@agent-native/dispatch 0.27.9 → 0.27.10

package/dist/server/lib/mcp-gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-gateway.d.ts","sourceRoot":"","sources":["../../../src/server/lib/mcp-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,IAAI,EACV,MAAM,wBAAwB,CAAC;AA6BhC,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,uBAAuB,CAAC;AA4B/B,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAkCD,KAAK,iCAAiC,GAClC,WAAW,GACX,SAAS,GACT,cAAc,GACd,cAAc,CAAC;AAEnB,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,SAAS,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,iBAAS,wBAAwB,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GACT,wBAAwB,CAyC1B;AA+XD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC;IACnD,QAAQ,EAAE,4BAA4B,CAAC;IACvC,IAAI,EAAE,wBAAwB,EAAE,CAAC;CAClC,CAAC,CAcD;AAED,wBAAsB,0BAA0B,IAAI,OAAO,CACzD,wBAAwB,EAAE,CAC3B,CAGA;AAED,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAG1E;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,wBAAwB,CAAC,CAwBnC;AA6ID,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,OAAO,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAqCtD;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC,CA+DnC;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC,CAkDD;AA6MD,wBAAsB,oCAAoC,CAAC,KAAK,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAWD;AA+ED,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAmBD"}
+{"version":3,"file":"mcp-gateway.d.ts","sourceRoot":"","sources":["../../../src/server/lib/mcp-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,IAAI,EACV,MAAM,wBAAwB,CAAC;AA6BhC,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,uBAAuB,CAAC;AA4B/B,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAkCD,KAAK,iCAAiC,GAClC,WAAW,GACX,SAAS,GACT,cAAc,GACd,cAAc,CAAC;AAEnB,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,SAAS,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,iBAAS,wBAAwB,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,GACT,wBAAwB,CAyC1B;AA+XD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC;IACnD,QAAQ,EAAE,4BAA4B,CAAC;IACvC,IAAI,EAAE,wBAAwB,EAAE,CAAC;CAClC,CAAC,CAcD;AAED,wBAAsB,0BAA0B,IAAI,OAAO,CACzD,wBAAwB,EAAE,CAC3B,CAGA;AAED,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAG1E;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,wBAAwB,CAAC,CAwBnC;AA8GD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,OAAO,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAqCtD;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC,CA+DnC;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC,CAkDD;AAySD,wBAAsB,oCAAoC,CAAC,KAAK,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAWD;AAiID,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAqCD"}

package/dist/server/lib/mcp-gateway.js

@@ -462,18 +462,6 @@ function workspaceSsoOriginForApp(appId) {
     const custom = parseWorkspaceSsoAppRegistrations(process.env.IDENTITY_SSO_APP_REGISTRY_JSON).find((registration) => registration.appId === appId);
     return custom?.origin ?? null;
 }
-function workspaceSsoGatewayOrigin() {
-    const configured = process.env.WORKSPACE_GATEWAY_URL?.trim();
-    if (!configured)
-        return null;
-    try {
-        return new URL(configured).origin;
-    }
-    catch {
-        // coercion-ok: malformed deployment configuration is not a trusted origin.
-        return null;
-    }
-}
 function isWorkspaceSsoCanonicalApp(app) {
     const origin = safeAppOrigin(app);
     if (!origin)
@@ -488,12 +476,7 @@ function isWorkspaceSsoCanonicalApp(app) {
         ? Object.prototype.hasOwnProperty.call(CANONICAL_WORKSPACE_SSO_APP_ORIGINS, app.id)
         : false;
 }
-function sameWorkspaceApp(candidate, mounted) {
-    if (candidate.id !== mounted.id || !mounted.url)
-        return false;
-    return candidate.url.replace(/\/+$/, "") === mounted.url.replace(/\/+$/, "");
-}
-async function isEligibleWorkspaceSsoApp(candidate, mountedApps) {
+async function isEligibleWorkspaceSsoApp(candidate) {
     const origin = safeAppOrigin(candidate);
     if (!origin)
         return false;
@@ -502,18 +485,7 @@ async function isEligibleWorkspaceSsoApp(candidate, mountedApps) {
     const customOrigin = workspaceSsoOriginForApp(candidate.id);
     if (customOrigin === origin)
         return true;
-    const dispatchOrigin = safeAppOrigin({
-        id: DISPATCH_APP_ID,
-        name: DISPATCH_NAME,
-        description: DISPATCH_DESCRIPTION,
-        url: dispatchSelfBaseUrl(),
-        color: DISPATCH_COLOR,
-        granted: true,
-    });
-    const trustedMountedOrigin = workspaceSsoGatewayOrigin() ?? dispatchOrigin;
-    if (origin !== trustedMountedOrigin)
-        return false;
-    return mountedApps.some((mounted) => sameWorkspaceApp(candidate, mounted));
+    return false;
 }
 async function listWorkspaceSsoApps() {
     const [agents, mountedApps] = await Promise.all([
@@ -533,8 +505,8 @@ async function listWorkspaceSsoApps() {
         });
     }
     // The hosted Dispatch database is separate from the shared Workspace
-    // database. Overlay the live mounted registry so custom apps are eligible
-    // without copying a stale app list into Dispatch configuration.
+    // database. Overlay the live mounted registry so custom apps remain
+    // discoverable without copying a stale app list into Dispatch configuration.
     for (const app of mountedApps) {
         if (app.isDispatch || !app.url)
             continue;
@@ -550,7 +522,7 @@ async function listWorkspaceSsoApps() {
     const candidates = [...candidatesById.values()];
     const eligible = [];
     for (const candidate of candidates) {
-        if (await isEligibleWorkspaceSsoApp(candidate, mountedApps)) {
+        if (await isEligibleWorkspaceSsoApp(candidate)) {
             eligible.push(candidate);
         }
     }
@@ -750,6 +722,31 @@ function isRetryableTargetMcpError(error) {
     }
     return /streamable http|handshake|failed to fetch|fetch failed|networkerror|econnrefused|enotfound|timed out|timeout|502|503|504/i.test(message);
 }
+function isTargetMcpAuthError(error) {
+    const message = error instanceof Error
+        ? error.message
+        : typeof error === "string"
+            ? error
+            : String(error ?? "");
+    return /\b401\b|\b403\b|unauthorized|forbidden|invalid(?: or expired)? (?:a2a )?token|authentication required/i.test(message);
+}
+function targetMcpErrorStatus(error) {
+    const message = error instanceof Error
+        ? error.message
+        : typeof error === "string"
+            ? error
+            : String(error ?? "");
+    const status = message.match(/\b([45]\d{2})\b/)?.[1];
+    return status ? Number(status) : undefined;
+}
+function targetMcpRequestDetails(input) {
+    const targetUrl = new URL(input.url);
+    return {
+        app: input.app.id,
+        targetOrigin: targetUrl.origin,
+        targetPath: targetUrl.pathname,
+    };
+}
 function targetMcpRetryDelay(attempt) {
     const base = TARGET_EMBED_SESSION_RETRY_BASE_MS * Math.pow(2, Math.max(0, attempt - 1));
     return base + Math.floor(Math.random() * 100);
@@ -789,6 +786,42 @@ async function callTargetCreateEmbedSession(input) {
         }
     }
 }
+async function createTargetMcpTokenAttempts(input) {
+    const attempts = [];
+    const addAttempt = async (tokenInput) => {
+        const token = await signA2AToken(input.ownerEmail, input.orgDomain, tokenInput.secret, {
+            expiresIn: "5m",
+            audience: canonicalA2AAudience(appBaseUrl(input.target)),
+            preferGlobalSecret: tokenInput.preferGlobalSecret,
+        });
+        if (!attempts.some((attempt) => attempt.token === token)) {
+            attempts.push({ token, strategy: tokenInput.strategy });
+        }
+    };
+    if (input.orgDomain && input.orgSecret) {
+        await addAttempt({
+            strategy: "org",
+            secret: input.orgSecret,
+            preferGlobalSecret: false,
+        });
+        // A target app may not have the org secret synced yet. The shared secret
+        // is a bounded compatibility fallback, used only after the target rejects
+        // the org-signed request and never after a non-authentication failure.
+        if (process.env.A2A_SECRET?.trim()) {
+            await addAttempt({
+                strategy: "global",
+                preferGlobalSecret: true,
+            });
+        }
+    }
+    else {
+        await addAttempt({
+            strategy: "global",
+            preferGlobalSecret: true,
+        });
+    }
+    return attempts;
+}
 async function resolveEmbedTarget(input, options) {
     const explicitApp = input.app?.trim()
         ? await options.resolveApp(input.app)
@@ -897,28 +930,75 @@ async function createEmbedSessionForResolvedApp(input) {
         : [null, null];
     const usableOrgSecret = typeof orgSecret === "string" && orgSecret.trim().length > 0;
     const usableOrgDomain = typeof orgDomain === "string" && orgDomain.trim().length > 0;
-    const useOrgSigning = usableOrgDomain && usableOrgSecret;
     const signedOrgDomain = usableOrgDomain ? orgDomain.trim() : undefined;
-    const token = await signA2AToken(ownerEmail, signedOrgDomain, useOrgSigning ? orgSecret.trim() : undefined, {
-        expiresIn: "5m",
-        audience: canonicalA2AAudience(appBaseUrl(target.app)),
-        // Prefer the synced org A2A secret when present because first-party
-        // production apps do not have to share the same deployment env secret.
-        // Fall back to the global A2A_SECRET for orgs that have not synced yet.
-        preferGlobalSecret: !useOrgSigning,
+    const tokenAttempts = await createTargetMcpTokenAttempts({
+        ownerEmail,
+        orgDomain: signedOrgDomain,
+        orgSecret: usableOrgSecret ? orgSecret.trim() : undefined,
+        target: target.app,
     });
-    const result = await callTargetCreateEmbedSession({
+    const targetDetails = targetMcpRequestDetails({
         app: target.app,
-        token,
         url: target.url,
-        chrome,
     });
-    const parsed = parseMcpToolTextResult(result);
+    let parsed = null;
+    let lastError;
+    for (let attemptIndex = 0; attemptIndex < tokenAttempts.length; attemptIndex++) {
+        const tokenAttempt = tokenAttempts[attemptIndex];
+        console.info("[dispatch] workspace embed target request", {
+            ...targetDetails,
+            authStrategy: tokenAttempt.strategy,
+            attempt: attemptIndex + 1,
+            attempts: tokenAttempts.length,
+        });
+        try {
+            const result = await callTargetCreateEmbedSession({
+                app: target.app,
+                token: tokenAttempt.token,
+                url: target.url,
+                chrome,
+            });
+            parsed = parseMcpToolTextResult(result);
+            break;
+        }
+        catch (error) {
+            lastError = error;
+            console.warn("[dispatch] workspace embed target response", {
+                ...targetDetails,
+                authStrategy: tokenAttempt.strategy,
+                attempt: attemptIndex + 1,
+                status: targetMcpErrorStatus(error),
+                category: isTargetMcpAuthError(error)
+                    ? "authentication"
+                    : isRetryableTargetMcpError(error)
+                        ? "transient"
+                        : "permanent",
+            });
+            if (!isTargetMcpAuthError(error) ||
+                attemptIndex >= tokenAttempts.length - 1) {
+                throw error;
+            }
+        }
+    }
+    if (!parsed) {
+        throw lastError instanceof Error
+            ? lastError
+            : new Error("Target app did not return an embed session.");
+    }
     if (!parsed.startUrl) {
         throw new Error("Target app did not return an embed start URL.");
     }
+    const startUrl = resolveGrantedAppEmbedStartUrl(target.app, parsed.startUrl);
+    const startUrlDetails = new URL(startUrl);
+    console.info("[dispatch] workspace embed target minted session", {
+        ...targetDetails,
+        startPath: startUrlDetails.pathname,
+        returnedTicket: startUrlDetails.searchParams.has("ticket"),
+        returnedTargetPath: typeof parsed.targetPath === "string",
+        returnedExpiry: typeof parsed.expiresAt === "number",
+    });
     const output = {
-        startUrl: resolveGrantedAppEmbedStartUrl(target.app, parsed.startUrl),
+        startUrl,
         app: target.app.id,
     };
     if (parsed.targetPath)
@@ -929,14 +1009,31 @@ async function createEmbedSessionForResolvedApp(input) {
 }
 export async function createWorkspaceSsoEmbedSession(input) {
     const ownerEmail = getRequestUserEmail();
-    if (!ownerEmail)
+    if (!ownerEmail) {
+        console.warn("[dispatch] workspace embed mint rejected", {
+            phase: "dispatch-auth",
+            requestedApp: input.app ?? null,
+            hasPath: typeof input.path === "string",
+            hasUrl: typeof input.url === "string",
+            ownerResolved: false,
+            orgResolved: Boolean(getRequestOrgId()),
+        });
         throw new Error("no authenticated user");
+    }
     const enabled = await isFeatureFlagEnabled(DISPATCH_WORKSPACE_SSO_FLAG, {
         userEmail: ownerEmail,
         userKey: ownerEmail,
         orgId: getRequestOrgId(),
     });
     if (!enabled) {
+        console.warn("[dispatch] workspace embed mint rejected", {
+            phase: "feature-flag",
+            requestedApp: input.app ?? null,
+            hasPath: typeof input.path === "string",
+            hasUrl: typeof input.url === "string",
+            ownerResolved: true,
+            orgResolved: Boolean(getRequestOrgId()),
+        });
         throw new Error("Dispatch workspace sign-in is not enabled.");
     }
     const target = await resolveWorkspaceSsoEmbedTarget(input);