@agent-native/core 0.22.17 → 0.22.19

package/dist/client/vite-dev-recovery-script.js

@@ -1,3 +1,4 @@
+import { EMBED_MODE_QUERY_PARAM, EMBED_TOKEN_QUERY_PARAM, } from "../shared/embed-auth.js";
 /**
  * Synchronous dev-only browser recovery for Vite optimized-dependency races.
  *
@@ -6,8 +7,16 @@
  * `head-prepend` for HTML that does pass through transformIndexHtml.
  */
 export function getViteDevRecoveryScript() {
+    const embedModeParam = JSON.stringify(EMBED_MODE_QUERY_PARAM);
+    const embedTokenParam = JSON.stringify(EMBED_TOKEN_QUERY_PARAM);
     return `
 (function() {
+  try {
+    var params = new URLSearchParams(window.location.search || "");
+    var embedded = params.get(${embedModeParam});
+    if (params.has(${embedTokenParam}) || embedded === "1" || embedded === "true") return;
+  } catch (e) {}
+
   var RELOAD_KEY = "__an_optimize_reload";
   var MAX_RELOADS = 3;
   var RESET_AFTER_MS = 8000;

package/dist/client/vite-dev-recovery-script.js.map

@@ -1 +1 @@
-{"version":3,"file":"vite-dev-recovery-script.js","sourceRoot":"","sources":["../../src/client/vite-dev-recovery-script.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAyLH,CAAC;AACP,CAAC;AAED,MAAM,UAAU,iCAAiC;IAC/C,MAAM,OAAO,GACX,MAAM,CAAC,IAGR,CAAC,GAAG,CAAC;IACN,IACE,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,EACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,EAAE,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["/**\n * Synchronous dev-only browser recovery for Vite optimized-dependency races.\n *\n * Keep this script dependency-free and non-module-safe: React Router SSR roots\n * inline it before `<Scripts />`, and the Vite plugin injects it at\n * `head-prepend` for HTML that does pass through transformIndexHtml.\n */\nexport function getViteDevRecoveryScript(): string {\n  return `\n(function() {\n  var RELOAD_KEY = \"__an_optimize_reload\";\n  var MAX_RELOADS = 3;\n  var RESET_AFTER_MS = 8000;\n\n  var reloadTimer = null;\n  var overlayShown = false;\n\n  // Track recent reloads in sessionStorage. If we reload too many times\n  // in a short window, stop and show a manual-refresh message instead of\n  // looping forever.\n  function readReloadHistory() {\n    try {\n      var raw = sessionStorage.getItem(RELOAD_KEY);\n      if (!raw) return [];\n      var arr = JSON.parse(raw);\n      var cutoff = Date.now() - 30000;\n      return Array.isArray(arr) ? arr.filter(function(t) { return t > cutoff; }) : [];\n    } catch (e) { return []; }\n  }\n  function recordReload() {\n    try {\n      var history = readReloadHistory();\n      history.push(Date.now());\n      sessionStorage.setItem(RELOAD_KEY, JSON.stringify(history));\n    } catch (e) {}\n  }\n  // Reset the counter after a stable period (page didn't fail again).\n  setTimeout(function() {\n    try { sessionStorage.removeItem(RELOAD_KEY); } catch (e) {}\n  }, RESET_AFTER_MS);\n\n  function showOverlay(title, subtitle) {\n    if (overlayShown) return;\n    overlayShown = true;\n    var mount = function() {\n      if (!document.body) { setTimeout(mount, 16); return; }\n      var el = document.createElement(\"div\");\n      el.id = \"__an-reload-overlay\";\n      el.style.cssText = [\n        \"position:fixed\",\"inset:0\",\"z-index:2147483647\",\n        \"display:flex\",\"align-items:center\",\"justify-content:center\",\n        \"background:rgba(0,0,0,0.6)\",\"backdrop-filter:blur(8px)\",\n        \"-webkit-backdrop-filter:blur(8px)\",\n        \"font-family:-apple-system,BlinkMacSystemFont,system-ui,sans-serif\",\n        \"color:#fff\",\"font-size:14px\"\n      ].join(\";\");\n      el.innerHTML =\n        '<div style=\"background:#171717;padding:20px 24px;border-radius:12px;' +\n        'border:1px solid rgba(255,255,255,0.1);max-width:340px;text-align:center;' +\n        'box-shadow:0 20px 60px rgba(0,0,0,0.5)\">' +\n        '<div style=\"font-weight:600;margin-bottom:6px\">' + title + '</div>' +\n        '<div style=\"font-size:12px;opacity:0.7\">' + subtitle + '</div>' +\n        '</div>';\n      document.body.appendChild(el);\n    };\n    mount();\n  }\n\n  function scheduleReload(reason) {\n    if (reloadTimer) return;\n    var history = readReloadHistory();\n    if (history.length >= MAX_RELOADS) {\n      console.warn(\"[agent-native] Dev server keeps re-bundling. Manual refresh needed.\", reason);\n      showOverlay(\n        \"Dev server out of sync\",\n        \"Auto-reload gave up after \" + MAX_RELOADS + \" tries. Refresh the page (\\\\u2318R / Ctrl+R).\"\n      );\n      return;\n    }\n    console.log(\"[agent-native] Vite re-bundled deps (\" + reason + \"), reloading\\\\u2026\");\n    recordReload();\n    // First reload is silent. One refresh almost always fixes it and the\n    // overlay flash is more disruptive than the reload itself. Only show\n    // the overlay starting on the second attempt, when something is clearly\n    // taking longer than expected.\n    if (history.length >= 1) {\n      showOverlay(\"Updating dev server\\\\u2026\", \"Reloading the page\");\n    }\n    reloadTimer = setTimeout(function() { window.location.reload(); }, 300);\n  }\n\n  function looksLikeViteFailureMessage(message) {\n    if (!message) return false;\n    return message.indexOf(\"Failed to fetch dynamically imported module\") !== -1\n        || message.indexOf(\"error loading dynamically imported module\") !== -1\n        || message.indexOf(\"Importing a module script failed\") !== -1\n        || message.indexOf(\"Outdated Optimize Dep\") !== -1\n        || message.indexOf(\"Optimize Deps Processing Error\") !== -1\n        || (message.indexOf(\"504\") !== -1 && (\n          message.indexOf(\".vite/deps\") !== -1 ||\n          message.indexOf(\"/node_modules/.vite/deps/\") !== -1\n        ));\n  }\n\n  function looksLikeViteDep(url) {\n    if (!url) return false;\n    // Only treat same-origin URLs as Vite deps. Do not reload the page\n    // because some third-party CDN script 404'd.\n    try {\n      var u = new URL(url, window.location.href);\n      if (u.origin !== window.location.origin) return false;\n    } catch (e) { return false; }\n    return url.indexOf(\"/node_modules/.vite/deps/\") !== -1\n        || url.indexOf(\"/@fs/\") !== -1\n        || url.indexOf(\"/@id/\") !== -1\n        || url.indexOf(\"?v=\") !== -1\n        || url.indexOf(\"?import\") !== -1\n        || /\\\\.(m?js|ts|tsx|jsx)(\\\\?|$)/.test(url);\n  }\n\n  // 1) <script type=\"module\"> / <link> 504. These fire on the element, not\n  //    window, so use capture phase to catch resource load errors.\n  window.addEventListener(\"error\", function(e) {\n    var t = e.target;\n    if (!t || t === window) {\n      var message = String(e.message || \"\");\n      if (looksLikeViteFailureMessage(message)) {\n        scheduleReload(\"window error\");\n      }\n      return;\n    }\n    var tag = t.tagName;\n    if (tag !== \"SCRIPT\" && tag !== \"LINK\") return;\n    var url = t.src || t.href || \"\";\n    if (looksLikeViteDep(url)) {\n      var name = url.split(\"/\").pop();\n      scheduleReload(\"script 504: \" + name);\n    }\n  }, true);\n\n  // Vite's documented hook for failed dynamic-import preloads. This mostly\n  // targets production chunk skew, but it also fires for some dev optimizer\n  // races, so wire it into the same guarded reload path.\n  window.addEventListener(\"vite:preloadError\", function(e) {\n    var payload = e && e.payload;\n    var msg = String((payload && (payload.message || payload)) || \"\");\n    if (!msg || looksLikeViteFailureMessage(msg)) {\n      if (e.preventDefault) e.preventDefault();\n      scheduleReload(\"preload error\");\n    }\n  });\n\n  // 2) Dynamic import failures (React Router code splitting, lazy components).\n  window.addEventListener(\"unhandledrejection\", function(e) {\n    var msg = String((e.reason && (e.reason.message || e.reason)) || \"\");\n    if (looksLikeViteFailureMessage(msg)) {\n      scheduleReload(\"dynamic import\");\n    }\n  });\n\n  // Static module-graph fetch failures for child imports don't always surface\n  // as element errors or rejections. Chrome exposes the HTTP status via\n  // Resource Timing; when available, use it as a final safety net.\n  var seenResources = {};\n  function checkResourceEntry(entry) {\n    var url = entry && entry.name;\n    if (!url || seenResources[url]) return;\n    seenResources[url] = true;\n    if (!looksLikeViteDep(url)) return;\n    if (entry.responseStatus === 504) {\n      var name = url.split(\"/\").pop();\n      scheduleReload(\"resource 504: \" + name);\n    }\n  }\n  function checkExistingResources() {\n    try {\n      var entries = performance.getEntriesByType(\"resource\") || [];\n      for (var i = 0; i < entries.length; i++) checkResourceEntry(entries[i]);\n    } catch (e) {}\n  }\n  if (window.PerformanceObserver) {\n    try {\n      var observer = new PerformanceObserver(function(list) {\n        var entries = list.getEntries();\n        for (var i = 0; i < entries.length; i++) checkResourceEntry(entries[i]);\n      });\n      observer.observe({ type: \"resource\", buffered: true });\n    } catch (e) {\n      setTimeout(checkExistingResources, 0);\n    }\n  } else {\n    setTimeout(checkExistingResources, 0);\n  }\n})();`;\n}\n\nexport function shouldInlineViteDevRecoveryScript(): boolean {\n  const viteEnv = (\n    import.meta as ImportMeta & {\n      env?: { DEV?: boolean; PROD?: boolean };\n    }\n  ).env;\n  if (\n    typeof process !== \"undefined\" &&\n    process.env?.NODE_ENV === \"production\"\n  ) {\n    return false;\n  }\n  if (viteEnv?.PROD === true) return false;\n  if (viteEnv?.DEV === true) return true;\n  return true;\n}\n"]}
+{"version":3,"file":"vite-dev-recovery-script.js","sourceRoot":"","sources":["../../src/client/vite-dev-recovery-script.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAEhE,OAAO;;;;gCAIuB,cAAc;qBACzB,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA0L9B,CAAC;AACP,CAAC;AAED,MAAM,UAAU,iCAAiC;IAC/C,MAAM,OAAO,GACX,MAAM,CAAC,IAGR,CAAC,GAAG,CAAC;IACN,IACE,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,EACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,EAAE,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,EAAE,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import {\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_TOKEN_QUERY_PARAM,\n} from \"../shared/embed-auth.js\";\n\n/**\n * Synchronous dev-only browser recovery for Vite optimized-dependency races.\n *\n * Keep this script dependency-free and non-module-safe: React Router SSR roots\n * inline it before `<Scripts />`, and the Vite plugin injects it at\n * `head-prepend` for HTML that does pass through transformIndexHtml.\n */\nexport function getViteDevRecoveryScript(): string {\n  const embedModeParam = JSON.stringify(EMBED_MODE_QUERY_PARAM);\n  const embedTokenParam = JSON.stringify(EMBED_TOKEN_QUERY_PARAM);\n\n  return `\n(function() {\n  try {\n    var params = new URLSearchParams(window.location.search || \"\");\n    var embedded = params.get(${embedModeParam});\n    if (params.has(${embedTokenParam}) || embedded === \"1\" || embedded === \"true\") return;\n  } catch (e) {}\n\n  var RELOAD_KEY = \"__an_optimize_reload\";\n  var MAX_RELOADS = 3;\n  var RESET_AFTER_MS = 8000;\n\n  var reloadTimer = null;\n  var overlayShown = false;\n\n  // Track recent reloads in sessionStorage. If we reload too many times\n  // in a short window, stop and show a manual-refresh message instead of\n  // looping forever.\n  function readReloadHistory() {\n    try {\n      var raw = sessionStorage.getItem(RELOAD_KEY);\n      if (!raw) return [];\n      var arr = JSON.parse(raw);\n      var cutoff = Date.now() - 30000;\n      return Array.isArray(arr) ? arr.filter(function(t) { return t > cutoff; }) : [];\n    } catch (e) { return []; }\n  }\n  function recordReload() {\n    try {\n      var history = readReloadHistory();\n      history.push(Date.now());\n      sessionStorage.setItem(RELOAD_KEY, JSON.stringify(history));\n    } catch (e) {}\n  }\n  // Reset the counter after a stable period (page didn't fail again).\n  setTimeout(function() {\n    try { sessionStorage.removeItem(RELOAD_KEY); } catch (e) {}\n  }, RESET_AFTER_MS);\n\n  function showOverlay(title, subtitle) {\n    if (overlayShown) return;\n    overlayShown = true;\n    var mount = function() {\n      if (!document.body) { setTimeout(mount, 16); return; }\n      var el = document.createElement(\"div\");\n      el.id = \"__an-reload-overlay\";\n      el.style.cssText = [\n        \"position:fixed\",\"inset:0\",\"z-index:2147483647\",\n        \"display:flex\",\"align-items:center\",\"justify-content:center\",\n        \"background:rgba(0,0,0,0.6)\",\"backdrop-filter:blur(8px)\",\n        \"-webkit-backdrop-filter:blur(8px)\",\n        \"font-family:-apple-system,BlinkMacSystemFont,system-ui,sans-serif\",\n        \"color:#fff\",\"font-size:14px\"\n      ].join(\";\");\n      el.innerHTML =\n        '<div style=\"background:#171717;padding:20px 24px;border-radius:12px;' +\n        'border:1px solid rgba(255,255,255,0.1);max-width:340px;text-align:center;' +\n        'box-shadow:0 20px 60px rgba(0,0,0,0.5)\">' +\n        '<div style=\"font-weight:600;margin-bottom:6px\">' + title + '</div>' +\n        '<div style=\"font-size:12px;opacity:0.7\">' + subtitle + '</div>' +\n        '</div>';\n      document.body.appendChild(el);\n    };\n    mount();\n  }\n\n  function scheduleReload(reason) {\n    if (reloadTimer) return;\n    var history = readReloadHistory();\n    if (history.length >= MAX_RELOADS) {\n      console.warn(\"[agent-native] Dev server keeps re-bundling. Manual refresh needed.\", reason);\n      showOverlay(\n        \"Dev server out of sync\",\n        \"Auto-reload gave up after \" + MAX_RELOADS + \" tries. Refresh the page (\\\\u2318R / Ctrl+R).\"\n      );\n      return;\n    }\n    console.log(\"[agent-native] Vite re-bundled deps (\" + reason + \"), reloading\\\\u2026\");\n    recordReload();\n    // First reload is silent. One refresh almost always fixes it and the\n    // overlay flash is more disruptive than the reload itself. Only show\n    // the overlay starting on the second attempt, when something is clearly\n    // taking longer than expected.\n    if (history.length >= 1) {\n      showOverlay(\"Updating dev server\\\\u2026\", \"Reloading the page\");\n    }\n    reloadTimer = setTimeout(function() { window.location.reload(); }, 300);\n  }\n\n  function looksLikeViteFailureMessage(message) {\n    if (!message) return false;\n    return message.indexOf(\"Failed to fetch dynamically imported module\") !== -1\n        || message.indexOf(\"error loading dynamically imported module\") !== -1\n        || message.indexOf(\"Importing a module script failed\") !== -1\n        || message.indexOf(\"Outdated Optimize Dep\") !== -1\n        || message.indexOf(\"Optimize Deps Processing Error\") !== -1\n        || (message.indexOf(\"504\") !== -1 && (\n          message.indexOf(\".vite/deps\") !== -1 ||\n          message.indexOf(\"/node_modules/.vite/deps/\") !== -1\n        ));\n  }\n\n  function looksLikeViteDep(url) {\n    if (!url) return false;\n    // Only treat same-origin URLs as Vite deps. Do not reload the page\n    // because some third-party CDN script 404'd.\n    try {\n      var u = new URL(url, window.location.href);\n      if (u.origin !== window.location.origin) return false;\n    } catch (e) { return false; }\n    return url.indexOf(\"/node_modules/.vite/deps/\") !== -1\n        || url.indexOf(\"/@fs/\") !== -1\n        || url.indexOf(\"/@id/\") !== -1\n        || url.indexOf(\"?v=\") !== -1\n        || url.indexOf(\"?import\") !== -1\n        || /\\\\.(m?js|ts|tsx|jsx)(\\\\?|$)/.test(url);\n  }\n\n  // 1) <script type=\"module\"> / <link> 504. These fire on the element, not\n  //    window, so use capture phase to catch resource load errors.\n  window.addEventListener(\"error\", function(e) {\n    var t = e.target;\n    if (!t || t === window) {\n      var message = String(e.message || \"\");\n      if (looksLikeViteFailureMessage(message)) {\n        scheduleReload(\"window error\");\n      }\n      return;\n    }\n    var tag = t.tagName;\n    if (tag !== \"SCRIPT\" && tag !== \"LINK\") return;\n    var url = t.src || t.href || \"\";\n    if (looksLikeViteDep(url)) {\n      var name = url.split(\"/\").pop();\n      scheduleReload(\"script 504: \" + name);\n    }\n  }, true);\n\n  // Vite's documented hook for failed dynamic-import preloads. This mostly\n  // targets production chunk skew, but it also fires for some dev optimizer\n  // races, so wire it into the same guarded reload path.\n  window.addEventListener(\"vite:preloadError\", function(e) {\n    var payload = e && e.payload;\n    var msg = String((payload && (payload.message || payload)) || \"\");\n    if (!msg || looksLikeViteFailureMessage(msg)) {\n      if (e.preventDefault) e.preventDefault();\n      scheduleReload(\"preload error\");\n    }\n  });\n\n  // 2) Dynamic import failures (React Router code splitting, lazy components).\n  window.addEventListener(\"unhandledrejection\", function(e) {\n    var msg = String((e.reason && (e.reason.message || e.reason)) || \"\");\n    if (looksLikeViteFailureMessage(msg)) {\n      scheduleReload(\"dynamic import\");\n    }\n  });\n\n  // Static module-graph fetch failures for child imports don't always surface\n  // as element errors or rejections. Chrome exposes the HTTP status via\n  // Resource Timing; when available, use it as a final safety net.\n  var seenResources = {};\n  function checkResourceEntry(entry) {\n    var url = entry && entry.name;\n    if (!url || seenResources[url]) return;\n    seenResources[url] = true;\n    if (!looksLikeViteDep(url)) return;\n    if (entry.responseStatus === 504) {\n      var name = url.split(\"/\").pop();\n      scheduleReload(\"resource 504: \" + name);\n    }\n  }\n  function checkExistingResources() {\n    try {\n      var entries = performance.getEntriesByType(\"resource\") || [];\n      for (var i = 0; i < entries.length; i++) checkResourceEntry(entries[i]);\n    } catch (e) {}\n  }\n  if (window.PerformanceObserver) {\n    try {\n      var observer = new PerformanceObserver(function(list) {\n        var entries = list.getEntries();\n        for (var i = 0; i < entries.length; i++) checkResourceEntry(entries[i]);\n      });\n      observer.observe({ type: \"resource\", buffered: true });\n    } catch (e) {\n      setTimeout(checkExistingResources, 0);\n    }\n  } else {\n    setTimeout(checkExistingResources, 0);\n  }\n})();`;\n}\n\nexport function shouldInlineViteDevRecoveryScript(): boolean {\n  const viteEnv = (\n    import.meta as ImportMeta & {\n      env?: { DEV?: boolean; PROD?: boolean };\n    }\n  ).env;\n  if (\n    typeof process !== \"undefined\" &&\n    process.env?.NODE_ENV === \"production\"\n  ) {\n    return false;\n  }\n  if (viteEnv?.PROD === true) return false;\n  if (viteEnv?.DEV === true) return true;\n  return true;\n}\n"]}

package/dist/index.browser.d.ts

@@ -1,4 +1,4 @@
-export { sendToAgentChat, useAgentChatGenerating, useDevMode, useSendToAgentChat, AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES, getMcpAppHostContext, openMcpAppHostLink, requestMcpAppDisplayMode, updateMcpAppModelContext, useMcpAppHostContext, CodeRequiredDialog, useDbSync, useFileWatcher, useSession, cn, ApiKeySettings, type AgentChatMessage, type AgentNativeMcpAppHostMessageType, type McpAppDisplayMode, type McpAppHostCapabilities, type McpAppHostContext, type McpAppHostContextSnapshot, type McpAppModelContextContentPart, type McpAppModelContextUpdate, type CodeRequiredDialogProps, type AuthSession, } from "./client/index.js";
+export { sendToAgentChat, useAgentChatGenerating, useDevMode, useSendToAgentChat, AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES, getMcpAppHostContext, openMcpAppHostLink, requestMcpAppDisplayMode, sendMcpAppHostMessage, updateMcpAppModelContext, useMcpAppHostContext, CodeRequiredDialog, useDbSync, useFileWatcher, useSession, cn, ApiKeySettings, type AgentChatMessage, type AgentNativeMcpAppHostMessageType, type McpAppDisplayMode, type McpAppHostChatMessage, type McpAppHostCapabilities, type McpAppHostContext, type McpAppHostContextSnapshot, type McpAppModelContextContentPart, type McpAppModelContextUpdate, type CodeRequiredDialogProps, type AuthSession, } from "./client/index.js";
 export { agentChat } from "./shared/index.js";
 export { parseArgs, camelCaseArgs } from "./scripts/parse-args.js";
 export { defineAction, AgentActionStopError, isAgentActionStopError, type ActionHttpConfig, type AgentActionStopOptions, MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, MCP_APP_RESOURCE_URI_META_KEY, type ActionMcpAppConfig, type ActionMcpAppCsp, type ActionMcpAppHtmlBuilder, type ActionMcpAppPermissions, type ActionMcpAppResourceConfig, type ActionMcpAppResourceMeta, } from "./action.js";

package/dist/index.browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../src/index.browser.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,uCAAuC,EACvC,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,UAAU,EACV,EAAE,EACF,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG9C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAGnE,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,QAAQ,EACR,iCAAiC,EACjC,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.browser.d.ts","sourceRoot":"","sources":["../src/index.browser.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,uCAAuC,EACvC,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,UAAU,EACV,EAAE,EACF,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,WAAW,GACjB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAG9C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAGnE,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,QAAQ,EACR,iCAAiC,EACjC,KAAK,eAAe,GACrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,UAAU,EACV,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,sBAAsB,CAAC"}

package/dist/index.browser.js

@@ -1,6 +1,6 @@
 // Browser-safe entry — only client & shared exports (no Node/Express/chokidar).
 // Client
-export { sendToAgentChat, useAgentChatGenerating, useDevMode, useSendToAgentChat, AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES, getMcpAppHostContext, openMcpAppHostLink, requestMcpAppDisplayMode, updateMcpAppModelContext, useMcpAppHostContext, CodeRequiredDialog, useDbSync, useFileWatcher, useSession, cn, ApiKeySettings, } from "./client/index.js";
+export { sendToAgentChat, useAgentChatGenerating, useDevMode, useSendToAgentChat, AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES, getMcpAppHostContext, openMcpAppHostLink, requestMcpAppDisplayMode, sendMcpAppHostMessage, updateMcpAppModelContext, useMcpAppHostContext, CodeRequiredDialog, useDbSync, useFileWatcher, useSession, cn, ApiKeySettings, } from "./client/index.js";
 // Shared (isomorphic)
 export { agentChat } from "./shared/index.js";
 // Pure utilities (no Node.js deps — safe for browser and SSR)

package/dist/index.browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.js","sourceRoot":"","sources":["../src/index.browser.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,SAAS;AACT,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,uCAAuC,EACvC,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,UAAU,EACV,EAAE,EACF,cAAc,GAWf,MAAM,mBAAmB,CAAC;AAE3B,sBAAsB;AACtB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,8DAA8D;AAC9D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEnE,2DAA2D;AAC3D,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,EAGtB,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,GAO9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,QAAQ,EACR,iCAAiC,GAElC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,UAAU,GAKX,MAAM,sBAAsB,CAAC","sourcesContent":["// Browser-safe entry — only client & shared exports (no Node/Express/chokidar).\n\n// Client\nexport {\n  sendToAgentChat,\n  useAgentChatGenerating,\n  useDevMode,\n  useSendToAgentChat,\n  AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES,\n  getMcpAppHostContext,\n  openMcpAppHostLink,\n  requestMcpAppDisplayMode,\n  updateMcpAppModelContext,\n  useMcpAppHostContext,\n  CodeRequiredDialog,\n  useDbSync,\n  useFileWatcher,\n  useSession,\n  cn,\n  ApiKeySettings,\n  type AgentChatMessage,\n  type AgentNativeMcpAppHostMessageType,\n  type McpAppDisplayMode,\n  type McpAppHostCapabilities,\n  type McpAppHostContext,\n  type McpAppHostContextSnapshot,\n  type McpAppModelContextContentPart,\n  type McpAppModelContextUpdate,\n  type CodeRequiredDialogProps,\n  type AuthSession,\n} from \"./client/index.js\";\n\n// Shared (isomorphic)\nexport { agentChat } from \"./shared/index.js\";\n\n// Pure utilities (no Node.js deps — safe for browser and SSR)\nexport { parseArgs, camelCaseArgs } from \"./scripts/parse-args.js\";\n\n// defineAction — used by template actions, no Node.js deps\nexport {\n  defineAction,\n  AgentActionStopError,\n  isAgentActionStopError,\n  type ActionHttpConfig,\n  type AgentActionStopOptions,\n  MCP_APP_EXTENSION_ID,\n  MCP_APP_MIME_TYPE,\n  MCP_APP_RESOURCE_URI_META_KEY,\n  type ActionMcpAppConfig,\n  type ActionMcpAppCsp,\n  type ActionMcpAppHtmlBuilder,\n  type ActionMcpAppPermissions,\n  type ActionMcpAppResourceConfig,\n  type ActionMcpAppResourceMeta,\n} from \"./action.js\";\nexport {\n  embedApp,\n  MCP_APP_REQUEST_ORIGIN_CSP_SOURCE,\n  type EmbedAppOptions,\n} from \"./mcp/embed-app.js\";\nexport {\n  embedRoute,\n  type EmbedRouteContext,\n  type EmbedRouteOptions,\n  type EmbedRoutePathBuilder,\n  type EmbedRouteResult,\n} from \"./mcp/embed-route.js\";\n"]}
+{"version":3,"file":"index.browser.js","sourceRoot":"","sources":["../src/index.browser.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAEhF,SAAS;AACT,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,UAAU,EACV,kBAAkB,EAClB,uCAAuC,EACvC,oBAAoB,EACpB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,kBAAkB,EAClB,SAAS,EACT,cAAc,EACd,UAAU,EACV,EAAE,EACF,cAAc,GAYf,MAAM,mBAAmB,CAAC;AAE3B,sBAAsB;AACtB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,8DAA8D;AAC9D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEnE,2DAA2D;AAC3D,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,sBAAsB,EAGtB,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,GAO9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,QAAQ,EACR,iCAAiC,GAElC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,UAAU,GAKX,MAAM,sBAAsB,CAAC","sourcesContent":["// Browser-safe entry — only client & shared exports (no Node/Express/chokidar).\n\n// Client\nexport {\n  sendToAgentChat,\n  useAgentChatGenerating,\n  useDevMode,\n  useSendToAgentChat,\n  AGENT_NATIVE_MCP_APP_HOST_MESSAGE_TYPES,\n  getMcpAppHostContext,\n  openMcpAppHostLink,\n  requestMcpAppDisplayMode,\n  sendMcpAppHostMessage,\n  updateMcpAppModelContext,\n  useMcpAppHostContext,\n  CodeRequiredDialog,\n  useDbSync,\n  useFileWatcher,\n  useSession,\n  cn,\n  ApiKeySettings,\n  type AgentChatMessage,\n  type AgentNativeMcpAppHostMessageType,\n  type McpAppDisplayMode,\n  type McpAppHostChatMessage,\n  type McpAppHostCapabilities,\n  type McpAppHostContext,\n  type McpAppHostContextSnapshot,\n  type McpAppModelContextContentPart,\n  type McpAppModelContextUpdate,\n  type CodeRequiredDialogProps,\n  type AuthSession,\n} from \"./client/index.js\";\n\n// Shared (isomorphic)\nexport { agentChat } from \"./shared/index.js\";\n\n// Pure utilities (no Node.js deps — safe for browser and SSR)\nexport { parseArgs, camelCaseArgs } from \"./scripts/parse-args.js\";\n\n// defineAction — used by template actions, no Node.js deps\nexport {\n  defineAction,\n  AgentActionStopError,\n  isAgentActionStopError,\n  type ActionHttpConfig,\n  type AgentActionStopOptions,\n  MCP_APP_EXTENSION_ID,\n  MCP_APP_MIME_TYPE,\n  MCP_APP_RESOURCE_URI_META_KEY,\n  type ActionMcpAppConfig,\n  type ActionMcpAppCsp,\n  type ActionMcpAppHtmlBuilder,\n  type ActionMcpAppPermissions,\n  type ActionMcpAppResourceConfig,\n  type ActionMcpAppResourceMeta,\n} from \"./action.js\";\nexport {\n  embedApp,\n  MCP_APP_REQUEST_ORIGIN_CSP_SOURCE,\n  type EmbedAppOptions,\n} from \"./mcp/embed-app.js\";\nexport {\n  embedRoute,\n  type EmbedRouteContext,\n  type EmbedRouteOptions,\n  type EmbedRoutePathBuilder,\n  type EmbedRouteResult,\n} from \"./mcp/embed-route.js\";\n"]}

package/dist/mcp/build-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-server.d.ts","sourceRoot":"","sources":["../../src/mcp/build-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAuBhE,MAAM,WAAW,SAAS;IACxB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChD,qEAAqE;IACrE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;kEAGkE;AAClE,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;IAC5C;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAiGD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,MAAM,EAAE,GAAG,EACX,IAAI,EAAE,cAAc,GAAG,SAAS,GAC/B;IACD,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAyBA;AA2QD;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,WAAW,CAAC,EAAE,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2X7B;AAOD,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAc1C;AAyCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7D,OAAO,CAAC;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC,CAmHD;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS7B"}
+{"version":3,"file":"build-server.d.ts","sourceRoot":"","sources":["../../src/mcp/build-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAuBhE,MAAM,WAAW,SAAS;IACxB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrC;;;;;;;;;;;OAWG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAChD,qEAAqE;IACrE,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;kEAGkE;AAClE,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,MAAM,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;IAC5C;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAiHD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,MAAM,EAAE,GAAG,EACX,IAAI,EAAE,cAAc,GAAG,SAAS,GAC/B;IACD,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAyBA;AAmTD;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,iBAAiB,GAAG,SAAS,EACvC,WAAW,CAAC,EAAE,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAgY7B;AAOD,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAc1C;AAyCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,EACrC,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7D,OAAO,CAAC;IACT,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC,CAmHD;AAED,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS7B"}

package/dist/mcp/build-server.js

@@ -82,18 +82,33 @@ async function isKnownMcpAppOAuthClient(identity) {
     try {
         const { getOAuthClient } = await import("./oauth-store.js");
         const client = await getOAuthClient(clientId);
+        // If the token carries an OAuth client id but its registration is missing,
+        // keep the model on the compact MCP Apps surface instead of exposing every
+        // private action/schema.
         if (!client)
-            return false;
+            return true;
         if (isKnownAppClientName(client.clientName))
             return true;
         if (isKnownNonAppClientName(client.clientName))
             return false;
-        return client.redirectUris.some(isKnownMcpAppRedirectUri);
+        if (client.redirectUris.some(isKnownMcpAppRedirectUri))
+            return true;
+        // Most OAuth hosts are UI-oriented MCP clients. Preserve the full catalog
+        // only for known code/CLI clients so unknown browser hosts cannot trigger
+        // massive resources/list payloads.
+        return true;
     }
     catch {
-        return false;
+        // On metadata lookup errors, fail compact instead of falling back to the
+        // full action surface; ChatGPT/Claude old tokens otherwise get huge lists.
+        return true;
     }
 }
+function metadataObject(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
 /**
  * Build the deep-link content block + structured `_meta` for a tool result.
  * Best-effort: any throw / nullish link is swallowed so a bad `link` builder
@@ -157,11 +172,36 @@ function safeUiSegment(value, fallback) {
         .replace(/^-+|-+$/g, "");
     return normalized || fallback;
 }
-function defaultMcpAppUri(config, actionName) {
+// ChatGPT and Claude cache MCP App resource HTML by `ui://` URI. Bump this
+// when the shared shell changes in a way that must invalidate host caches.
+const MCP_APP_RESOURCE_SHELL_VERSION = "shell-v3";
+function legacyDefaultMcpAppUri(config, actionName) {
     const app = safeUiSegment(config.appId ?? config.name, "agent-native");
     const action = safeUiSegment(actionName, "tool");
     return `ui://${app}/${action}`;
 }
+function versionMcpAppResourceUri(rawUri) {
+    const uri = rawUri.trim();
+    if (!uri.startsWith("ui://"))
+        return null;
+    const versionSuffix = `/${MCP_APP_RESOURCE_SHELL_VERSION}`;
+    let versionedUri;
+    try {
+        const parsed = new URL(uri);
+        const path = parsed.pathname.replace(/\/+$/g, "");
+        parsed.pathname = /\/shell-v\d+$/.test(path)
+            ? path.replace(/\/shell-v\d+$/, versionSuffix)
+            : `${path}${versionSuffix}`;
+        versionedUri = parsed.toString();
+    }
+    catch {
+        return null;
+    }
+    return {
+        uri: versionedUri,
+        ...(versionedUri !== uri ? { legacyUris: [uri] } : {}),
+    };
+}
 function expandRequestOriginSources(sources, requestMeta) {
     if (!sources)
         return undefined;
@@ -228,13 +268,15 @@ function resolveMcpAppResource(config, actionName, entry, requestMeta) {
     const resource = entry.mcpApp?.resource;
     if (!resource)
         return null;
-    const uri = resource.uri?.trim() || defaultMcpAppUri(config, actionName);
-    if (!uri.startsWith("ui://"))
+    const baseUri = resource.uri?.trim() || legacyDefaultMcpAppUri(config, actionName);
+    const resolvedUri = versionMcpAppResourceUri(baseUri);
+    if (!resolvedUri)
         return null;
     const description = resource.description ?? entry.tool.description;
     const resourceMeta = mcpAppUiMeta(resource, requestMeta, description);
     return {
-        uri,
+        uri: resolvedUri.uri,
+        ...(resolvedUri.legacyUris ? { legacyUris: resolvedUri.legacyUris } : {}),
         name: resource.name?.trim() || actionName,
         ...(resource.title ? { title: resource.title } : {}),
         ...(description ? { description } : {}),
@@ -261,20 +303,30 @@ function renderMcpAppHtml(resource, actionName, config, requestMeta) {
 }
 function openAiToolDescriptorMeta(resource) {
     const label = resource.title ?? resource.name;
+    const widgetCsp = metadataObject(resource._meta?.["openai/widgetCSP"]);
     return {
         "openai/outputTemplate": resource.uri,
         "openai/toolInvocation/invoking": `Opening ${label}`,
         "openai/toolInvocation/invoked": `${label} ready`,
         "openai/widgetAccessible": true,
+        ...(Object.keys(widgetCsp).length > 0
+            ? { "openai/widgetCSP": widgetCsp }
+            : {}),
     };
 }
 function openAiToolResultMeta(resource) {
     const label = resource.title ?? resource.name;
+    const ui = metadataObject(resource._meta?.ui);
+    const widgetCsp = metadataObject(resource._meta?.["openai/widgetCSP"]);
     return {
         "openai/outputTemplate": resource.uri,
         "openai/toolInvocation/invoking": `Opening ${label}`,
         "openai/toolInvocation/invoked": `${label} ready`,
         "openai/widgetAccessible": true,
+        ...(Object.keys(ui).length > 0 ? { ui } : {}),
+        ...(Object.keys(widgetCsp).length > 0
+            ? { "openai/widgetCSP": widgetCsp }
+            : {}),
     };
 }
 function primitiveValue(value) {
@@ -430,6 +482,7 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
                             ...openAiToolDescriptorMeta(mcpAppResource),
                             [MCP_APP_RESOURCE_URI_META_KEY]: mcpAppResource.uri,
                             ui: {
+                                ...metadataObject(mcpAppResource._meta?.ui),
                                 ...(rawToolMeta.ui &&
                                     typeof rawToolMeta.ui === "object" &&
                                     !Array.isArray(rawToolMeta.ui)
@@ -622,14 +675,15 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
                     actionName: name,
                     resource: resolveMcpAppResource(config, name, entry, requestMeta),
                 }))
-                    .find((candidate) => candidate.resource?.uri === uri);
+                    .find((candidate) => candidate.resource?.uri === uri ||
+                    candidate.resource?.legacyUris?.includes(uri));
                 if (!found?.resource) {
                     throw new Error(`MCP App resource not found: ${uri}`);
                 }
                 return {
                     contents: [
                         {
-                            uri: found.resource.uri,
+                            uri,
                             mimeType: found.resource.mimeType,
                             text: renderMcpAppHtml(found.resource, found.actionName, config, requestMeta),
                             ...(found.resource._meta