@agent-native/dispatch 0.27.6 → 0.27.8

package/src/components/workspace-app-host.tsx

@@ -11,12 +11,7 @@ import {
 } from "@agent-native/core/client/hooks";
 import { useT } from "@agent-native/core/client/i18n";
 import { withBuilderUtmTrackingParams } from "@agent-native/core/shared/builder-link-tracking";
-import {
-  IconArrowLeft,
-  IconArrowUpRight,
-  IconClockHour4,
-  IconLock,
-} from "@tabler/icons-react";
+import { IconArrowLeft, IconClockHour4 } from "@tabler/icons-react";
 import { useTheme } from "next-themes";
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { Link } from "react-router";
@@ -57,31 +52,6 @@ interface GrantedWorkspaceAppsResult {
 }
 
 type WorkspaceAppTheme = "light" | "dark";
-type WorkspaceAppAuthState = "unknown" | "authenticated" | "unauthenticated";
-
-function resolveWorkspaceAppAuthState(
-  rawUrl: string | null,
-): WorkspaceAppAuthState {
-  if (!rawUrl) return "unknown";
-  try {
-    const lastSegment = new URL(rawUrl, window.location.origin).pathname
-      .split("/")
-      .filter(Boolean)
-      .at(-1)
-      ?.toLowerCase();
-    if (
-      lastSegment === "sign-in" ||
-      lastSegment === "login" ||
-      lastSegment === "signup"
-    ) {
-      return "unauthenticated";
-    }
-    return "authenticated";
-  } catch {
-    return "unknown";
-  }
-}
-
 function buildWorkspaceAppThemeUpdate(theme: WorkspaceAppTheme) {
   return {
     type: "agent-native-theme-update" as const,
@@ -131,7 +101,6 @@ export function WorkspaceAppFrame({
   const [embedError, setEmbedError] = useState<Error | null>(null);
   const [isDirectFallback, setIsDirectFallback] = useState(false);
   const [embedAttempt, setEmbedAttempt] = useState(0);
-  const [authState, setAuthState] = useState<WorkspaceAppAuthState>("unknown");
   const embedFrameRef = useRef<HTMLIFrameElement>(null);
   const postThemeToFrame = useCallback(() => {
     embedFrameRef.current?.contentWindow?.postMessage(
@@ -142,17 +111,7 @@ export function WorkspaceAppFrame({
   const handleFrameLoad = useCallback(() => {
     postThemeToFrame();
     if (isDirectFallback) setEmbedError(null);
-    const frame = embedFrameRef.current;
-    let frameUrl = embedUrl;
-    try {
-      frameUrl = frame?.contentWindow?.location.href ?? frameUrl;
-      // coercion-ok: Cross-origin frames cannot expose location; their auth state arrives by message.
-    } catch {
-      // Cross-origin app frames report their auth state through postMessage.
-    }
-    const nextAuthState = resolveWorkspaceAppAuthState(frameUrl);
-    if (nextAuthState !== "unknown") setAuthState(nextAuthState);
-  }, [embedUrl, isDirectFallback, postThemeToFrame]);
+  }, [isDirectFallback, postThemeToFrame]);
   const workspaceSsoEnabled = useFeatureFlag(DISPATCH_WORKSPACE_SSO_FLAG.key);
   const createEmbedSession = useActionMutation<
     EmbedSessionResult,
@@ -190,7 +149,6 @@ export function WorkspaceAppFrame({
     setEmbedUrl(null);
     setEmbedError(null);
     setIsDirectFallback(false);
-    setAuthState("unknown");
     const createSession = workspaceSsoEnabled
       ? createWorkspaceSsoEmbedSession
       : createEmbedSession;
@@ -201,6 +159,17 @@ export function WorkspaceAppFrame({
       })
       .catch((cause: unknown) => {
         if (cancelled) return;
+        const error = cause instanceof Error ? cause : new Error(String(cause));
+        if (workspaceSsoEnabled) {
+          // An SSO-enabled pane must never fall back to the child app's
+          // unauthenticated shell. Keep the parent-owned retry surface in
+          // place so a transient exchange failure cannot expose another
+          // login form.
+          setIsDirectFallback(false);
+          setEmbedUrl(null);
+          setEmbedError(error);
+          return;
+        }
         setIsDirectFallback(true);
         setEmbedUrl(
           workspaceAppDirectHref(
@@ -208,9 +177,7 @@ export function WorkspaceAppFrame({
             embedPath ?? "/",
           ),
         );
-        setEmbedError(
-          cause instanceof Error ? cause : new Error(String(cause)),
-        );
+        setEmbedError(error);
       });
     return () => {
       cancelled = true;
@@ -242,21 +209,6 @@ export function WorkspaceAppFrame({
       window.removeEventListener("message", handleEmbedSessionExpired);
   }, [embedUrl]);
 
-  useEffect(() => {
-    const handleAuthState = (event: MessageEvent) => {
-      const frame = embedFrameRef.current;
-      if (!frame || event.source !== frame.contentWindow) return;
-      if (event.data?.type !== "agentNative.authState") return;
-      const status = event.data.data?.status;
-      if (status === "authenticated" || status === "unauthenticated") {
-        setAuthState(status);
-      }
-    };
-
-    window.addEventListener("message", handleAuthState);
-    return () => window.removeEventListener("message", handleAuthState);
-  }, []);
-
   useEffect(() => {
     postThemeToFrame();
   }, [embedUrl, postThemeToFrame]);
@@ -315,24 +267,6 @@ export function WorkspaceAppFrame({
       dynamicSuggestions={false}
       suggestions={[]}
       emptyStateText={`Ask about ${app.name}`}
-      composerSlot={
-        authState === "unauthenticated" ? (
-          <div className="flex shrink-0 items-center px-3 pb-1">
-            <button
-              type="button"
-              data-dispatch-app-sign-in
-              aria-label={`Sign in to ${app.name} on the right`}
-              title={`Sign in to ${app.name} on the right`}
-              onClick={() => embedFrameRef.current?.focus()}
-              className="inline-flex h-6 shrink-0 items-center gap-1 rounded-full border border-border/70 bg-background/60 px-2 text-[11px] font-medium text-muted-foreground transition-colors hover:bg-accent hover:text-foreground"
-            >
-              <IconLock size={12} stroke={1.8} />
-              <span>Sign in on the right</span>
-              <IconArrowUpRight size={12} stroke={1.8} />
-            </button>
-          </div>
-        ) : null
-      }
     >
       {appPane}
     </AgentSidebar>

package/src/server/lib/mcp-gateway.spec.ts

@@ -17,6 +17,7 @@ const mocks = vi.hoisted(() => ({
   a2aSend: vi.fn(),
   a2aGetTask: vi.fn(),
   signA2AToken: vi.fn(),
+  canonicalA2AAudience: vi.fn((url: string) => url.replace(/\/+$/, "")),
   getOrgA2ASecret: vi.fn(),
   getOrgDomain: vi.fn(),
   isFeatureFlagEnabled: vi.fn(),
@@ -71,6 +72,7 @@ vi.mock("@agent-native/core/a2a", () => ({
     }
   },
   signA2AToken: mocks.signA2AToken,
+  canonicalA2AAudience: mocks.canonicalA2AAudience,
 }));
 
 vi.mock("@agent-native/core/org", () => ({
@@ -1255,6 +1257,7 @@ describe("createGrantedDispatchMcpEmbedSession", () => {
       "org-specific-secret",
       {
         expiresIn: "5m",
+        audience: "http://localhost:8086",
         preferGlobalSecret: false,
       },
     );
@@ -1283,6 +1286,7 @@ describe("createGrantedDispatchMcpEmbedSession", () => {
       undefined,
       {
         expiresIn: "5m",
+        audience: "http://localhost:8086",
         preferGlobalSecret: true,
       },
     );
@@ -1311,6 +1315,7 @@ describe("createGrantedDispatchMcpEmbedSession", () => {
       undefined,
       {
         expiresIn: "5m",
+        audience: "http://localhost:8086",
         preferGlobalSecret: true,
       },
     );

package/src/server/lib/mcp-gateway.ts

@@ -1,4 +1,9 @@
-import { A2AClient, signA2AToken, type Task } from "@agent-native/core/a2a";
+import {
+  A2AClient,
+  canonicalA2AAudience,
+  signA2AToken,
+  type Task,
+} from "@agent-native/core/a2a";
 import { isFeatureFlagEnabled } from "@agent-native/core/feature-flags";
 import {
   buildMcpToolName,
@@ -1195,6 +1200,7 @@ async function createEmbedSessionForResolvedApp(input: {
     useOrgSigning ? orgSecret.trim() : undefined,
     {
       expiresIn: "5m",
+      audience: canonicalA2AAudience(appBaseUrl(target.app)),
       // Prefer the synced org A2A secret when present because first-party
       // production apps do not have to share the same deployment env secret.
       // Fall back to the global A2A_SECRET for orgs that have not synced yet.

package/src/server/lib/workspace-app-action-auth.ts

@@ -8,6 +8,7 @@ import type {
   ActionRouteAuthAdapter,
   ActionRouteResolvedCaller,
 } from "@agent-native/core/server";
+import { getSession } from "@agent-native/core/server";
 
 export const WORKSPACE_APPS_ACTION_PATH =
   "/_agent-native/actions/list-workspace-apps";
@@ -57,6 +58,22 @@ export const workspaceAppActionRouteAuth: ActionRouteAuthAdapter = {
       throw new Error("Invalid workspace registry authorization");
     }
 
+    // Native clients use their normal persisted session bearer for the same
+    // read-only action. Let the framework resolve that credential before
+    // treating an otherwise opaque bearer as an A2A token.
+    const hasRequestUrl =
+      typeof event?.node?.req?.url === "string" ||
+      typeof event?.req?.url === "string" ||
+      typeof event?.url === "string";
+    const session = hasRequestUrl ? await getSession(event) : null;
+    if (session?.email) {
+      return {
+        owner: session.email,
+        anonymous: false,
+        ...(session.orgId ? { orgId: session.orgId } : {}),
+      };
+    }
+
     const token = authorization.slice("Bearer ".length).trim();
     if (!token) throw new Error("Invalid workspace registry authorization");
 

package/src/shared/feature-flags.ts

@@ -11,3 +11,10 @@ export const DISPATCH_WORKSPACE_SSO_FLAG = defineFeatureFlag({
   description:
     "Let Dispatch use the signed-in workspace identity for exact registered app panes.",
 });
+
+export const DISPATCH_WORKSPACE_APP_LIST_FLAG = defineFeatureFlag({
+  key: "dispatch.workspace-app-list",
+  displayName: "Workspace app list",
+  description:
+    "Show apps from the signed-in workspace in native desktop and mobile app lists.",
+});