@iloveagents/foundry-agent 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,24 @@
+# @iloveagents/foundry-agent
+
+## 0.1.1
+
+### Patch Changes
+
+- 689d3e9: feat(sidebar): distinct file-drop affordance for nav containers
+
+  `useNavItemDnd` now exposes `isFileDragOver` separately from `isDragOver`
+  so consuming nav items can render a prominent file-drop visual (dashed
+  primary outline + soft primary background + Upload icon) when the user
+  is dragging native files over the container. Previously file drags
+  shared the same subtle ring as entity-move drags, so users couldn't
+  tell that a folder accepted external files. Applies to all five nav-
+  item shapes (action-row leaf, button leaf, `NestedFolderItem`,
+  `CollapsibleNavItem` with children/actions, `NavLink` fallthrough) and
+  updates `ContainerDropZone` for visual parity.
+
+  Also fixes a related regression: the capture-phase
+  `onDragEnterCapture` / `onDragOverCapture` handlers were calling
+  `e.stopPropagation()`, which short-circuits React's synthetic dispatch
+  and prevented the bubble-phase `onDragEnter` (where state actually
+  mutates) from running. Removed — `preventDefault()` alone is enough to
+  mark the element as droppable.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iloveagents/foundry-agent",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
   "types": "./src/index.ts",

package/src/__tests__/auth-store.test.ts

@@ -1,5 +1,6 @@
-import { beforeEach, describe, expect, it } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { authStore } from "../msal/auth-store.ts";
+import * as authConfig from "../msal/auth-config.ts";
 
 const store = () => authStore.getState();
 
@@ -35,3 +36,134 @@ describe("authStore", () => {
     expect(store().user?.avatar).toBe("https://example.com/bob.png");
   });
 });
+
+describe("authStore.getAccessToken — canonical MSAL.js fallback", () => {
+  // Reference: https://learn.microsoft.com/entra/msal/javascript/browser/errors
+  const config = {
+    clientId: "test-client",
+    authority: "https://login.microsoftonline.com/test-tenant",
+    redirectUri: "http://localhost:8010",
+    apiScope: "api://test-api/access_as_user",
+  };
+
+  function mockMsal(overrides: Record<string, unknown> = {}) {
+    const account = { username: "alice@example.com", localAccountId: "alice-oid" };
+    const mock = {
+      initialize: vi.fn().mockResolvedValue(undefined),
+      handleRedirectPromise: vi.fn().mockResolvedValue(null),
+      getAllAccounts: vi.fn().mockReturnValue([account]),
+      loginRedirect: vi.fn().mockResolvedValue(undefined),
+      logoutRedirect: vi.fn().mockResolvedValue(undefined),
+      setActiveAccount: vi.fn(),
+      acquireTokenSilent: vi.fn().mockResolvedValue({ accessToken: "fresh-token" }),
+      acquireTokenRedirect: vi.fn().mockResolvedValue(undefined),
+      acquireTokenPopup: vi.fn().mockResolvedValue({ accessToken: "popup-token" }),
+      ...overrides,
+    };
+    vi.spyOn(authConfig, "getMsalInstance").mockReturnValue(mock);
+    vi.spyOn(authConfig, "getMsalConfig").mockReturnValue(config);
+    return mock;
+  }
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("returns null without navigating when MSAL isn't configured", async () => {
+    vi.spyOn(authConfig, "getMsalInstance").mockReturnValue(null);
+    vi.spyOn(authConfig, "getMsalConfig").mockReturnValue(null);
+    expect(await store().getAccessToken()).toBeNull();
+  });
+
+  it("returns the access token on a normal silent acquire", async () => {
+    const msal = mockMsal();
+    expect(await store().getAccessToken()).toBe("fresh-token");
+    expect(msal.acquireTokenSilent).toHaveBeenCalledOnce();
+    expect(msal.acquireTokenRedirect).not.toHaveBeenCalled();
+    expect(msal.loginRedirect).not.toHaveBeenCalled();
+  });
+
+  it("returns null without redirecting when no account is cached", async () => {
+    // AuthGuard calls loginRedirect when accounts.length === 0; double-
+    // redirecting from getAccessToken would race with AuthGuard.
+    const msal = mockMsal({ getAllAccounts: vi.fn().mockReturnValue([]) });
+    expect(await store().getAccessToken()).toBeNull();
+    expect(msal.acquireTokenSilent).not.toHaveBeenCalled();
+    expect(msal.acquireTokenRedirect).not.toHaveBeenCalled();
+    expect(msal.loginRedirect).not.toHaveBeenCalled();
+  });
+
+  it("triggers acquireTokenRedirect on InteractionRequiredAuthError (canonical pattern)", async () => {
+    const err = Object.assign(new Error("MFA required"), {
+      name: "InteractionRequiredAuthError",
+      errorCode: "interaction_required",
+    });
+    const msal = mockMsal({ acquireTokenSilent: vi.fn().mockRejectedValue(err) });
+    expect(await store().getAccessToken()).toBeNull();
+    expect(msal.acquireTokenRedirect).toHaveBeenCalledOnce();
+    expect(msal.acquireTokenRedirect).toHaveBeenCalledWith({
+      scopes: [config.apiScope],
+      account: { username: "alice@example.com", localAccountId: "alice-oid" },
+    });
+  });
+
+  it("triggers acquireTokenRedirect on consent_required", async () => {
+    const err = Object.assign(new Error("consent required"), {
+      name: "InteractionRequiredAuthError",
+      errorCode: "consent_required",
+    });
+    const msal = mockMsal({ acquireTokenSilent: vi.fn().mockRejectedValue(err) });
+    expect(await store().getAccessToken()).toBeNull();
+    expect(msal.acquireTokenRedirect).toHaveBeenCalledOnce();
+  });
+
+  it("triggers acquireTokenRedirect on monitor_window_timeout (third-party-iframe block)", async () => {
+    // Microsoft Learn → "Common errors in MSAL JS" → monitor_window_timeout
+    // → documented remedy includes "Invoke an interactive API".
+    const err = Object.assign(new Error("monitor_window_timeout"), {
+      name: "BrowserAuthError",
+      errorCode: "monitor_window_timeout",
+    });
+    const msal = mockMsal({ acquireTokenSilent: vi.fn().mockRejectedValue(err) });
+    expect(await store().getAccessToken()).toBeNull();
+    expect(msal.acquireTokenRedirect).toHaveBeenCalledOnce();
+  });
+
+  it("does NOT redirect on interaction_in_progress (would race with another flow)", async () => {
+    const err = Object.assign(new Error("interaction_in_progress"), {
+      name: "BrowserAuthError",
+      errorCode: "interaction_in_progress",
+    });
+    const msal = mockMsal({ acquireTokenSilent: vi.fn().mockRejectedValue(err) });
+    expect(await store().getAccessToken()).toBeNull();
+    expect(msal.acquireTokenRedirect).not.toHaveBeenCalled();
+  });
+
+  it("does NOT redirect on hash_empty_error (config bug, redirect won't fix)", async () => {
+    const err = Object.assign(new Error("hash_empty_error"), {
+      name: "BrowserAuthError",
+      errorCode: "hash_empty_error",
+    });
+    const msal = mockMsal({ acquireTokenSilent: vi.fn().mockRejectedValue(err) });
+    expect(await store().getAccessToken()).toBeNull();
+    expect(msal.acquireTokenRedirect).not.toHaveBeenCalled();
+  });
+
+  it("does NOT redirect on a transient/unknown error", async () => {
+    // A network blip shouldn't bounce the user through a login flow.
+    const err = new Error("connection reset");
+    const msal = mockMsal({ acquireTokenSilent: vi.fn().mockRejectedValue(err) });
+    expect(await store().getAccessToken()).toBeNull();
+    expect(msal.acquireTokenRedirect).not.toHaveBeenCalled();
+    expect(msal.loginRedirect).not.toHaveBeenCalled();
+  });
+
+  it("matches InteractionRequiredAuthError by class name when no errorCode is set", async () => {
+    const err = Object.assign(new Error("interaction"), {
+      name: "InteractionRequiredAuthError",
+    });
+    const msal = mockMsal({ acquireTokenSilent: vi.fn().mockRejectedValue(err) });
+    expect(await store().getAccessToken()).toBeNull();
+    expect(msal.acquireTokenRedirect).toHaveBeenCalledOnce();
+  });
+});

package/src/__tests__/link-store.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, it, beforeEach, vi } from "vitest";
+import { linkStore, resolveLinkHandler, type LinkHandler } from "../store/link-store.ts";
+
+describe("linkStore", () => {
+  beforeEach(() => {
+    linkStore.getState().clear();
+  });
+
+  it("registers and clears a markdown link handler", () => {
+    const handler: LinkHandler = {
+      canHandle: (href) => href.startsWith("/spaces/"),
+      openLink: vi.fn(),
+    };
+
+    linkStore.getState().setHandler(handler);
+    expect(linkStore.getState().handler).toBe(handler);
+    expect(linkStore.getState().handlers).toEqual([handler]);
+
+    linkStore.getState().clear();
+    expect(linkStore.getState().handler).toBeNull();
+    expect(linkStore.getState().handlers).toEqual([]);
+  });
+
+  it("keeps multiple handlers and resolves the matching namespace", () => {
+    const spacesHandler: LinkHandler = {
+      canHandle: (href) => href.startsWith("/spaces/"),
+      openLink: vi.fn(),
+    };
+    const docsHandler: LinkHandler = {
+      normalizeHref: (href) => (href.startsWith("docs:") ? `/docs/${href.slice(5)}` : href),
+      canHandle: (href) => href.startsWith("/docs/"),
+      openLink: vi.fn(),
+    };
+
+    linkStore.getState().setHandler(spacesHandler);
+    linkStore.getState().setHandler(docsHandler);
+
+    expect(resolveLinkHandler("/spaces/page-1")).toEqual({
+      handler: spacesHandler,
+      href: "/spaces/page-1",
+    });
+    expect(resolveLinkHandler("docs:setup")).toEqual({
+      handler: docsHandler,
+      href: "/docs/setup",
+    });
+    expect(resolveLinkHandler("/unknown")).toBeNull();
+  });
+});

package/src/index.ts

@@ -10,19 +10,18 @@ export {
 } from "./client/service-fetch.ts";
 
 // --- Tool registry ---
-export {
-  clientToolRegistry,
-  type ClientToolEntry,
-  type ToolRegistry,
-} from "./tools/registry.ts";
+export { clientToolRegistry, type ClientToolEntry, type ToolRegistry } from "./tools/registry.ts";
 
 // --- Stores (vanilla) ---
-export {
-  streamingStatusStore,
-  type StreamingStatus,
-} from "./store/streaming-status-store.ts";
+export { streamingStatusStore, type StreamingStatus } from "./store/streaming-status-store.ts";
 export {
   citationStore,
   type CitationResult,
   type CitationHandler,
 } from "./store/citation-store.ts";
+export {
+  linkStore,
+  resolveLinkHandler,
+  type LinkHandler,
+  type ResolvedLinkHandler,
+} from "./store/link-store.ts";

package/src/msal/auth-config.ts

@@ -57,6 +57,13 @@ export async function initializeMsal(
 
   const { PublicClientApplication: PCA } = await import("@azure/msal-browser");
 
+  // Token-renewal config — see Microsoft Learn:
+  // https://learn.microsoft.com/entra/msal/javascript/browser/errors
+  //
+  // SPA refresh tokens are 24 h, non-sliding, non-renewable. After that
+  // window the user MUST re-auth; nothing the SPA can do silently saves
+  // it. Goal of these knobs is to make the unavoidable interactive
+  // bounce predictable and to keep the silent path healthy in between.
   const msalConfiguration = {
     auth: {
       clientId: config.clientId,
@@ -68,6 +75,24 @@ export async function initializeMsal(
       // localStorage is required for Playwright E2E tests — sessionStorage
       // is not preserved across page navigations in the Playwright context.
       cacheLocation: "localStorage",
+      // Cache key includes a hash of any `claims` parameter. Without
+      // this, MSAL serves the same cached access token even after a
+      // claims-challenge / token revocation / role change. The MSAL
+      // team has signalled this will become the default; opt in early.
+      claimsBasedCachingEnabled: true,
+    },
+    system: {
+      // Treat access tokens as "expired" 10 min before the actual exp
+      // claim instead of MSAL's default 5 min. Eliminates the race
+      // where the SPA's clock thinks the token is still valid but the
+      // resource server rejects it as expired (clock skew, slow request
+      // queueing, etc.).
+      tokenRenewalOffsetSeconds: 600,
+      // Default 6 s is too tight on modern browsers — third-party
+      // storage partitioning + slower CPUs in the silent iframe can
+      // push the round-trip past it. 10 s is the value MSAL Angular
+      // and React samples ship with.
+      iframeHashTimeout: 10000,
     },
   };
 

package/src/msal/auth-store.ts

@@ -21,10 +21,69 @@ interface AuthState {
   /**
    * Acquire an access token for the given audience.
    * Returns null when MSAL is not configured (local dev).
+   *
+   * Recovery semantics — follows the canonical MSAL.js pattern documented
+   * at https://learn.microsoft.com/entra/msal/javascript/browser/errors:
+   *
+   *   try {
+   *     await msal.acquireTokenSilent(req);
+   *   } catch (error) {
+   *     if (error instanceof InteractionRequiredAuthError) {
+   *       await msal.acquireTokenRedirect(req);
+   *     }
+   *   }
+   *
+   * Plus one extra recoverable case explicitly called out in those docs:
+   * `BrowserAuthError: monitor_window_timeout`. Microsoft's recommendation
+   * is to either backoff, fix the redirectUri page, or "invoke an
+   * interactive API such as acquireTokenPopup or acquireTokenRedirect" —
+   * we take the last option, which matches third-party-iframe storage
+   * blocking on Chrome 120+ / Edge / Safari (the silent iframe times
+   * out because the cross-site cookie is partitioned).
+   *
+   * Other `BrowserAuthError` codes (`interaction_in_progress`,
+   * `hash_empty_error`, `hash_does_not_contain_known_properties`,
+   * `block_iframe_reload`) are config / race-condition bugs that another
+   * redirect won't fix — propagate them as null without navigating.
+   *
+   * The "no account in cache" case is handled at boot by `AuthGuard`,
+   * which calls `loginRedirect` when `accounts.length === 0`. If we
+   * still reach this method without an account, it's an unusual state;
+   * return null and let the next AuthGuard render recover.
+   *
+   * Errors are matched by `name` / `errorCode` rather than `instanceof`
+   * because `@azure/msal-browser` is loaded via dynamic import; the
+   * error class identity isn't shared across module boundaries.
    */
   getAccessToken: (audience?: "api" | "spaces") => Promise<string | null>;
 }
 
+/** Recoverable error codes per MSAL.js docs — every one of these has the
+ * documented remedy "invoke an interactive API". */
+const RECOVERABLE_ERROR_CODES = new Set([
+  // InteractionRequiredAuthError — canonical fallback case.
+  "interaction_required",
+  "login_required",
+  "consent_required",
+  // BrowserAuthError: monitor_window_timeout. Documented remedy includes
+  // "Invoke an interactive API" (Microsoft Learn → "Common errors in
+  // MSAL JS" → monitor_window_timeout → "Throttling" + "X-Frame-Options
+  // Deny"). Real-world trigger on Chrome 120+ is third-party-iframe
+  // storage partitioning blocking the silent SSO frame.
+  "monitor_window_timeout",
+]);
+
+/** `InteractionRequiredAuthError` always triggers the redirect — match by
+ * class name as a fallback when the error code isn't set. */
+const INTERACTION_REQUIRED_NAME = "InteractionRequiredAuthError";
+
+function isRecoverableAuthError(err: unknown): boolean {
+  if (!err || typeof err !== "object") return false;
+  const name = (err as { name?: string }).name ?? "";
+  const code = (err as { errorCode?: string }).errorCode ?? "";
+  return name === INTERACTION_REQUIRED_NAME || RECOVERABLE_ERROR_CODES.has(code);
+}
+
 export const authStore = createStore<AuthState>((set) => ({
   user: null,
   isAuthenticated: false,
@@ -45,9 +104,13 @@ export const authStore = createStore<AuthState>((set) => ({
     if (!msal || !config) return null;
 
     const accounts = msal.getAllAccounts();
-    if (accounts.length === 0) return null;
+    if (accounts.length === 0) {
+      // No cached account — `AuthGuard` will call `loginRedirect` on
+      // its next render. Don't double-redirect from here.
+      return null;
+    }
 
-    // Single API-scoped token — Spaces accepts both audiences (multi-audience JWT)
+    // Single API-scoped token — Spaces accepts both audiences (multi-audience JWT).
     const scope = config.apiScope;
 
     try {
@@ -56,15 +119,16 @@ export const authStore = createStore<AuthState>((set) => ({
         account: accounts[0],
       });
       return result.accessToken;
-    } catch {
-      // Silent acquisition failed — trigger interactive redirect
-      try {
-        await msal.acquireTokenRedirect({
-          scopes: [scope],
-          account: accounts[0],
-        });
-      } catch {
-        // Redirect will navigate away; nothing to return
+    } catch (err) {
+      if (isRecoverableAuthError(err)) {
+        try {
+          await msal.acquireTokenRedirect({
+            scopes: [scope],
+            account: accounts[0],
+          });
+        } catch {
+          // Redirect navigates away; nothing to return.
+        }
       }
       return null;
     }

package/src/store/link-store.ts

@@ -0,0 +1,53 @@
+import { createStore } from "zustand/vanilla";
+
+export interface LinkHandler {
+  canHandle: (href: string) => boolean;
+  normalizeHref?: (href: string) => string | null;
+  openLink: (href: string) => void;
+}
+
+export interface ResolvedLinkHandler {
+  handler: LinkHandler;
+  href: string;
+}
+
+interface LinkState {
+  /**
+   * Latest registered handler kept for backwards-compatible consumers.
+   * New code should use `handlers` or `resolveLinkHandler`.
+   */
+  handler: LinkHandler | null;
+  handlers: LinkHandler[];
+  setHandler: (handler: LinkHandler) => void;
+  clear: () => void;
+}
+
+/**
+ * Generic markdown-link extension point.
+ *
+ * Feature modules register a handler for their own deep-link namespace
+ * (for example Spaces handles `/spaces/...`). The chat renderer stays
+ * module-agnostic while still letting app-local links navigate in-place.
+ */
+export const linkStore = createStore<LinkState>((set) => ({
+  handler: null,
+  handlers: [],
+  setHandler: (handler) =>
+    set((state) => ({
+      handler,
+      handlers: [...state.handlers.filter((item) => item !== handler), handler],
+    })),
+  clear: () => set({ handler: null, handlers: [] }),
+}));
+
+export function resolveLinkHandler(rawHref: string): ResolvedLinkHandler | null {
+  const handlers = linkStore.getState().handlers;
+  for (let i = handlers.length - 1; i >= 0; i -= 1) {
+    const handler = handlers[i];
+    const href = handler.normalizeHref ? handler.normalizeHref(rawHref) : rawHref;
+    if (href && handler.canHandle(href)) {
+      return { handler, href };
+    }
+  }
+  return null;
+}