@agent-native/dispatch 0.15.29 → 0.16.1

package/dist/server/lib/browser-extension-allowlist.js

@@ -0,0 +1,39 @@
+const CHROME_EXTENSION_ID = /^[a-p]{32}$/;
+const MAX_BROWSER_EXTENSION_IDS = 64;
+export function resolveAllowedBrowserExtensionIds(configIds = [], envValue = process.env.AGENT_NATIVE_BROWSER_EXTENSION_IDS) {
+    const ids = [...configIds, ...(envValue?.split(",") ?? [])]
+        .map((value) => value.trim())
+        .filter(Boolean);
+    const invalid = ids.find((value) => !CHROME_EXTENSION_ID.test(value));
+    if (invalid) {
+        throw new Error("Browser extension allowlist contains an invalid Chrome extension id.");
+    }
+    const uniqueIds = new Set(ids);
+    if (uniqueIds.size > MAX_BROWSER_EXTENSION_IDS) {
+        throw new Error(`Browser extension allowlist cannot exceed ${MAX_BROWSER_EXTENSION_IDS} ids.`);
+    }
+    return uniqueIds;
+}
+function isLoopbackOrigin(value) {
+    if (!value)
+        return false;
+    try {
+        const url = new URL(value);
+        return ((url.protocol === "http:" || url.protocol === "https:") &&
+            (url.hostname === "localhost" ||
+                url.hostname === "127.0.0.1" ||
+                url.hostname === "[::1]"));
+    }
+    catch {
+        return false;
+    }
+}
+export function isBrowserExtensionIdAllowed(options) {
+    if (!CHROME_EXTENSION_ID.test(options.extensionId))
+        return false;
+    const configured = resolveAllowedBrowserExtensionIds(options.configIds, options.envValue);
+    if (configured.has(options.extensionId))
+        return true;
+    return (options.nodeEnv !== "production" && isLoopbackOrigin(options.requestOrigin));
+}
+//# sourceMappingURL=browser-extension-allowlist.js.map

package/dist/server/lib/browser-extension-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-extension-allowlist.js","sourceRoot":"","sources":["../../../src/server/lib/browser-extension-allowlist.ts"],"names":[],"mappings":"AAAA,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAC1C,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,MAAM,UAAU,iCAAiC,CAC/C,SAAS,GAAsB,EAAE,EACjC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kCAAkC;IAEzD,MAAM,GAAG,GAAG,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,SAAS,CAAC,IAAI,GAAG,yBAAyB,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,6CAA6C,yBAAyB,OAAO,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CACL,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;YACvD,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW;gBAC3B,GAAG,CAAC,QAAQ,KAAK,WAAW;gBAC5B,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAM3C;IACC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,UAAU,GAAG,iCAAiC,CAClD,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,QAAQ,CACjB,CAAC;IACF,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,OAAO,CACL,OAAO,CAAC,OAAO,KAAK,YAAY,IAAI,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,CAC5E,CAAC;AACJ,CAAC","sourcesContent":["const CHROME_EXTENSION_ID = /^[a-p]{32}$/;\nconst MAX_BROWSER_EXTENSION_IDS = 64;\n\nexport function resolveAllowedBrowserExtensionIds(\n  configIds: readonly string[] = [],\n  envValue = process.env.AGENT_NATIVE_BROWSER_EXTENSION_IDS,\n): Set<string> {\n  const ids = [...configIds, ...(envValue?.split(\",\") ?? [])]\n    .map((value) => value.trim())\n    .filter(Boolean);\n  const invalid = ids.find((value) => !CHROME_EXTENSION_ID.test(value));\n  if (invalid) {\n    throw new Error(\n      \"Browser extension allowlist contains an invalid Chrome extension id.\",\n    );\n  }\n  const uniqueIds = new Set(ids);\n  if (uniqueIds.size > MAX_BROWSER_EXTENSION_IDS) {\n    throw new Error(\n      `Browser extension allowlist cannot exceed ${MAX_BROWSER_EXTENSION_IDS} ids.`,\n    );\n  }\n  return uniqueIds;\n}\n\nfunction isLoopbackOrigin(value: string | undefined): boolean {\n  if (!value) return false;\n  try {\n    const url = new URL(value);\n    return (\n      (url.protocol === \"http:\" || url.protocol === \"https:\") &&\n      (url.hostname === \"localhost\" ||\n        url.hostname === \"127.0.0.1\" ||\n        url.hostname === \"[::1]\")\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isBrowserExtensionIdAllowed(options: {\n  extensionId: string;\n  configIds?: readonly string[];\n  envValue?: string;\n  nodeEnv?: string;\n  requestOrigin?: string;\n}): boolean {\n  if (!CHROME_EXTENSION_ID.test(options.extensionId)) return false;\n  const configured = resolveAllowedBrowserExtensionIds(\n    options.configIds,\n    options.envValue,\n  );\n  if (configured.has(options.extensionId)) return true;\n\n  return (\n    options.nodeEnv !== \"production\" && isLoopbackOrigin(options.requestOrigin)\n  );\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.15.29",
+  "version": "0.16.1",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -84,7 +84,7 @@
     "tailwind-merge": "^3.5.0",
     "vaul": "^1.1.2",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "0.10.12"
+    "@agent-native/toolkit": "0.11.1"
   },
   "devDependencies": {
     "@react-router/dev": "^8.1.0",
@@ -98,7 +98,7 @@
     "typescript-7": "npm:typescript@^7.0.2",
     "vite": "8.1.0",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.130.0"
+    "@agent-native/core": "0.131.2"
   },
   "peerDependencies": {
     "@agent-native/core": ">=0.8.0",

package/src/actions/create-browser-chat-session.spec.ts

@@ -0,0 +1,122 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const server = vi.hoisted(() => ({
+  buildStartPath: vi.fn(
+    (ticket: string) => `/_agent-native/embed/start?ticket=${ticket}`,
+  ),
+  createTicket: vi.fn(),
+  getContext: vi.fn(),
+  getEmail: vi.fn(),
+}));
+const dispatch = vi.hoisted(() => ({
+  getConfig: vi.fn(),
+}));
+const integrations = vi.hoisted(() => ({
+  createRemoteDevice: vi.fn(),
+}));
+
+vi.mock("@agent-native/core/server", () => ({
+  buildEmbedStartPath: server.buildStartPath,
+  createEmbedSessionTicket: server.createTicket,
+  getRequestContext: server.getContext,
+  getRequestUserEmail: server.getEmail,
+  withConfiguredAppBasePath: (origin: string) => origin,
+}));
+vi.mock("@agent-native/core/integrations", () => ({
+  createRemoteDevice: integrations.createRemoteDevice,
+}));
+vi.mock("../server/index.js", () => ({
+  getDispatchConfig: dispatch.getConfig,
+}));
+
+import action from "./create-browser-chat-session.js";
+
+const nonce = "browser-chat-nonce-1234567890";
+const extensionId = "abcdefghijklmnopabcdefghijklmnop";
+const parentOrigin = `chrome-extension://${extensionId}`;
+
+describe("create-browser-chat-session", () => {
+  beforeEach(() => {
+    server.createTicket.mockReset();
+    server.getContext.mockReturnValue({
+      orgId: "org-example",
+      requestOrigin: "https://dispatch.example.com",
+    });
+    server.getEmail.mockReturnValue("user@example.com");
+    dispatch.getConfig.mockReturnValue({
+      browserExtensionIds: [extensionId],
+    });
+    integrations.createRemoteDevice.mockResolvedValue({
+      device: { id: "remote-device-example" },
+      token: "anr_example",
+    });
+  });
+
+  it("mints a one-time ticket bound to the bridge nonce and parent origin", async () => {
+    server.createTicket.mockResolvedValue({
+      ticket: "ticket-example",
+      ticketHash: "hash-example",
+      expiresAt: 12345,
+    });
+
+    await expect(action.run({ nonce, extensionId })).resolves.toEqual({
+      startPath: "/_agent-native/embed/start?ticket=ticket-example",
+      expiresAt: 12345,
+      parentOrigin,
+      remoteDevice: {
+        id: "remote-device-example",
+        token: "anr_example",
+      },
+      relayBaseUrl: "https://dispatch.example.com",
+    });
+    expect(server.createTicket).toHaveBeenCalledWith({
+      ownerEmail: "user@example.com",
+      orgId: "org-example",
+      targetPath:
+        "/browser-chat?browserChatNonce=browser-chat-nonce-1234567890&browserChatParentOrigin=chrome-extension%3A%2F%2Fabcdefghijklmnopabcdefghijklmnop",
+      scope: "browser-chat",
+      ttlSeconds: 60,
+    });
+    expect(action.agentTool).toBe(false);
+    expect(action.toolCallable).toBe(false);
+    expect(integrations.createRemoteDevice).toHaveBeenCalledWith({
+      ownerEmail: "user@example.com",
+      orgId: "org-example",
+      label: "Agent Native for Chrome",
+      platform: "chrome-extension",
+      metadata: {
+        browserExtension: { extensionId },
+        computerCapabilities: {
+          browser: {
+            observe: true,
+            control: true,
+            provider: "agent-native-chrome-extension",
+          },
+        },
+      },
+    });
+  });
+
+  it("fails closed without an authenticated Dispatch identity", async () => {
+    server.getEmail.mockReturnValue(undefined);
+
+    await expect(action.run({ nonce, extensionId })).rejects.toThrow(
+      "Sign in to Dispatch",
+    );
+    expect(server.createTicket).not.toHaveBeenCalled();
+  });
+
+  it("rejects an extension id that is not configured in production", async () => {
+    const previousNodeEnv = process.env.NODE_ENV;
+    process.env.NODE_ENV = "production";
+    dispatch.getConfig.mockReturnValue({ browserExtensionIds: [] });
+    try {
+      await expect(action.run({ nonce, extensionId })).rejects.toThrow(
+        "not allowed",
+      );
+    } finally {
+      process.env.NODE_ENV = previousNodeEnv;
+    }
+    expect(server.createTicket).not.toHaveBeenCalled();
+  });
+});

package/src/actions/create-browser-chat-session.ts

@@ -0,0 +1,99 @@
+import { defineAction } from "@agent-native/core";
+import { createRemoteDevice } from "@agent-native/core/integrations";
+import {
+  buildEmbedStartPath,
+  createEmbedSessionTicket,
+  getRequestContext,
+  getRequestUserEmail,
+  withConfiguredAppBasePath,
+} from "@agent-native/core/server";
+import { z } from "zod";
+
+import {
+  BROWSER_CHAT_NONCE_QUERY_PARAM,
+  BROWSER_CHAT_PARENT_ORIGIN_QUERY_PARAM,
+  browserChatExtensionIdSchema,
+  browserChatNonceSchema,
+} from "../lib/browser-chat-protocol.js";
+import { isBrowserExtensionIdAllowed } from "../server/lib/browser-extension-allowlist.js";
+
+export default defineAction({
+  description:
+    "Create a one-time authenticated Dispatch browser-chat embed session for an approved Agent-Native Chrome extension.",
+  schema: z
+    .object({
+      nonce: browserChatNonceSchema,
+      extensionId: browserChatExtensionIdSchema,
+    })
+    .strict(),
+  readOnly: false,
+  parallelSafe: true,
+  agentTool: false,
+  toolCallable: false,
+  run: async ({ nonce, extensionId }) => {
+    const ownerEmail = getRequestUserEmail()?.trim();
+    if (!ownerEmail) {
+      throw new Error(
+        "Sign in to Dispatch before connecting the browser extension.",
+      );
+    }
+
+    const requestContext = getRequestContext();
+    const { browserExtensionIds } = await import("../server/index.js").then(
+      (module) => module.getDispatchConfig(),
+    );
+    if (
+      !isBrowserExtensionIdAllowed({
+        extensionId,
+        configIds: browserExtensionIds,
+        nodeEnv: process.env.NODE_ENV,
+        requestOrigin: requestContext?.requestOrigin,
+      })
+    ) {
+      throw new Error(
+        "This browser extension is not allowed to connect to Dispatch.",
+      );
+    }
+
+    const parentOrigin = `chrome-extension://${extensionId}`;
+    const requestOrigin = requestContext?.requestOrigin;
+    if (!requestOrigin) {
+      throw new Error("Dispatch could not resolve its browser relay URL.");
+    }
+    const query = new URLSearchParams({
+      [BROWSER_CHAT_NONCE_QUERY_PARAM]: nonce,
+      [BROWSER_CHAT_PARENT_ORIGIN_QUERY_PARAM]: parentOrigin,
+    });
+    const session = await createEmbedSessionTicket({
+      ownerEmail,
+      orgId: requestContext?.orgId ?? null,
+      targetPath: `/browser-chat?${query}`,
+      scope: "browser-chat",
+      ttlSeconds: 60,
+    });
+    const remote = await createRemoteDevice({
+      ownerEmail,
+      orgId: requestContext?.orgId ?? null,
+      label: "Agent Native for Chrome",
+      platform: "chrome-extension",
+      metadata: {
+        browserExtension: { extensionId },
+        computerCapabilities: {
+          browser: {
+            observe: true,
+            control: true,
+            provider: "agent-native-chrome-extension",
+          },
+        },
+      },
+    });
+
+    return {
+      startPath: buildEmbedStartPath(session.ticket),
+      expiresAt: session.expiresAt,
+      parentOrigin,
+      remoteDevice: { id: remote.device.id, token: remote.token },
+      relayBaseUrl: withConfiguredAppBasePath(requestOrigin),
+    };
+  },
+});

package/src/actions/index.ts

@@ -6,6 +6,7 @@ import approveVaultRequest from "./approve-vault-request.js";
 import archiveWorkspaceApp from "./archive-workspace-app.js";
 import askApp from "./ask_app.js";
 import askAppStatus from "./ask_app_status.js";
+import createBrowserChatSession from "./create-browser-chat-session.js";
 import createDreamReport from "./create-dream-report.js";
 import createLinkToken from "./create-link-token.js";
 import createPylonTicket from "./create-pylon-ticket.js";
@@ -111,6 +112,7 @@ export const dispatchActions: Record<string, ActionEntry> = {
   "create-workspace-resource-grant": createWorkspaceResourceGrant,
   "create-workspace-resource": createWorkspaceResource,
   "create-dream-report": createDreamReport,
+  "create-browser-chat-session": createBrowserChatSession,
   create_embed_session: createEmbedSession,
   "delete-staged-dataset": deleteStagedDataset,
   "delete-destination": deleteDestination,

package/src/actions/view-screen.ts

@@ -68,9 +68,12 @@ export default defineAction({
       approvalPolicy: overview.settings,
     };
     if (navigation) screen.navigation = navigation;
-    if (navigation?.view === "chat") {
+    if (navigation?.view === "chat" || navigation?.view === "browser-chat") {
       screen.chatSurface = {
-        view: "full-page Dispatch chat",
+        view:
+          navigation.view === "browser-chat"
+            ? "embedded browser chat"
+            : "full-page Dispatch chat",
         purpose:
           "Create apps, manage workspace resources, route work to connected agents, and continue Dispatch conversations.",
       };

package/src/components/create-app-popover.spec.tsx

@@ -246,4 +246,57 @@ describe("CreateAppFlow", () => {
     expect(() => findButton(container, "Connect Builder")).toThrow();
     expect(() => findButton(container, "Try again")).toThrow();
   });
+
+  it("replaces the composer with Builder branch progress and success states", async () => {
+    let resolveBuilderRequest: ((response: Response) => void) | undefined;
+    fetchSpy.mockImplementation(async (input: RequestInfo | URL) => {
+      const url = String(input);
+      if (url.includes("get-vault-access-settings")) {
+        return jsonResponse({ mode: "all-apps" });
+      }
+      if (
+        url.includes("list-vault-secret-options") ||
+        url.includes("list-workspace-resource-options")
+      ) {
+        return jsonResponse([]);
+      }
+      if (url.includes("start-workspace-app-creation")) {
+        return new Promise<Response>((resolve) => {
+          resolveBuilderRequest = resolve;
+        });
+      }
+      return jsonResponse({ error: `Unexpected URL: ${url}` }, 404);
+    });
+
+    await renderAndSubmit("Build a quality dashboard");
+
+    await act(async () => {
+      await vi.waitFor(() => {
+        expect(container.textContent).toContain("Creating your Builder branch");
+      });
+    });
+    expect(container.textContent).not.toContain("Dispatch keys");
+
+    await act(async () => {
+      resolveBuilderRequest?.(
+        jsonResponse({
+          mode: "builder",
+          appId: "quality-dashboard",
+          url: "https://branch.example.test",
+        }),
+      );
+    });
+
+    await act(async () => {
+      await vi.waitFor(() => {
+        expect(container.textContent).toContain("Your Builder branch is ready");
+      });
+    });
+    const branchLink = Array.from(container.querySelectorAll("a")).find(
+      (candidate) => candidate.textContent?.includes("Open Builder branch"),
+    );
+    expect(branchLink?.getAttribute("href")).toBe(
+      "https://branch.example.test",
+    );
+  });
 });

package/src/components/create-app-popover.tsx

@@ -362,6 +362,55 @@ export function CreateAppFlow({
   }
 
   const submitWithSelectedAccess = () => submit(prompt);
+  const isCreatingBuilderBranch =
+    isSubmitting && !isInBuilderFrame() && !isDevMode;
+
+  if (branchUrl) {
+    return (
+      <div
+        className={`flex min-h-[260px] flex-col items-center justify-center gap-5 px-6 py-8 text-center ${className}`}
+      >
+        <span className="flex size-11 items-center justify-center rounded-full bg-primary/10 text-primary">
+          <IconCheck className="size-5" aria-hidden="true" />
+        </span>
+        <div className="space-y-2">
+          <h2 className="text-base font-semibold text-foreground">
+            Your Builder branch is ready
+          </h2>
+          <p className="text-sm leading-6 text-muted-foreground">
+            Continue building and editing your app in Builder.
+          </p>
+        </div>
+        <Button asChild className="w-full sm:w-auto">
+          <a href={branchUrl} target="_blank" rel="noreferrer">
+            Open Builder branch <IconArrowUpRight aria-hidden="true" />
+          </a>
+        </Button>
+      </div>
+    );
+  }
+
+  if (isCreatingBuilderBranch) {
+    return (
+      <div
+        className={`flex min-h-[260px] flex-col items-center justify-center gap-4 px-6 py-8 text-center ${className}`}
+        aria-live="polite"
+      >
+        <IconLoader2
+          className="size-7 animate-spin text-muted-foreground"
+          aria-hidden="true"
+        />
+        <div className="space-y-2">
+          <h2 className="text-base font-semibold text-foreground">
+            Creating your Builder branch
+          </h2>
+          <p className="text-sm leading-6 text-muted-foreground">
+            This usually takes a few seconds.
+          </p>
+        </div>
+      </div>
+    );
+  }
 
   return (
     <div className={`flex flex-col gap-3 ${className}`}>

package/src/components/layout/Layout.spec.tsx

@@ -43,7 +43,6 @@ vi.mock("@agent-native/core/client/hooks", () => ({
 }));
 
 vi.mock("@agent-native/core/client/i18n", () => ({
-  LanguagePicker: () => <div>Language</div>,
   useT: () => (key: string, values?: Record<string, unknown>) => {
     const messages: Record<string, string> = {
       "dispatch.nav.chat": "Chat",

package/src/components/layout/Layout.tsx

@@ -8,7 +8,7 @@ import {
   type ChatThreadSummary,
 } from "@agent-native/core/client/agent-chat";
 import { appBasePath, appPath } from "@agent-native/core/client/api-path";
-import { LanguagePicker, useT } from "@agent-native/core/client/i18n";
+import { useT } from "@agent-native/core/client/i18n";
 import { openCommandMenu } from "@agent-native/core/client/navigation";
 import { InvitationBanner, OrgSwitcher } from "@agent-native/core/client/org";
 import { FeedbackButton } from "@agent-native/core/client/ui";
@@ -229,7 +229,7 @@ const ADVANCED_NAV_ITEMS = [
 
 const EMPTY_NAV_ITEMS: readonly DispatchNavItem[] = [];
 
-const CHROMELESS_PATHS = ["/approval"];
+const CHROMELESS_PATHS = ["/approval", "/browser-chat", "/browser-connect"];
 const SIDEBAR_COLLAPSE_KEY = "dispatch.sidebar.collapsed";
 
 // Routes whose page renders its own toolbar.
@@ -534,9 +534,6 @@ export function NavContent({
       <TooltipContent side="right">{t("sidebar.search")}</TooltipContent>
     </Tooltip>
   );
-  const translateButton = (
-    <LanguagePicker variant="ghost-icon" label={t("settings.languageLabel")} />
-  );
   const feedbackButton = (
     <FeedbackButton
       variant={collapsed ? "icon" : "sidebar"}
@@ -743,7 +740,6 @@ export function NavContent({
         <SidebarFooterActions
           collapsed={collapsed}
           feedback={feedbackButton}
-          translate={translateButton}
           search={searchButton}
           collapse={collapseButton}
         />

package/src/config.ts

@@ -25,6 +25,11 @@ export interface DispatchIntegrationsConfig {
 
 export interface DispatchConfig {
   auth?: DispatchAuthConfig;
+  /**
+   * Exact Chrome Web Store or managed-install extension ids allowed to pair
+   * with Dispatch browser chat. Wildcards are not supported.
+   */
+  browserExtensionIds?: readonly string[];
   /**
    * App IDs to hide from `list-connected-agents` results. Used to filter
    * out first-party Builder apps (calls, issues, macros, …) from the

package/src/hooks/use-navigation-state.spec.ts

@@ -10,6 +10,13 @@ describe("buildDispatchNavigationState", () => {
     });
   });
 
+  it("recognizes the embedded browser chat route", () => {
+    expect(buildDispatchNavigationState("/browser-chat")).toEqual({
+      view: "browser-chat",
+      path: "/browser-chat",
+    });
+  });
+
   it("exposes the current extension id from extension routes", () => {
     expect(
       buildDispatchNavigationState("/extensions/ext-1/github-stars-over-time"),

package/src/hooks/use-navigation-state.ts

@@ -208,6 +208,7 @@ function resolveView(
   if (pathname === "/extensions" || pathname.startsWith("/extensions/")) {
     return "extensions";
   }
+  if (pathname.startsWith("/browser-chat")) return "browser-chat";
   if (pathname.startsWith("/chat")) return "chat";
   if (pathname.startsWith("/apps")) return "apps";
   if (pathname.startsWith("/metrics")) return "metrics";

package/src/lib/automations.spec.ts

@@ -0,0 +1,64 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { listDispatchAutomations } from "./automations.js";
+
+describe("listDispatchAutomations", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it("returns the automation list", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        new Response(
+          JSON.stringify([
+            {
+              id: "automation-1",
+              name: "daily-digest",
+              path: "jobs/daily-digest.md",
+              owner: "alice@example.com",
+            },
+          ]),
+          { status: 200, headers: { "content-type": "application/json" } },
+        ),
+      ),
+    );
+
+    await expect(listDispatchAutomations()).resolves.toEqual([
+      expect.objectContaining({ name: "daily-digest" }),
+    ]);
+  });
+
+  it("surfaces request failures instead of presenting an empty list", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        new Response(JSON.stringify({ error: "Database unavailable" }), {
+          status: 503,
+          headers: { "content-type": "application/json" },
+        }),
+      ),
+    );
+
+    await expect(listDispatchAutomations()).rejects.toThrow(
+      "Database unavailable",
+    );
+  });
+
+  it("rejects malformed successful responses", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(
+        new Response(JSON.stringify({ automations: [] }), {
+          status: 200,
+          headers: { "content-type": "application/json" },
+        }),
+      ),
+    );
+
+    await expect(listDispatchAutomations()).rejects.toThrow(
+      "Automation list returned an invalid response",
+    );
+  });
+});

package/src/lib/automations.ts

@@ -43,9 +43,11 @@ export async function listDispatchAutomations(): Promise<
   DispatchAutomationItem[]
 > {
   const response = await fetch(agentNativePath("/_agent-native/automations"));
-  if (!response.ok) return [];
-  const rows = await response.json().catch(() => []);
-  return Array.isArray(rows) ? rows : [];
+  const rows = await readAutomationResponse<unknown>(response);
+  if (!Array.isArray(rows)) {
+    throw new Error("Automation list returned an invalid response");
+  }
+  return rows as DispatchAutomationItem[];
 }
 
 export async function setDispatchAutomationEnabled(