@agent-native/dispatch 0.6.1 → 0.8.0

package/src/lib/catch-all-target.spec.ts

@@ -0,0 +1,218 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const loadWorkspaceAppsManifestMock = vi.hoisted(() => vi.fn());
+const getBuiltinAgentsMock = vi.hoisted(() => vi.fn());
+
+vi.mock("@agent-native/core/server/agent-discovery", () => ({
+  loadWorkspaceAppsManifest: loadWorkspaceAppsManifestMock,
+  getBuiltinAgents: getBuiltinAgentsMock,
+}));
+
+import { resolveCatchAllTarget } from "./catch-all-target.js";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("resolveCatchAllTarget", () => {
+  it("prefers the workspace manifest entry when one matches", () => {
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      { id: "todo", name: "Todo", path: "/todo" },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([
+      {
+        id: "todo",
+        name: "Todo",
+        description: "",
+        url: "https://todo.example.com",
+        color: "#000",
+      },
+    ]);
+
+    expect(resolveCatchAllTarget("todo")).toBe("/todo");
+  });
+
+  it("falls back to the built-in template URL when no workspace manifest exists", () => {
+    loadWorkspaceAppsManifestMock.mockReturnValue(null);
+    getBuiltinAgentsMock.mockReturnValue([
+      {
+        id: "forms",
+        name: "Forms",
+        description: "",
+        url: "http://localhost:8084",
+        color: "#06B6D4",
+      },
+    ]);
+
+    expect(resolveCatchAllTarget("forms")).toBe("http://localhost:8084");
+  });
+
+  it("falls back to the built-in template URL when the workspace manifest does not include the app", () => {
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      { id: "dispatch", name: "Dispatch", path: "/dispatch" },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([
+      {
+        id: "forms",
+        name: "Forms",
+        description: "",
+        url: "http://localhost:8084",
+        color: "#06B6D4",
+      },
+    ]);
+
+    expect(resolveCatchAllTarget("forms")).toBe("http://localhost:8084");
+  });
+
+  it("normalizes a manifest entry without a leading slash", () => {
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      { id: "todo", name: "Todo", path: "todo" },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([]);
+
+    expect(resolveCatchAllTarget("todo")).toBe("/todo");
+  });
+
+  it("uses app.path when id !== path (not /${appId})", () => {
+    // Before the fix, an entry whose mounted path differs from its id —
+    // e.g. id: "forms", path: "my-forms" without a leading slash — was
+    // silently rewritten to `/forms` (the appId) and routed to the wrong
+    // app. The normalizer now keeps the manifest path and only prepends
+    // the missing slash.
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      { id: "forms", name: "Forms", path: "my-forms" },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([]);
+
+    expect(resolveCatchAllTarget("forms")).toBe("/my-forms");
+  });
+
+  it("prefers app.url when the manifest entry has an externally-hosted URL", () => {
+    // Workspaces can point at remote deploys. The catch-all should bounce
+    // to the absolute URL instead of mounting a local path that doesn't
+    // exist inside the gateway.
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      {
+        id: "forms",
+        name: "Forms",
+        path: "/forms",
+        url: "https://forms.example.com",
+      },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([]);
+
+    expect(resolveCatchAllTarget("forms")).toBe("https://forms.example.com");
+  });
+
+  it("ignores app.url that isn't an absolute http(s) URL and falls back to path", () => {
+    // Bare hostname — `new URL("forms.example.com")` throws, so the value
+    // is rejected and we fall through to the (validated) path. Without
+    // this, the catch-all would `throw redirect("forms.example.com")`
+    // and the browser would treat the value as a relative path inside the
+    // gateway, producing a broken redirect.
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      {
+        id: "forms",
+        name: "Forms",
+        path: "/forms",
+        url: "forms.example.com",
+      },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([]);
+
+    expect(resolveCatchAllTarget("forms")).toBe("/forms");
+  });
+
+  it("rejects non-http(s) URL schemes (e.g. javascript:) and falls back to path", () => {
+    // Defense in depth — a hostile manifest entry can't produce a
+    // `javascript:` redirect target. Validation enforces http(s) only.
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      {
+        id: "forms",
+        name: "Forms",
+        path: "/forms",
+        url: "javascript:alert(1)",
+      },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([]);
+
+    expect(resolveCatchAllTarget("forms")).toBe("/forms");
+  });
+
+  it("strips a trailing slash from app.url", () => {
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      {
+        id: "forms",
+        name: "Forms",
+        path: "/forms",
+        url: "https://forms.example.com/",
+      },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([]);
+
+    expect(resolveCatchAllTarget("forms")).toBe("https://forms.example.com");
+  });
+
+  it("ignores an empty/whitespace app.url and falls back to path", () => {
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      {
+        id: "forms",
+        name: "Forms",
+        path: "/forms",
+        url: "   ",
+      },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([]);
+
+    expect(resolveCatchAllTarget("forms")).toBe("/forms");
+  });
+
+  it("collapses leading slashes/backslashes in app.path so `/\\evil.example` can't redirect off-origin", () => {
+    // Browsers normalize backslashes to forward slashes during URL
+    // parsing, so `throw redirect("/\\evil.example")` would resolve to
+    // `https://evil.example`. The regex covers both slash types.
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      { id: "forms", name: "Forms", path: "/\\evil.example" },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([]);
+
+    expect(resolveCatchAllTarget("forms")).toBe("/evil.example");
+  });
+
+  it("collapses leading double slashes in app.path so `//evil.example` can't redirect off-origin", () => {
+    // The manifest parser only checks `startsWith("/")`, so a path of
+    // `//evil.example` slips through. Browsers treat that as a network-
+    // path reference and `throw redirect("//evil.example")` would redirect
+    // to `https://evil.example` — the same phishing vector the `app.url`
+    // validator closes. Collapse the leading slashes so the redirect
+    // stays on the gateway.
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      { id: "forms", name: "Forms", path: "//evil.example" },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([]);
+
+    expect(resolveCatchAllTarget("forms")).toBe("/evil.example");
+  });
+
+  it("falls back to /${appId} when the manifest entry has neither path nor url", () => {
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      { id: "forms", name: "Forms", path: "" },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([]);
+
+    expect(resolveCatchAllTarget("forms")).toBe("/forms");
+  });
+
+  it("returns null when nothing matches", () => {
+    loadWorkspaceAppsManifestMock.mockReturnValue([
+      { id: "dispatch", name: "Dispatch", path: "/dispatch" },
+    ]);
+    getBuiltinAgentsMock.mockReturnValue([]);
+
+    expect(resolveCatchAllTarget("unknown-app")).toBeNull();
+  });
+});

package/src/lib/catch-all-target.ts

@@ -0,0 +1,99 @@
+import {
+  getBuiltinAgents,
+  loadWorkspaceAppsManifest,
+} from "@agent-native/core/server/agent-discovery";
+
+/**
+ * Resolve where `/dispatch/<appId>` should bounce to when it doesn't match
+ * an explicit dispatch route. Used by the `$appId` catch-all route loader.
+ *
+ * Resolution order:
+ *
+ * 1. Workspace apps manifest (env, .agent-native/workspace-apps.json, or a
+ *    filesystem scan of `apps/`).
+ *    - `app.url` (absolute URL — externally hosted workspace app) wins if
+ *      present.
+ *    - Otherwise the `app.path` mounted under the workspace gateway is
+ *      used. Path is normalized to a leading slash if missing
+ *      (e.g. manifest entry `path: "my-forms"` → `/my-forms`), so an app
+ *      whose mounted path differs from its id ends up at the right place
+ *      instead of being silently rewritten to `/${appId}`.
+ *    - Bare entry with no path / url falls back to `/${appId}`.
+ * 2. First-party template registry. When no workspace manifest matches
+ *    (framework dev with each template on its own port, hosted dispatch
+ *    with no sibling apps), return the matching template's deploy URL —
+ *    dev URL in development (e.g. http://localhost:8084 for forms), prod
+ *    URL in production (e.g. https://forms.agent-native.com).
+ *
+ * Returns `null` if neither lookup matches, letting the route render its
+ * "Page not found" pane.
+ */
+/**
+ * Validate `app.url` is an absolute http(s) URL before we trust it as a
+ * redirect target. A bare hostname (`"forms.example.com"`) or a
+ * `javascript:` scheme would otherwise get returned verbatim from
+ * `resolveCatchAllTarget` and produce a broken redirect (or a phishing
+ * vector). Mirrors `normalizeWorkspaceAppUrl` in
+ * `packages/core/src/deploy/workspace-deploy.ts` — but inlined to avoid
+ * pulling the deploy CLI module into a runtime path.
+ */
+function validatedAbsoluteUrl(value: unknown): string | undefined {
+  if (typeof value !== "string" || !value.trim()) return undefined;
+  try {
+    const parsed = new URL(value.trim());
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return undefined;
+    }
+    return parsed.toString().replace(/\/$/, "");
+  } catch {
+    return undefined;
+  }
+}
+
+export function resolveCatchAllTarget(appId: string): string | null {
+  const apps = loadWorkspaceAppsManifest();
+  if (apps) {
+    const app = apps.find((entry) => entry?.id === appId);
+    if (app) {
+      // Explicit externally-hosted URL wins. Workspaces that point at a
+      // remote deploy (e.g. a sibling app on Netlify) set `url` and we
+      // should bounce the user there rather than mounting a local path
+      // that doesn't exist inside the gateway. Validate the URL first —
+      // a bare hostname or non-http(s) scheme would produce a broken
+      // redirect (and a `javascript:` value would be a phishing vector).
+      const url = validatedAbsoluteUrl(app.url);
+      if (url) {
+        return url;
+      }
+      // Fall back to the mounted path. Normalize to leading slash so an
+      // entry whose path differs from its id (e.g. `id: "forms"`,
+      // `path: "my-forms"`) still lands on the correct gateway mount —
+      // not on `/${appId}`, which would silently route to the wrong app.
+      //
+      // Reject scheme-relative paths. Three variants reach this point —
+      // all of them get collapsed to a single leading slash so the
+      // redirect stays on the gateway:
+      //
+      //   `//evil.example`   — network-path reference, browser treats as
+      //                        absolute (https://evil.example).
+      //   `/\evil.example`   — browsers normalize backslashes to forward
+      //                        slashes during URL parsing, same result.
+      //   `\/evil.example`   — same idea, leading-backslash variant.
+      //
+      // The manifest parser only checks `startsWith("/")` for the first
+      // case, and even that allows `//evil…`. Defend in depth here by
+      // collapsing any run of leading slashes-or-backslashes to one
+      // forward slash. Same phishing vector that `validatedAbsoluteUrl`
+      // closes for `app.url`.
+      if (typeof app.path === "string" && app.path.trim()) {
+        const normalized = app.path.trim().replace(/^[/\\]+/, "/");
+        return normalized.startsWith("/") ? normalized : `/${normalized}`;
+      }
+      return `/${appId}`;
+    }
+  }
+  const builtin = getBuiltinAgents("dispatch").find(
+    (agent) => agent.id === appId,
+  );
+  return builtin?.url ?? null;
+}

package/src/lib/utils.ts

@@ -1 +1,6 @@
-export { cn } from "@agent-native/core";
+import { type ClassValue, clsx } from "clsx";
+import { twMerge } from "tailwind-merge";
+
+export function cn(...inputs: ClassValue[]) {
+  return twMerge(clsx(inputs));
+}

package/src/lib/workspace-apps.ts

@@ -5,10 +5,19 @@ export interface WorkspaceAppSummary {
   path: string;
   url?: string | null;
   isDispatch?: boolean;
+  audience?: "internal" | "public";
+  publicPaths?: string[];
+  protectedPaths?: string[];
   status?: "ready" | "pending";
   statusLabel?: string;
   builderUrl?: string | null;
   branchName?: string | null;
+  createdAt?: string | null;
+  agentCardUrl?: string | null;
+  agentCardReachable?: boolean;
+  a2aEndpointUrl?: string | null;
+  agentName?: string | null;
+  agentSkillsCount?: number | null;
   archived?: boolean;
 }
 

package/src/routes/index.ts

@@ -46,6 +46,7 @@ export const dispatchRoutes: RouteConfig = [
   route("approval", "./pages/approval.js"),
   route("approvals", "./pages/approvals.js"),
   route("audit", "./pages/audit.js"),
+  route("dreams", "./pages/dreams.js"),
   route("thread-debug", "./pages/thread-debug.js"),
   route("team", "./pages/team.js"),
   route("extensions", "./pages/extensions._index.js"),

package/src/routes/pages/$appId.tsx

@@ -4,10 +4,10 @@ import {
   Navigate,
   redirect,
   useParams,
+  type ClientLoaderFunctionArgs,
   type LoaderFunctionArgs,
 } from "react-router";
 import { useActionQuery, appPath } from "@agent-native/core/client";
-import { loadWorkspaceAppsManifest } from "@agent-native/core/server/agent-discovery";
 import {
   IconArrowLeft,
   IconArrowUpRight,
@@ -17,6 +17,7 @@ import { DispatchShell } from "@/components/dispatch-shell";
 import { Spinner } from "@/components/ui/spinner";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
+import { resolveCatchAllTarget } from "@/lib/catch-all-target";
 import {
   workspaceAppHref,
   type WorkspaceAppSummary,
@@ -49,6 +50,14 @@ export function meta() {
  * and looks broken. This route fixes both the post-creation navigation
  * and the OAuth round-trip from a single place.
  *
+ * Built-in template fallback: when no workspace manifest is available
+ * (framework dev with each template on its own port, hosted dispatch with
+ * no sibling apps), redirect to the matching first-party template's deploy
+ * URL — `http://localhost:<devPort>` in dev, `https://<id>.agent-native.com`
+ * in production. Without this, a user visiting `/forms` on dispatch is
+ * forced to sign in (auth guard) and then lands on this route's "Page not
+ * found" pane after the post-login reload.
+ *
  * `appId === "dispatch"` short-circuit: when the segment matches Dispatch
  * itself (e.g. `/dispatch/dispatch`), we go straight to the overview rather
  * than chaining through `/dispatch` (which polled `useActionQuery` re-fired
@@ -64,19 +73,23 @@ export function loader({ params }: LoaderFunctionArgs) {
   if (!appId) return null;
   const selfTarget = dispatchSelfRedirect(appId);
   if (selfTarget) throw redirect(selfTarget);
-  const apps = loadWorkspaceAppsManifest();
-  if (!apps) return null;
-  const app = apps.find((entry) => entry?.id === appId);
-  const target =
-    app?.path && app.path.startsWith("/") ? app.path : app ? `/${appId}` : null;
+  const target = resolveCatchAllTarget(appId);
   if (target) throw redirect(target);
   return null;
 }
 
-export function clientLoader({ params }: LoaderFunctionArgs) {
+export async function clientLoader({
+  params,
+  serverLoader,
+}: ClientLoaderFunctionArgs) {
   const selfTarget = dispatchSelfRedirect(params.appId);
   if (selfTarget) throw redirect(selfTarget);
-  return null;
+  // Defer to the server loader so the built-in template fallback runs on
+  // SPA navigations too (e.g. clicking a `/<template-id>` link inside
+  // dispatch). Without this the client side would only check the workspace
+  // apps query, which never lists the static first-party templates and so
+  // the user would land on the "Page not found" pane.
+  return serverLoader();
 }
 
 export default function WorkspaceAppCatchAllRoute() {

package/src/routes/pages/approval.tsx

@@ -7,6 +7,10 @@ import {
   appPath,
 } from "@agent-native/core/client";
 import { toast } from "sonner";
+import {
+  ApprovalValueBlock,
+  parseApprovalValue,
+} from "@/components/approval-value-block";
 import { Button } from "@/components/ui/button";
 import { Badge } from "@/components/ui/badge";
 import { Skeleton } from "@/components/ui/skeleton";
@@ -168,10 +172,12 @@ export default function ApprovalPreviewRoute() {
   }
 
   const isPending = approval.status === "pending";
+  const beforeValue = parseApprovalValue(approval.beforeValue);
+  const afterValue = parseApprovalValue(approval.afterValue);
 
   return (
     <div className="flex min-h-screen items-start justify-center bg-background p-6">
-      <div className="w-full max-w-md space-y-4">
+      <div className="w-full max-w-2xl space-y-4">
         <div className="rounded-2xl border bg-card p-5">
           <div className="flex items-start gap-3">
             <div className="flex h-9 w-9 shrink-0 items-center justify-center rounded-xl border bg-muted text-foreground">
@@ -224,6 +230,13 @@ export default function ApprovalPreviewRoute() {
             )}
           </div>
 
+          {(beforeValue !== null || afterValue !== null) && (
+            <div className="mt-4 grid gap-3 md:grid-cols-2">
+              <ApprovalValueBlock label="Before" value={beforeValue} />
+              <ApprovalValueBlock label="After" value={afterValue} />
+            </div>
+          )}
+
           {isPending && (
             <div className="mt-4 flex gap-2">
               <Button

package/src/routes/pages/approvals.tsx

@@ -58,7 +58,7 @@ export default function ApprovalsRoute() {
                 </div>
                 <div className="mt-1 text-xs text-muted-foreground">
                   {hasOrg
-                    ? "Applies to saved destinations and dispatch settings today."
+                    ? "Applies to saved destinations, shared dream proposals, All-app workspace resources, and dispatch settings."
                     : "Requires a team workspace. Set one up on the Team page."}
                 </div>
               </div>

package/src/routes/pages/dream-settings.spec.ts

@@ -0,0 +1,130 @@
+import { describe, expect, it } from "vitest";
+import {
+  dreamSettingsToDraft,
+  dreamSettingsUpdateFromDraft,
+  splitSourceIds,
+  type DreamSettingsDraft,
+} from "./dream-settings.js";
+
+function draft(
+  overrides: Partial<DreamSettingsDraft> = {},
+): DreamSettingsDraft {
+  return {
+    enabled: true,
+    schedule: "0 9 * * 1",
+    sourceId: "all",
+    sourceIdsText: "",
+    allSources: true,
+    query: "",
+    limit: "8",
+    sourceTimeoutMs: "30000",
+    sourceConcurrency: "2",
+    sourceStartStaggerMs: "250",
+    threadConcurrency: "3",
+    threadTimeoutMs: "8000",
+    minCandidateCount: "1",
+    ...overrides,
+  };
+}
+
+describe("dream settings payload helpers", () => {
+  it("normalizes persisted settings into editable draft text", () => {
+    expect(
+      dreamSettingsToDraft({
+        enabled: true,
+        schedule: "0 8 * * 2",
+        sourceId: "selected",
+        sourceIds: ["mail", "calendar"],
+        allSources: false,
+        query: "memory",
+        limit: 12,
+        sourceTimeoutMs: 45000,
+        sourceConcurrency: 4,
+        sourceStartStaggerMs: 500,
+        threadConcurrency: 5,
+        threadTimeoutMs: 9000,
+        minCandidateCount: 2,
+      }),
+    ).toMatchObject({
+      enabled: true,
+      schedule: "0 8 * * 2",
+      sourceId: "selected",
+      sourceIdsText: "mail\ncalendar",
+      allSources: false,
+      query: "memory",
+      limit: "12",
+      sourceTimeoutMs: "45000",
+      sourceConcurrency: "4",
+      sourceStartStaggerMs: "500",
+      threadConcurrency: "5",
+      threadTimeoutMs: "9000",
+      minCandidateCount: "2",
+    });
+  });
+
+  it("splits explicit source ids from commas and newlines", () => {
+    expect(splitSourceIds(" mail\ncalendar, analytics ,, \nbrain ")).toEqual([
+      "mail",
+      "calendar",
+      "analytics",
+      "brain",
+    ]);
+  });
+
+  it("builds a save payload that clears source ids and query", () => {
+    expect(
+      dreamSettingsUpdateFromDraft(
+        draft({
+          enabled: false,
+          schedule: " 0 10 * * 3 ",
+          sourceId: " current ",
+          sourceIdsText: "",
+          allSources: false,
+          query: "   ",
+          minCandidateCount: "0",
+        }),
+      ),
+    ).toMatchObject({
+      enabled: false,
+      schedule: "0 10 * * 3",
+      sourceId: "current",
+      sourceIds: [],
+      allSources: false,
+      query: "",
+      limit: 8,
+      sourceTimeoutMs: 30000,
+      sourceConcurrency: 2,
+      sourceStartStaggerMs: 250,
+      threadConcurrency: 3,
+      threadTimeoutMs: 8000,
+      minCandidateCount: 0,
+    });
+  });
+
+  it("falls back to all source scope and omits invalid numeric edits", () => {
+    expect(
+      dreamSettingsUpdateFromDraft(
+        draft({
+          sourceId: "   ",
+          sourceIdsText: "mail\ncalendar",
+          limit: "not-a-number",
+          threadTimeoutMs: "",
+        }),
+      ),
+    ).toMatchObject({
+      sourceId: "all",
+      sourceIds: ["mail", "calendar"],
+      allSources: true,
+    });
+    expect(
+      dreamSettingsUpdateFromDraft(
+        draft({ limit: "not-a-number", threadTimeoutMs: "" }),
+      ),
+    ).not.toHaveProperty("limit");
+    expect(
+      dreamSettingsUpdateFromDraft(
+        draft({ limit: "not-a-number", threadTimeoutMs: "" }),
+      ),
+    ).not.toHaveProperty("threadTimeoutMs");
+  });
+});