@agent-native/core 0.98.12 → 0.98.13

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @agent-native/core
 
+## 0.98.13
+
+### Patch Changes
+
+- c61d923: Keep delegated A2A and MCP agent turns explicitly bound to the authenticated owner/org scope and Act execution mode.
+
 ## 0.98.12
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.98.12",
+  "version": "0.98.13",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -1371,6 +1371,13 @@ export function createAgentChatPlugin(
               availableTools: a2aToolSurface.availableTools,
               messages: a2aMessages,
               actions: a2aActions,
+              // A2A already establishes these values in request context. Pass
+              // them explicitly too so delegated tool execution and template
+              // final-response guards cannot lose the authenticated caller's
+              // scope when a processor hop or alternate runner is involved.
+              ownerEmail: userEmail,
+              orgId: getRequestOrgId() ?? null,
+              executionMode: "act",
               send: (event) => {
                 a2aEvents.push(event);
                 if (event.type === "tool_start") {
@@ -1640,6 +1647,9 @@ export function createAgentChatPlugin(
                   },
                 ],
                 actions: mcpActions,
+                ownerEmail: getRequestUserEmail(),
+                orgId: getRequestOrgId() ?? null,
+                executionMode: "act",
                 send: (event) => {
                   accumulatedText = applyAgentTextEventToBuffer(
                     accumulatedText,

package/dist/progress/routes.d.ts

@@ -15,7 +15,7 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/resources/handlers.d.ts

@@ -49,8 +49,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/agent-chat-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-chat-plugin.d.ts","sourceRoot":"","sources":["../../src/server/agent-chat-plugin.ts"],"names":[],"mappings":"AAyIA,OAAO,EACL,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,+BAA+B,CAAC;AAoCvC,OAAO,EAAE,yBAAyB,EAAE,CAAC;AACrC,YAAY,EAAE,6BAA6B,EAAE,CAAC;AAmB9C,OAAO,EACL,0BAA0B,EAK1B,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EAE1B,MAAM,oCAAoC,CAAC;AAW5C,OAAO,EACL,gCAAgC,EAOjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EACL,sBAAsB,EAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAEL,sCAAsC,EACvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,OAAO,EAAE,gCAAgC,EAAE,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,CAAC;AACpC,YAAY,EAAE,sBAAsB,EAAE,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACtC,OAAO,EAAE,sCAAsC,EAAE,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,OAAO,EAAE,iCAAiC,EAAE,CAAC;AAC7C,OAAO,EAAE,yCAAyC,EAAE,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,uCAAuC,CAC3D,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAUlB;AAaD,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CAu5JhB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC;AAE9E,OAAO,EAEL,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,CAAC"}
+{"version":3,"file":"agent-chat-plugin.d.ts","sourceRoot":"","sources":["../../src/server/agent-chat-plugin.ts"],"names":[],"mappings":"AAyIA,OAAO,EACL,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,+BAA+B,CAAC;AAoCvC,OAAO,EAAE,yBAAyB,EAAE,CAAC;AACrC,YAAY,EAAE,6BAA6B,EAAE,CAAC;AAmB9C,OAAO,EACL,0BAA0B,EAK1B,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EAE1B,MAAM,oCAAoC,CAAC;AAW5C,OAAO,EACL,gCAAgC,EAOjC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yCAAyC,EAAE,MAAM,qCAAqC,CAAC;AAChG,OAAO,EACL,sBAAsB,EAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAC3F,OAAO,EAEL,sCAAsC,EACvC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAYxE,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,OAAO,EAAE,gCAAgC,EAAE,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,CAAC;AACrC,OAAO,EAAE,wBAAwB,EAAE,CAAC;AACpC,YAAY,EAAE,sBAAsB,EAAE,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACtC,OAAO,EAAE,sCAAsC,EAAE,CAAC;AAClD,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAClC,OAAO,EAAE,iCAAiC,EAAE,CAAC;AAC7C,OAAO,EAAE,yCAAyC,EAAE,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,uCAAuC,CAC3D,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAUlB;AAaD,wBAAgB,qBAAqB,CACnC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,cAAc,CAi6JhB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC;AAE9E,OAAO,EAEL,mBAAmB,EACnB,uBAAuB,EAGxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,CAAC"}

package/dist/server/agent-chat-plugin.js

@@ -1044,6 +1044,13 @@ export function createAgentChatPlugin(options) {
                         availableTools: a2aToolSurface.availableTools,
                         messages: a2aMessages,
                         actions: a2aActions,
+                        // A2A already establishes these values in request context. Pass
+                        // them explicitly too so delegated tool execution and template
+                        // final-response guards cannot lose the authenticated caller's
+                        // scope when a processor hop or alternate runner is involved.
+                        ownerEmail: userEmail,
+                        orgId: getRequestOrgId() ?? null,
+                        executionMode: "act",
                         send: (event) => {
                             a2aEvents.push(event);
                             if (event.type === "tool_start") {
@@ -1266,6 +1273,9 @@ export function createAgentChatPlugin(options) {
                                 },
                             ],
                             actions: mcpActions,
+                            ownerEmail: getRequestUserEmail(),
+                            orgId: getRequestOrgId() ?? null,
+                            executionMode: "act",
                             send: (event) => {
                                 accumulatedText = applyAgentTextEventToBuffer(accumulatedText, event);
                             },