@agent-native/dispatch 0.38.1 → 0.38.2-nightly-20260916205829

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.38.1",
+  "version": "0.38.2-nightly-20260916205829",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -88,7 +88,7 @@
     "tailwind-merge": "^3.5.0",
     "vaul": "^1.1.2",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "0.20.3"
+    "@agent-native/toolkit": "0.20.4-nightly-20260916205829"
   },
   "devDependencies": {
     "@react-router/dev": "^8.1.0",
@@ -102,10 +102,10 @@
     "typescript-7": "npm:typescript@^7.0.2",
     "vite": "8.1.0",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.182.0"
+    "@agent-native/core": "0.182.1-nightly-20260916205829"
   },
   "peerDependencies": {
-    "@agent-native/core": ">=0.8.0",
+    "@agent-native/core": "0.182.1-nightly-20260916205829",
     "react": ">=19.2.7",
     "react-dom": ">=19.2.7",
     "react-router": ">=8"

package/src/server/lib/app-creation-store.spec.ts

@@ -28,9 +28,11 @@ const mocks = vi.hoisted(() => {
   const state = {
     orgRole: "admin" as string | null,
   };
+  const executedSql: string[] = [];
   return {
     settings,
     state,
+    executedSql,
     getSetting: vi.fn(async (key: string) => settings.get(key) ?? null),
     mutateSetting: vi.fn(
       async (key: string, updater: (current: any) => any) => {
@@ -54,6 +56,7 @@ const mocks = vi.hoisted(() => {
           typeof statement === "string"
             ? statement
             : String((statement as { sql?: unknown })?.sql ?? "");
+        executedSql.push(sql);
         if (sql.includes("SELECT id FROM workspace_apps")) {
           return { rows: [], rowsAffected: 0 };
         }
@@ -163,6 +166,7 @@ afterEach(() => {
   vi.unstubAllEnvs();
   vi.unstubAllGlobals();
   vi.clearAllMocks();
+  mocks.executedSql.length = 0;
   mocks.settings.clear();
   mocks.getOrgSetting.mockReset();
   mocks.getOrgSetting.mockResolvedValue(null);
@@ -184,6 +188,7 @@ afterEach(() => {
         typeof statement === "string"
           ? statement
           : String((statement as { sql?: unknown })?.sql ?? "");
+      mocks.executedSql.push(sql);
       if (sql.includes("SELECT id FROM workspace_apps")) {
         return { rows: [], rowsAffected: 0 };
       }
@@ -362,6 +367,35 @@ describe("listWorkspaceApps", () => {
     ]);
   });
 
+  it.each([401, 403])(
+    "keeps a local gateway denial on the unverified fallback path (%i)",
+    async (status) => {
+      const fetchMock = vi.fn(async () => new Response("denied", { status }));
+      vi.stubGlobal("fetch", fetchMock);
+      vi.stubEnv("NODE_ENV", "production");
+      vi.stubEnv("WORKSPACE_GATEWAY_URL", "http://127.0.0.1:8080");
+      const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+      stubManifest([
+        { id: "dispatch", name: "Dispatch", path: "/dispatch" },
+        { id: "clips", name: "Clips", path: "/clips" },
+      ]);
+
+      const apps = await runWithRequestContext(
+        { userEmail: "dev@example.test" },
+        () => listWorkspaceApps({ includeAgentCards: false }),
+      );
+
+      expect(apps.map((app) => app.id)).toEqual(["dispatch", "clips"]);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+      expect(warn).toHaveBeenCalledWith(
+        expect.stringContaining(
+          `workspace apps gateway denied the registry read with HTTP ${status}`,
+        ),
+      );
+      warn.mockRestore();
+    },
+  );
+
   it("derives manifest app URLs from the Vercel preview when no workspace origin is configured", async () => {
     stubNoPendingContext();
     stubManifest([
@@ -433,10 +467,12 @@ describe("listWorkspaceApps", () => {
   });
 
   it.each([401, 403])(
-    "surfaces hosted registry authorization failures instead of using local manifests (%i)",
+    "does not expose manifest apps without ACL rows when the hosted registry denies the read (%i)",
     async (status) => {
       const fetchMock = vi.fn(async () => new Response("denied", { status }));
       vi.stubGlobal("fetch", fetchMock);
+      mocks.resolveAccess.mockResolvedValue(null);
+      const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
       vi.stubEnv("A2A_SECRET", "test-a2a-secret");
       vi.stubEnv("WORKSPACE_GATEWAY_URL", "https://agent-workspace.builder.io");
       stubManifest([
@@ -444,6 +480,60 @@ describe("listWorkspaceApps", () => {
         { id: "clips", name: "Clips", path: "/clips" },
       ]);
 
+      const apps = await runWithRequestContext(
+        { userEmail: "dev@example.test" },
+        () => listWorkspaceApps({ includeAgentCards: false }),
+      );
+
+      expect(apps.map((app) => app.id)).toEqual(["dispatch"]);
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+      expect(warn).toHaveBeenCalledWith(
+        expect.stringContaining(
+          `workspace apps gateway denied the registry read with HTTP ${status}`,
+        ),
+      );
+      expect(warn).toHaveBeenCalledWith(
+        expect.stringContaining("hidden from this response"),
+      );
+      warn.mockRestore();
+    },
+  );
+
+  it("never mutates registry state from the unverified fallback manifest", async () => {
+    const fetchMock = vi.fn(
+      async () => new Response("denied", { status: 403 }),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    vi.stubEnv("A2A_SECRET", "test-a2a-secret");
+    vi.stubEnv("WORKSPACE_GATEWAY_URL", "https://agent-workspace.builder.io");
+    stubManifest([
+      { id: "dispatch", name: "Dispatch", path: "/dispatch" },
+      { id: "clips", name: "Clips", path: "/clips" },
+    ]);
+
+    await runWithRequestContext(
+      { userEmail: "dev@example.test", orgId: "builder_io" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(
+      mocks.executedSql.filter((sql) =>
+        /\b(INSERT|UPDATE|DELETE)\b/i.test(sql),
+      ),
+    ).toEqual([]);
+    warn.mockRestore();
+  });
+
+  it.each([401, 403])(
+    "still rejects a denied registry read when no deployment manifest can answer (%i)",
+    async (status) => {
+      const fetchMock = vi.fn(async () => new Response("denied", { status }));
+      vi.stubGlobal("fetch", fetchMock);
+      vi.stubEnv("A2A_SECRET", "test-a2a-secret");
+      vi.stubEnv("WORKSPACE_GATEWAY_URL", "https://agent-workspace.builder.io");
+      vi.stubEnv("AGENT_NATIVE_WORKSPACE_APPS_JSON", "");
+
       await expect(
         runWithRequestContext({ userEmail: "dev@example.test" }, () =>
           listWorkspaceApps({ includeAgentCards: false }),
@@ -451,7 +541,6 @@ describe("listWorkspaceApps", () => {
       ).rejects.toThrow(
         `Workspace apps gateway rejected the request with HTTP ${status}.`,
       );
-      expect(fetchMock).toHaveBeenCalledTimes(1);
     },
   );
 

package/src/server/lib/app-creation-store.ts

@@ -119,6 +119,17 @@ class WorkspaceAppsGatewayAuthorizationError extends Error {
   statusCode: 401 | 403;
 }
 
+/** A denied gateway read is visible in logs even when a fallback can answer. */
+function warnWorkspaceAppsGatewayDenial(
+  denial: WorkspaceAppsGatewayAuthorizationError | null,
+  source: string,
+): void {
+  if (!denial) return;
+  console.warn(
+    `[dispatch] workspace apps gateway denied the registry read with HTTP ${denial.statusCode}; served the ${source} instead`,
+  );
+}
+
 type WorkspaceAppAudience = "internal" | "public";
 type WorkspaceAppVisibility = "private" | "org";
 
@@ -154,6 +165,13 @@ export interface WorkspaceAppSummary {
   orgEnabled?: boolean;
 }
 
+interface FinalizeWorkspaceAppsOptions {
+  /** Delete org rows absent from an authoritative manifest. */
+  reconcile?: boolean;
+  /** Write registry rows. False for a source the caller could not authenticate. */
+  persist?: boolean;
+}
+
 interface WorkspaceAppDiscovery {
   apps: WorkspaceAppSummary[];
   authoritative: boolean;
@@ -1259,13 +1277,20 @@ function appRecordTimestamp(value: string | null | undefined): number {
  */
 async function ensureWorkspaceAppRecords(
   apps: WorkspaceAppSummary[],
-  options: { reconcile?: boolean } = {},
+  options: { reconcile?: boolean; persist?: boolean } = {},
 ): Promise<WorkspaceAppSummary[]> {
   const readyApps = apps.filter(
     (app) => app.status !== "pending" && !app.isDispatch,
   );
-  const shouldReconcile = options.reconcile === true;
-  if (!shouldReconcile && readyApps.length === 0) return apps;
+  // A source the caller could not authenticate annotates from existing rows
+  // only. Minting a row here would create the very authorization the access
+  // filter then checks, and reconciling would delete rows and shares on the
+  // word of a manifest no authoritative registry confirmed.
+  const shouldPersist = options.persist !== false;
+  const shouldReconcile = options.reconcile === true && shouldPersist;
+  if (!shouldReconcile && readyApps.length === 0) {
+    return apps;
+  }
 
   const orgId = currentOrgId();
   const metadata = await readWorkspaceAppMetadataSettings();
@@ -1279,6 +1304,7 @@ async function ensureWorkspaceAppRecords(
       orgEnabled: boolean;
     }
   >();
+  const unresolvedIds: string[] = [];
 
   try {
     const existingRecords = new Map<
@@ -1312,6 +1338,10 @@ async function ensureWorkspaceAppRecords(
     for (const app of readyApps) {
       const existing = existingRecords.get(app.id);
       if (!existing) {
+        if (!shouldPersist) {
+          unresolvedIds.push(app.id);
+          continue;
+        }
         const override = metadata.apps[app.id];
         // Never infer ownership from the person who happened to list apps.
         // Legacy manifests without trusted creation metadata remain
@@ -1354,7 +1384,7 @@ async function ensureWorkspaceAppRecords(
         const existingOrgId = cleanOptionalText(existing.org_id) ?? null;
         // A registry row belongs to the org that created it. Never reassign a
         // row from another org just because a caller listed the same manifest.
-        if (existingOrgId && existingOrgId !== orgId) {
+        if (!shouldPersist || (existingOrgId && existingOrgId !== orgId)) {
           records.set(app.id, {
             ownerEmail: existingOwnerEmail,
             orgId: existingOrgId,
@@ -1424,6 +1454,12 @@ async function ensureWorkspaceAppRecords(
       }
     }
 
+    if (unresolvedIds.length > 0) {
+      console.warn(
+        `[dispatch] unverified workspace app read has no access record for ${unresolvedIds.length} app(s); hidden from this response: ${unresolvedIds.join(", ")}`,
+      );
+    }
+
     if (shouldReconcile && orgId) {
       const currentAppIds = new Set(readyApps.map((app) => app.id));
       const result = await db.execute({
@@ -1539,6 +1575,8 @@ async function filterWorkspaceAppsByAccess(
             { userEmail, orgId },
             { skipResourceBody: true },
           );
+          // A missing row is not an authorization result. This remains
+          // fail-closed when a denied registry read falls back to a manifest.
           return { app, allowed: Boolean(access) };
         } catch (error) {
           // Rolling deployments may discover an app before the additive access
@@ -1747,6 +1785,9 @@ async function readWorkspaceAppsFromGateway(): Promise<WorkspaceAppDiscovery | n
           signal: controller.signal,
         },
       );
+      if (localResponse.status === 401 || localResponse.status === 403) {
+        throw new WorkspaceAppsGatewayAuthorizationError(localResponse.status);
+      }
       if (localResponse.ok) {
         const apps = parseWorkspaceAppsManifest(
           // coercion-ok: malformed gateway JSON is an unavailable registry and
@@ -2026,11 +2067,17 @@ export async function updateWorkspaceAppMetadata(input: {
 export async function listWorkspaceApps(
   options: ListWorkspaceAppsOptions = {},
 ): Promise<WorkspaceAppSummary[]> {
-  const finalize = async (apps: WorkspaceAppSummary[], reconcile = false) => {
+  const finalize = async (
+    apps: WorkspaceAppSummary[],
+    { reconcile = false, persist = true }: FinalizeWorkspaceAppsOptions = {},
+  ) => {
     // Reconcile from the complete manifest. Archive and audience filters only
     // control the response; treating hidden apps as absent deletes their rows.
     const annotated = await applyArchivedAndPending(apps);
-    const recorded = await ensureWorkspaceAppRecords(annotated, { reconcile });
+    const recorded = await ensureWorkspaceAppRecords(annotated, {
+      reconcile,
+      persist,
+    });
     const listed = options.includeArchived
       ? recorded
       : recorded.filter((app) => !app.archived);
@@ -2039,10 +2086,21 @@ export async function listWorkspaceApps(
     );
     return maybeIncludeAgentCards(visible, options);
   };
-  const gatewayApps = await readWorkspaceAppsFromGateway();
+  let gatewayDenial: WorkspaceAppsGatewayAuthorizationError | null = null;
+  let gatewayApps: WorkspaceAppDiscovery | null = null;
+  try {
+    gatewayApps = await readWorkspaceAppsFromGateway();
+  } catch (error) {
+    if (!(error instanceof WorkspaceAppsGatewayAuthorizationError)) throw error;
+    // A denial answers for the gateway hop, not for what this caller may see.
+    // Serve deployment manifests below, but keep the degraded read read-only
+    // because an unauthenticated manifest must not mint access rows.
+    gatewayDenial = error;
+  }
   if (gatewayApps) {
-    return finalize(gatewayApps.apps, gatewayApps.authoritative);
+    return finalize(gatewayApps.apps, { reconcile: gatewayApps.authoritative });
   }
+  const unverified = gatewayDenial !== null;
 
   const workspaceRoot = findWorkspaceRoot();
   const localFilesystemApps =
@@ -2050,15 +2108,25 @@ export async function listWorkspaceApps(
       ? await readWorkspaceAppsFromFilesystem(workspaceRoot)
       : null;
   if (localFilesystemApps) {
-    return finalize(localFilesystemApps, true);
+    warnWorkspaceAppsGatewayDenial(gatewayDenial, "local filesystem");
+    return finalize(localFilesystemApps, {
+      reconcile: !unverified,
+      persist: !unverified,
+    });
   }
 
   const manifestApps =
     readWorkspaceAppsFromEnv() ?? readWorkspaceAppsFromManifestFile();
   if (manifestApps) {
-    return finalize(manifestApps, true);
+    warnWorkspaceAppsGatewayDenial(gatewayDenial, "deployment manifest");
+    return finalize(manifestApps, {
+      reconcile: !unverified,
+      persist: !unverified,
+    });
   }
 
+  if (gatewayDenial) throw gatewayDenial;
+
   if (!workspaceRoot) {
     return finalize([
       {