@agent-native/core 0.98.16 → 0.99.0

package/corpus/core/src/mcp/connect-route.ts

@@ -1,20 +1,21 @@
 /**
- * `/_agent-native/mcp/connect` — frictionless external-agent connection.
+ * `/mcp/connect` — frictionless external-agent connection. The legacy
+ * `/_agent-native/mcp/connect` alias is mounted by the core route plugin.
  *
  * A logged-in user on a deployed agent-native app (e.g. mail.agent-native.com)
  * mints a per-user, scoped, revocable MCP bearer token WITHOUT ever copying a
  * shared deployment secret. Two surfaces:
  *
- *   1. Browser  — `GET /connect` renders a minimal in-app page (same inline
+ *   1. Browser  — `GET /mcp/connect` renders a minimal in-app page (same inline
  *      HTML approach as the auth pages). The Authorize button POSTs to
  *      `/connect/token`, then shows the ready-to-paste `.mcp.json` entry, the
  *      `agent-native connect <origin>` one-liner, and the user's existing
  *      tokens with Revoke buttons.
  *   2. CLI      — an OAuth-2.0-device-authorization-style flow:
- *        POST /connect/device/start      (unauth)  → device_code + user_code
- *        GET  /connect?user_code=…       (browser) → user signs in & approves
- *        POST /connect/device/authorize  (session) → binds user to the code
- *        POST /connect/device/poll       (unauth)  → mints + returns the token
+ *        POST /mcp/connect/device/start      (unauth)  → device_code + user_code
+ *        GET  /mcp/connect?user_code=…       (browser) → user signs in & approves
+ *        POST /mcp/connect/device/authorize  (session) → binds user to the code
+ *        POST /mcp/connect/device/poll       (unauth)  → mints + returns the token
  *
  * When A2A_SECRET exists, the minted token reuses the existing A2A signer
  * (`signA2AToken`) and adds a random `jti` + `scope: "mcp-connect"` claim so
@@ -64,6 +65,7 @@ import {
   MCP_OAUTH_DEFAULT_SCOPE,
   signMcpOAuthAccessToken,
 } from "./oauth-token.js";
+import { MCP_PUBLIC_ROUTE_PREFIX } from "./route-paths.js";
 
 /** Device-flow poll interval hint (seconds). */
 const DEVICE_POLL_INTERVAL_S = 3;
@@ -383,7 +385,7 @@ function mcpResultPayload(
 }
 
 function mcpResourceUrl(appUrl: string): string {
-  return `${appUrl}/_agent-native/mcp`;
+  return `${appUrl}${MCP_PUBLIC_ROUTE_PREFIX}`;
 }
 
 // ---------------------------------------------------------------------------
@@ -415,7 +417,7 @@ function renderConnectPage(params: {
     params;
   const safeEmail = escapeHtml(email);
   const safeApp = escapeHtml(appName);
-  const mcpUrl = `${appUrl}/_agent-native/mcp`;
+  const mcpUrl = `${appUrl}${MCP_PUBLIC_ROUTE_PREFIX}`;
   const safeMcpUrl = escapeHtml(mcpUrl);
   const safeServerId = escapeHtml(serverId);
   const safeClaudeCodeCmd = escapeHtml(
@@ -948,7 +950,7 @@ function renderConnectPage(params: {
 </div>
 <script>
 (function () {
-  var BASE = ${JSON.stringify(joinAppPath(connectBasePath, "/_agent-native/mcp/connect"))};
+  var BASE = ${JSON.stringify(joinAppPath(connectBasePath, MCP_PUBLIC_ROUTE_PREFIX + "/connect"))};
   var USER_CODE = ${JSON.stringify(safeUserCode || null)};
   var msgEl = document.getElementById("msg");
   var connectionsEl = document.getElementById("connections");
@@ -1182,10 +1184,11 @@ function renderConnectPage(params: {
 // ---------------------------------------------------------------------------
 
 /**
- * Handle a `/_agent-native/mcp/connect[...]` request. `subpath` is the part
- * after `/connect` (empty string = the page itself, otherwise e.g.
- * `/token`, `/device/start`). The core-routes-plugin computes it from the
- * stripped event path so this module stays mount-agnostic.
+ * Handle a `/mcp/connect[...]` request. The legacy
+ * `/_agent-native/mcp/connect` alias is mounted too. `subpath` is the part
+ * after `/connect` (empty string = the page itself, otherwise e.g. `/token`,
+ * `/device/start`). The core-routes-plugin computes it from the stripped event
+ * path so this module stays mount-agnostic.
  */
 export async function handleMcpConnect(
   event: H3Event,
@@ -1291,7 +1294,7 @@ export async function handleMcpConnect(
     if (method !== "POST") return json({ error: "Method not allowed" }, 405);
     try {
       const row = await createDeviceCode();
-      const verificationUri = `${appUrl}/_agent-native/mcp/connect`;
+      const verificationUri = `${appUrl}${MCP_PUBLIC_ROUTE_PREFIX}/connect`;
       return json({
         device_code: row.deviceCode,
         user_code: row.userCode,

package/corpus/core/src/mcp/oauth-route.ts

@@ -3,7 +3,7 @@
  *
  * These routes let MCP hosts such as Claude Code and ChatGPT authenticate
  * through their native remote-MCP OAuth flow instead of pasting bearer tokens.
- * The issued access tokens are audience-bound to `/_agent-native/mcp`, carry
+ * The issued access tokens are audience-bound to `/mcp`, carry
  * the same user/org identity as the existing connect flow, and are mediated by
  * `verifyAuth` before any MCP tool/resource request runs.
  */
@@ -35,6 +35,7 @@ import {
   normalizeOAuthScope,
   signMcpOAuthAccessToken,
 } from "./oauth-token.js";
+import { MCP_PUBLIC_ROUTE_PREFIX, MCP_ROUTE_PREFIXES } from "./route-paths.js";
 
 export interface McpOAuthRouteOptions {
   appId?: string;
@@ -172,7 +173,16 @@ export function getMcpOAuthIssuer(event: H3Event): string | undefined {
 export function getMcpOAuthResource(event: H3Event): string | undefined {
   const issuer = getMcpOAuthIssuer(event);
   if (!issuer) return undefined;
-  return `${issuer}/_agent-native/mcp`;
+  return `${issuer}${MCP_PUBLIC_ROUTE_PREFIX}`;
+}
+
+function mcpResourcesForIssuer(issuer: string): string[] {
+  return [
+    MCP_PUBLIC_ROUTE_PREFIX,
+    ...MCP_ROUTE_PREFIXES.filter(
+      (prefix) => prefix !== MCP_PUBLIC_ROUTE_PREFIX,
+    ),
+  ].map((prefix) => `${issuer}${prefix}`);
 }
 
 /**
@@ -185,18 +195,21 @@ export function getMcpOAuthResource(event: H3Event): string | undefined {
  * accepts either without issuing a 401.
  */
 export function getMcpOAuthAudiences(event: H3Event): string[] {
-  const derived = getMcpOAuthResource(event);
-  const configured = (() => {
+  const configuredIssuer = (() => {
     const base = configuredPublicBaseUrl();
     if (!base) return undefined;
     // Re-apply base path if present so the configured resource is also
     // base-path-aware, consistent with how getMcpOAuthResource computes it.
-    const withPath = appendConfiguredBasePath(base);
-    return `${withPath}/_agent-native/mcp`;
+    return appendConfiguredBasePath(base);
   })();
   const seen = new Set<string>();
   const out: string[] = [];
-  for (const r of [derived, configured]) {
+  for (const r of [
+    ...(getMcpOAuthIssuer(event)
+      ? mcpResourcesForIssuer(getMcpOAuthIssuer(event) as string)
+      : []),
+    ...(configuredIssuer ? mcpResourcesForIssuer(configuredIssuer) : []),
+  ]) {
     const n = r?.replace(/\/+$/, "");
     if (n && !seen.has(n)) {
       seen.add(n);
@@ -224,17 +237,21 @@ export function buildMcpOAuthChallenge(event: H3Event): string {
 
 function authorizationEndpoint(event: H3Event): string | undefined {
   const issuer = getMcpOAuthIssuer(event);
-  return issuer ? `${issuer}/_agent-native/mcp/oauth/authorize` : undefined;
+  return issuer
+    ? `${issuer}${MCP_PUBLIC_ROUTE_PREFIX}/oauth/authorize`
+    : undefined;
 }
 
 function tokenEndpoint(event: H3Event): string | undefined {
   const issuer = getMcpOAuthIssuer(event);
-  return issuer ? `${issuer}/_agent-native/mcp/oauth/token` : undefined;
+  return issuer ? `${issuer}${MCP_PUBLIC_ROUTE_PREFIX}/oauth/token` : undefined;
 }
 
 function registrationEndpoint(event: H3Event): string | undefined {
   const issuer = getMcpOAuthIssuer(event);
-  return issuer ? `${issuer}/_agent-native/mcp/oauth/register` : undefined;
+  return issuer
+    ? `${issuer}${MCP_PUBLIC_ROUTE_PREFIX}/oauth/register`
+    : undefined;
 }
 
 export function handleMcpOAuthProtectedResourceMetadata(
@@ -707,8 +724,11 @@ async function handleAuthorize(
   const state = params.state;
   const clientId = params.client_id;
   const redirectUri = params.redirect_uri;
-  const resource = params.resource || getMcpOAuthResource(event);
-  const expectedResource = getMcpOAuthResource(event);
+  const resource = (params.resource || getMcpOAuthResource(event))?.replace(
+    /\/+$/,
+    "",
+  );
+  const expectedResources = getMcpOAuthAudiences(event);
 
   if (params.response_type !== "code") {
     return oauthError(
@@ -716,7 +736,12 @@ async function handleAuthorize(
       "response_type must be code",
     );
   }
-  if (!clientId || !redirectUri || !resource || resource !== expectedResource) {
+  if (
+    !clientId ||
+    !redirectUri ||
+    !resource ||
+    !expectedResources.includes(resource)
+  ) {
     return oauthError("invalid_request", "Invalid OAuth authorization request");
   }
   if (params.code_challenge_method !== "S256" || !params.code_challenge) {

package/corpus/core/src/mcp/route-paths.ts

@@ -0,0 +1,34 @@
+/**
+ * MCP's public protocol path and the framework path kept for compatibility.
+ *
+ * Only the protocol and its OAuth/connect companions use the public alias.
+ * Other framework-owned MCP management routes remain under `/_agent-native`.
+ */
+export const MCP_PUBLIC_ROUTE_PREFIX = "/mcp";
+export const MCP_LEGACY_ROUTE_PREFIX = "/_agent-native/mcp";
+
+export const MCP_ROUTE_PREFIXES = [
+  MCP_LEGACY_ROUTE_PREFIX,
+  MCP_PUBLIC_ROUTE_PREFIX,
+] as const;
+
+export function joinMcpRoute(prefix: string, suffix: string): string {
+  const normalizedSuffix = suffix.startsWith("/") ? suffix : `/${suffix}`;
+  return `${prefix}${normalizedSuffix}` || normalizedSuffix;
+}
+
+export function isMcpPublicPath(pathname: string): boolean {
+  return (
+    pathname === MCP_PUBLIC_ROUTE_PREFIX ||
+    pathname.startsWith(`${MCP_PUBLIC_ROUTE_PREFIX}/`)
+  );
+}
+
+export function isMcpProtocolPath(pathname: string): boolean {
+  return (
+    pathname === MCP_PUBLIC_ROUTE_PREFIX ||
+    pathname === MCP_LEGACY_ROUTE_PREFIX ||
+    pathname === `${MCP_PUBLIC_ROUTE_PREFIX}/` ||
+    pathname === `${MCP_LEGACY_ROUTE_PREFIX}/`
+  );
+}

package/corpus/core/src/mcp/server.ts

@@ -28,6 +28,11 @@ import {
   getMcpOAuthProtectedResourceMetadataUrl,
   getMcpOAuthResource,
 } from "./oauth-route.js";
+import {
+  MCP_PUBLIC_ROUTE_PREFIX,
+  MCP_ROUTE_PREFIXES,
+  joinMcpRoute,
+} from "./route-paths.js";
 
 // Re-export the shared MCP server builder + types so the stdio transport and
 // any (future) external importer of `@agent-native/core/mcp` keep resolving
@@ -183,7 +188,7 @@ function buildWebRequest(event: H3Event, method: string): Request {
     forwardedProto?.split(",")[0]?.trim() ||
     (/^(localhost|127\.0\.0\.1)(:|$)/.test(host) ? "http" : "https");
   const basePath = getConfiguredAppBasePath();
-  const url = `${proto}://${host}${basePath}/_agent-native/mcp`;
+  const url = `${proto}://${host}${basePath}${MCP_PUBLIC_ROUTE_PREFIX}`;
 
   // No body here on purpose: the JSON-RPC payload is forwarded via the
   // transport's `parsedBody` option (the same mechanism the Node transport
@@ -220,7 +225,7 @@ function buildUnauthorizedBody(event: H3Event): {
     ? `npx @agent-native/core@latest connect ${issuer}`
     : undefined;
   const authorizeUrl = issuer
-    ? `${issuer}/_agent-native/mcp/oauth/authorize`
+    ? `${issuer}${MCP_PUBLIC_ROUTE_PREFIX}/oauth/authorize`
     : undefined;
   const message = command
     ? `Authentication required. Run \`${command}\` to re-authenticate this ` +
@@ -454,7 +459,8 @@ export async function handleMcpRequest(
 /**
  * Mount an MCP remote server on an H3/Nitro app.
  *
- * Endpoint: `{routePrefix}/mcp` (default `/_agent-native/mcp`)
+ * Endpoints: `/mcp` (public) and `/_agent-native/mcp` (compatibility).
+ * A custom route prefix only mounts that custom endpoint.
  *
  * Uses stateless Streamable HTTP transport — no in-memory sessions, JSON
  * request/response (no SSE), and no standalone GET stream, so it survives
@@ -473,15 +479,20 @@ export function mountMCP(
   config: MCPConfig,
   routePrefix = "/_agent-native",
 ): void {
-  getH3App(nitroApp).use(
-    `${routePrefix}/mcp`,
-    defineEventHandler(async (event) => {
-      return handleMcpRequest(event as H3Event, config);
-    }),
-  );
+  const routePaths =
+    routePrefix === "/_agent-native"
+      ? [...MCP_ROUTE_PREFIXES]
+      : [joinMcpRoute(routePrefix, "/mcp")];
+  const handler = defineEventHandler(async (event) => {
+    return handleMcpRequest(event as H3Event, config);
+  });
+
+  for (const routePath of routePaths) {
+    getH3App(nitroApp).use(routePath, handler);
+  }
 
   if (process.env.DEBUG)
     console.log(
-      `[mcp] Mounted MCP server at ${routePrefix}/mcp (${Object.keys(config.actions).length} tools${config.askAgent ? " + ask-agent" : ""})`,
+      `[mcp] Mounted MCP server at ${routePaths.join(" and ")} (${Object.keys(config.actions).length} tools${config.askAgent ? " + ask-agent" : ""})`,
     );
 }

package/corpus/core/src/mcp/stdio.ts

@@ -7,12 +7,13 @@
  *
  *   - **proxy (default)** — connect an MCP `Client` over
  *     `StreamableHTTPClientTransport` to the *already-running* local app's
- *     `http://127.0.0.1:<port>/_agent-native/mcp`, and run a stdio `Server`
- *     that forwards tools and optional MCP App resources to it. The live app
- *     is the single source of truth: HMR'd actions, the real registry, correct
- *     per-request deep links, and tenant scoping all come for free. If the
- *     app isn't running, we wait briefly for it (the workspace gateway boots
- *     it lazily on first request).
+ *     `http://127.0.0.1:<port>/mcp` (falling back to the legacy
+ *     `/_agent-native/mcp` path), and run a stdio `Server` that forwards tools
+ *     and optional MCP App resources to it. The live app is the single source
+ *     of truth: HMR'd actions, the real registry, correct per-request deep
+ *     links, and tenant scoping all come for free. If the app isn't running,
+ *     we wait briefly for it (the workspace gateway boots it lazily on first
+ *     request).
  *
  *   - **standalone (`--standalone`)** — no running server, no HMR. Build the
  *     MCP server in-process from `autoDiscoverActions(cwd)` +
@@ -25,6 +26,10 @@
 
 import type { ServerCapabilities } from "@modelcontextprotocol/sdk/types.js";
 
+import {
+  MCP_LEGACY_ROUTE_PREFIX,
+  MCP_PUBLIC_ROUTE_PREFIX,
+} from "./route-paths.js";
 import { resolveLocalAppOrigin } from "./workspace-resolve.js";
 
 export interface RunMCPStdioOptions {
@@ -42,7 +47,10 @@ export interface RunMCPStdioOptions {
   waitForAppMs?: number;
 }
 
-const MCP_SUBPATH = "/_agent-native/mcp";
+const MCP_SUBPATHS = [
+  MCP_PUBLIC_ROUTE_PREFIX,
+  MCP_LEGACY_ROUTE_PREFIX,
+] as const;
 
 function log(msg: string): void {
   // stderr only — stdout is the MCP protocol channel and must stay clean.
@@ -74,9 +82,13 @@ function authHeaders(env: NodeJS.ProcessEnv): Record<string, string> {
   return headers;
 }
 
-async function probeOrigin(origin: string, timeoutMs = 800): Promise<boolean> {
+async function probeOrigin(
+  origin: string,
+  subpath: string,
+  timeoutMs = 800,
+): Promise<boolean> {
   try {
-    const res = await fetch(`${origin}${MCP_SUBPATH}`, {
+    const res = await fetch(`${origin}${subpath}`, {
       method: "GET",
       signal: AbortSignal.timeout(timeoutMs),
     });
@@ -87,6 +99,13 @@ async function probeOrigin(origin: string, timeoutMs = 800): Promise<boolean> {
   }
 }
 
+async function resolveMcpSubpath(origin: string): Promise<string | null> {
+  for (const subpath of MCP_SUBPATHS) {
+    if (await probeOrigin(origin, subpath)) return subpath;
+  }
+  return null;
+}
+
 /**
  * Proxy mode: stdio Server ⇄ HTTP Client to the running app.
  *
@@ -103,27 +122,26 @@ async function runProxy(opts: RunMCPStdioOptions): Promise<void> {
     port: opts.port,
   });
   const env = opts.env ?? process.env;
-  const target = `${origin}${MCP_SUBPATH}`;
-
   // Wait for the app to come up. The workspace gateway lazily boots an app's
   // dev server on first request, so a fresh `mcp serve` may briefly race the
   // boot. Hit the gateway path too so the lazy start is triggered.
   const deadline = Date.now() + (opts.waitForAppMs ?? 60_000);
-  let up = await probeOrigin(origin);
-  if (!up) {
+  let mcpSubpath = await resolveMcpSubpath(origin);
+  if (!mcpSubpath) {
     log(`Waiting for ${appId} at ${origin} …`);
-    while (!up && Date.now() < deadline) {
+    while (!mcpSubpath && Date.now() < deadline) {
       await new Promise((r) => setTimeout(r, 750));
-      up = await probeOrigin(origin);
+      mcpSubpath = await resolveMcpSubpath(origin);
     }
   }
-  if (!up) {
+  if (!mcpSubpath) {
     throw new Error(
       `Timed out waiting for the local app at ${origin}. Start it with ` +
         `\`agent-native dev\` (or \`agent-native workspace-dev\`), or run ` +
         `\`agent-native mcp serve --standalone\` to build the server from disk.`,
     );
   }
+  const target = `${origin}${mcpSubpath}`;
 
   const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
   const { StreamableHTTPClientTransport } =

package/corpus/core/src/mcp/workspace-resolve.ts

@@ -213,7 +213,8 @@ export async function resolveWorkspace(
 /**
  * Resolve the local app the stdio proxy should connect its MCP HTTP client
  * to. Honours an explicit `--app` / appId and `--port` / explicit port.
- * Returns the chosen app's origin (where `/_agent-native/mcp` is mounted).
+ * Returns the chosen app's origin (where `/mcp` is mounted; the legacy
+ * `/_agent-native/mcp` alias is supported too).
  *
  * Order of precedence:
  *   1. explicit `port` → http://127.0.0.1:<port>

package/corpus/core/src/mcp-client/manager.ts

@@ -954,9 +954,11 @@ function firstPartyMcpAudienceForUrl(rawUrl: string): string | undefined {
   try {
     const url = new URL(rawUrl);
     const pathname = url.pathname.replace(/\/+$/, "");
-    url.pathname = pathname.endsWith("/_agent-native/mcp")
-      ? pathname
-      : `${pathname}/_agent-native/mcp`;
+    if (pathname.endsWith("/_agent-native/mcp")) {
+      url.pathname = `${pathname.slice(0, -"/_agent-native/mcp".length)}/mcp`;
+    } else {
+      url.pathname = pathname.endsWith("/mcp") ? pathname : `${pathname}/mcp`;
+    }
     url.search = "";
     url.hash = "";
     return url.toString().replace(/\/+$/, "");

package/corpus/core/src/mcp-client/remote-store.ts

@@ -438,22 +438,22 @@ function normalizeEndpointPath(pathname: string): string {
   return pathname.replace(/\/+$/, "") || "/";
 }
 
-function expectedFirstPartyMcpUrl(appUrl: string): URL | null {
+function expectedFirstPartyMcpUrls(appUrl: string): URL[] {
   try {
-    return new URL(`${appUrl.replace(/\/+$/, "")}/_agent-native/mcp`);
+    const base = appUrl.replace(/\/+$/, "");
+    return [new URL(`${base}/mcp`), new URL(`${base}/_agent-native/mcp`)];
   } catch {
-    return null;
+    return [];
   }
 }
 
 function sameFirstPartyMcpEndpoint(endpointUrl: URL, appUrl: string): boolean {
-  const expected = expectedFirstPartyMcpUrl(appUrl);
-  if (!expected) return false;
-  return (
-    endpointUrl.origin === expected.origin &&
-    normalizeEndpointPath(endpointUrl.pathname) ===
-      normalizeEndpointPath(expected.pathname) &&
-    endpointUrl.search === expected.search
+  return expectedFirstPartyMcpUrls(appUrl).some(
+    (expected) =>
+      endpointUrl.origin === expected.origin &&
+      normalizeEndpointPath(endpointUrl.pathname) ===
+        normalizeEndpointPath(expected.pathname) &&
+      endpointUrl.search === expected.search,
   );
 }
 

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -168,6 +168,7 @@ import {
 import { mountRealtimeVoiceRoutes } from "./realtime-voice.js";
 import {
   runWithRequestContext,
+  getRequestContext,
   getRequestOrgId,
   getRequestUserEmail,
   getRequestRunContext,
@@ -1255,6 +1256,35 @@ export function createAgentChatPlugin(
           const { getOwnerActiveApiKey } =
             await import("../agent/production-agent.js");
           const ownerApiKey = await getOwnerActiveApiKey(userEmail);
+          // A2A runs are reconstructed in a fresh processor request, so they
+          // do not pass through the interactive handler's prepareRun hook.
+          // Seed the same mutable run context before resolving the engine and
+          // building tools. Provider credentials, team/fetch helpers, and
+          // other action closures read this context rather than the engine
+          // argument alone; without it delegated runs can silently fall back
+          // to an unscoped/unconfigured provider path even though interactive
+          // chat works for the same owner.
+          const a2aRunContext = ensureRequestRunContext();
+          if (a2aRunContext) {
+            a2aRunContext.owner = userEmail;
+            a2aRunContext.userApiKey = ownerApiKey;
+            // The async processor restores the original request origin from
+            // task metadata. Only derive a fallback for synchronous A2A calls
+            // where the inbound event is still the caller request.
+            if (!a2aRunContext.requestOrigin) {
+              const restoredOrigin = getRequestContext()?.requestOrigin;
+              if (restoredOrigin) {
+                a2aRunContext.requestOrigin = restoredOrigin;
+              }
+            }
+            if (!a2aRunContext.requestOrigin) {
+              try {
+                a2aRunContext.requestOrigin = getOrigin(context.event as any);
+              } catch {
+                // Keep the owner context even when no browser origin exists.
+              }
+            }
+          }
           const a2aEngine = await resolveEngine({
             engineOption: options?.engine,
             apiKey: ownerApiKey ?? options?.apiKey,
@@ -1274,14 +1304,6 @@ export function createAgentChatPlugin(
             ? ""
             : await buildSchemaBlock(owner, databaseToolsMode);
           const extra = await resolveExtraContext(context.event, owner);
-          // Stable content first, most-volatile-per-day last: the
-          // runtime-context block is appended after resources/schema/extra so
-          // a day rollover (or the resources/extra content changing) only
-          // invalidates the cached prompt prefix as late as possible.
-          const runtimeContext = runtimeContextForEvent(context.event);
-          const systemPrompt = devActive
-            ? devPrompt + resources + schemaBlock + extra + runtimeContext
-            : basePrompt + resources + schemaBlock + extra + runtimeContext;
 
           const a2aModelCandidate =
             options?.model ??
@@ -1290,6 +1312,34 @@ export function createAgentChatPlugin(
             })) ??
             a2aEngine.defaultModel;
           const model = normalizeModelForEngine(a2aEngine, a2aModelCandidate);
+          if (a2aRunContext) {
+            a2aRunContext.engine = a2aEngine;
+            a2aRunContext.model = model;
+          }
+
+          // Keep delegated runs aligned with the interactive production
+          // prompt's model-specific behavior without importing interactive
+          // onboarding into a background/cross-app task.
+          const modelOverlay = getModelFamilyOverlay(model);
+          // Stable content first, most-volatile-per-day last: the
+          // runtime-context block is appended after resources/schema/extra so
+          // a day rollover (or the resources/extra content changing) only
+          // invalidates the cached prompt prefix as late as possible.
+          const runtimeContext = runtimeContextForEvent(context.event);
+          const systemPrompt = devActive
+            ? devPrompt +
+              resources +
+              schemaBlock +
+              extra +
+              modelOverlay +
+              runtimeContext
+            : basePrompt +
+              resources +
+              schemaBlock +
+              extra +
+              modelOverlay +
+              runtimeContext;
+          if (a2aRunContext) a2aRunContext.systemPrompt = systemPrompt;
 
           // Build tools — same as interactive handler but WITHOUT call-agent
           // to prevent infinite recursive A2A loops (agent calling itself).
@@ -5343,6 +5393,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
         "/_agent-native/actions",
         "/_agent-native/agent-model-defaults",
         "/_agent-native/mcp",
+        "/mcp",
       ],
     });
   };

package/corpus/core/src/server/auth.ts

@@ -74,6 +74,11 @@ import {
 } from "../db/client.js";
 import { ensureColumnExists, ensureTableExists } from "../db/ddl-guard.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
+import {
+  MCP_LEGACY_ROUTE_PREFIX,
+  MCP_PUBLIC_ROUTE_PREFIX,
+  isMcpProtocolPath,
+} from "../mcp/route-paths.js";
 import { readBody } from "../server/h3-helpers.js";
 import { putSetting } from "../settings/store.js";
 import { DEFAULT_SSR_CACHE_HEADERS } from "../shared/cache-control.js";
@@ -718,8 +723,9 @@ async function getBearerLegacySession(
  * `agent-native connect` mints this token for the local Plans publish flow and
  * POSTs it to the HOSTED action route
  * `/_agent-native/actions/import-visual-plan-source`. That token is audience-
- * bound to the app's MCP resource (`{appUrl}/_agent-native/mcp`), not to the
- * legacy `sessions` table — so the legacy bearer lookup above never matches it.
+ * bound to the app's canonical MCP resource (`{appUrl}/mcp`; the legacy
+ * `/_agent-native/mcp` resource is also accepted), not to the legacy `sessions`
+ * table — so the legacy bearer lookup above never matches it.
  * Reuse the MCP surface's canonical `verifyAuth` here so the HTTP action surface
  * honors EXACTLY the tokens the MCP endpoint honors: same signature check, same
  * audience binding to THIS app's resource, same connect-token revocation gate.
@@ -740,13 +746,13 @@ async function getMcpOAuthBearerSession(
   if (!bearerToken) return null;
 
   try {
-    const [{ getMcpOAuthResource }, { verifyAuth, resolveOrgIdFromDomain }] =
+    const [{ getMcpOAuthAudiences }, { verifyAuth, resolveOrgIdFromDomain }] =
       await Promise.all([
         import("../mcp/oauth-route.js"),
         import("../mcp/build-server.js"),
       ]);
     const result = await verifyAuth(authHeader, undefined, {
-      resourceUrl: getMcpOAuthResource(event),
+      resourceUrl: getMcpOAuthAudiences(event),
       allowDevOpen: false,
     });
     const identity = result.authed ? result.identity : undefined;
@@ -1775,7 +1781,11 @@ function createAuthGuardFn(): (
     // the stdio proxy or HTTP can never reach it. Exact protocol endpoint only:
     // tolerate the common trailing slash, but keep
     // `/_agent-native/mcp/*` management subroutes on normal session auth.
-    if (p === "/_agent-native/mcp" || p === "/_agent-native/mcp/") {
+    if (
+      isMcpProtocolPath(p) ||
+      p === `${MCP_PUBLIC_ROUTE_PREFIX}/` ||
+      p === `${MCP_LEGACY_ROUTE_PREFIX}/`
+    ) {
       return;
     }
 
@@ -1806,7 +1816,13 @@ function createAuthGuardFn(): (
       p === "/_agent-native/mcp/connect/device/poll" ||
       p === "/_agent-native/mcp/oauth/authorize" ||
       p === "/_agent-native/mcp/oauth/token" ||
-      p === "/_agent-native/mcp/oauth/register"
+      p === "/_agent-native/mcp/oauth/register" ||
+      p === `${MCP_PUBLIC_ROUTE_PREFIX}/connect` ||
+      p === `${MCP_PUBLIC_ROUTE_PREFIX}/connect/device/start` ||
+      p === `${MCP_PUBLIC_ROUTE_PREFIX}/connect/device/poll` ||
+      p === `${MCP_PUBLIC_ROUTE_PREFIX}/oauth/authorize` ||
+      p === `${MCP_PUBLIC_ROUTE_PREFIX}/oauth/token` ||
+      p === `${MCP_PUBLIC_ROUTE_PREFIX}/oauth/register`
     ) {
       return;
     }