@agentproto/runtime 3.2.0 → 3.3.0

package/dist/index.d.ts

@@ -3899,8 +3899,12 @@ type WorktreeGcClass = "reclaim" | "salvage" | "hold";
  * `orphan` is set on an entry/outcome the orphan scan found — a directory
  * physically present under the repo's worktree pool with no `git worktree
  * list` entry at all (see `WorktreeGcPlanEntryView.orphan`).
+ * `prunable` is set on an entry/outcome `git worktree list --porcelain`
+ * itself already reported dead — the mirror image of `orphan`: the
+ * registration is still there, but the working directory is gone (see
+ * `WorktreeGcPlanEntryView.prunable`).
  */
-type WorktreeGcReclaimReason = "dep-bump" | "orphan";
+type WorktreeGcReclaimReason = "dep-bump" | "orphan" | "prunable";
 /**
  * One entry of the dry-run plan — a runtime-local projection of a
  * `GcPlanEntry`. `tree` / `integration` / `liveness` are flattened to their
@@ -3912,7 +3916,7 @@ interface WorktreeGcPlanEntryView {
     branch: string | null;
     head: string;
     class: WorktreeGcClass;
-    /** Set only when `class === "reclaim"` via the dep-bump exemption or the orphan scan. */
+    /** Set only when `class === "reclaim"` via the dep-bump exemption, the orphan scan, or the prunable signal. */
     reclaimReason?: WorktreeGcReclaimReason;
     /**
      * `true` only for an orphan-scan entry: a directory physically present
@@ -3923,6 +3927,13 @@ interface WorktreeGcPlanEntryView {
      * literal `"orphan"` placeholder below rather than a fabricated value.
      */
     orphan?: boolean;
+    /**
+     * `true` only for a linked worktree `git worktree list --porcelain` itself
+     * already marked `prunable`. Same reasoning as `orphan` above — no
+     * tree/integration/liveness axis was ever read for a working directory
+     * that's gone — projected as the literal `"prunable"` placeholder below.
+     */
+    prunable?: boolean;
     tree: string;
     integration: {
         state: string;

package/dist/index.mjs

@@ -25,7 +25,7 @@ import { inferLegacyModeKind, parseModelSwitchCommand, isModelSwitchAcknowledgem
 import { loadSandboxConfig, resolveCommandSandbox, COMMAND_SANDBOX_MODE_ENV } from '@agentproto/command-sandbox';
 import { createBrainManager, parseKnowledgeConfig } from '@agentproto/workspace-brain';
 import { defineHttpDriver } from '@agentproto/driver-http';
-import { makeSessionsPanelApp, makeAgentsOverviewApp, makeBureauSessionsApp, makeSessionStoryPanelApp, makeLiveSessionApp, makeSessionChatApp, makeWorkBoardApp, SESSION_CHAT_APP_ID, sessionsPanelApp, agentsOverviewApp, bureauSessionsApp, sessionStoryApp, liveSessionApp, sessionChatApp, workBoardApp } from '@agentproto/apps';
+import { liveSessionApp, makeLiveSessionApp, sessionsPanelApp, agentsOverviewApp, bureauSessionsApp, sessionStoryApp, workBoardApp, makeSessionsPanelApp, makeAgentsOverviewApp, makeBureauSessionsApp, makeSessionStoryPanelApp, makeSessionChatApp, makeWorkBoardApp, SESSION_CHAT_APP_ID, sessionChatApp } from '@agentproto/apps';
 import matter2 from 'gray-matter';
 import { createServer } from 'http';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
@@ -20343,6 +20343,18 @@ var PANEL_APP_HANDLES = [
   sessionChatApp,
   workBoardApp
 ];
+function resolveBuiltinPanelUi(appId, httpBaseUrl) {
+  if (appId === liveSessionApp.id) {
+    const app = makeLiveSessionApp({ httpBaseUrl });
+    const html = typeof app.html === "function" ? app.html({ httpBaseUrl }) : app.html;
+    return { html, tools: liveSessionApp.ui?.tools ?? [] };
+  }
+  const handle = [sessionsPanelApp, agentsOverviewApp, bureauSessionsApp, sessionStoryApp, workBoardApp].find(
+    (h) => h.id === appId
+  );
+  if (!handle?.ui) return void 0;
+  return { html: handle.ui.html, tools: handle.ui.tools ?? [] };
+}
 function builtinPanelCatalogEntries() {
   const apps = makeBuiltinPanelApps({
     listSessions: () => [],
@@ -21953,12 +21965,7 @@ function notEnabled(tool) {
     `${tool} is not enabled \u2014 the daemon was started without an adapter resolver. Re-run the daemon with the \`@agentproto/cli\` shim wired (see playground/scripts/gateway.ts).`
   );
 }
-async function performAppToolCall(appRegistry, input, deps2) {
-  const installed = appRegistry.getApp(input.appId);
-  if (!installed || !installed.ui) {
-    return errorResult2(`app_tool_call: app "${input.appId}" is not installed or has no UI.`);
-  }
-  const declaredAllowlist = installed.ui.tools ?? [];
+async function dispatchAllowlistedAppTool(declaredAllowlist, input, deps2) {
   const effectiveAllowlist = [...declaredAllowlist, ...APP_UI_DISCOVERY_TOOLS];
   if (!effectiveAllowlist.includes(input.tool)) {
     return errorResult2(
@@ -21986,6 +21993,19 @@ async function performAppToolCall(appRegistry, input, deps2) {
     return errorResult2(`app_tool_call: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+async function performAppToolCall(appRegistry, input, deps2) {
+  const installed = appRegistry.getApp(input.appId);
+  if (!installed || !installed.ui) {
+    return errorResult2(`app_tool_call: app "${input.appId}" is not installed or has no UI.`);
+  }
+  return dispatchAllowlistedAppTool(installed.ui.tools ?? [], input, deps2);
+}
+async function performBuiltinPanelToolCall(tools, input, deps2) {
+  if (tools === void 0) {
+    return errorResult2(`app_tool_call: app "${input.appId}" is not installed or has no UI.`);
+  }
+  return dispatchAllowlistedAppTool(tools, input, deps2);
+}
 function refIdOf(ref) {
   if (typeof ref === "string") return ref;
   return ref.ref ?? ref.file ?? "inline";
@@ -26688,6 +26708,7 @@ var DEFAULT_ALLOWED_ORIGINS = [
   // matching how guilde.work is trusted. Drop it via `strictOrigins`.
   "https://cli.agentproto.sh"
 ];
+var DEFAULT_FRAME_ANCESTORS = ["vscode-webview:"];
 var PROXY_FORWARDING_HEADERS = [
   "x-forwarded-for",
   "forwarded",
@@ -28050,7 +28071,8 @@ async function startHttpServer(opts) {
               req,
               res,
               decodeURIComponent(uiMatch[1]),
-              opts.appRegistry
+              opts.appRegistry,
+              [...DEFAULT_FRAME_ANCESTORS, ...opts.frameAncestors ?? []]
             );
             return;
           }
@@ -28601,7 +28623,9 @@ function parseMcpServersField(raw) {
     servers.push({
       name: o.name,
       transport: o.transport,
-      ...typeof o.ref === "string" ? { ref: o.ref } : {}
+      ...typeof o.ref === "string" ? { ref: o.ref } : {},
+      ...isStringRecord(o.headers) ? { headers: o.headers } : {},
+      ...typeof o.credentialRef === "string" ? { credentialRef: o.credentialRef } : {}
     });
   }
   return servers;
@@ -30749,33 +30773,43 @@ async function handleProviderInbound(req, res, slug, deps2) {
   res.writeHead(200, { "content-type": "application/json" });
   res.end(JSON.stringify(result));
 }
-async function handleAppUiPage(req, res, appId, appRegistry) {
+function requestHttpBaseUrl(req) {
+  return `http://${req.headers.host ?? "127.0.0.1"}`;
+}
+async function handleAppUiPage(req, res, appId, appRegistry, frameAncestors) {
   const app = appRegistry.getApp(appId);
-  if (!app?.ui) {
+  const builtin = app?.ui ? void 0 : resolveBuiltinPanelUi(appId, requestHttpBaseUrl(req));
+  if (!app?.ui && !builtin) {
     res.writeHead(404, { "content-type": "application/json" });
     res.end(JSON.stringify({ error: `app "${appId}" is not installed or has no UI.` }));
     return;
   }
   let raw;
-  try {
-    raw = await readFile(app.ui.path, "utf8");
-  } catch (err) {
-    res.writeHead(500, { "content-type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: `could not read app "${appId}"'s ui html at "${app.ui.path}": ${err instanceof Error ? err.message : String(err)}`
-      })
-    );
-    return;
+  if (app?.ui) {
+    try {
+      raw = await readFile(app.ui.path, "utf8");
+    } catch (err) {
+      res.writeHead(500, { "content-type": "application/json" });
+      res.end(
+        JSON.stringify({
+          error: `could not read app "${appId}"'s ui html at "${app.ui.path}": ${err instanceof Error ? err.message : String(err)}`
+        })
+      );
+      return;
+    }
+  } else {
+    raw = builtin.html;
   }
   const embedRequested = new URL(req.url ?? "/", "http://localhost").searchParams.get("embed") === "1";
   const headers = {
     "content-type": "text/html; charset=utf-8",
     "cache-control": "no-store"
   };
-  if (!(embedRequested && iframeEmbedAllowed(req, app))) {
-    headers["x-frame-options"] = "DENY";
-    headers["content-security-policy"] = "frame-ancestors 'none'";
+  if (!(embedRequested && iframeEmbedAllowed(req, app ?? {}))) {
+    headers["content-security-policy"] = `frame-ancestors 'self' ${frameAncestors.join(" ")}`.trimEnd();
+    if (frameAncestors.length === 0) {
+      headers["x-frame-options"] = "SAMEORIGIN";
+    }
   }
   res.writeHead(200, headers);
   res.end(injectStandaloneAppBridge(raw));
@@ -30911,7 +30945,12 @@ async function handleAppUiToolCall(req, res, appId, appRegistry, deps2) {
     tool = inner.tool;
     args = inner.args && typeof inner.args === "object" && !Array.isArray(inner.args) ? inner.args : {};
   }
-  const result = await performAppToolCall(appRegistry, { appId, tool, args }, deps2);
+  const installed = appRegistry.getApp(appId);
+  const result = installed?.ui ? await performAppToolCall(appRegistry, { appId, tool, args }, deps2) : await performBuiltinPanelToolCall(
+    resolveBuiltinPanelUi(appId, requestHttpBaseUrl(req))?.tools,
+    { appId, tool, args },
+    deps2
+  );
   res.writeHead(200, { "content-type": "application/json" });
   res.end(JSON.stringify(result));
 }