@agent-native/dispatch 0.38.11 → 0.38.12-nightly-20260926081002

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.38.11",
+  "version": "0.38.12-nightly-20260926081002",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -88,7 +88,7 @@
     "tailwind-merge": "^3.5.0",
     "vaul": "^1.1.2",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "0.21.3"
+    "@agent-native/toolkit": "0.22.0-nightly-20260926081002"
   },
   "devDependencies": {
     "@react-router/dev": "^8.1.0",
@@ -102,10 +102,10 @@
     "typescript-7": "npm:typescript@^7.0.2",
     "vite": "8.1.0",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.191.0"
+    "@agent-native/core": "0.192.0-nightly-20260926081002"
   },
   "peerDependencies": {
-    "@agent-native/core": ">=0.8.0",
+    "@agent-native/core": "0.192.0-nightly-20260926081002",
     "react": ">=19.2.7",
     "react-dom": ">=19.2.7",
     "react-router": ">=8"

package/src/actions/list-workspace-apps.spec.ts

@@ -0,0 +1,78 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  listWorkspaceApps: vi.fn(),
+}));
+
+vi.mock("../server/lib/app-creation-store.js", () => ({
+  listWorkspaceApps: mocks.listWorkspaceApps,
+}));
+
+import type { ActionRunContext } from "@agent-native/core/action";
+
+import action from "./list-workspace-apps.js";
+
+const input = {
+  includeAgentCards: false,
+  includeArchived: false,
+  audience: "all" as const,
+};
+
+function context(userEmail: string, orgId: string | null): ActionRunContext {
+  return {
+    caller: "http",
+    userEmail,
+    orgId,
+    appId: "dispatch",
+  };
+}
+
+describe("list-workspace-apps", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("shares only a pending registry read for the same authorization context", async () => {
+    mocks.listWorkspaceApps.mockResolvedValue([]);
+    let resolve!: (apps: never[]) => void;
+    mocks.listWorkspaceApps.mockImplementationOnce(
+      () =>
+        new Promise((done) => {
+          resolve = done;
+        }),
+    );
+
+    const caller = context("member@example.com", "org-1");
+    const first = action.run(input, caller);
+    const concurrent = action.run(input, caller);
+    await vi.waitFor(() =>
+      expect(mocks.listWorkspaceApps).toHaveBeenCalledOnce(),
+    );
+
+    resolve([]);
+    await expect(Promise.all([first, concurrent])).resolves.toEqual([[], []]);
+
+    await action.run(input, caller);
+    expect(mocks.listWorkspaceApps).toHaveBeenCalledTimes(2);
+  });
+
+  it("isolates users, organizations, app contexts, and list options", async () => {
+    mocks.listWorkspaceApps.mockResolvedValue([]);
+
+    await Promise.all([
+      action.run(input, context("member@example.com", "org-1")),
+      action.run(input, context("another@example.com", "org-1")),
+      action.run(input, context("member@example.com", "org-2")),
+      action.run(input, {
+        ...context("member@example.com", "org-1"),
+        appId: "other-dispatch",
+      }),
+      action.run(
+        { ...input, includeArchived: true },
+        context("member@example.com", "org-1"),
+      ),
+    ]);
+
+    expect(mocks.listWorkspaceApps).toHaveBeenCalledTimes(5);
+  });
+});

package/src/actions/list-workspace-apps.ts

@@ -1,7 +1,44 @@
-import { defineAction } from "@agent-native/core/action";
+import { defineAction, type ActionRunContext } from "@agent-native/core/action";
 import { z } from "zod";
 
-import { listWorkspaceApps } from "../server/lib/app-creation-store.js";
+import {
+  listWorkspaceApps,
+  type ListWorkspaceAppsOptions,
+  type WorkspaceAppSummary,
+} from "../server/lib/app-creation-store.js";
+
+const inFlightWorkspaceAppLists = new Map<
+  string,
+  Promise<WorkspaceAppSummary[]>
+>();
+
+function listWorkspaceAppsForRequest(
+  input: ListWorkspaceAppsOptions,
+  context?: ActionRunContext,
+): Promise<WorkspaceAppSummary[]> {
+  const email = context?.userEmail?.trim().toLowerCase();
+  if (!context || !email) return listWorkspaceApps(input);
+
+  const key = JSON.stringify([
+    email,
+    context.orgId?.trim() || null,
+    context.appId?.trim() || null,
+    context.caller,
+    input,
+  ]);
+  const pending = inFlightWorkspaceAppLists.get(key);
+  if (pending) return pending;
+
+  const request = listWorkspaceApps(input);
+  inFlightWorkspaceAppLists.set(key, request);
+  const removeSettledRequest = () => {
+    if (inFlightWorkspaceAppLists.get(key) === request) {
+      inFlightWorkspaceAppLists.delete(key);
+    }
+  };
+  void request.then(removeSettledRequest, removeSettledRequest);
+  return request;
+}
 
 const httpBoolean = z.preprocess((value) => {
   if (typeof value !== "string") return value;
@@ -29,5 +66,5 @@ export default defineAction({
       .describe("Filter by workspace app audience."),
   }),
   http: { method: "GET" },
-  run: async (input) => listWorkspaceApps(input),
+  run: async (input, context) => listWorkspaceAppsForRequest(input, context),
 });

package/src/server/lib/app-creation-store.spec.ts

@@ -45,7 +45,9 @@ const mocks = vi.hoisted(() => {
       settings.set(key, value);
     }),
     getOrgSetting: vi.fn(async () => null),
-    isWorkspaceAppAccessAllowed: vi.fn(async () => true),
+    isWorkspaceAppAccessAllowed: vi.fn(
+      async (): Promise<boolean | "unavailable"> => true,
+    ),
     resolveAccess: vi.fn(async () => ({
       role: "viewer",
       resource: {},
@@ -798,6 +800,18 @@ describe("listWorkspaceApps", () => {
     });
   });
 
+  it("does not expose Dispatch when its access check is unavailable", async () => {
+    stubManifest();
+    mocks.isWorkspaceAppAccessAllowed.mockResolvedValueOnce("unavailable");
+
+    const apps = await runWithRequestContext(
+      { userEmail: "member@example.test", orgId: "org-123" },
+      () => listWorkspaceApps({ includeAgentCards: false }),
+    );
+
+    expect(apps).toEqual([]);
+  });
+
   it("does not expose the workspace app registry without an authenticated user", async () => {
     stubNoPendingContext();
     stubManifest([

package/src/server/lib/app-creation-store.ts

@@ -1556,12 +1556,11 @@ async function filterWorkspaceAppsByAccess(
       continue;
     }
     if (app.isDispatch) {
-      if (
-        await isWorkspaceAppAccessAllowed("dispatch", {
-          email: userEmail,
-          orgId,
-        })
-      ) {
+      const dispatchAccess = await isWorkspaceAppAccessAllowed("dispatch", {
+        email: userEmail,
+        orgId,
+      });
+      if (dispatchAccess === true) {
         visibleIds.add(app.id);
       }
       continue;