@agentproto/apps 0.11.0 → 0.12.0

package/dist/index.mjs

@@ -2888,12 +2888,29 @@ function panelBridgeScript(appName) {
 // JSON-RPC 2.0 over window.parent.postMessage \xB7 spec 2026-01-26
 var _nextId = 1, _pending = {}, _notifyHandlers = [];
 var _hostContext = null, _hostContextHandlers = [];
+var _hostCaps = null;
 var _standaloneApp = null;
 function _isStandalone(){
   return window.parent === window && !!window.McpApp && typeof window.McpApp.connect === 'function';
 }
+// \u2500\u2500 Per-boot embed token (runtime embed-tokens.ts) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+// Panels that iframe the daemon's standalone app host carry this proof so
+// GET /apps/:appId/ui?embed=1&et=... can drop its anti-framing headers for
+// MCP-Apps hosts whose widget context is an opaque origin (Claude Desktop).
+// registerMcpApps replaces the placeholder with a real per-boot token when
+// serving the panel as a resource; every other render (tests, standalone
+// tab, VS Code HTTP-iframe panel \u2014 the latter two already pass
+// iframeEmbedAllowed's origin checks) keeps the literal, and
+// withEmbedToken() then degrades to an identity function.
+window.__AGENPROTO_EMBED_TOKEN__ = "__AGENPROTO_EMBED_TOKEN__";
+function withEmbedToken(url){
+  var t = window.__AGENPROTO_EMBED_TOKEN__;
+  if (!t || t === '__AGENPROTO_EMBED_TOKEN__') return url;
+  return url + (url.indexOf('?') >= 0 ? '&' : '?') + 'et=' + encodeURIComponent(t);
+}
 function post(msg){ window.parent.postMessage(msg, '*'); }
 function getHostContext(){ return _hostContext; }
+function getHostCapabilities(){ return _hostCaps; }
 function onHostContext(cb){
   _hostContextHandlers.push(cb);
   // Replay the last context so a late subscriber isn't stuck blind.
@@ -2956,12 +2973,20 @@ function initBridge(){
     // The initialize result carries the initial hostContext (displayMode +
     // availableDisplayModes) \u2014 capture it before notifying the host.
     if (result && result.hostContext) _setHostContext(result.hostContext);
+    // McpUiInitializeResult.hostCapabilities (ext-apps spec) \u2014 e.g. openLinks,
+    // "Host supports opening external URLs". Captured once, read via
+    // getHostCapabilities() by panels that need to branch on it.
+    if (result && result.hostCapabilities) _hostCaps = result.hostCapabilities;
     rpcNotify('ui/notifications/initialized', {});
   });
 }
 function requestDisplayMode(mode){
   return rpcRequest('ui/request-display-mode', {mode: mode});
 }
+function openLink(url){
+  if (_standaloneApp && typeof _standaloneApp.openLink === 'function') return _standaloneApp.openLink(url);
+  return rpcRequest('ui/open-link', {url: url});
+}
 function callTool(name, args){
   var raw = _standaloneApp
     ? _standaloneApp.callTool(name, args || {})
@@ -5507,14 +5532,89 @@ var liveSessionApp = defineApp({
   }
 });
 
+// src/session-chat/blob-embed.ts
+var BLOB_BOOT_MESSAGE_TYPE = "agentproto-blob-boot";
+function blobEmbedScript() {
+  return `// \u2500\u2500 Blob pass-through transform (shared: session-chat/blob-embed.ts) \u2500\u2500
+function _blobEscapeAttr(s){ return String(s).replace(/&/g, '&').replace(/"/g, '"'); }
+// Rewrite the fetched chat html so it works as a blob: document: <base> on
+// the deep link, a fetch/EventSource shim that carries the embed token to
+// the daemon origin, and the standalone bridge's ./tool-call made absolute.
+function transformChatHtmlForBlob(html, url, token){
+  var origin = new URL(url).origin;
+  var tc = new URL('./tool-call', url);
+  tc.searchParams.set('et', token);
+  // The app-visible query for the blob doc: the deep link's search minus the
+  // embed token (the token must not ride the app's visible params). The
+  // blob document's own location has no params, so this is the ONLY channel
+  // for ?session= / ?embed=1 \u2014 the app reads it via bootSearchParams().
+  var bootUrl = new URL(url);
+  bootUrl.searchParams.delete('et');
+  var bootQuery = bootUrl.search;
+  var shim = '<script>(function(){'
+    + 'try { window.parent.postMessage({ type: ${JSON.stringify(BLOB_BOOT_MESSAGE_TYPE)} }, "*"); } catch (_) {}'
+    + 'var ORIGIN = ' + JSON.stringify(origin) + ', TOKEN = ' + JSON.stringify(token) + ';'
+    + 'window.__AGENTPROTO_BASEURL__ = ORIGIN;'
+    + 'var _h = window.history, _rs = _h.replaceState.bind(_h), _ps = _h.pushState.bind(_h);'
+    + 'function _sameOrLoc(u){'
+    +   'try {'
+    +     'var x = new URL(u == null ? window.location.href : u, document.baseURI);'
+    +     'return x.origin === window.location.origin ? u : window.location.href;'
+    +   '} catch (_) { return window.location.href; }'
+    + '}'
+    + '_h.replaceState = function(s, t, u){'
+    +   'try { _rs(s, t, _sameOrLoc(u)); } catch (_) { try { _rs(s, t, window.location.href); } catch (_) {} }'
+    + '};'
+    + '_h.pushState = function(s, t, u){'
+    +   'try { _ps(s, t, _sameOrLoc(u)); } catch (_) { try { _ps(s, t, window.location.href); } catch (_) {} }'
+    + '};'
+    + 'window.__AGENTPROTO_BOOT_QUERY__ = ' + JSON.stringify(bootQuery) + ';'
+    + 'function withEt(u){'
+    +   'try {'
+    +     'var x = new URL(String(u), document.baseURI);'
+    +     'if (x.origin !== ORIGIN) return null;'
+    +     'if (!x.searchParams.has("et")) x.searchParams.set("et", TOKEN);'
+    +     'return x.href;'
+    +   '} catch (_) { return null; }'
+    + '}'
+    + 'var _fetch = window.fetch;'
+    + 'if (typeof _fetch === "function") {'
+    +   'window.fetch = function(input, init){'
+    +     'var r;'
+    +     'if (typeof Request !== "undefined" && input instanceof Request) {'
+    +       'r = withEt(input.url);'
+    +       'if (r) { try { input = new Request(r, input); } catch (_) {} }'
+    +     '} else {'
+    +       'r = withEt(input);'
+    +       'if (r) input = r;'
+    +     '}'
+    +     'return _fetch.call(window, input, init);'
+    +   '};'
+    + '}'
+    + 'var _ES = window.EventSource;'
+    + 'if (typeof _ES === "function") {'
+    +   'window.EventSource = function(u, cfg){ return new _ES(withEt(u) || u, cfg); };'
+    +   'window.EventSource.prototype = _ES.prototype;'
+    + '}'
+    + '})();<\\/script>';
+  var head = '<base href="' + _blobEscapeAttr(url) + '">' + shim;
+  var m = html.match(/<head[^>]*>/i);
+  var out = m
+    ? html.slice(0, m.index + m[0].length) + head + html.slice(m.index + m[0].length)
+    : head + html;
+  return out.split('fetch("./tool-call"').join('fetch(' + JSON.stringify(tc.href));
+}`;
+}
+
 // src/session-chat/panel.ts
 function escapeAttr(text) {
   return text.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
 }
 function sessionChatEmbedHtml(initData) {
-  const url = initData.url;
-  const link = url != null ? `<a href="${escapeAttr(url)}" target="_blank" rel="noreferrer">open in a tab</a>` : "app not installed";
-  const iframe = url != null ? `<iframe id="chat" title="Session Chat" src="${escapeAttr(url)}"></iframe>` : "";
+  const url = typeof initData.url === "string" && initData.url ? initData.url : null;
+  const notInstalled = initData.installed === false;
+  const link = url != null ? `<a href="${escapeAttr(url)}" target="_blank" rel="noreferrer">open in a tab</a>` : notInstalled ? "app not installed" : "connecting\u2026";
+  const iframe = url != null ? `<iframe id="chat" title="Session Chat"></iframe>` : "";
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -5526,12 +5626,354 @@ function sessionChatEmbedHtml(initData) {
 html,body{height:100%;font-family:system-ui,-apple-system,sans-serif;background:#0d1117;color:#e6edf3;overflow:hidden}
 #bar{padding:6px 12px;font-size:12px;color:#8b949e;background:#161b22;border-bottom:1px solid #30363d}
 #bar a{color:#58a6ff}
-#chat{border:0;display:block;width:100%;height:calc(100% - 29px)}
+#mode{color:#6e7681}
+#stage{position:relative;height:calc(100% - 29px)}
+#chat{position:absolute;inset:0;z-index:2;border:0;display:block;width:100%;height:100%}
+#card{position:absolute;inset:0;z-index:1;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:10px;text-align:center;padding:24px}
+#card h2{font-size:15px;font-weight:600}
+#card .sid{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px;color:#8b949e;background:#161b22;border:1px solid #30363d;border-radius:4px;padding:2px 8px}
+#card p{font-size:12px;color:#8b949e;max-width:420px;line-height:1.5}
+#card a{display:inline-block;margin-top:2px;border:1px solid #30363d;background:#161b22;color:#58a6ff;font-size:13px;padding:7px 14px;border-radius:6px;text-decoration:none}
+#card a:hover{border-color:#58a6ff}
+#notice{display:none;max-width:560px;margin:0 auto;padding:48px 24px;line-height:1.6}
+#notice.show{display:block}
+#notice h1{font-size:18px;margin-bottom:12px}
+#notice code{background:#161b22;border:1px solid #30363d;border-radius:4px;padding:2px 6px;font-size:13px}
+#notice p{margin:8px 0;color:#8b949e;font-size:13px}
 </style>
 </head>
 <body>
-<div id="bar">Session Chat &#183; ${link}</div>
-${iframe}
+<div id="bar">Session Chat &#183; <span id="link">${link}</span><span id="mode"></span></div>
+<div id="stage">${iframe}<div id="card">
+  <h2>Session Chat</h2>
+  <div id="card-session" class="sid">&#8212;</div>
+  <p>Full embed isn't supported by this host &#8212; the chat opens in a browser tab.</p>
+  <a id="card-open" href="#" target="_blank" rel="noreferrer">Open chat</a>
+</div><div id="notice"${notInstalled ? ' class="show"' : ""}>
+  <h1>Session Chat is not installed</h1>
+  <p>This panel is a thin launcher for the <code>@agentik/session-chat</code> app &#8212;
+  it does not bundle the chat UI itself.</p>
+  <p>To use it, install the app into this daemon:</p>
+  <p><code>agentproto app install @agentik/session-chat</code></p>
+</div></div>
+<script>
+window.__APP_INIT__ = ${JSON.stringify(initData)};
+
+${panelBridgeScript("agentproto-session-chat")}
+
+${blobEmbedScript()}
+
+// \u2500\u2500 Session-chat launcher logic \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+var mountedUrl = (window.__APP_INIT__ && window.__APP_INIT__.url) || null;
+var pinnedSessionId = null;   // session named by the host's tool-result push
+var pendingUrl = null;        // url pushed by the host before the bridge was up
+var pendingNotInstalled = false;
+var bridged = false;
+var cardUrl = null;           // deep link once resolved (drives the card button)
+var cardSessionEl = document.getElementById('card-session');
+var cardOpenEl = document.getElementById('card-open');
+var mountGen = 0;             // bumps per mount(); async work checks it before touching the DOM
+var blobUrl = null;           // live object url of the blob-mounted chat, if any
+var blobBootTimer = null;
+var blobBootOk = false;
+
+function escapeHtml(text) {
+  return String(text).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/"/g, '&quot;');
+}
+
+function setMode(text) {
+  document.getElementById('mode').textContent = text ? ' \\u00b7 ' + text : '';
+  // The chat app is live inside the frame \u2014 the launcher bar (title, deep
+  // link, mount mode) is noise on top of the real surface. Hide it and let
+  // the frame own the full height. Only a failed mount (launcher card /
+  // not-installed notice) shows the bar again.
+  var bar = document.getElementById('bar');
+  var stage = document.getElementById('stage');
+  if (bar && stage) {
+    bar.style.display = text ? 'none' : '';
+    stage.style.height = text ? '100%' : 'calc(100% - 29px)';
+  }
+}
+
+// One fresh #chat frame on the stage (over the card), the previous one gone.
+function newFrame() {
+  var stage = document.getElementById('stage');
+  var old = document.getElementById('chat');
+  if (old) old.remove();
+  var frame = document.createElement('iframe');
+  frame.id = 'chat';
+  frame.title = 'Session Chat';
+  stage.insertBefore(frame, stage.firstChild);
+  return frame;
+}
+
+function revokeBlob() {
+  if (blobBootTimer) { clearTimeout(blobBootTimer); blobBootTimer = null; }
+  if (blobUrl) {
+    try { URL.revokeObjectURL(blobUrl); } catch (_) {}
+    blobUrl = null;
+  }
+}
+
+function mount(url) {
+  if (!url || url === mountedUrl) return;
+  mountedUrl = url;
+  var gen = ++mountGen;
+  revokeBlob();
+  document.getElementById('notice').className = '';
+  setCardUrl(url);
+  document.getElementById('link').innerHTML =
+    '<a href="' + escapeHtml(url) + '" target="_blank" rel="noreferrer">open in a tab</a>';
+  var tokened = withEmbedToken(url);
+  if (tokened === url) {
+    // No per-boot token baked in (standalone tab, VS Code HTTP-iframe panel):
+    // the direct frame already passes the daemon's origin checks, and the
+    // blob path's daemon calls would have nothing to carry \u2014 skip it.
+    mountDirect(url);
+    return;
+  }
+  mountBlob(url, tokened, gen).catch(function (err) {
+    if (gen !== mountGen) return;
+    // The fetch itself was refused (host connect-src not merging our
+    // connectDomains, PNA, daemon down, \u2026) \u2014 probe answered: no blob path.
+    console.warn('[session-chat] blob mount failed, falling back to a direct frame:',
+      err && err.message ? err.message : String(err));
+    mountDirect(url);
+  });
+}
+
+// Direct-src iframe of the deep link, with the block probe \u2192 launcher card
+// fallback. The terminal mount path when the blob one is unavailable.
+function mountDirect(url) {
+  var frame = newFrame();
+  frame.src = withEmbedToken(url);
+  setMode('direct frame');
+  armBlockProbe(frame);
+}
+
+// Blob pass-through: fetch the chat html through the embed token, rewrite it
+// for life as a blob: document (transformChatHtmlForBlob, blob-embed.ts) and
+// mount it \u2014 blob: passes a host frame-src that refuses the daemon origin.
+function mountBlob(url, tokened, gen) {
+  return fetch(tokened, { credentials: 'omit' }).then(function (res) {
+    if (!res.ok) throw new Error('HTTP ' + res.status);
+    return res.text();
+  }).then(function (html) {
+    if (gen !== mountGen) return;
+    var doc = transformChatHtmlForBlob(html, url, window.__AGENPROTO_EMBED_TOKEN__);
+    blobUrl = URL.createObjectURL(new Blob([doc], { type: 'text/html' }));
+    var frame = newFrame();
+    armBlobBootProbe(frame, url, gen);
+    frame.src = blobUrl;
+    setMode('embedded');
+  });
+}
+
+// The blob document's shim posts a boot ack as its first statement. No ack
+// within the settle window means the host refused the blob frame or its
+// inherited CSP killed the document's inline scripts \u2014 surface that through
+// the direct-frame path (whose own probe ends on the launcher card) rather
+// than leaving a silent blank.
+window.addEventListener('message', function (evt) {
+  var d = evt.data;
+  if (!d || typeof d !== 'object' || d.type !== ${JSON.stringify(BLOB_BOOT_MESSAGE_TYPE)}) return;
+  var frame = document.getElementById('chat');
+  if (!frame || evt.source !== frame.contentWindow) return;
+  blobBootOk = true;
+  if (blobBootTimer) { clearTimeout(blobBootTimer); blobBootTimer = null; }
+});
+
+function armBlobBootProbe(frame, url, gen) {
+  blobBootOk = false;
+  blobBootTimer = setTimeout(function () {
+    blobBootTimer = null;
+    if (gen !== mountGen || blobBootOk) return;
+    console.warn('[session-chat] blob document never booted (host CSP?), falling back to a direct frame');
+    revokeBlob();
+    frame.remove();
+    mountDirect(url);
+  }, 5000);
+}
+
+function showNotInstalled() {
+  var old = document.getElementById('chat');
+  if (old) old.remove();
+  revokeBlob();
+  setMode('');
+  mountedUrl = null;
+  document.getElementById('card').style.display = 'none';
+  document.getElementById('notice').className = 'show';
+  document.getElementById('link').textContent = 'app not installed';
+}
+
+// The body of an ext-apps tool-result notification, whichever wrapping
+// shape the host uses (params IS the CallToolResult, or nests it under
+// params.result). null for error results / non-JSON text.
+function parseToolResultBody(params) {
+  if (!params || typeof params !== 'object') return null;
+  var res = (params.result && typeof params.result === 'object') ? params.result : params;
+  if (res.isError) return null;
+  var content = Array.isArray(res.content) ? res.content : [];
+  var item = content[0];
+  if (!item || item.type !== 'text' || typeof item.text !== 'string') return null;
+  try { return JSON.parse(item.text); } catch (_) { return null; }
+}
+
+// INLINED COPY of live-session/logic.ts extractToolResultSessionId \u2014 keep
+// in sync. \`sessionId\` (an agentproto_session_chat / live_session result)
+// wins over \`id\` (an agent_start result: the spawned session descriptor).
+function extractToolResultSessionId(params) {
+  var body = parseToolResultBody(params);
+  if (!body) return null;
+  if (typeof body.sessionId === 'string' && body.sessionId) return body.sessionId;
+  if (typeof body.id === 'string' && body.id) return body.id;
+  return null;
+}
+
+// \u2500\u2500 Embed-token refresh \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+// The token baked into this page by registerMcpApps dies with the daemon
+// boot that minted it (runtime embed-tokens.ts), but hosts cache the
+// rendered widget: Claude Desktop keeps a conversation's srcdoc, so after
+// any daemon restart the cached page replays a dead token and every daemon
+// call 403s \u2014 the blob fetch fails, the direct frame is refused, and the
+// user is left on the launcher card forever. Every tool result carries a
+// live token (SessionChatOutput.embedToken), so adopt it before mounting.
+//
+// Only a render that WAS baked refreshes. A standalone tab or VS Code
+// HTTP-iframe panel still holds the literal placeholder and passes the
+// daemon's origin checks on its own; handing it a token would switch it
+// onto the blob path for no reason.
+function adoptEmbedToken(body) {
+  var cur = window.__AGENPROTO_EMBED_TOKEN__;
+  if (!cur || cur === '__AGENPROTO_EMBED_TOKEN__') return;
+  if (!body || typeof body.embedToken !== 'string' || !body.embedToken) return;
+  window.__AGENPROTO_EMBED_TOKEN__ = body.embedToken;
+}
+
+// Turn a session id into the installed app's deep link over the bridge.
+function resolveSession(sessionId) {
+  noteSession(sessionId);
+  return callTool('agentproto_session_chat', sessionId ? { sessionId: sessionId } : {})
+    .then(function(out) {
+      adoptEmbedToken(out);
+      if (out && out.installed && typeof out.url === 'string' && out.url) mount(out.url);
+      else showNotInstalled();
+    })
+    .catch(function(err) {
+      document.getElementById('link').textContent = 'bridge error: ' + (err && err.message ? err.message : String(err));
+    });
+}
+
+// \u2500\u2500 Launcher card (the frame-blocked fallback UI) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+// The iframe mounts OVER the card. When the host's own CSP refuses the
+// frame (Claude Desktop / Codex widget frames run frame-src 'self' blob:
+// data: and do not yet merge csp.frameDomains), the frame stays on a
+// same-origin about:blank \u2014 readable, unlike the loaded cross-origin chat \u2014
+// and is removed after a settle window so the card becomes the interactive
+// surface.
+//
+// The anchor carries target="_blank" rel="noreferrer" as the fallback path,
+// but that is a plain no-op in hosts that sandbox the widget iframe without
+// allow-popups (observed in Claude Desktop's side chat) \u2014 a normal click
+// on such a host does nothing. Where the host advertises the capability
+// (McpUiInitializeResult.hostCapabilities.openLinks in the ext-apps spec,
+// captured by the bridge's getHostCapabilities()), route through the
+// host-mediated ui/open-link request instead, which is not subject to the
+// iframe's popup sandboxing.
+cardOpenEl.addEventListener('click', function (evt) {
+  if (!cardUrl) { evt.preventDefault(); return; }
+  if (getHostCapabilities() && getHostCapabilities().openLinks) {
+    evt.preventDefault();
+    openLink(cardUrl).catch(function () { window.open(cardUrl, '_blank'); });
+  }
+});
+
+function noteSession(id) {
+  if (id && cardSessionEl) cardSessionEl.textContent = id;
+}
+
+function setCardUrl(u) {
+  if (!u) return;
+  cardUrl = u;
+  cardOpenEl.setAttribute('href', u);
+}
+
+// A blocked frame never leaves about:blank (same-origin with this page \u2014
+// readable); the loaded chat is cross-origin (the probe throws). A readable
+// frame that is STILL blank when the settle window closes = blocked.
+function isBlank(frame) {
+  try { return frame.contentWindow.location.href === 'about:blank'; } catch (_) { return false; }
+}
+
+function armBlockProbe(frame) {
+  var settle = null;
+  function probe() {
+    if (settle) { clearTimeout(settle); settle = null; }
+    if (!isBlank(frame)) return;
+    // Still on about:blank right now \u2014 arm the settle window, but
+    // re-check when it closes: a slow (not blocked) load may have landed
+    // in the meantime, and only a frame STILL blank after the window gets
+    // removed. load firing in between clears this timeout above.
+    settle = setTimeout(function () {
+      settle = null;
+      if (isBlank(frame)) frame.remove();
+    }, 2000);
+  }
+  setTimeout(function () {
+    frame.addEventListener('load', probe);
+    probe();
+  }, 100);
+}
+
+// A url baked at render time (a host that re-renders per call with a real
+// initData) mounts on boot \u2014 through the same blob-first path as every
+// other mount, since the same opaque widget context frames it. The
+// pre-rendered #chat frame is replaced by mount()'s own.
+if (mountedUrl) {
+  var bootUrl = mountedUrl;
+  mountedUrl = null;
+  adoptEmbedToken(window.__APP_INIT__);
+  mount(bootUrl);
+}
+
+// The host pushes the triggering tool call's result (ext-apps
+// ui/notifications/tool-result). For agent_start that result IS the spawned
+// session's descriptor \u2014 pin the widget to THAT session.
+onHostNotification(function(method, params) {
+  if (method !== 'ui/notifications/tool-result') return;
+  var body = parseToolResultBody(params);
+  if (!body) return;
+  if (typeof body.url === 'string' && body.url && body.installed !== false) {
+    // Adopt now, not at mount time: the token doesn't depend on the bridge.
+    adoptEmbedToken(body);
+    if (bridged) mount(body.url); else pendingUrl = body.url;
+    return;
+  }
+  if (body.installed === false) {
+    if (bridged) showNotInstalled(); else pendingNotInstalled = true;
+    return;
+  }
+  var id = extractToolResultSessionId(params);
+  if (!id || id === pinnedSessionId) return;
+  pinnedSessionId = id;
+  noteSession(id);
+  if (bridged) resolveSession(id);
+});
+
+initBridge().then(function() {
+  bridged = true;
+  if (pendingUrl) { mount(pendingUrl); pendingUrl = null; return; }
+  if (pendingNotInstalled) { showNotInstalled(); return; }
+  if (mountedUrl) return;                       // rendered with a real url
+  var init = window.__APP_INIT__ || {};
+  if (init.installed === false) { showNotInstalled(); return; }
+  // No url baked in (static ui:// render): resolve over the bridge \u2014 the
+  // pinned session when the host named one, else the app's picker.
+  return resolveSession(pinnedSessionId);
+}).catch(function(err) {
+  document.getElementById('link').textContent = 'bridge error: ' + (err && err.message ? err.message : String(err));
+});
+</script>
 </body>
 </html>`;
 }
@@ -5578,7 +6020,7 @@ function sessionChatAppUrl(httpBaseUrl, sessionId) {
   params.set("embed", "1");
   return `${base}?${params.toString()}`;
 }
-function frameOrigin(httpBaseUrl) {
+function daemonOrigin(httpBaseUrl) {
   return new URL(httpBaseUrl).origin;
 }
 function makeSessionChatApp(ops) {
@@ -5588,12 +6030,27 @@ function makeSessionChatApp(ops) {
     title: "Session Chat",
     description: "Open the Session Chat app \u2014 a chat-thread view of any agentproto daemon session: full transcript replay, live follow-over SSE, and a composer that sends prompts into the same session. Requires the `@agentik/session-chat` app to be installed; without it the panel shows install instructions. Pass `sessionId` to deep-link straight into a known session.",
     inputSchema: sessionChatInputSchema,
-    execute: async (input) => ({
-      installed,
-      url: installed ? sessionChatAppUrl(ops.httpBaseUrl, input.sessionId) : null
-    }),
+    execute: async (input) => {
+      if (!installed) return { installed, url: null };
+      const token = ops.mintEmbedToken?.();
+      return {
+        installed,
+        url: sessionChatAppUrl(ops.httpBaseUrl, input.sessionId),
+        // Re-arms a cached widget whose baked token died with an earlier
+        // daemon boot (see SessionChatOutput.embedToken).
+        ...token ? { embedToken: token } : {}
+      };
+    },
     html: (initData) => sessionChatEmbedHtml(initData),
-    csp: { frameDomains: [frameOrigin(ops.httpBaseUrl)] }
+    // Spec-correct either way (ext-apps McpUiResourceMeta). Measured
+    // 2026-09-18: Claude Desktop / Codex do NOT merge frameDomains into
+    // their widget frame-src; whether they merge connectDomains is unknown,
+    // so the panel probes it at runtime (blob fetch → fallback) rather than
+    // assuming either way.
+    csp: {
+      frameDomains: [daemonOrigin(ops.httpBaseUrl)],
+      connectDomains: [daemonOrigin(ops.httpBaseUrl)]
+    }
   };
 }
 var sessionChatApp = defineApp({
@@ -5623,12 +6080,29 @@ var WORK_BOARD_HTML_GENERATED = `<!DOCTYPE html>
 // JSON-RPC 2.0 over window.parent.postMessage \xB7 spec 2026-01-26
 var _nextId = 1, _pending = {}, _notifyHandlers = [];
 var _hostContext = null, _hostContextHandlers = [];
+var _hostCaps = null;
 var _standaloneApp = null;
 function _isStandalone(){
   return window.parent === window && !!window.McpApp && typeof window.McpApp.connect === 'function';
 }
+// \u2500\u2500 Per-boot embed token (runtime embed-tokens.ts) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+// Panels that iframe the daemon's standalone app host carry this proof so
+// GET /apps/:appId/ui?embed=1&et=... can drop its anti-framing headers for
+// MCP-Apps hosts whose widget context is an opaque origin (Claude Desktop).
+// registerMcpApps replaces the placeholder with a real per-boot token when
+// serving the panel as a resource; every other render (tests, standalone
+// tab, VS Code HTTP-iframe panel \u2014 the latter two already pass
+// iframeEmbedAllowed's origin checks) keeps the literal, and
+// withEmbedToken() then degrades to an identity function.
+window.__AGENPROTO_EMBED_TOKEN__ = "__AGENPROTO_EMBED_TOKEN__";
+function withEmbedToken(url){
+  var t = window.__AGENPROTO_EMBED_TOKEN__;
+  if (!t || t === '__AGENPROTO_EMBED_TOKEN__') return url;
+  return url + (url.indexOf('?') >= 0 ? '&' : '?') + 'et=' + encodeURIComponent(t);
+}
 function post(msg){ window.parent.postMessage(msg, '*'); }
 function getHostContext(){ return _hostContext; }
+function getHostCapabilities(){ return _hostCaps; }
 function onHostContext(cb){
   _hostContextHandlers.push(cb);
   // Replay the last context so a late subscriber isn't stuck blind.
@@ -5691,12 +6165,20 @@ function initBridge(){
     // The initialize result carries the initial hostContext (displayMode +
     // availableDisplayModes) \u2014 capture it before notifying the host.
     if (result && result.hostContext) _setHostContext(result.hostContext);
+    // McpUiInitializeResult.hostCapabilities (ext-apps spec) \u2014 e.g. openLinks,
+    // "Host supports opening external URLs". Captured once, read via
+    // getHostCapabilities() by panels that need to branch on it.
+    if (result && result.hostCapabilities) _hostCaps = result.hostCapabilities;
     rpcNotify('ui/notifications/initialized', {});
   });
 }
 function requestDisplayMode(mode){
   return rpcRequest('ui/request-display-mode', {mode: mode});
 }
+function openLink(url){
+  if (_standaloneApp && typeof _standaloneApp.openLink === 'function') return _standaloneApp.openLink(url);
+  return rpcRequest('ui/open-link', {url: url});
+}
 function callTool(name, args){
   var raw = _standaloneApp
     ? _standaloneApp.callTool(name, args || {})