@agent-native/dispatch 0.26.0 → 0.27.1

package/src/lib/workspace-apps.spec.ts

@@ -4,6 +4,7 @@ import {
   isDefaultWorkspaceAppHiddenId,
   isDispatchWorkspaceAppId,
   isWorkspaceAppVisibleInDefaultLaunchers,
+  mergeChatFirstWorkspaceApps,
   workspaceAppIdFromRoute,
   workspaceAppRoute,
 } from "./workspace-apps";
@@ -41,4 +42,54 @@ describe("workspace app routes", () => {
     ).toBe(false);
     expect(isWorkspaceAppVisibleInDefaultLaunchers({ id: "mail" })).toBe(true);
   });
+
+  it("maps default first-party apps to their canonical hosted origins", () => {
+    const apps = mergeChatFirstWorkspaceApps(undefined);
+    expect(apps).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          id: "content",
+          path: "/",
+          url: "https://content.agent-native.com",
+        }),
+        expect.objectContaining({
+          id: "design",
+          path: "/",
+          url: "https://design.agent-native.com",
+        }),
+        expect.objectContaining({
+          id: "mail",
+          path: "/",
+          url: "https://mail.agent-native.com",
+        }),
+        expect.objectContaining({
+          id: "calendar",
+          path: "/",
+          url: "https://calendar.agent-native.com",
+        }),
+        expect.objectContaining({
+          id: "clips",
+          path: "/",
+          url: "https://clips.agent-native.com",
+        }),
+      ]),
+    );
+  });
+
+  it("lets a mounted workspace app override a default row", () => {
+    const apps = mergeChatFirstWorkspaceApps([
+      {
+        id: "mail",
+        name: "Internal Mail",
+        path: "/internal-mail",
+        url: null,
+        status: "ready",
+      },
+    ]);
+    expect(apps.find((app) => app.id === "mail")).toMatchObject({
+      name: "Internal Mail",
+      path: "/internal-mail",
+      url: null,
+    });
+  });
 });

package/src/lib/workspace-apps.ts

@@ -1,6 +1,8 @@
 import { CHAT_FIRST_DEFAULT_APP_IDS } from "@agent-native/core/client/chat-first";
 import { withBuilderUtmTrackingParams } from "@agent-native/core/shared/builder-link-tracking";
 
+import { CANONICAL_WORKSPACE_SSO_APP_ORIGINS } from "../shared/workspace-sso";
+
 export interface WorkspaceAppSummary {
   id: string;
   name: string;
@@ -169,8 +171,11 @@ export function mergeChatFirstWorkspaceApps(
     merged.set(id, {
       id,
       name: id.charAt(0).toUpperCase() + id.slice(1),
-      path: `/${id}`,
-      url: null,
+      // The five default rows are hosted sibling apps, not routes owned by
+      // Dispatch. Keep a mounted path for legacy callers, but give embed
+      // session resolution the exact canonical origin.
+      path: "/",
+      url: CANONICAL_WORKSPACE_SSO_APP_ORIGINS[id],
       status: "ready",
     });
   }

package/src/server/lib/vault-store.spec.ts

@@ -102,9 +102,11 @@ describe("vault authorization", () => {
       execute: vi.fn().mockResolvedValue({ rows: [{ role: "member" }] }),
     });
 
-    await expect(assertCanManageVault()).rejects.toThrow(
-      "Only organization owners and admins can manage the workspace vault.",
-    );
+    await expect(assertCanManageVault()).rejects.toMatchObject({
+      message:
+        "Only organization owners and admins can manage the workspace vault.",
+      statusCode: 403,
+    });
   });
 
   it("rejects organization members before listing or reading grants", async () => {

package/src/server/lib/vault-store.ts

@@ -173,8 +173,11 @@ export async function assertCanManageVault(): Promise<void> {
   }
 
   if (role !== "owner" && role !== "admin") {
-    throw new Error(
-      "Only organization owners and admins can manage the workspace vault.",
+    throw Object.assign(
+      new Error(
+        "Only organization owners and admins can manage the workspace vault.",
+      ),
+      { statusCode: 403 },
     );
   }
 }