@agent-native/dispatch 0.29.3 → 0.29.4

package/src/components/layout/Layout.tsx

@@ -106,9 +106,13 @@ import { toast } from "sonner";
 import { cn } from "../../lib/utils";
 import {
   isDispatchWorkspaceAppId,
+  isPathMountedWorkspaceApp,
   isWorkspaceAppVisibleInDefaultLaunchers,
+  isWorkspaceSsoApp,
   mergeChatFirstWorkspaceApps,
+  navigateToWorkspaceApp,
   workspaceAppIdFromRoute,
+  workspaceAppDirectHref,
   workspaceAppRoute,
   type WorkspaceAppSummary,
 } from "../../lib/workspace-apps";
@@ -1450,6 +1454,26 @@ export function Layout({
         })),
     [chatFirstAppRegistrations],
   );
+  const openChatFirstApp = useCallback(
+    (app: ChatFirstAppItem) => {
+      if (isDispatchWorkspaceAppId(app.id)) return;
+      const registration = chatFirstAppRegistrations.find(
+        (candidate) => candidate.id.toLowerCase() === app.id.toLowerCase(),
+      );
+      const directHref =
+        registration &&
+        !isWorkspaceSsoApp(registration) &&
+        isPathMountedWorkspaceApp(registration)
+          ? workspaceAppDirectHref(registration, "/")
+          : null;
+      if (directHref) {
+        navigateToWorkspaceApp(directHref);
+        return;
+      }
+      navigate(dispatchNavLinkTarget(workspaceAppRoute(app.id)));
+    },
+    [chatFirstAppRegistrations, navigate],
+  );
   const chatFirstCopy = useMemo(() => createDispatchChatFirstCopy(t), [t]);
   const [chatFirstPane, setChatFirstPane] =
     useState<DispatchChatFirstPane | null>(null);
@@ -2448,7 +2472,7 @@ export function Layout({
               onChatFirstAppOpen={(app) => {
                 if (isDispatchWorkspaceAppId(app.id)) return;
                 setSidebarCollapsed(true);
-                navigate(dispatchNavLinkTarget(workspaceAppRoute(app.id)));
+                openChatFirstApp(app);
               }}
               onChatFirstAppsRetry={() => void chatFirstAppsQuery.refetch()}
               collapsible
@@ -2489,9 +2513,7 @@ export function Layout({
                     chatFirstSurfaceTabsStore.closeAll();
                     setChatFirstSurfacePanelOpen(false);
                   }}
-                  onChatFirstAppOpen={(app) =>
-                    navigate(dispatchNavLinkTarget(workspaceAppRoute(app.id)))
-                  }
+                  onChatFirstAppOpen={openChatFirstApp}
                   onChatFirstAppsRetry={() => void chatFirstAppsQuery.refetch()}
                   onNavigate={() => setMobileOpen(false)}
                 />

package/src/components/workspace-app-card.spec.tsx

@@ -53,6 +53,7 @@ describe("WorkspaceAppCard", () => {
                 id: "analytics",
                 name: "Analytics",
                 path: "/analytics",
+                url: "https://analytics.agent-native.com",
                 description: "Explore product and growth performance.",
                 status: "ready",
               }}
@@ -116,6 +117,65 @@ describe("WorkspaceAppCard", () => {
     ).toBeNull();
   });
 
+  it("opens mounted workspace apps at their published URL", async () => {
+    const originalParent = window.parent;
+    const originalTop = window.top;
+    const topWindow = { location: { href: "" } } as unknown as Window;
+    Object.defineProperty(window, "parent", {
+      configurable: true,
+      value: {},
+    });
+    Object.defineProperty(window, "top", {
+      configurable: true,
+      value: topWindow,
+    });
+
+    try {
+      await act(async () => {
+        root.render(
+          <MemoryRouter>
+            <TooltipProvider>
+              <WorkspaceAppCard
+                app={{
+                  id: "feedback-leaderboard",
+                  name: "Feedback leaderboard",
+                  path: "/feedback-leaderboard",
+                  url: "https://agent-workspace.builder.io/feedback-leaderboard/leaderboard",
+                  status: "ready",
+                }}
+              />
+            </TooltipProvider>
+          </MemoryRouter>,
+        );
+      });
+
+      const openButton = container.querySelector<HTMLButtonElement>(
+        ".app-open-actions__primary",
+      );
+      expect(openButton).not.toBeNull();
+      expect(openButton?.textContent).toContain("Open app");
+      expect(
+        container.querySelector(
+          'a[href="https://agent-workspace.builder.io/feedback-leaderboard/leaderboard"]',
+        ),
+      ).toBeNull();
+
+      await act(async () => openButton?.click());
+      expect(topWindow.location.href).toBe(
+        "https://agent-workspace.builder.io/feedback-leaderboard/leaderboard",
+      );
+    } finally {
+      Object.defineProperty(window, "parent", {
+        configurable: true,
+        value: originalParent,
+      });
+      Object.defineProperty(window, "top", {
+        configurable: true,
+        value: originalTop,
+      });
+    }
+  });
+
   it("keeps pinning in the app open menu", async () => {
     const onTogglePinned = vi.fn();
     await act(async () => {

package/src/components/workspace-app-card.tsx

@@ -26,6 +26,10 @@ import { toast } from "sonner";
 
 import { cn } from "../lib/utils";
 import {
+  isPathMountedWorkspaceApp,
+  isWorkspaceSsoApp,
+  navigateToWorkspaceApp,
+  workspaceAppDirectHref,
   workspaceAppHref,
   workspaceAppRoute,
   type WorkspaceAppSummary,
@@ -75,6 +79,12 @@ export function WorkspaceAppCard({
 }) {
   const t = useT();
   const href = workspaceAppHref(app);
+  const directHref =
+    app.status !== "pending" &&
+    !isWorkspaceSsoApp(app) &&
+    isPathMountedWorkspaceApp(app)
+      ? workspaceAppDirectHref(app, "/")
+      : null;
   const isPending = app.status === "pending";
   const pendingLabel = app.statusLabel || "Builder branch";
   const pendingOpenLabel = t("dispatch.pages.openBuilderBranch", {
@@ -193,7 +203,8 @@ export function WorkspaceAppCard({
         <div className="flex shrink-0 items-center gap-2">
           <WorkspaceAppOpenActions
             app={app}
-            href={href}
+            href={directHref ?? href}
+            openDirectly={Boolean(directHref)}
             isPinned={isPinned}
             pinLabel={pinLabel}
             pendingOpenLabel={pendingOpenLabel}
@@ -285,6 +296,7 @@ export function WorkspaceAppCard({
 function WorkspaceAppOpenActions({
   app,
   href,
+  openDirectly,
   isPinned,
   pinLabel,
   pendingOpenLabel,
@@ -292,6 +304,7 @@ function WorkspaceAppOpenActions({
 }: {
   app: WorkspaceAppSummary;
   href: string | null;
+  openDirectly: boolean;
   isPinned: boolean;
   pinLabel: string;
   pendingOpenLabel: string;
@@ -328,9 +341,9 @@ function WorkspaceAppOpenActions({
       name={app.name}
       href={href}
       showNewTabOption
-      onOpen={() => {
-        navigate(appRoute);
-      }}
+      onOpen={() =>
+        openDirectly ? navigateToWorkspaceApp(href) : navigate(appRoute)
+      }
       menuItems={
         onTogglePinned
           ? [

package/src/components/workspace-app-host.spec.tsx

@@ -309,7 +309,14 @@ describe("WorkspaceAppKeepAlive", () => {
 
     await act(async () => {
       root.render(
-        <WorkspaceAppFrame app={{ id: "mail", name: "Mail", path: "/mail" }} />,
+        <WorkspaceAppFrame
+          app={{
+            id: "mail",
+            name: "Mail",
+            path: "/mail",
+            url: "https://mail.agent-native.com",
+          }}
+        />,
       );
       await Promise.resolve();
       await Promise.resolve();
@@ -317,12 +324,99 @@ describe("WorkspaceAppKeepAlive", () => {
 
     expect(clientState.workspaceSsoMutateAsync).toHaveBeenCalledWith({
       app: "mail",
-      path: "/mail",
+      url: "https://mail.agent-native.com",
       chrome: "minimal",
     });
     expect(clientState.legacyMutateAsync).not.toHaveBeenCalled();
   });
 
+  it("uses the granted-app session when a mounted app reuses a canonical id", async () => {
+    clientState.workspaceSsoEnabled = true;
+
+    await act(async () => {
+      root.render(
+        <WorkspaceAppFrame
+          app={{
+            id: "mail",
+            name: "Internal Mail",
+            path: "/mail",
+            url: "https://agent-workspace.builder.io/mail",
+          }}
+        />,
+      );
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect(clientState.legacyMutateAsync).toHaveBeenCalledWith({
+      app: "mail",
+      url: "https://agent-workspace.builder.io/mail",
+      chrome: "minimal",
+    });
+    expect(clientState.workspaceSsoMutateAsync).not.toHaveBeenCalled();
+  });
+
+  it("uses the granted-app session action for mounted apps outside the SSO registry", async () => {
+    clientState.workspaceSsoEnabled = true;
+
+    await act(async () => {
+      root.render(
+        <WorkspaceAppFrame
+          app={{
+            id: "feedback-leaderboard",
+            name: "Feedback leaderboard",
+            path: "/feedback-leaderboard",
+            url: "https://agent-workspace.builder.io/feedback-leaderboard/leaderboard",
+          }}
+        />,
+      );
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect(clientState.legacyMutateAsync).toHaveBeenCalledWith({
+      app: "feedback-leaderboard",
+      url: "https://agent-workspace.builder.io/feedback-leaderboard/leaderboard",
+      chrome: "minimal",
+    });
+    expect(clientState.workspaceSsoMutateAsync).not.toHaveBeenCalled();
+  });
+
+  it("mints custom SSO before navigating an embedded Dispatch surface", async () => {
+    clientState.workspaceSsoEnabled = true;
+    const navigateToTopWindow = vi.fn(() => true);
+    Object.defineProperty(window, "parent", {
+      configurable: true,
+      value: {},
+    });
+
+    await act(async () => {
+      root.render(
+        <WorkspaceAppFrame
+          app={{
+            id: "custom-sso",
+            name: "Custom SSO",
+            path: "/custom-sso",
+            url: "https://custom.example/custom-sso",
+            workspaceSso: true,
+          }}
+          navigateToTopWindow={navigateToTopWindow}
+        />,
+      );
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+
+    expect(clientState.workspaceSsoMutateAsync).toHaveBeenCalledWith({
+      app: "custom-sso",
+      url: "https://custom.example/custom-sso",
+      chrome: "minimal",
+    });
+    expect(navigateToTopWindow).toHaveBeenCalledWith("about:blank");
+    expect(clientState.legacyMutateAsync).not.toHaveBeenCalled();
+    expect(container.querySelector("iframe")).toBeNull();
+  });
+
   it("sends the parent theme on iframe load and when the parent changes", async () => {
     await act(async () => {
       root.render(
@@ -420,7 +514,14 @@ describe("WorkspaceAppKeepAlive", () => {
 
     await act(async () => {
       root.render(
-        <WorkspaceAppFrame app={{ id: "mail", name: "Mail", path: "/mail" }} />,
+        <WorkspaceAppFrame
+          app={{
+            id: "mail",
+            name: "Mail",
+            path: "/mail",
+            url: "https://mail.agent-native.com",
+          }}
+        />,
       );
       await Promise.resolve();
       await Promise.resolve();

package/src/components/workspace-app-host.tsx

@@ -31,6 +31,7 @@ import { Link } from "react-router";
 import { isEmbedSessionExpiredMessage } from "../lib/embed-session-recovery";
 import {
   mergeChatFirstWorkspaceApps,
+  isWorkspaceSsoApp,
   navigateToWorkspaceApp,
   shouldOpenWorkspaceAppInTopWindow,
   workspaceAppDirectHref,
@@ -287,6 +288,7 @@ export function WorkspaceAppFrame({
     if (isDirectFallback) setEmbedError(null);
   }, [isDirectFallback, postThemeToFrame]);
   const workspaceSsoEnabled = useFeatureFlag(DISPATCH_WORKSPACE_SSO_FLAG.key);
+  const useWorkspaceSso = workspaceSsoEnabled && isWorkspaceSsoApp(app);
   const createEmbedSession = useActionMutation<
     EmbedSessionResult,
     EmbedSessionInput
@@ -320,6 +322,8 @@ export function WorkspaceAppFrame({
     return target.url ?? target.path ?? null;
   }, [app.path, app.url, embedPath]);
   const openInTopWindow = shouldOpenWorkspaceAppInTopWindow();
+  const topWindowSsoAttemptKey = `${app.id}\u0000${app.path ?? ""}\u0000${app.url ?? ""}\u0000${embedPath ?? ""}\u0000${embedAttempt}`;
+  const topWindowSsoAttemptedRef = useRef<string | null>(null);
   const embedInput = useMemo<EmbedSessionInput | null>(() => {
     if (embedPath !== undefined) {
       return buildChatFirstEmbedSessionInput(app.id, embedPath);
@@ -333,6 +337,10 @@ export function WorkspaceAppFrame({
   }, [app.id, app.path, app.url, appHref, embedPath]);
 
   useEffect(() => {
+    if (openInTopWindow && useWorkspaceSso && embedInput) {
+      setTopWindowNavigationFailed(false);
+      return;
+    }
     if (!openInTopWindow) {
       setTopWindowNavigationFailed(false);
       return;
@@ -349,26 +357,59 @@ export function WorkspaceAppFrame({
       didNavigate = false;
     }
     setTopWindowNavigationFailed(!didNavigate);
-  }, [navigateToTopWindow, openInTopWindow, topWindowHref]);
+  }, [
+    embedInput,
+    navigateToTopWindow,
+    openInTopWindow,
+    topWindowHref,
+    useWorkspaceSso,
+  ]);
 
   useEffect(() => {
-    if (!embedInput || (openInTopWindow && !topWindowNavigationFailed)) return;
+    const useTopWindowSso = openInTopWindow && useWorkspaceSso && !!embedInput;
+    if (
+      !embedInput ||
+      (openInTopWindow && !useWorkspaceSso && !topWindowNavigationFailed)
+    ) {
+      return;
+    }
+    if (
+      useTopWindowSso &&
+      topWindowSsoAttemptedRef.current === topWindowSsoAttemptKey
+    ) {
+      return;
+    }
+    if (useTopWindowSso) {
+      topWindowSsoAttemptedRef.current = topWindowSsoAttemptKey;
+    }
     let cancelled = false;
     setEmbedUrl(null);
     setEmbedError(null);
     setIsDirectFallback(false);
-    const createSession = workspaceSsoEnabled
+    const createSession = useWorkspaceSso
       ? createWorkspaceSsoEmbedSession
       : createEmbedSession;
     void createSession
       .mutateAsync(embedInput)
       .then((result) => {
-        if (!cancelled) setEmbedUrl(result.startUrl);
+        if (cancelled) return;
+        if (useTopWindowSso) {
+          let didNavigate = false;
+          try {
+            didNavigate = navigateToTopWindow(result.startUrl) !== false;
+          } catch {
+            didNavigate = false;
+          }
+          setTopWindowNavigationFailed(!didNavigate);
+          setEmbedUrl(didNavigate ? null : result.startUrl);
+          return;
+        }
+        setEmbedUrl(result.startUrl);
       })
       .catch((cause: unknown) => {
         if (cancelled) return;
         const error = cause instanceof Error ? cause : new Error(String(cause));
-        if (workspaceSsoEnabled) {
+        if (useWorkspaceSso) {
           // An SSO-enabled pane must never fall back to the child app's
           // unauthenticated shell. Keep the parent-owned retry surface in
           // place so a transient exchange failure cannot expose another
@@ -376,6 +417,7 @@ export function WorkspaceAppFrame({
           setIsDirectFallback(false);
           setEmbedUrl(null);
           setEmbedError(error);
+          if (useTopWindowSso) setTopWindowNavigationFailed(true);
           return;
         }
         setIsDirectFallback(true);
@@ -400,8 +442,10 @@ export function WorkspaceAppFrame({
     embedPath,
     embedAttempt,
     openInTopWindow,
+    navigateToTopWindow,
+    topWindowSsoAttemptKey,
     topWindowNavigationFailed,
-    workspaceSsoEnabled,
+    useWorkspaceSso,
   ]);
 
   useEffect(() => {

package/src/lib/workspace-apps.spec.ts

@@ -3,9 +3,12 @@ import { describe, expect, it } from "vitest";
 import {
   isDefaultWorkspaceAppHiddenId,
   isDispatchWorkspaceAppId,
+  isPathMountedWorkspaceApp,
   isWorkspaceAppVisibleInDefaultLaunchers,
+  isWorkspaceSsoApp,
   mergeChatFirstWorkspaceApps,
   workspaceAppIdFromRoute,
+  workspaceAppDirectHref,
   workspaceAppRoute,
 } from "./workspace-apps";
 
@@ -31,6 +34,83 @@ describe("workspace app routes", () => {
     expect(isDispatchWorkspaceAppId("dispatch-tools")).toBe(false);
   });
 
+  it("requires canonical metadata before enabling workspace SSO", () => {
+    expect(
+      isWorkspaceSsoApp({
+        id: " Mail ",
+        path: "/",
+        url: "https://mail.agent-native.com",
+      }),
+    ).toBe(true);
+    expect(
+      isWorkspaceSsoApp({
+        id: "mail",
+        path: "/mail",
+        url: "https://agent-workspace.builder.io/mail",
+      }),
+    ).toBe(false);
+    expect(
+      isWorkspaceSsoApp({
+        id: "feedback-leaderboard",
+        path: "/feedback-leaderboard",
+        url: "https://agent-workspace.builder.io/feedback-leaderboard",
+      }),
+    ).toBe(false);
+  });
+
+  it("accepts the server eligibility projection for registered custom apps", () => {
+    expect(
+      isWorkspaceSsoApp({
+        id: "workspace-reports",
+        path: "/workspace-reports",
+        url: "https://reports.example.com/workspace-reports",
+        workspaceSso: true,
+      }),
+    ).toBe(true);
+    expect(
+      isWorkspaceSsoApp({
+        id: "workspace-reports",
+        path: "/workspace-reports",
+        url: "javascript:alert(1)",
+        workspaceSso: true,
+      }),
+    ).toBe(false);
+  });
+
+  it("keeps canonical loopback apps eligible outside production", () => {
+    expect(
+      isWorkspaceSsoApp({
+        id: "mail",
+        path: "/mail",
+        url: "http://localhost:8084",
+      }),
+    ).toBe(true);
+  });
+
+  it("identifies mounted apps and resolves their direct workspace href", () => {
+    const app = {
+      path: "/feedback-leaderboard",
+      url: "https://agent-workspace.builder.io/feedback-leaderboard/leaderboard",
+    };
+
+    expect(isPathMountedWorkspaceApp(app)).toBe(true);
+    expect(workspaceAppDirectHref(app, "/")).toBe(
+      "https://agent-workspace.builder.io/feedback-leaderboard/leaderboard",
+    );
+    expect(
+      isPathMountedWorkspaceApp({
+        path: "/",
+        url: "https://mail.agent-native.com",
+      }),
+    ).toBe(false);
+    expect(
+      isPathMountedWorkspaceApp({
+        path: "/",
+        url: "https://feedback.example.com",
+      }),
+    ).toBe(true);
+  });
+
   it("hides the generic chat starter and Dispatch from default launchers", () => {
     expect(isDefaultWorkspaceAppHiddenId(" Chat ")).toBe(true);
     expect(isWorkspaceAppVisibleInDefaultLaunchers({ id: "chat" })).toBe(false);

package/src/lib/workspace-apps.ts

@@ -2,7 +2,10 @@ import { CHAT_FIRST_DEFAULT_APP_IDS } from "@agent-native/core/client/chat-first
 import { isInBuilderFrame } from "@agent-native/core/client/host";
 import { withBuilderUtmTrackingParams } from "@agent-native/core/shared/builder-link-tracking";
 
-import { CANONICAL_WORKSPACE_SSO_APP_ORIGINS } from "../shared/workspace-sso";
+import {
+  CANONICAL_WORKSPACE_SSO_APP_ORIGINS,
+  isWorkspaceSsoAppUrl,
+} from "../shared/workspace-sso";
 
 export interface WorkspaceAppSummary {
   id: string;
@@ -28,17 +31,108 @@ export interface WorkspaceAppSummary {
   agentName?: string | null;
   agentSkillsCount?: number | null;
   archived?: boolean;
+  workspaceSso?: boolean;
 }
 
 interface WorkspaceAppHrefSource {
   path?: string | null;
   url?: string | null;
+  workspaceSso?: boolean;
 }
 
 export function isDispatchWorkspaceAppId(appId: string): boolean {
   return appId.trim().toLowerCase() === "dispatch";
 }
 
+function clientRuntimeEnvironment(): "production" | "development" {
+  const importMetaEnv = (
+    import.meta as unknown as {
+      env?: Record<string, string | boolean | undefined>;
+    }
+  ).env;
+  const processEnv = (
+    globalThis as typeof globalThis & {
+      process?: { env?: Record<string, string | boolean | undefined> };
+    }
+  ).process?.env;
+  const env = { ...processEnv, ...importMetaEnv };
+  if (
+    env.PROD === true ||
+    env.MODE === "production" ||
+    env.NODE_ENV === "production"
+  ) {
+    return "production";
+  }
+  if (
+    env.DEV === true ||
+    env.MODE === "development" ||
+    env.MODE === "test" ||
+    env.NODE_ENV === "development" ||
+    env.NODE_ENV === "test"
+  ) {
+    return "development";
+  }
+  return "production";
+}
+
+/**
+ * The workspace SSO action only accepts an exact registered app identity and
+ * origin. The catalog's boolean is a server-derived projection for custom
+ * registrations; the URL check keeps malformed metadata out of the action.
+ */
+export function isWorkspaceSsoApp(
+  app: WorkspaceAppHrefSource & { id: string },
+): boolean {
+  const rawUrl = app.url?.trim();
+  if (!rawUrl) return false;
+  try {
+    const url = new URL(rawUrl);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return false;
+    if (app.workspaceSso === true) return true;
+    return isWorkspaceSsoAppUrl(
+      { id: app.id, url: rawUrl },
+      { nodeEnv: clientRuntimeEnvironment() },
+    );
+    // coercion-ok: malformed app metadata is not eligible for workspace SSO.
+  } catch {
+    return false;
+  }
+}
+
+function isCanonicalWorkspaceSsoOrigin(rawUrl: string): boolean {
+  try {
+    const origin = new URL(rawUrl).origin;
+    return Object.values(CANONICAL_WORKSPACE_SSO_APP_ORIGINS).some(
+      (canonicalOrigin) => canonicalOrigin === origin,
+    );
+  } catch {
+    // coercion-ok: malformed app metadata is not a canonical first-party app.
+    return false;
+  }
+}
+
+/**
+ * A mounted app URL leaves Dispatch's `/apps/:id` host route. Canonical
+ * first-party origins can stay inline even at `/`, while external published
+ * apps must open at their own origin regardless of their path.
+ */
+export function isPathMountedWorkspaceApp(
+  app: WorkspaceAppHrefSource,
+): boolean {
+  const rawUrl = app.url?.trim();
+  if (rawUrl) {
+    try {
+      const pathname = new URL(rawUrl).pathname.replace(/\/+$/, "") || "/";
+      return pathname !== "/" || !isCanonicalWorkspaceSsoOrigin(rawUrl);
+      // coercion-ok: invalid absolute URLs use the mounted path fallback.
+    } catch {
+      // Fall through to the mounted path for relative manifest values.
+    }
+  }
+  const path = app.path?.trim().replace(/\/+$/, "") || "/";
+  return path !== "/";
+}
+
 export function isDefaultWorkspaceAppHiddenId(appId: string): boolean {
   const normalized = appId.trim().toLowerCase();
   return normalized === "chat" || isDispatchWorkspaceAppId(normalized);