value) => value.trim())
+      .filter((value) => {
+        const normalized = value.toLowerCase();
+        return (
+          normalized &&
+          normalized !== "*" &&
+          normalized !== "cookie" &&
+          normalized !== "authorization"
+        );
+      });
+    if (publicVary.length > 0) headers.set("vary", publicVary.join(", "));
+    else headers.delete("vary");
+  }
+
   // Netlify Functions/proxies are not cached by default. Set all three cache
   // headers: Cache-Control for browsers, CDN-Cache-Control for generic CDNs,
   // and Netlify-CDN-Cache-Control (with durable) so Netlify's shared cache
@@ -347,7 +398,9 @@ export function createH3SSRHandler(getBuild: () => Promise<unknown> | unknown) {
       return new Response(null, { status: 404 });
     }
     try {
-      const request = requestWithPathname(event.req as Request, p, basePath);
+      const request = requestForAnonymousSsr(
+        requestWithPathname(event.req as Request, p, basePath),
+      );
       // SSR renders an IMPERSONAL public shell — we deliberately do NOT read the
       // request's session/cookies here, and pin an explicitly anonymous request
       // context. That keeps the SSR HTML/.data identical for every visitor so it