@agent-native/core 0.98.17 → 0.99.1

package/corpus/core/docs/content/mcp-clients.mdx

@@ -272,7 +272,32 @@ export default {
 ```
 
 Preset ids are `context7`, `sentry`, `notion`, `semgrep`, `linear`,
-`supabase`, `neon`, and `stripe`.
+`atlassian`, `supabase`, `neon`, and `stripe`.
+
+### Atlassian / Jira
+
+The Atlassian preset uses Atlassian Rovo MCP's OAuth 2.1 endpoint,
+`https://mcp.atlassian.com/v1/mcp/authv2`, and exposes Jira and Confluence
+tools. Creating Jira tickets requires the Atlassian permissions that cover
+Jira writes; the user still only sees the projects and content allowed by
+their Atlassian account.
+
+Atlassian organization admins can control whether an OAuth client is allowed
+to connect. Before connecting, an admin may need to add the app's actual HTTPS
+origin to the trusted-domain list under **Atlassian Administration → Rovo →
+Rovo MCP server → Domains**, and enable the required **Read**, **Write**, and
+**Search** permissions under **Permissions**. The domain must be the host where
+the agent-native app runs; do not copy `https://builder.io/**` to another
+deployment unless that is its actual origin. See Atlassian's [Rovo MCP setup
+guide](https://developer.atlassian.com/cloud/rovo-mcp/guides/getting-started/)
+and [admin controls](https://support.atlassian.com/security-and-access-policies/docs/control-atlassian-rovo-mcp-server-settings/).
+
+The catalog supplies the endpoint and setup guidance. The generic settings
+form stores the endpoint and optional encrypted headers; it does not replace
+Atlassian's interactive OAuth consent flow. Use an OAuth-capable MCP client or
+runtime when Atlassian requires interactive OAuth. If the provider or runtime
+supports a static bearer token, follow its approved secret-management path and
+never paste tokens into prompts or committed config.
 
 ### How to connect a remote MCP server
 
@@ -292,7 +317,7 @@ Two scopes are supported:
 
 Adds and removes hot-reload into the running MCP manager — no process restart, and no server restart. The new `mcp__<scope>-<name>__*` tools appear to the agent on the next message and are searchable via `tool-search`.
 
-HTTPS URLs are accepted everywhere; plain `http://` is only allowed for `localhost` during development. Optional auth goes in as a Bearer token that's sent via `Authorization: Bearer …` on every request.
+HTTPS URLs are accepted everywhere; plain `http://` is only allowed for `localhost` during development. Optional auth goes in as a Bearer token that's sent via `Authorization: Bearer …` on every request. OAuth-only providers, including Atlassian Rovo MCP, require the provider's OAuth flow instead of a static header.
 
 Under the hood these servers are persisted in the framework's `settings` table under the key `u:<email>:mcp-servers-remote` (Personal) or `o:<orgId>:mcp-servers-remote` (Team) and merged with `mcp.config.json` on startup.
 
@@ -355,7 +380,9 @@ pull its org-scope MCP servers automatically. Dispatch is the conventional hub
   <div class="diagram-panel center" data-rough>
     <span class="diagram-pill accent">Dispatch hub</span
     ><small class="diagram-muted">org-scope MCP servers</small
-    ><small class="diagram-muted"><code>GET /mcp/hub/servers</code></small>
+    ><small class="diagram-muted"
+      ><code>GET /_agent-native/mcp/hub/servers</code></small
+    >
   </div>
   <div class="diagram-col arrows">
     <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
@@ -469,7 +496,7 @@ Reports which configured servers connected, the total live tool count, the merge
 
 Individual MCP server failures never take down the agent:
 
-- A misconfigured `command` → the server is skipped, its error appears in `/mcp/status` under `errors.<server-id>`, and every other server continues to work.
+- A misconfigured `command` → the server is skipped, its error appears in `/_agent-native/mcp/status` under `errors.<server-id>`, and every other server continues to work.
 - The MCP SDK is missing from `node_modules` → all MCP functionality is skipped with a warning; agent chat keeps working with zero MCP tools.
 - Running in an edge runtime → MCP client is a no-op.
 

package/corpus/core/docs/content/mcp-protocol.mdx

@@ -23,7 +23,7 @@ MCP is the standard protocol for connecting AI tools to external capabilities. W
 
 Key concepts:
 
-- **Auto-mounted** — every app gets `/_agent-native/mcp` for free, no setup required
+- **Auto-mounted** — every app gets `/mcp` for free, no setup required
 - **Streamable HTTP** — uses the modern MCP transport over standard HTTP (POST + SSE)
 - **Same actions** — the exact same action registry that powers agent chat and A2A
 - **`ask-agent` tool** — a meta-tool that delegates to the full agent loop for complex tasks
@@ -42,7 +42,7 @@ Key concepts:
   </div>
   <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
   <div class="diagram-panel">
-    <span class="diagram-pill accent">POST /_agent-native/mcp</span
+    <span class="diagram-pill accent">POST /mcp</span
     ><small class="diagram-muted">Streamable HTTP</small
     ><small class="diagram-muted"
       >initialize &rarr; tools/list &rarr; tools/call</small
@@ -95,7 +95,7 @@ Both protocols are auto-mounted. Use whichever fits your use case:
 | **Best for**       | External tools calling your app                                          | Agent-to-agent communication                 |
 | **Protocol**       | MCP Streamable HTTP                                                      | JSON-RPC 2.0                                 |
 | **Tool discovery** | `tools/list`                                                             | Agent card at `/.well-known/agent-card.json` |
-| **Endpoint**       | `/_agent-native/mcp`                                                     | `/_agent-native/a2a`                         |
+| **Endpoint**       | `/mcp`                                                                   | `/_agent-native/a2a`                         |
 | **Supported by**   | Claude, ChatGPT, Claude Code, Cursor, Codex, Cowork, and other MCP hosts | Other agent-native apps                      |
 | **Execution**      | Direct tool calls (no extra LLM)                                         | Full agent loop (LLM reasoning)              |
 
@@ -106,7 +106,7 @@ You can also use the `ask-agent` MCP tool to get the best of both worlds — cal
 For the recommended one-command setup, use [External Agents](/docs/external-agents). If you are hand-writing MCP config for an OAuth-capable host, add your app as a remote MCP server with no static headers:
 
 ```bash
-claude mcp add --transport http mail https://mail.example.com/_agent-native/mcp
+claude mcp add --transport http mail https://mail.example.com/mcp
 ```
 
 Or write the entry by hand in `.mcp.json` (project scope) or `~/.claude.json` (user scope):
@@ -117,7 +117,7 @@ Or write the entry by hand in `.mcp.json` (project scope) or `~/.claude.json` (u
   "mcpServers": {
     "mail": {
       "type": "http",
-      "url": "https://mail.example.com/_agent-native/mcp",
+      "url": "https://mail.example.com/mcp",
     },
   },
 }
@@ -136,12 +136,12 @@ Claude Code calls: draft-email(to: "john@example.com", subject: "Q3 Report", bod
 Any MCP host that supports Streamable HTTP transport can connect. The endpoint is:
 
 ```
-POST https://your-app.example.com/_agent-native/mcp
+POST https://your-app.example.com/mcp
 ```
 
 The server supports the standard MCP handshake: `initialize` → `initialized` → `tools/list` → `tools/call`.
 
-<Endpoint id="doc-block-86ic5g" title="MCP endpoint" summary="The auto-mounted Streamable HTTP endpoint every agent-native app exposes." method="POST" path="/_agent-native/mcp" auth="Standard remote MCP OAuth (Bearer access token), connect-minted JWT, or static ACCESS_TOKEN/ACCESS_TOKENS" params={[
+<Endpoint id="doc-block-86ic5g" title="MCP endpoint" summary="The auto-mounted Streamable HTTP endpoint every agent-native app exposes." method="POST" path="/mcp" auth="Standard remote MCP OAuth (Bearer access token), connect-minted JWT, or static ACCESS_TOKEN/ACCESS_TOKENS" params={[
   {
     "name": "Authorization",
     "in": "header",
@@ -211,18 +211,38 @@ When `mcpApp` is present, the tool entry also includes `_meta.ui.resourceUri`, `
 
 In addition to individual action tools, every MCP server includes an `ask-agent` meta-tool. This sends a natural-language message to the app's AI agent and returns the response.
 
+Hosted MCP requests use a bounded inline wait so a long agent loop does not
+keep one `tools/call` open until a client or gateway timeout. The optional
+`async` argument starts the durable task and returns immediately; without it,
+the server waits briefly for a fast completion and then returns a task handle
+when more work remains. The hosted wait is capped at 25 seconds.
+
 Use `ask-agent` for complex tasks that benefit from the agent's reasoning and context:
 
 ```json
 {
   "name": "ask-agent",
   "arguments": {
-    "message": "Draft a follow-up email to the Q3 planning thread with John, summarizing the action items we discussed"
+    "message": "Draft a follow-up email to the Q3 planning thread with John, summarizing the action items we discussed",
+    "async": true
+  }
+}
+```
+
+The agent runs the same loop as the interactive chat — it can call multiple tools, reason about context, and produce a thoughtful response. A task that is not finished returns JSON containing `taskId`, `status`, `pollAfterMs`, and:
+
+```json
+{
+  "poll": {
+    "tool": "ask_app_status",
+    "arguments": { "app": "mail", "taskId": "task_123" }
   }
 }
 ```
 
-The agent runs the same loop as the interactive chat — it can call multiple tools, reason about context, and produce a thoughtful response.
+Call `ask_app_status` with those arguments until the task reaches a terminal
+state. Dispatch's app-owned `ask_app` uses the same durable task and status
+contract, with the selected-app grant checked on both submission and polling.
 
 ## Authentication {#authentication}
 
@@ -240,7 +260,7 @@ The MCP endpoint supports standard remote MCP OAuth plus the existing bearer-tok
 For OAuth-capable MCP hosts, configure the remote server URL with no static headers:
 
 ```bash
-claude mcp add --transport http agent-native https://dispatch.agent-native.com/_agent-native/mcp
+claude mcp add --transport http agent-native https://dispatch.agent-native.com/mcp
 ```
 
 The first unauthenticated MCP request receives:
@@ -256,9 +276,9 @@ Discovery endpoints:
 | ----------------------------------------- | ------------------------------------------- |
 | `/.well-known/oauth-protected-resource`   | RFC 9728 protected-resource metadata        |
 | `/.well-known/oauth-authorization-server` | OAuth authorization server metadata         |
-| `/_agent-native/mcp/oauth/register`       | Dynamic public-client registration          |
-| `/_agent-native/mcp/oauth/authorize`      | Browser authorization + consent             |
-| `/_agent-native/mcp/oauth/token`          | Authorization-code and refresh-token grants |
+| `/mcp/oauth/register`                     | Dynamic public-client registration          |
+| `/mcp/oauth/authorize`                    | Browser authorization + consent             |
+| `/mcp/oauth/token`                        | Authorization-code and refresh-token grants |
 
 <Diagram id="doc-block-79kjly" title="OAuth discovery flow" summary={"A 401 kicks off discovery, registration, and a PKCE authorize → token exchange. The Bearer token is audience-bound and scoped."}>
 
@@ -358,7 +378,7 @@ export default defineNitroPlugin(async (nitro) => {
 You have a deployed analytics app at `analytics.example.com`. From Claude Code:
 
 ```bash
-claude mcp add --transport http analytics https://analytics.example.com/_agent-native/mcp
+claude mcp add --transport http analytics https://analytics.example.com/mcp
 ```
 
 Or add it by hand in `.mcp.json`:
@@ -369,7 +389,7 @@ Or add it by hand in `.mcp.json`:
   "mcpServers": {
     "analytics": {
       "type": "http",
-      "url": "https://analytics.example.com/_agent-native/mcp",
+      "url": "https://analytics.example.com/mcp",
     },
   },
 }

package/corpus/core/docs/content/plan-plugin.mdx

@@ -12,7 +12,7 @@ The Agent-Native **Plan** app ships as one installable bundle. A single install
 One install gives you:
 
 - **Three skills** — `/visual-plan` (the canonical entry point), `/visual-recap`, and `/visualize-repo`.
-- **The Plan MCP connector** — registered against the hosted app at `https://plan.agent-native.com` (MCP endpoint `https://plan.agent-native.com/_agent-native/mcp`, server name `plan`).
+- **The Plan MCP connector** — registered against the hosted app at `https://plan.agent-native.com` (MCP endpoint `https://plan.agent-native.com/mcp`, server name `plan`).
 
 <Diagram id="doc-block-i1sn3n" title="Three routes, one bundle" summary="The universal CLI, Claude Code plugin, and Codex plugin all install the same Plan skills plus the hosted Plan connector.">
 
@@ -43,7 +43,7 @@ One install gives you:
   <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
   <div class="diagram-box">
     Plan MCP connector<br /><small class="diagram-muted"
-      >plan.agent-native.com/_agent-native/mcp</small
+      >plan.agent-native.com/mcp</small
     >
   </div>
 </div>
@@ -251,7 +251,7 @@ codex plugin add agent-native-visual-plans@agent-native-apps
 codex mcp login plan   # OAuth in the browser
 ```
 
-After install, **start a new Codex thread** so the skills and MCP tools load into the session. The plugin ships a URL-only connector (`[mcp_servers.plan]` → `https://plan.agent-native.com/_agent-native/mcp`); `codex mcp login plan` runs the OAuth flow. The universal CLI route above also works for Codex (`npx @agent-native/core@latest skills add visual-plan --client codex`) if you prefer one command that installs and authenticates together, or when you want local-files or self-hosted mode.
+After install, **start a new Codex thread** so the skills and MCP tools load into the session. The plugin ships a URL-only connector (`[mcp_servers.plan]` → `https://plan.agent-native.com/mcp`); `codex mcp login plan` runs the OAuth flow. The universal CLI route above also works for Codex (`npx @agent-native/core@latest skills add visual-plan --client codex`) if you prefer one command that installs and authenticates together, or when you want local-files or self-hosted mode.
 
 <Callout tone="info">
 

package/corpus/core/docs/content/server.mdx

@@ -269,7 +269,7 @@ The framework mounts its own routes under `/_agent-native/`. Treat that namespac
 | `/_agent-native/extensions/*`    | Runtime extensions and extension proxy (legacy alias: `/_agent-native/tools/*`) |
 | `/_agent-native/integrations/*`  | Messaging/webhook integrations                                                  |
 | `/_agent-native/a2a`             | Agent-to-agent JSON-RPC                                                         |
-| `/_agent-native/mcp`             | MCP endpoint                                                                    |
+| `/mcp`                           | MCP endpoint                                                                    |
 | `/_agent-native/onboarding/*`    | Setup checklist                                                                 |
 | `/_agent-native/observability/*` | Traces, feedback, evals, experiments                                            |
 | `/_agent-native/file-upload`     | File upload provider endpoint                                                   |
@@ -465,4 +465,4 @@ const handler = createProductionAgentHandler({
 - [**Database**](/docs/database) — the `getDb()`/`schema` pattern custom routes and actions both import
 - [**Security**](/docs/security#access-guards) — `accessFilter`/`assertAccess` and the full data-scoping model
 - [**Messaging**](/docs/messaging) — the canonical inbound-webhook integration queue pattern
-- [**MCP Protocol**](/docs/mcp-protocol) — the `/_agent-native/mcp` endpoint this server mounts automatically
+- [**MCP Protocol**](/docs/mcp-protocol) — the `/mcp` endpoint this server mounts automatically

package/corpus/core/docs/content/skills-guide.mdx

@@ -317,7 +317,7 @@ Each app-backed skill starts with `agent-native.app-skill.json` at the app root:
   "id": "assets",
   "hosted": {
     "url": "https://assets.agent-native.com",
-    "mcpUrl": "https://assets.agent-native.com/_agent-native/mcp"
+    "mcpUrl": "https://assets.agent-native.com/mcp"
   },
   "mcp": { "serverName": "agent-native-assets" },
   "skills": [

package/corpus/core/docs/content/template-assets.mdx

@@ -628,7 +628,7 @@ human picker UI.
 ### Developer: distribute the app skill
 
 The Assets app skill has app id `assets` and hosted MCP URL
-`https://assets.agent-native.com/_agent-native/mcp`.
+`https://assets.agent-native.com/mcp`.
 
 ```bash
 # Easiest hosted install: exported skill instructions plus MCP connector.

package/corpus/core/docs/content/template-dispatch.mdx

@@ -123,7 +123,7 @@ Day-to-day, Dispatch is the place admins and ops folks open to keep the workspac
   Dispatch access without copying raw secrets. App-specific source
   configuration stays in the app that uses the provider.
 - **Expose one MCP connector.** Add
-  `https://dispatch.agent-native.com/_agent-native/mcp` in Claude, ChatGPT,
+  `https://dispatch.agent-native.com/mcp` in Claude, ChatGPT,
   Codex, Cursor, or another MCP host, then choose which workspace apps the
   connector can reach from Dispatch's **Agents** page. Use a direct app URL
   only when that host should be isolated to one app.
@@ -304,7 +304,7 @@ _How it works under the hood (for developers)._
   ]}
 />
 
-- **MCP hub mode.** Dispatch can still act as the workspace's [MCP hub](/docs/mcp-clients#hub) so every other app in the workspace pulls the same org-scope MCP server list. Separately, Dispatch's own `/_agent-native/mcp` endpoint is the recommended external MCP connector for Claude, ChatGPT, and other hosts that should reach multiple workspace apps.
+- **MCP hub mode.** Dispatch can still act as the workspace's [MCP hub](/docs/mcp-clients#hub) so every other app in the workspace pulls the same org-scope MCP server list. Separately, Dispatch's own `/mcp` endpoint is the recommended external MCP connector for Claude, ChatGPT, and other hosts that should reach multiple workspace apps.
 
 ## Dreams {#dreams}
 

package/corpus/core/docs/content/template-plan.mdx

@@ -124,7 +124,7 @@ The command installs three commands: `/visual-plan`, `/visual-recap`, and
 
 If you are using a chat-based host that accepts MCP connector URLs directly
 (rather than a CLI-configured client), connect the hosted Plans connector at
-`https://plan.agent-native.com/_agent-native/mcp` — see [MCP Clients](/docs/mcp-clients) for client-specific setup.
+`https://plan.agent-native.com/mcp` — see [MCP Clients](/docs/mcp-clients) for client-specific setup.
 
 Authentication is a one-time browser sign-in at setup — this is intended, and it
 is what lets the agent persist and share the plans it generates. What the auth
@@ -267,7 +267,7 @@ Sharing and commenting are the workflows that need an account:
   cross-device or team review) requires signing in. Google sign-in appears when
   the standard Google OAuth env vars are configured.
 
-The hosted Plans connector lives at `https://plan.agent-native.com/_agent-native/mcp`.
+The hosted Plans connector lives at `https://plan.agent-native.com/mcp`.
 Never put shared secrets in skill files.
 
 ## Local-files privacy mode {#local-files}
@@ -475,7 +475,7 @@ pnpm dev
 The hosted app-backed skill uses:
 
 - App: `https://plan.agent-native.com`
-- MCP: `https://plan.agent-native.com/_agent-native/mcp`
+- MCP: `https://plan.agent-native.com/mcp`
 
 The local template is useful when you are developing Plans itself, testing local persistence, or running a fully self-hosted review surface.
 

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.98.17",
+  "version": "0.99.1",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/a2a/client.ts

@@ -540,6 +540,8 @@ export async function callAgent(
     userEmail?: string;
     orgDomain?: string;
     orgSecret?: string;
+    /** Origin used to build links back to the receiving app. */
+    requestOrigin?: string;
     /**
      * Use async/poll instead of a single blocking POST. Recommended for
      * cross-app calls that may exceed a synchronous serverless request budget.
@@ -571,6 +573,7 @@ export async function callAgent(
   const metadata: Record<string, unknown> = {};
   if (opts?.userEmail) metadata.userEmail = opts.userEmail;
   if (opts?.orgDomain) metadata.orgDomain = opts.orgDomain;
+  if (opts?.requestOrigin) metadata.requestOrigin = opts.requestOrigin;
 
   // Default to async + poll. The receiving A2A server's `_process-task` route
   // runs the handler in a fresh function execution (cross-platform queue

package/corpus/core/src/a2a/handlers.ts

@@ -8,6 +8,7 @@ import {
   resolveAgentChatProcessRunDispatchPath,
 } from "../agent/durable-background.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
+import { getOrigin, isConfiguredAppOrigin } from "../server/google-oauth.js";
 import { fireInternalDispatch } from "../server/self-dispatch.js";
 import { agentChat } from "../shared/agent-chat.js";
 import {
@@ -46,6 +47,70 @@ const A2A_QUEUED_DISPATCH_STUCK_AFTER_MS = 10_000;
 const A2A_PROCESSING_STUCK_AFTER_MS = 5 * 60 * 1000;
 const A2A_PROCESSING_HEARTBEAT_MS = 30_000;
 
+/**
+ * Request origin is routing/link context, not an identity signal. Accept only
+ * an absolute HTTP(S) origin from caller metadata so queued runs can preserve
+ * custom-domain/workspace links without allowing arbitrary values to leak
+ * into browser or artifact URLs.
+ */
+function requestOriginFromMetadata(
+  metadata: Record<string, unknown> | undefined,
+): string | undefined {
+  const raw = metadata?.requestOrigin;
+  if (typeof raw !== "string" || !raw.trim()) return undefined;
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return undefined;
+    return url.origin;
+  } catch {
+    return undefined;
+  }
+}
+
+function requestOriginFromEvent(event: any | undefined): string | undefined {
+  if (!event) return undefined;
+  try {
+    return requestOriginFromMetadata({
+      requestOrigin: getOrigin(event as any),
+    });
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Prefer the origin resolved from the receiving request. A distinct public
+ * browser origin is allowed only when the receiver configured it explicitly;
+ * arbitrary caller metadata must not steer links or service-token URLs.
+ */
+function requestOriginForContext(
+  metadata: Record<string, unknown> | undefined,
+  event: any | undefined,
+): string | undefined {
+  if (!event) return undefined;
+  const receiverOrigin = requestOriginFromEvent(event);
+  const metadataOrigin = requestOriginFromMetadata(metadata);
+  if (
+    metadataOrigin &&
+    (metadataOrigin === receiverOrigin || isConfiguredAppOrigin(metadataOrigin))
+  ) {
+    return metadataOrigin;
+  }
+  return receiverOrigin;
+}
+
+function trustedA2AMetadata(
+  metadata: Record<string, unknown> | undefined,
+  event: any | undefined,
+): Record<string, unknown> | undefined {
+  if (!metadata) return undefined;
+  const trusted = { ...metadata };
+  const requestOrigin = requestOriginForContext(metadata, event);
+  if (requestOrigin) trusted.requestOrigin = requestOrigin;
+  else delete trusted.requestOrigin;
+  return trusted;
+}
+
 /**
  * Hard cap on how long a task may sit in submitted/working (never reaching
  * `processing`) before the dispatch-retry loop in
@@ -172,6 +237,12 @@ export async function processA2ATaskFromQueue(
   const processorMeta = (meta.__a2a_processor ?? {}) as Record<string, unknown>;
   const verifiedEmail = processorMeta.verifiedEmail as string | undefined;
   const orgDomainHint = processorMeta.orgDomainHint as string | undefined;
+  // The processor metadata was created by the authenticated inbound handler
+  // from that request's resolved origin. Prefer it over the processor event,
+  // whose host may be an internal worker/dispatch origin. Legacy tasks that
+  // predate this metadata fall back to the processor event.
+  const requestOrigin =
+    requestOriginFromMetadata(processorMeta) ?? requestOriginFromEvent(event);
   const contextId =
     (processorMeta.contextId as string | null | undefined) ?? undefined;
   const callerMetadata =
@@ -197,7 +268,11 @@ export async function processA2ATaskFromQueue(
   ).unref?.();
   try {
     await runWithRequestContext(
-      { userEmail: verifiedEmail, orgId: resolvedOrgId },
+      {
+        userEmail: verifiedEmail,
+        orgId: resolvedOrgId,
+        ...(requestOrigin ? { requestOrigin } : {}),
+      },
       () =>
         runHandlerAndPersist(
           taskId,
@@ -349,7 +424,7 @@ function makeHandlerContext(
  * inside `runWithRequestContext` so downstream actions see the org.
  */
 async function withA2ARequestContext<T>(
-  _metadata: Record<string, unknown> | undefined,
+  metadata: Record<string, unknown> | undefined,
   event: any | undefined,
   fn: () => Promise<T>,
 ): Promise<T> {
@@ -366,9 +441,14 @@ async function withA2ARequestContext<T>(
     (event?.context?.__a2aOrgDomain as string | undefined) ?? undefined;
 
   const resolvedOrgId = await resolveVerifiedA2AOrgId(verifiedEmail, orgDomain);
+  const requestOrigin = requestOriginForContext(metadata, event);
 
   return runWithRequestContext(
-    { userEmail: verifiedEmail, orgId: resolvedOrgId },
+    {
+      userEmail: verifiedEmail,
+      orgId: resolvedOrgId,
+      ...(requestOrigin ? { requestOrigin } : {}),
+    },
     fn,
   ) as Promise<T>;
 }
@@ -528,14 +608,17 @@ async function handleSend(
     // to metadata.orgDomain which is caller-supplied and unverified.
     const orgDomainHint =
       (event?.context?.__a2aOrgDomain as string | undefined) ?? undefined;
+    const requestOrigin = requestOriginForContext(metadata, event);
+    const safeMetadata = trustedA2AMetadata(metadata, event);
 
     const taskMetadata: Record<string, unknown> = {
-      ...(metadata ?? {}),
+      ...(safeMetadata ?? {}),
       __a2a_processor: {
         verifiedEmail,
         orgDomainHint,
+        ...(requestOrigin ? { requestOrigin } : {}),
         contextId: contextId ?? null,
-        callerMetadata: metadata ?? null,
+        callerMetadata: safeMetadata ?? null,
       },
     };
     const task = await createTask(
@@ -571,7 +654,12 @@ async function handleSend(
     );
     await updateTask(task.id, { state: "working" });
 
-    const ctx = makeHandlerContext(task.id, contextId, metadata, event);
+    const ctx = makeHandlerContext(
+      task.id,
+      contextId,
+      trustedA2AMetadata(metadata, event),
+      event,
+    );
 
     try {
       const result = getHandler(config)(message, ctx.context);
@@ -653,7 +741,7 @@ async function handleStream(
     const { context, artifacts } = makeHandlerContext(
       task.id,
       contextId,
-      metadata,
+      trustedA2AMetadata(metadata, event),
       event,
     );
 

package/corpus/core/src/agent/production-agent.ts

@@ -1820,6 +1820,15 @@ export type AgentLoopFinalResponseGuardResult =
        * guard/model combination from looping indefinitely.
        */
       maxRetries?: number;
+      /**
+       * A rejected final answer is a recovery path, not a normal compact
+       * first request. When true, expose the complete active registry before
+       * the corrective retry so the model can reach the tool the guard is
+       * asking for without depending on a second, model-specific tool-search
+       * round trip. The registry is still limited to tools already exposed to
+       * this run; hidden/agentTool=false actions are never added.
+       */
+      expandToolSurface?: boolean;
     };
 
 export type AgentLoopFinalResponseGuard = (
@@ -3701,6 +3710,18 @@ export async function runAgentLoop(opts: {
             ? 1
             : Math.max(0, Math.min(3, Math.trunc(guard.maxRetries ?? 1)));
         if (finalGuardRetries < maxGuardRetries) {
+          // Compact starter catalogs are an optimization for the first model
+          // request. Once a guard rejects a final answer, preserving that
+          // compact surface can make the corrective instruction impossible to
+          // satisfy: the requested data action may still be behind
+          // tool-search, and some models spend the entire retry narrating the
+          // discovery step instead of calling it. Let guards opt into the
+          // full *already-authorized* run registry for the retry. This is
+          // intentionally handled in the shared loop so A2A/MCP and every
+          // model family get the same recovery behavior.
+          if (typeof guard !== "string" && guard.expandToolSurface) {
+            expandActiveTools([...availableToolMap.keys()]);
+          }
           finalGuardRetries += 1;
           send({ type: "clear" });
           messages.push({