@agent-native/dispatch 0.27.3 → 0.27.5

package/dist/server/plugins/agent-chat.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-chat.js","sourceRoot":"","sources":["../../../src/server/plugins/agent-chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,kBAAkB,GAAG;IACzB,aAAa;IACb,qBAAqB;IACrB,+BAA+B;IAC/B,uBAAuB;IACvB,SAAS;IACT,UAAU;IACV,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,cAAc;IACd,mBAAmB;IACnB,iBAAiB;IACjB,wBAAwB;IACxB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,aAAa;IACb,8BAA8B;IAC9B,oCAAoC;IACpC,sBAAsB;IACtB,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,UAAU;CACX,CAAC;AAEF,eAAe,qBAAqB,CAAC;IACnC,KAAK,EAAE,UAAU;IACjB,qBAAqB,EAAE,IAAI;IAC3B,gBAAgB,EAAE,kBAAkB;IACpC,GAAG,EAAE;QACH,gBAAgB,EAAE;YAChB,oCAAoC;YACpC,8BAA8B;SAC/B;KACF;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,OAAO,EAAE,eAAe;IACxB,aAAa,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;IAC1C,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4EAmC4D;CAC3E,CAAC,CAAC","sourcesContent":["import { getOrgContext } from \"@agent-native/core/org\";\nimport { createAgentChatPlugin } from \"@agent-native/core/server\";\n\nimport { dispatchActions } from \"../../actions/index.js\";\n\nconst INITIAL_TOOL_NAMES = [\n  \"view-screen\",\n  \"list-workspace-apps\",\n  \"update-workspace-app-metadata\",\n  \"list-connected-agents\",\n  \"ask_app\",\n  \"open_app\",\n  \"list-workspace-resources\",\n  \"create-workspace-resource\",\n  \"update-workspace-resource\",\n  \"import-agent\",\n  \"import-agent-pack\",\n  \"list-agent-pack\",\n  \"connect-external-agent\",\n  \"list-vault-secrets\",\n  \"request-vault-secret\",\n  \"create-vault-secret\",\n  \"list-destinations\",\n  \"upsert-destination\",\n  \"list-dreams\",\n  \"start-workspace-app-creation\",\n  \"list-available-workspace-templates\",\n  \"provider-api-catalog\",\n  \"provider-api-docs\",\n  \"provider-api-request\",\n  \"query-staged-dataset\",\n  \"navigate\",\n];\n\nexport default createAgentChatPlugin({\n  appId: \"dispatch\",\n  durableBackgroundRuns: true,\n  initialToolNames: INITIAL_TOOL_NAMES,\n  mcp: {\n    connectorCatalog: [\n      \"resolve-integration-source-context\",\n      \"start-workspace-app-creation\",\n    ],\n  },\n  // Without this, AGENT_ORG_ID is never set on agent action calls and every\n  // row written through the frontend (vault secrets, destinations, workspace\n  // resources) lands with org_id=NULL — breaking data isolation across orgs.\n  resolveOrgId: async (event) => {\n    const ctx = await getOrgContext(event);\n    return ctx.orgId;\n  },\n  // Read actions directly from the package's own action map rather than from\n  // a build-time-generated `.generated/actions-registry.ts` (the latter is a\n  // template-only construct that the Vite plugin emits next to actions/).\n  actions: dispatchActions,\n  codeExecution: { production: \"sandboxed\" },\n  systemPrompt: `You are the central dispatch for this workspace.\n\nDefault posture:\n- Treat Slack and Telegram as shared entrypoints into the workspace.\n- Heavily delegate domain work to specialized agents through A2A when another app owns the job.\n- Keep durable memory and operating instructions in resources rather than ephemeral chat.\n- Prefer replying in the current external thread unless the user explicitly asks you to send to a saved destination.\n\nUse the standard workspace primitives:\n- Read and update resources like AGENTS.md, LEARNINGS.md, jobs/*.md, agents/*.md, and remote-agents/*.json when appropriate.\n- Use recurring jobs for scheduled behavior.\n- Use custom agent profiles in agents/*.md for local spawned work and remote-agents/*.json for remote A2A apps.\n- For a Claude-style Markdown or JSON agent setup, use import-agent so the\n  profile is normalized into agents/<slug>.md. Never import credentials, hooks,\n  shell commands, or local environment settings.\n- For a folder of agent instructions, references, or skills, use\n  import-agent-pack. It preserves the text files under agents/<slug>/ and\n  creates the normalized profile alongside them. Use list-agent-pack to inspect\n  the pack before editing or handing it off to an app.\n- For an existing HTTP/A2A endpoint, use connect-external-agent and let the\n  normal A2A/MCP connection flow handle authentication.\n- You receive a compact available-apps block with sibling workspace app names and descriptions. Use it to pick the right A2A target, and call list-connected-agents or tool-search only when you need fresh details.\n- Hosted/connected A2A neighbors such as Analytics and Content come from the available-apps context or list-connected-agents. list-workspace-apps only inventories apps mounted inside this workspace deployment; never use a missing row there to conclude that a connected agent is unavailable.\n- When answering whether a mounted workspace app exposes an agent card or A2A endpoint, call list-workspace-apps with includeAgentCards=true. If you have not requested that probe, absence of agent-card fields means unchecked, not unavailable.\n- When creating a new workspace app, create a separate app under apps/<app-id> with apps/<app-id>/package.json including a concise generated description, mount it at /<app-id>, use relative /<app-id> links, never hardcode localhost or dev ports, use shadcn/ui with @tabler/icons-react rather than lucide-react, and ensure the React Router client entry preserves APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath(). There is no separate workspace app registry to edit.\n- When a user asks to rename an existing workspace app or change its Dispatch title/description, call update-workspace-app-metadata with the existing appId from list-workspace-apps. This is a metadata-only edit — never call start-workspace-app-creation, which creates a new app and Builder branch.\n- When an explicit app-creation request already includes a source brief or a concrete repeatable workflow, call start-workspace-app-creation without asking non-blocking product or UX questions. Choose recommended defaults, let the Builder handoff record assumptions, and ask only for authorization, credentials, a destructive action, an ambiguous target workspace, or a genuinely missing workflow.\n- If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible \"Chat\", \"Starter\", \"Blank app\", or \"New app\" UI behind.\n- Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.\n- Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.\n- For broad provider searches, joins, classification, corpus counts, or absence claims, fetch every relevant page or an explicitly bounded cohort, stage/save large responses with stageAs/saveToFile/fetchAllPages, and reduce them with query-staged-dataset or run-code. Report source, filters, row counts, pagination, truncation, failed pages, and uncovered gaps.\n\nWhen a user asks for something like a digest, reminder, routing rule, or saved behavior:\n- First decide whether it should be a resource, a recurring job, a destination, or a delegated task.\n- Keep responses concise and operational.\n- Avoid inventing integrations or destinations that are not configured yet.`,\n});\n"]}
+{"version":3,"file":"agent-chat.js","sourceRoot":"","sources":["../../../src/server/plugins/agent-chat.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,qCAAqC,CAAC;AAE7C,MAAM,kBAAkB,GAAG;IACzB,aAAa;IACb,qBAAqB;IACrB,+BAA+B;IAC/B,uBAAuB;IACvB,SAAS;IACT,UAAU;IACV,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,cAAc;IACd,mBAAmB;IACnB,iBAAiB;IACjB,wBAAwB;IACxB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,aAAa;IACb,8BAA8B;IAC9B,oCAAoC;IACpC,sBAAsB;IACtB,mBAAmB;IACnB,sBAAsB;IACtB,sBAAsB;IACtB,UAAU;CACX,CAAC;AAEF,eAAe,qBAAqB,CAAC;IACnC,KAAK,EAAE,UAAU;IACjB,qBAAqB,EAAE,IAAI;IAC3B,gBAAgB,EAAE,kBAAkB;IACpC,GAAG,EAAE;QACH,gBAAgB,EAAE;YAChB,oCAAoC;YACpC,8BAA8B;SAC/B;KACF;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,GAAG,CAAC,KAAK,CAAC;IACnB,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,OAAO,EAAE,eAAe;IACxB,eAAe,EAAE,2BAA2B;IAC5C,sBAAsB,EAAE,CAAC,0BAA0B,CAAC;IACpD,aAAa,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE;IAC1C,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4EAmC4D;CAC3E,CAAC,CAAC","sourcesContent":["import { getOrgContext } from \"@agent-native/core/org\";\nimport { createAgentChatPlugin } from \"@agent-native/core/server\";\n\nimport { dispatchActions } from \"../../actions/index.js\";\nimport {\n  workspaceAppActionRouteAuth,\n  WORKSPACE_APPS_ACTION_PATH,\n} from \"../lib/workspace-app-action-auth.js\";\n\nconst INITIAL_TOOL_NAMES = [\n  \"view-screen\",\n  \"list-workspace-apps\",\n  \"update-workspace-app-metadata\",\n  \"list-connected-agents\",\n  \"ask_app\",\n  \"open_app\",\n  \"list-workspace-resources\",\n  \"create-workspace-resource\",\n  \"update-workspace-resource\",\n  \"import-agent\",\n  \"import-agent-pack\",\n  \"list-agent-pack\",\n  \"connect-external-agent\",\n  \"list-vault-secrets\",\n  \"request-vault-secret\",\n  \"create-vault-secret\",\n  \"list-destinations\",\n  \"upsert-destination\",\n  \"list-dreams\",\n  \"start-workspace-app-creation\",\n  \"list-available-workspace-templates\",\n  \"provider-api-catalog\",\n  \"provider-api-docs\",\n  \"provider-api-request\",\n  \"query-staged-dataset\",\n  \"navigate\",\n];\n\nexport default createAgentChatPlugin({\n  appId: \"dispatch\",\n  durableBackgroundRuns: true,\n  initialToolNames: INITIAL_TOOL_NAMES,\n  mcp: {\n    connectorCatalog: [\n      \"resolve-integration-source-context\",\n      \"start-workspace-app-creation\",\n    ],\n  },\n  // Without this, AGENT_ORG_ID is never set on agent action calls and every\n  // row written through the frontend (vault secrets, destinations, workspace\n  // resources) lands with org_id=NULL — breaking data isolation across orgs.\n  resolveOrgId: async (event) => {\n    const ctx = await getOrgContext(event);\n    return ctx.orgId;\n  },\n  // Read actions directly from the package's own action map rather than from\n  // a build-time-generated `.generated/actions-registry.ts` (the latter is a\n  // template-only construct that the Vite plugin emits next to actions/).\n  actions: dispatchActions,\n  actionRouteAuth: workspaceAppActionRouteAuth,\n  actionRoutePublicPaths: [WORKSPACE_APPS_ACTION_PATH],\n  codeExecution: { production: \"sandboxed\" },\n  systemPrompt: `You are the central dispatch for this workspace.\n\nDefault posture:\n- Treat Slack and Telegram as shared entrypoints into the workspace.\n- Heavily delegate domain work to specialized agents through A2A when another app owns the job.\n- Keep durable memory and operating instructions in resources rather than ephemeral chat.\n- Prefer replying in the current external thread unless the user explicitly asks you to send to a saved destination.\n\nUse the standard workspace primitives:\n- Read and update resources like AGENTS.md, LEARNINGS.md, jobs/*.md, agents/*.md, and remote-agents/*.json when appropriate.\n- Use recurring jobs for scheduled behavior.\n- Use custom agent profiles in agents/*.md for local spawned work and remote-agents/*.json for remote A2A apps.\n- For a Claude-style Markdown or JSON agent setup, use import-agent so the\n  profile is normalized into agents/<slug>.md. Never import credentials, hooks,\n  shell commands, or local environment settings.\n- For a folder of agent instructions, references, or skills, use\n  import-agent-pack. It preserves the text files under agents/<slug>/ and\n  creates the normalized profile alongside them. Use list-agent-pack to inspect\n  the pack before editing or handing it off to an app.\n- For an existing HTTP/A2A endpoint, use connect-external-agent and let the\n  normal A2A/MCP connection flow handle authentication.\n- You receive a compact available-apps block with sibling workspace app names and descriptions. Use it to pick the right A2A target, and call list-connected-agents or tool-search only when you need fresh details.\n- Hosted/connected A2A neighbors such as Analytics and Content come from the available-apps context or list-connected-agents. list-workspace-apps only inventories apps mounted inside this workspace deployment; never use a missing row there to conclude that a connected agent is unavailable.\n- When answering whether a mounted workspace app exposes an agent card or A2A endpoint, call list-workspace-apps with includeAgentCards=true. If you have not requested that probe, absence of agent-card fields means unchecked, not unavailable.\n- When creating a new workspace app, create a separate app under apps/<app-id> with apps/<app-id>/package.json including a concise generated description, mount it at /<app-id>, use relative /<app-id> links, never hardcode localhost or dev ports, use shadcn/ui with @tabler/icons-react rather than lucide-react, and ensure the React Router client entry preserves APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath(). There is no separate workspace app registry to edit.\n- When a user asks to rename an existing workspace app or change its Dispatch title/description, call update-workspace-app-metadata with the existing appId from list-workspace-apps. This is a metadata-only edit — never call start-workspace-app-creation, which creates a new app and Builder branch.\n- When an explicit app-creation request already includes a source brief or a concrete repeatable workflow, call start-workspace-app-creation without asking non-blocking product or UX questions. Choose recommended defaults, let the Builder handoff record assumptions, and ask only for authorization, credentials, a destructive action, an ambiguous target workspace, or a genuinely missing workflow.\n- If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible \"Chat\", \"Starter\", \"Blank app\", or \"New app\" UI behind.\n- Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.\n- Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.\n- For broad provider searches, joins, classification, corpus counts, or absence claims, fetch every relevant page or an explicitly bounded cohort, stage/save large responses with stageAs/saveToFile/fetchAllPages, and reduce them with query-staged-dataset or run-code. Report source, filters, row counts, pagination, truncation, failed pages, and uncovered gaps.\n\nWhen a user asks for something like a digest, reminder, routing rule, or saved behavior:\n- First decide whether it should be a resource, a recurring job, a destination, or a delegated task.\n- Keep responses concise and operational.\n- Avoid inventing integrations or destinations that are not configured yet.`,\n});\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.27.3",
+  "version": "0.27.5",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -101,7 +101,7 @@
     "typescript-7": "npm:typescript@^7.0.2",
     "vite": "8.1.0",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.157.10"
+    "@agent-native/core": "0.157.16"
   },
   "peerDependencies": {
     "@agent-native/core": ">=0.8.0",

package/src/server/lib/app-creation-store.spec.ts

@@ -259,6 +259,92 @@ describe("listWorkspaceApps", () => {
     ]);
   });
 
+  it("falls back to the authenticated workspace action for hosted gateways", async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(new Response("not found", { status: 404 }))
+      .mockResolvedValueOnce(
+        new Response(
+          JSON.stringify([
+            {
+              id: "atlas",
+              name: "Atlas",
+              path: "/atlas",
+              url: "https://agent-workspace.builder.io/atlas",
+            },
+          ]),
+          { headers: { "content-type": "application/json" } },
+        ),
+      );
+    vi.stubGlobal("fetch", fetchMock);
+    vi.stubEnv("A2A_SECRET", "test-a2a-secret");
+    vi.stubEnv("WORKSPACE_GATEWAY_URL", "https://agent-workspace.builder.io");
+
+    const apps = await runWithRequestContext(
+      { userEmail: "dev@example.test" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(String(fetchMock.mock.calls[1]?.[0])).toBe(
+      "https://agent-workspace.builder.io/_agent-native/actions/list-workspace-apps?includeAgentCards=false&audience=all",
+    );
+    expect(fetchMock.mock.calls[1]?.[1]).toEqual(
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          accept: "application/json",
+          Authorization: expect.stringMatching(/^Bearer /),
+        }),
+      }),
+    );
+    expect(apps.map((app) => app.id)).toEqual(["atlas"]);
+    expect(apps[0]?.url).toBe("https://agent-workspace.builder.io/atlas");
+  });
+
+  it("keeps the exact request org in hosted registry tokens", async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(new Response("not found", { status: 404 }))
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify([]), {
+          headers: { "content-type": "application/json" },
+        }),
+      );
+    vi.stubGlobal("fetch", fetchMock);
+    vi.stubEnv("A2A_SECRET", "test-a2a-secret");
+    vi.stubEnv("WORKSPACE_GATEWAY_URL", "https://agent-workspace.builder.io");
+
+    await runWithRequestContext(
+      { userEmail: "dev@example.test", orgId: "org-exact" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    const authorization = fetchMock.mock.calls[1]?.[1]?.headers
+      ?.Authorization as string;
+    const tokenPayload = JSON.parse(
+      Buffer.from(
+        authorization.slice("Bearer ".length).split(".")[1]!,
+        "base64url",
+      ).toString(),
+    ) as { org_id?: string };
+    expect(tokenPayload.org_id).toBe("org-exact");
+  });
+
+  it("falls back to local discovery when the gateway URL is malformed", async () => {
+    stubManifest();
+    vi.stubEnv("WORKSPACE_GATEWAY_URL", "not-a-url");
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+
+    const apps = await runWithRequestContext(
+      { userEmail: "dev@example.test" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(apps.map((app) => app.id)).toEqual(["dispatch"]);
+  });
+
   it("filters workspace apps by audience", async () => {
     stubNoPendingContext();
     vi.stubEnv(

package/src/server/lib/app-creation-store.ts

@@ -3,7 +3,9 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
+import { signA2AToken } from "@agent-native/core/a2a";
 import { getDbExec } from "@agent-native/core/db";
+import { getOrgA2ASecret, getOrgDomain } from "@agent-native/core/org";
 import {
   ensureBuilderProject,
   getBuilderBranchProjectId,
@@ -23,6 +25,7 @@ import {
   resolveLinkedOwner,
 } from "./dispatch-store.js";
 import { createRequest, listSecretOptions } from "./vault-store.js";
+import { WORKSPACE_APPS_ACTION_PATH } from "./workspace-app-action-auth.js";
 import {
   grantWorkspaceResourcesToApp,
   listWorkspaceResourceOptions,
@@ -42,7 +45,7 @@ const WORKSPACE_APP_METADATA_SETTINGS_KEY = "workspace-app-metadata";
 const WORKSPACE_APPS_ENV_KEY = "AGENT_NATIVE_WORKSPACE_APPS_JSON";
 const WORKSPACE_APPS_MANIFEST_FILE = "workspace-apps.json";
 const WORKSPACE_APPS_GATEWAY_PATH = "/_workspace/apps";
-const WORKSPACE_APPS_GATEWAY_TIMEOUT_MS = 1_000;
+const WORKSPACE_APPS_GATEWAY_TIMEOUT_MS = 2_500;
 const MAX_PENDING_APPS = 50;
 const PENDING_WORKSPACE_APP_TTL_MS = 7 * 24 * 60 * 60 * 1_000;
 const AGENT_CARD_PATH = "/.well-known/agent-card.json";
@@ -1075,22 +1078,108 @@ async function readWorkspaceAppsFromGateway(): Promise<
   const base = process.env.WORKSPACE_GATEWAY_URL;
   if (!base) return null;
 
+  let baseUrl: URL;
+  try {
+    baseUrl = new URL(base);
+  } catch {
+    // coercion-ok: malformed gateway configuration is an unavailable registry
+    // and falls back to local sources.
+    return null;
+  }
+  if (baseUrl.protocol !== "http:" && baseUrl.protocol !== "https:") {
+    return null;
+  }
+
   const controller = new AbortController();
   const timeout = setTimeout(
     () => controller.abort(),
     WORKSPACE_APPS_GATEWAY_TIMEOUT_MS,
   );
 
+  const requestContext = getRequestContext();
+  const authHeaders: Record<string, string> = {};
+  if (requestContext?.userEmail) {
+    const [orgDomain, orgSecret] = requestContext.orgId
+      ? await Promise.all([
+          // coercion-ok: an unavailable org row falls back to the deployment secret.
+          getOrgDomain(requestContext.orgId).catch(() => null),
+          // coercion-ok: an unavailable org row falls back to the deployment secret.
+          getOrgA2ASecret(requestContext.orgId).catch(() => null),
+        ])
+      : [null, null];
+    const usableOrgSecret =
+      typeof orgSecret === "string" && orgSecret.trim().length > 0;
+    const usableOrgDomain =
+      typeof orgDomain === "string" && orgDomain.trim().length > 0;
+    try {
+      const token = await signA2AToken(
+        requestContext.userEmail,
+        usableOrgDomain ? orgDomain.trim() : undefined,
+        usableOrgSecret ? orgSecret.trim() : undefined,
+        {
+          expiresIn: "1m",
+          // The workspace registry is an authenticated read. Prefer the
+          // shared deployment secret so a registry read does not depend on
+          // every app having the same org row.
+          preferGlobalSecret: true,
+          // Keep the exact request scope even when the org-domain lookup is
+          // unavailable. The receiver must never infer a different org from
+          // the caller's email in that case.
+          ...(requestContext.orgId
+            ? { extraClaims: { org_id: requestContext.orgId } }
+            : {}),
+        },
+      );
+      authHeaders.Authorization = `Bearer ${token}`;
+    } catch {
+      // coercion-ok: absent signing credentials keep local unauthenticated
+      // gateway discovery available and make hosted discovery fail closed.
+      // Keep the unauthenticated local-dev gateway path available. A hosted
+      // gateway will fail closed below when its action route needs identity.
+    }
+  }
+
+  const gatewayUrl = (pathname: string): URL => {
+    const url = new URL(baseUrl.toString());
+    const basePath = url.pathname.replace(/\/+$/, "");
+    url.pathname = `${basePath}${pathname}` || "/";
+    url.search = "";
+    url.hash = "";
+    return url;
+  };
+
+  const headers = {
+    accept: "application/json",
+    ...authHeaders,
+  };
+
   try {
-    const response = await fetch(
-      new URL(WORKSPACE_APPS_GATEWAY_PATH, `${base.replace(/\/$/, "")}/`),
-      {
-        headers: { accept: "application/json" },
-        signal: controller.signal,
-      },
+    const localResponse = await fetch(gatewayUrl(WORKSPACE_APPS_GATEWAY_PATH), {
+      headers,
+      signal: controller.signal,
+    });
+    if (localResponse.ok) {
+      return parseWorkspaceAppsManifest(
+        // coercion-ok: malformed gateway JSON is an unavailable registry and
+        // must fall through to the local manifest sources.
+        await localResponse.json().catch(() => null),
+      );
+    }
+
+    if (!authHeaders.Authorization) return null;
+    const actionUrl = gatewayUrl(WORKSPACE_APPS_ACTION_PATH);
+    actionUrl.searchParams.set("includeAgentCards", "false");
+    actionUrl.searchParams.set("audience", "all");
+    const actionResponse = await fetch(actionUrl, {
+      headers,
+      signal: controller.signal,
+    });
+    if (!actionResponse.ok) return null;
+    return parseWorkspaceAppsManifest(
+      // coercion-ok: malformed gateway JSON is an unavailable registry and
+      // must fall through to the local manifest sources.
+      await actionResponse.json().catch(() => null),
     );
-    if (!response.ok) return null;
-    return parseWorkspaceAppsManifest(await response.json().catch(() => null));
   } catch {
     return null;
   } finally {

package/src/server/lib/mcp-gateway.spec.ts

@@ -940,6 +940,55 @@ describe("createGrantedDispatchMcpEmbedSession", () => {
     expect(mocks.managerConstructor).toHaveBeenCalled();
   });
 
+  it("allows custom mounted workspace apps from the live workspace registry", async () => {
+    vi.stubEnv("WORKSPACE_GATEWAY_URL", "https://agent-workspace.builder.io");
+    mocks.discoverAgents.mockResolvedValue([]);
+    mocks.managerCallTool.mockResolvedValueOnce({
+      structuredContent: {
+        startUrl:
+          "https://agent-workspace.builder.io/atlas/_agent-native/embed/start?ticket=remote",
+      },
+    });
+    mocks.listWorkspaceApps.mockResolvedValue([
+      {
+        id: "atlas",
+        name: "Atlas",
+        description: "Workspace app",
+        path: "/atlas",
+        url: "https://agent-workspace.builder.io/atlas",
+        isDispatch: false,
+        audience: "internal",
+        publicPaths: [],
+        protectedPaths: [],
+      },
+    ]);
+
+    const result = await runWithRequestContext(
+      {
+        userEmail: "owner@example.test",
+        requestOrigin: "https://dispatch.agent-native.com",
+      },
+      () =>
+        createWorkspaceSsoEmbedSession({
+          app: "atlas",
+          path: "/",
+        }),
+    );
+
+    expect(result).toMatchObject({
+      app: "atlas",
+      startUrl:
+        "https://agent-workspace.builder.io/atlas/_agent-native/embed/start?ticket=remote",
+    });
+    expect(mocks.managerConstructor).toHaveBeenCalledWith({
+      servers: {
+        target: expect.objectContaining({
+          url: "https://agent-workspace.builder.io/atlas/mcp",
+        }),
+      },
+    });
+  });
+
   it("allows an exact custom registry entry and rejects an unregistered external app", async () => {
     vi.stubEnv(
       "IDENTITY_SSO_APP_REGISTRY_JSON",

package/src/server/lib/mcp-gateway.ts

@@ -621,6 +621,17 @@ function workspaceSsoOriginForApp(appId: string): string | null {
   return custom?.origin ?? null;
 }
 
+function workspaceSsoGatewayOrigin(): string | null {
+  const configured = process.env.WORKSPACE_GATEWAY_URL?.trim();
+  if (!configured) return null;
+  try {
+    return new URL(configured).origin;
+  } catch {
+    // coercion-ok: malformed deployment configuration is not a trusted origin.
+    return null;
+  }
+}
+
 function isWorkspaceSsoCanonicalApp(app: DispatchMcpAccessibleApp): boolean {
   const origin = safeAppOrigin(app);
   if (!origin) return false;
@@ -664,7 +675,8 @@ async function isEligibleWorkspaceSsoApp(
     color: DISPATCH_COLOR,
     granted: true,
   });
-  if (origin !== dispatchOrigin) return false;
+  const trustedMountedOrigin = workspaceSsoGatewayOrigin() ?? dispatchOrigin;
+  if (origin !== trustedMountedOrigin) return false;
   return mountedApps.some((mounted) => sameWorkspaceApp(candidate, mounted));
 }
 
@@ -673,15 +685,32 @@ async function listWorkspaceSsoApps(): Promise<DispatchMcpAccessibleApp[]> {
     discoverAgents("dispatch"),
     listWorkspaceApps({ includeAgentCards: false }),
   ]);
-  const candidates = agents
-    .filter((agent) => normalizeAppId(agent.id) !== DISPATCH_APP_ID)
-    .map((agent) => ({
+  const candidatesById = new Map<string, DispatchMcpAccessibleApp>();
+  for (const agent of agents) {
+    if (normalizeAppId(agent.id) === DISPATCH_APP_ID) continue;
+    candidatesById.set(agent.id, {
       ...toAccessibleApp(agent, {
         mode: "all-apps",
         selectedAppIds: [],
       }),
       granted: true,
-    }));
+    });
+  }
+  // The hosted Dispatch database is separate from the shared Workspace
+  // database. Overlay the live mounted registry so custom apps are eligible
+  // without copying a stale app list into Dispatch configuration.
+  for (const app of mountedApps) {
+    if (app.isDispatch || !app.url) continue;
+    candidatesById.set(app.id, {
+      id: app.id,
+      name: app.name,
+      description: app.description,
+      url: app.url,
+      color: DISPATCH_COLOR,
+      granted: true,
+    });
+  }
+  const candidates = [...candidatesById.values()];
   const eligible = [] as DispatchMcpAccessibleApp[];
   for (const candidate of candidates) {
     if (await isEligibleWorkspaceSsoApp(candidate, mountedApps)) {

package/src/server/lib/workspace-app-action-auth.spec.ts

@@ -0,0 +1,212 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  verifyA2AToken: vi.fn(),
+  isOrgMember: vi.fn(),
+  resolveOrgByDomain: vi.fn(),
+  resolveOrgIdForEmail: vi.fn(),
+}));
+
+vi.mock("@agent-native/core/a2a", () => ({
+  verifyA2AToken: mocks.verifyA2AToken,
+}));
+
+vi.mock("@agent-native/core/org", () => ({
+  isOrgMember: mocks.isOrgMember,
+  resolveOrgByDomain: mocks.resolveOrgByDomain,
+  resolveOrgIdForEmail: mocks.resolveOrgIdForEmail,
+}));
+
+import {
+  workspaceAppActionRouteAuth,
+  WORKSPACE_APPS_ACTION_PATH,
+} from "./workspace-app-action-auth.js";
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+function eventFor(path: string, authorization?: string) {
+  return {
+    path,
+    context: {},
+    node: {
+      req: {
+        headers: authorization ? { authorization } : {},
+      },
+    },
+  };
+}
+
+describe("workspace app action auth", () => {
+  it("only resolves the mounted workspace registry action", async () => {
+    await expect(
+      workspaceAppActionRouteAuth.resolveCaller?.(
+        eventFor(
+          "/_agent-native/actions/list-connected-agents",
+          "Bearer token",
+        ),
+      ),
+    ).resolves.toBeNull();
+    expect(mocks.verifyA2AToken).not.toHaveBeenCalled();
+  });
+
+  it("rejects an invalid registry bearer instead of falling through to cookies", async () => {
+    mocks.verifyA2AToken.mockResolvedValue({ email: null, orgDomain: null });
+
+    await expect(
+      workspaceAppActionRouteAuth.resolveCaller?.(
+        eventFor(WORKSPACE_APPS_ACTION_PATH, "Bearer invalid"),
+      ),
+    ).rejects.toThrow("Invalid workspace registry authorization");
+  });
+
+  it("returns the verified caller and local org scope", async () => {
+    mocks.verifyA2AToken.mockResolvedValue({
+      email: "steve@builder.io",
+      orgDomain: "builder.io",
+    });
+    mocks.resolveOrgByDomain.mockResolvedValue({
+      orgId: "org-builder",
+      orgName: "Builder.io",
+    });
+    mocks.isOrgMember.mockResolvedValue(true);
+
+    await expect(
+      workspaceAppActionRouteAuth.resolveCaller?.(
+        eventFor(WORKSPACE_APPS_ACTION_PATH, "Bearer verified"),
+      ),
+    ).resolves.toEqual({
+      owner: "steve@builder.io",
+      anonymous: false,
+      orgId: "org-builder",
+    });
+    expect(mocks.verifyA2AToken).toHaveBeenCalledWith(
+      "verified",
+      expect.anything(),
+    );
+    expect(mocks.resolveOrgByDomain).toHaveBeenCalledWith("builder.io");
+    expect(mocks.isOrgMember).toHaveBeenCalledWith(
+      "org-builder",
+      "steve@builder.io",
+    );
+    expect(mocks.resolveOrgIdForEmail).not.toHaveBeenCalled();
+  });
+
+  it("uses the original mounted pathname after the route prefix is stripped", async () => {
+    mocks.verifyA2AToken.mockResolvedValue({
+      email: "steve@builder.io",
+      orgDomain: "builder.io",
+    });
+    mocks.resolveOrgByDomain.mockResolvedValue({
+      orgId: "org-builder",
+      orgName: "Builder.io",
+    });
+    mocks.isOrgMember.mockResolvedValue(true);
+    const event = eventFor("/", "Bearer mounted");
+    event.context = {
+      _mountedPathname: WORKSPACE_APPS_ACTION_PATH,
+    };
+
+    await expect(
+      workspaceAppActionRouteAuth.resolveCaller?.(event),
+    ).resolves.toMatchObject({
+      owner: "steve@builder.io",
+      orgId: "org-builder",
+    });
+    expect(mocks.verifyA2AToken).toHaveBeenCalledWith(
+      "mounted",
+      expect.anything(),
+    );
+  });
+
+  it("keeps legacy email-derived scope when the token has no org domain", async () => {
+    mocks.verifyA2AToken.mockResolvedValue({
+      email: "steve@builder.io",
+      orgDomain: null,
+    });
+    mocks.resolveOrgIdForEmail.mockResolvedValue("org-by-email");
+
+    await expect(
+      workspaceAppActionRouteAuth.resolveCaller?.(
+        eventFor(WORKSPACE_APPS_ACTION_PATH, "Bearer legacy"),
+      ),
+    ).resolves.toMatchObject({ orgId: "org-by-email" });
+    expect(mocks.resolveOrgIdForEmail).toHaveBeenCalledWith("steve@builder.io");
+  });
+
+  it("preserves a signed org id when the token has no resolvable domain", async () => {
+    mocks.verifyA2AToken.mockResolvedValue({
+      email: "steve@builder.io",
+      orgDomain: null,
+      orgId: "org-builder",
+    });
+    mocks.isOrgMember.mockResolvedValue(true);
+
+    await expect(
+      workspaceAppActionRouteAuth.resolveCaller?.(
+        eventFor(WORKSPACE_APPS_ACTION_PATH, "Bearer scoped"),
+      ),
+    ).resolves.toMatchObject({ orgId: "org-builder" });
+    expect(mocks.isOrgMember).toHaveBeenCalledWith(
+      "org-builder",
+      "steve@builder.io",
+    );
+    expect(mocks.resolveOrgIdForEmail).not.toHaveBeenCalled();
+  });
+
+  it("rejects mismatched domain and org id claims", async () => {
+    mocks.verifyA2AToken.mockResolvedValue({
+      email: "steve@builder.io",
+      orgDomain: "builder.io",
+      orgId: "org-other",
+    });
+    mocks.resolveOrgByDomain.mockResolvedValue({
+      orgId: "org-builder",
+      orgName: "Builder.io",
+    });
+
+    await expect(
+      workspaceAppActionRouteAuth.resolveCaller?.(
+        eventFor(WORKSPACE_APPS_ACTION_PATH, "Bearer mismatched"),
+      ),
+    ).rejects.toThrow("Invalid workspace registry authorization");
+    expect(mocks.isOrgMember).not.toHaveBeenCalled();
+  });
+
+  it("rejects a verified domain that is not registered locally", async () => {
+    mocks.verifyA2AToken.mockResolvedValue({
+      email: "steve@builder.io",
+      orgDomain: "unknown.example",
+    });
+    mocks.resolveOrgByDomain.mockResolvedValue(null);
+
+    await expect(
+      workspaceAppActionRouteAuth.resolveCaller?.(
+        eventFor(WORKSPACE_APPS_ACTION_PATH, "Bearer unmapped"),
+      ),
+    ).rejects.toThrow("Invalid workspace registry authorization");
+  });
+
+  it("rejects a global-token caller who is not a member of the claimed org", async () => {
+    mocks.verifyA2AToken.mockResolvedValue({
+      email: "outsider@example.com",
+      orgDomain: "builder.io",
+    });
+    mocks.resolveOrgByDomain.mockResolvedValue({
+      orgId: "org-builder",
+      orgName: "Builder.io",
+    });
+    mocks.isOrgMember.mockResolvedValue(false);
+
+    await expect(
+      workspaceAppActionRouteAuth.resolveCaller?.(
+        eventFor(WORKSPACE_APPS_ACTION_PATH, "Bearer global-token"),
+      ),
+    ).rejects.toThrow("Invalid workspace registry authorization");
+    expect(mocks.isOrgMember).toHaveBeenCalledWith(
+      "org-builder",
+      "outsider@example.com",
+    );
+  });
+});