@agent-native/dispatch 0.6.1 → 0.7.0

package/src/routes/pages/integrations.tsx

@@ -28,6 +28,11 @@ import {
 } from "@/components/ui/dialog";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
+import {
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/ui/tooltip";
 
 export function meta() {
   return [{ title: "Connections — Dispatch" }];
@@ -90,10 +95,12 @@ function ConnectDialog({
   service,
   open,
   onOpenChange,
+  accessMode,
 }: {
   service: Service;
   open: boolean;
   onOpenChange: (next: boolean) => void;
+  accessMode: "all-apps" | "manual";
 }) {
   const [value, setValue] = useState("");
   const qc = useQueryClient();
@@ -128,16 +135,18 @@ function ConnectDialog({
         throw new Error("Secret created but id missing");
       }
 
-      // 2. Grant + sync to every app that declared this credential.
-      const targets = service.apps.filter((a) => !a.vaultGranted);
-      for (const app of targets) {
-        try {
-          await createGrant.mutateAsync({
-            secretId,
-            appId: app.appId,
-          });
-        } catch (err) {
-          console.warn(`grant to ${app.appId} failed`, err);
+      // 2. Manual mode needs grants; all-apps mode only needs sync.
+      if (accessMode === "manual") {
+        const targets = service.apps.filter((a) => !a.vaultGranted);
+        for (const app of targets) {
+          try {
+            await createGrant.mutateAsync({
+              secretId,
+              appId: app.appId,
+            });
+          } catch (err) {
+            console.warn(`grant to ${app.appId} failed`, err);
+          }
         }
       }
       for (const app of service.apps) {
@@ -217,7 +226,13 @@ function ConnectDialog({
   );
 }
 
-function ConnectorCard({ service }: { service: Service }) {
+function ConnectorCard({
+  service,
+  accessMode,
+}: {
+  service: Service;
+  accessMode: "all-apps" | "manual";
+}) {
   const [open, setOpen] = useState(false);
   const isConnected = service.apps.some((a) => a.configured);
   const appCount = service.apps.length;
@@ -251,10 +266,15 @@ function ConnectorCard({ service }: { service: Service }) {
             </Badge>
           )}
         </div>
-        <div className="min-w-0">
-          <div className="text-sm font-semibold text-foreground truncate">
-            {service.label}
-          </div>
+        <div className="w-full min-w-0">
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <div className="text-sm font-semibold text-foreground truncate">
+                {service.label}
+              </div>
+            </TooltipTrigger>
+            <TooltipContent>{service.label}</TooltipContent>
+          </Tooltip>
           <div className="font-mono text-xs text-muted-foreground/80 truncate">
             {service.key}
           </div>
@@ -263,7 +283,12 @@ function ConnectorCard({ service }: { service: Service }) {
           Used by {appCount} {appCount === 1 ? "app" : "apps"}
         </div>
       </button>
-      <ConnectDialog service={service} open={open} onOpenChange={setOpen} />
+      <ConnectDialog
+        service={service}
+        open={open}
+        onOpenChange={setOpen}
+        accessMode={accessMode}
+      />
     </>
   );
 }
@@ -297,7 +322,13 @@ export default function ConnectionsRoute() {
     "list-integrations-catalog",
     {},
   );
+  const { data: accessSettings } = useActionQuery(
+    "get-vault-access-settings",
+    {},
+  );
   const apps = (catalog as CatalogApp[]) || [];
+  const accessMode =
+    (accessSettings as any)?.mode === "manual" ? "manual" : "all-apps";
 
   const services = useMemo<Service[]>(() => {
     const map = new Map<string, Service>();
@@ -357,7 +388,11 @@ export default function ConnectionsRoute() {
           </div>
           <div className="grid gap-3 sm:grid-cols-2 xl:grid-cols-3">
             {available.map((service) => (
-              <ConnectorCard key={service.key} service={service} />
+              <ConnectorCard
+                key={service.key}
+                service={service}
+                accessMode={accessMode}
+              />
             ))}
           </div>
         </section>
@@ -373,7 +408,11 @@ export default function ConnectionsRoute() {
           </div>
           <div className="grid gap-3 sm:grid-cols-2 xl:grid-cols-3">
             {connected.map((service) => (
-              <ConnectorCard key={service.key} service={service} />
+              <ConnectorCard
+                key={service.key}
+                service={service}
+                accessMode={accessMode}
+              />
             ))}
           </div>
         </section>

package/src/routes/pages/new-app.tsx

@@ -9,7 +9,7 @@ export default function NewAppRoute() {
   return (
     <DispatchShell
       title="New App"
-      description="Create a workspace app from a prompt and grant it selected vault keys."
+      description="Create a workspace app from a prompt and apply the workspace vault policy."
     >
       <NewWorkspaceAppFlow sourceApp="dispatch" className="px-0 py-0" />
     </DispatchShell>

package/src/routes/pages/overview.tsx

@@ -617,7 +617,7 @@ export default function OverviewRoute() {
         <div className="grid gap-4 md:grid-cols-2 xl:grid-cols-4">
           <StatCard
             label="Vault secrets"
-            help="Credentials stored in the workspace vault. Grant them to apps from the Vault page."
+            help="Credentials stored in the workspace vault."
             value={data?.vault?.secretCount || 0}
             icon={IconKey}
             cta={
@@ -629,8 +629,16 @@ export default function OverviewRoute() {
             }
           />
           <StatCard
-            label="Active grants"
-            help="Secrets currently granted to apps. Sync them to push credentials."
+            label={
+              data?.vault?.accessMode === "manual"
+                ? "Active grants"
+                : "Accessible keys"
+            }
+            help={
+              data?.vault?.accessMode === "manual"
+                ? "Secrets currently granted to apps. Sync them to push credentials."
+                : "Vault keys available to every workspace app."
+            }
             value={data?.vault?.activeGrantCount || 0}
             icon={IconShieldCheck}
           />

package/src/routes/pages/vault.tsx

@@ -37,6 +37,7 @@ import {
 } from "@/components/ui/alert-dialog";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
+import { Switch } from "@/components/ui/switch";
 import {
   Select,
   SelectContent,
@@ -61,6 +62,8 @@ const PROVIDERS = [
   "other",
 ];
 
+type VaultAccessMode = "all-apps" | "manual";
+
 export function meta() {
   return [{ title: "Vault — Dispatch" }];
 }
@@ -241,7 +244,53 @@ function GrantDialog({
   );
 }
 
-function SecretRow({ secret, grants }: { secret: any; grants: any[] }) {
+function VaultAccessSettingsCard({ mode }: { mode: VaultAccessMode }) {
+  const update = useActionMutation("set-vault-access-settings", {
+    onSuccess: (next: any) =>
+      toast.success(
+        next?.mode === "manual"
+          ? "Manual vault access enabled"
+          : "All apps can use vault keys",
+      ),
+    onError: (err) => toast.error(String(err)),
+  });
+  const allApps = mode !== "manual";
+
+  return (
+    <div className="rounded-xl border bg-card px-4 py-3">
+      <div className="flex items-center justify-between gap-4">
+        <div className="min-w-0">
+          <Label className="text-sm font-medium">
+            All apps can use vault keys
+          </Label>
+          <p className="mt-1 text-xs text-muted-foreground">
+            {allApps
+              ? "Every workspace app can receive every saved key."
+              : "Only apps with explicit grants can receive saved keys."}
+          </p>
+        </div>
+        <Switch
+          checked={allApps}
+          disabled={update.isPending}
+          onCheckedChange={(checked) =>
+            update.mutate({ mode: checked ? "all-apps" : "manual" })
+          }
+          aria-label="Allow all workspace apps to use vault keys"
+        />
+      </div>
+    </div>
+  );
+}
+
+function SecretRow({
+  secret,
+  grants,
+  accessMode,
+}: {
+  secret: any;
+  grants: any[];
+  accessMode: VaultAccessMode;
+}) {
   const [expanded, setExpanded] = useState(false);
   const [showValue, setShowValue] = useState(false);
 
@@ -260,6 +309,7 @@ function SecretRow({ secret, grants }: { secret: any; grants: any[] }) {
   });
 
   const activeGrants = grants.filter((g) => g.status === "active");
+  const allApps = accessMode !== "manual";
 
   return (
     <div className="rounded-xl border bg-card">
@@ -290,7 +340,9 @@ function SecretRow({ secret, grants }: { secret: any; grants: any[] }) {
         </div>
         <div className="flex items-center gap-2">
           <Badge variant="outline" className="text-xs">
-            {activeGrants.length} grant{activeGrants.length !== 1 ? "s" : ""}
+            {allApps
+              ? "All apps"
+              : `${activeGrants.length} grant${activeGrants.length !== 1 ? "s" : ""}`}
           </Badge>
         </div>
       </button>
@@ -320,11 +372,17 @@ function SecretRow({ secret, grants }: { secret: any; grants: any[] }) {
           <div className="space-y-2">
             <div className="flex items-center justify-between">
               <span className="text-xs font-medium text-foreground">
-                Grants
+                {allApps ? "Access" : "Grants"}
               </span>
-              <GrantDialog secretId={secret.id} secretName={secret.name} />
+              {!allApps && (
+                <GrantDialog secretId={secret.id} secretName={secret.name} />
+              )}
             </div>
-            {activeGrants.length > 0 ? (
+            {allApps ? (
+              <div className="rounded-lg border border-dashed px-3 py-4 text-center text-xs text-muted-foreground">
+                Available to every workspace app.
+              </div>
+            ) : activeGrants.length > 0 ? (
               <div className="space-y-1.5">
                 {activeGrants.map((grant: any) => (
                   <div
@@ -366,7 +424,7 @@ function SecretRow({ secret, grants }: { secret: any; grants: any[] }) {
               </div>
             ) : (
               <div className="rounded-lg border border-dashed px-3 py-4 text-center text-xs text-muted-foreground">
-                No grants yet. Grant this secret to an app to share it.
+                No grants yet.
               </div>
             )}
           </div>
@@ -388,8 +446,8 @@ function SecretRow({ secret, grants }: { secret: any; grants: any[] }) {
                   <AlertDialogTitle>Delete this secret?</AlertDialogTitle>
                   <AlertDialogDescription>
                     Removing “{secret.name}” revokes all of its grants. Apps
-                    that depended on this credential will lose access on the
-                    next sync. This cannot be undone.
+                    that depended on this credential can lose access on the next
+                    sync. This cannot be undone.
                   </AlertDialogDescription>
                 </AlertDialogHeader>
                 <AlertDialogFooter>
@@ -508,6 +566,12 @@ export default function VaultRoute() {
   const { data: grants } = useActionQuery("list-vault-grants", {});
   const { data: requests } = useActionQuery("list-vault-requests", {});
   const { data: audit } = useActionQuery("list-vault-audit", { limit: 20 });
+  const { data: accessSettings } = useActionQuery(
+    "get-vault-access-settings",
+    {},
+  );
+  const accessMode: VaultAccessMode =
+    (accessSettings as any)?.mode === "manual" ? "manual" : "all-apps";
 
   const grantsBySecret = (grants || []).reduce(
     (acc: Record<string, any[]>, g: any) => {
@@ -525,7 +589,7 @@ export default function VaultRoute() {
   return (
     <DispatchShell
       title="Vault"
-      description="Centralized secret management for your workspace. Store credentials once, grant them to apps."
+      description="Centralized secret management for your workspace. Store credentials once and sync them to apps."
     >
       <Tabs defaultValue="secrets">
         <TabsList>
@@ -547,6 +611,8 @@ export default function VaultRoute() {
         </TabsList>
 
         <TabsContent value="secrets" className="mt-4 space-y-3">
+          <VaultAccessSettingsCard mode={accessMode} />
+
           <div className="flex items-center justify-between">
             <div className="flex items-center gap-2 text-sm text-muted-foreground">
               <IconKey size={16} />
@@ -576,6 +642,7 @@ export default function VaultRoute() {
                   key={secret.id}
                   secret={secret}
                   grants={grantsBySecret[secret.id] || []}
+                  accessMode={accessMode}
                 />
               ))}
 

package/src/server/lib/app-creation-store.spec.ts

@@ -1,6 +1,9 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import { runWithRequestContext } from "@agent-native/core/server";
-import { listWorkspaceApps } from "./app-creation-store.js";
+import {
+  generateWorkspaceAppDescription,
+  listWorkspaceApps,
+} from "./app-creation-store.js";
 
 const originalFetch = globalThis.fetch;
 
@@ -21,7 +24,15 @@ describe("listWorkspaceApps", () => {
               name: "Agent-Native Dispatch",
               path: "/dispatch",
             },
-            { id: "todo", name: "Todo", path: "/todo" },
+            {
+              id: "todo",
+              name: "Todo",
+              description: "Tracks personal tasks and follow-ups",
+              path: "/todo",
+              audience: "public",
+              publicPaths: ["/"],
+              protectedPaths: ["/admin"],
+            },
           ],
         }),
         { headers: { "content-type": "application/json" } },
@@ -47,5 +58,53 @@ describe("listWorkspaceApps", () => {
       }),
     );
     expect(apps.map((app) => app.id)).toEqual(["dispatch", "todo"]);
+    expect(apps.find((app) => app.id === "todo")?.description).toBe(
+      "Tracks personal tasks and follow-ups",
+    );
+    expect(apps.find((app) => app.id === "todo")?.audience).toBe("public");
+    expect(apps.find((app) => app.id === "todo")?.publicPaths).toEqual(["/"]);
+    expect(apps.find((app) => app.id === "todo")?.protectedPaths).toEqual([
+      "/admin",
+    ]);
+  });
+
+  it("filters workspace apps by audience", async () => {
+    vi.stubEnv(
+      "AGENT_NATIVE_WORKSPACE_APPS_JSON",
+      JSON.stringify([
+        {
+          id: "dispatch",
+          name: "Dispatch",
+          path: "/dispatch",
+          audience: "internal",
+        },
+        {
+          id: "portal",
+          name: "Portal",
+          path: "/portal",
+          audience: "public",
+        },
+      ]),
+    );
+
+    const apps = await runWithRequestContext(
+      { userEmail: "dev@example.test" },
+      () =>
+        listWorkspaceApps({
+          includeAgentCards: false,
+          audience: "public",
+        }),
+    );
+
+    expect(apps.map((app) => app.id)).toEqual(["portal"]);
+  });
+
+  it("generates a concise seed description from an app prompt", () => {
+    expect(
+      generateWorkspaceAppDescription(
+        "Build me an app that tracks customer onboarding risks and handoffs",
+        "customer-onboarding",
+      ),
+    ).toBe("Tracks customer onboarding risks and handoffs.");
   });
 });