@agentproto/runtime 3.6.1 → 4.1.0

package/dist/app-ui-delivery.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/app-ui-delivery.ts"],"names":["zlibConstants"],"mappings":";;;;;;;;AA6BO,SAAS,yBAAyB,MAAA,EAAsD;AAC7F,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,MAAM,IAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AACvD,EAAA,IAAI,CAAC,KAAK,OAAO,UAAA;AACjB,EAAA,MAAM,CAAA,uBAAQ,GAAA,EAAoB;AAClC,EAAA,KAAA,MAAW,IAAA,IAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,EAAG;AACjC,IAAA,MAAM,CAAC,IAAA,EAAM,GAAG,MAAM,CAAA,GAAI,IAAA,CAAK,IAAA,EAAK,CAAE,WAAA,EAAY,CAAE,KAAA,CAAM,GAAG,CAAA;AAC7D,IAAA,IAAI,CAAC,IAAA,EAAM;AACX,IAAA,IAAI,MAAA,GAAS,CAAA;AACb,IAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,MAAA,MAAM,CAAA,GAAI,CAAA,CAAE,IAAA,EAAK,CAAE,MAAM,eAAe,CAAA;AACxC,MAAA,IAAI,CAAA,EAAG,MAAA,GAAS,MAAA,CAAO,CAAA,CAAE,CAAC,CAAC,CAAA;AAAA,IAC7B;AACA,IAAA,CAAA,CAAE,GAAA,CAAI,IAAA,KAAS,QAAA,GAAW,MAAA,GAAS,IAAA,EAAM,OAAO,QAAA,CAAS,MAAM,CAAA,GAAI,MAAA,GAAS,CAAC,CAAA;AAAA,EAC/E;AACA,EAAA,MAAM,UAAA,GAAa,CAAC,MAAA,KAA4B;AAC9C,IAAA,MAAM,IAAI,CAAA,CAAE,GAAA,CAAI,MAAM,CAAA,IAAK,CAAA,CAAE,IAAI,GAAG,CAAA;AACpC,IAAA,OAAO,CAAA,KAAM,UAAa,CAAA,GAAI,CAAA;AAAA,EAChC,CAAA;AACA,EAAA,IAAI,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,IAAA;AAC7B,EAAA,IAAI,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,MAAA;AAC/B,EAAA,OAAO,UAAA;AACT;AAMO,SAAS,UAAA,CAAW,MAAuB,OAAA,EAA0B;AAC1E,EAAA,MAAM,MAAA,GAAS,WAAW,QAAQ,CAAA,CAAE,OAAO,IAAI,CAAA,CAAE,OAAO,WAAW,CAAA;AACnE,EAAA,OAAO,UAAU,CAAA,CAAA,EAAI,MAAM,IAAI,OAAO,CAAA,CAAA,CAAA,GAAM,IAAI,MAAM,CAAA,CAAA,CAAA;AACxD;AAIO,SAAS,eAAA,CAAgB,QAAuC,IAAA,EAAuB;AAC5F,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,MAAM,IAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AACvD,EAAA,IAAI,CAAC,KAAK,OAAO,KAAA;AACjB,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACpC,EAAA,KAAA,MAAW,IAAA,IAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA,EAAG;AACjC,IAAA,MAAM,GAAA,GAAM,KAAK,IAAA,EAAK;AACtB,IAAA,IAAI,GAAA,KAAQ,KAAK,OAAO,IAAA;AACxB,IAAA,IAAI,IAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA,KAAM,MAAM,OAAO,IAAA;AAAA,EAC/C;AACA,EAAA,OAAO,KAAA;AACT;AAGO,IAAM,kBAAA,GAAuD;AAAA,EAClE,OAAA,EAAS,0BAAA;AAAA,EACT,MAAA,EAAQ,0BAAA;AAAA,EACR,KAAA,EAAO,gCAAA;AAAA,EACP,MAAA,EAAQ,gCAAA;AAAA,EACR,MAAA,EAAQ,yBAAA;AAAA,EACR,OAAA,EAAS,iCAAA;AAAA,EACT,cAAA,EAAgB,0CAAA;AAAA,EAChB,MAAA,EAAQ,iCAAA;AAAA,EACR,MAAA,EAAQ,eAAA;AAAA,EACR,MAAA,EAAQ,WAAA;AAAA,EACR,MAAA,EAAQ,YAAA;AAAA,EACR,OAAA,EAAS,YAAA;AAAA,EACT,MAAA,EAAQ,WAAA;AAAA,EACR,OAAA,EAAS,YAAA;AAAA,EACT,MAAA,EAAQ,cAAA;AAAA,EACR,OAAA,EAAS,WAAA;AAAA,EACT,QAAA,EAAU,YAAA;AAAA,EACV,MAAA,EAAQ,UAAA;AAAA,EACR,MAAA,EAAQ,2BAAA;AAAA,EACR,OAAA,EAAS;AACX;AAGO,SAAS,iBAAiB,GAAA,EAAqB;AACpD,EAAA,MAAM,GAAA,GAAA,CAAO,IAAI,UAAA,CAAW,GAAG,IAAI,GAAA,GAAM,CAAA,CAAA,EAAI,GAAG,CAAA,CAAA,EAAI,WAAA,EAAY;AAChE,EAAA,OAAO,kBAAA,CAAmB,GAAG,CAAA,IAAK,0BAAA;AACpC;AAIO,SAAS,0BAA0B,WAAA,EAA8B;AACtE,EAAA,MAAM,IAAA,GAAO,YAAY,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA,CAAG,IAAA,EAAK,CAAE,WAAA,EAAY;AAC3D,EAAA,OACE,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA,IACvB,IAAA,KAAS,sBACT,IAAA,KAAS,wBAAA,IACT,IAAA,KAAS,eAAA,IACT,IAAA,KAAS,kBAAA;AAEb;AAIO,SAAS,sBAAsB,IAAA,EAAuB;AAC3D,EAAA,OAAO,gCAAA,CAAiC,KAAK,IAAI,CAAA;AACnD;AAGO,IAAM,uBAAA,GAA0B;AAWhC,SAAS,2BAAA,CACd,UACA,IAAA,EACuB;AACvB,EAAA,MAAM,OAAA,uBAAc,GAAA,CAA2B,CAAC,CAAC,UAAA,EAAY,QAAQ,CAAC,CAAC,CAAA;AACvE,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,IAAA,CAAK,IAAA,IAAQ,UAAA,CAAW,QAAQ,CAAA;AAAA,IACtC,cAAc,IAAA,CAAK,YAAA;AAAA,IACnB,KAAK,MAAA,EAAQ;AACX,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA;AAC9B,MAAA,IAAI,KAAK,OAAO,GAAA;AAChB,MAAA,MAAM,GAAA,GACJ,MAAA,KAAW,IAAA,GACP,kBAAA,CAAmB,QAAA,EAAU;AAAA,QAC3B,MAAA,EAAQ;AAAA,UACN,CAACA,SAAA,CAAc,oBAAoB,GAAG,CAAA;AAAA,UACtC,CAACA,SAAA,CAAc,sBAAsB,GAAG,QAAA,CAAS;AAAA;AACnD,OACD,CAAA,GACD,QAAA,CAAS,UAAU,EAAE,KAAA,EAAO,GAAG,CAAA;AACrC,MAAA,OAAA,CAAQ,GAAA,CAAI,QAAQ,GAAG,CAAA;AACvB,MAAA,OAAO,GAAA;AAAA,IACT;AAAA,GACF;AACF;AAcO,SAAS,yBAAA,CAA0B,aAAa,EAAA,EAAyB;AAC9E,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA2D;AAC/E,EAAA,OAAO;AAAA,IACL,MAAM,GAAA,CAAI,GAAA,EAAK,KAAA,EAAO,KAAA,EAAO;AAC3B,MAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC3B,MAAA,IAAI,GAAA,IAAO,GAAA,CAAI,KAAA,KAAU,KAAA,EAAO;AAC9B,QAAA,OAAA,CAAQ,OAAO,GAAG,CAAA;AAClB,QAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,GAAG,CAAA;AACpB,QAAA,OAAO,GAAA,CAAI,GAAA;AAAA,MACb;AACA,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,EAAM;AACxB,MAAA,OAAA,CAAQ,OAAO,GAAG,CAAA;AAClB,MAAA,OAAA,CAAQ,GAAA,CAAI,GAAA,EAAK,EAAE,KAAA,EAAO,KAAK,CAAA;AAC/B,MAAA,OAAO,OAAA,CAAQ,OAAO,UAAA,EAAY;AAChC,QAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,IAAA,EAAK,CAAE,MAAK,CAAE,KAAA;AACrC,QAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,QAAA,OAAA,CAAQ,OAAO,MAAM,CAAA;AAAA,MACvB;AACA,MAAA,OAAO,GAAA;AAAA,IACT,CAAA;AAAA,IACA,IAAI,IAAA,GAAO;AACT,MAAA,OAAO,OAAA,CAAQ,IAAA;AAAA,IACjB;AAAA,GACF;AACF;AAOO,SAAS,kBAAA,CACd,GAAA,EACA,GAAA,EACA,GAAA,EACA,OAAA,EACM;AAGN,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,SAAA,CAAU,MAAM,CAAA;AAClC,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,GAAI,KAAA,KAAU,MAAA,GAAY,EAAA,GAAK,OAAO,KAAK,CAAA;AACnG,EAAA,MAAM,IAAA,GAAO,mCAAmC,IAAA,CAAK,SAAS,IAC1D,SAAA,GACA,SAAA,GACE,CAAA,EAAG,SAAS,CAAA,iBAAA,CAAA,GACZ,iBAAA;AACN,EAAA,MAAM,MAA8B,EAAE,GAAG,SAAS,IAAA,EAAM,GAAA,CAAI,MAAM,IAAA,EAAK;AACvE,EAAA,IAAI,gBAAgB,GAAA,CAAI,OAAA,CAAQ,eAAe,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,EAAG;AAC3D,IAAA,GAAA,CAAI,SAAA,CAAU,KAAK,GAAG,CAAA;AACtB,IAAA,GAAA,CAAI,GAAA,EAAI;AACR,IAAA;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAS,IAAI,YAAA,GAAe,wBAAA,CAAyB,IAAI,OAAA,CAAQ,iBAAiB,CAAC,CAAA,GAAI,UAAA;AAC7F,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,MAAM,CAAA;AAC5B,EAAA,IAAI,MAAA,KAAW,UAAA,EAAY,GAAA,CAAI,kBAAkB,CAAA,GAAI,MAAA;AACrD,EAAA,GAAA,CAAI,gBAAgB,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA;AAC1C,EAAA,GAAA,CAAI,SAAA,CAAU,KAAK,GAAG,CAAA;AACtB,EAAA,GAAA,CAAI,GAAA,CAAI,GAAA,CAAI,MAAA,KAAW,MAAA,GAAS,SAAY,IAAI,CAAA;AAClD","file":"app-ui-delivery.mjs","sourcesContent":["/**\n * HTTP delivery primitives for the app-UI shell — `GET /apps/:appId/ui` and\n * `GET /apps/:appId/ui/assets/:file` on the daemon (http-server.ts), and the\n * same shapes under `agentproto app serve` (cli/src/app-serve.ts). One\n * module so both hosts negotiate, validate and cache identically:\n *\n *   - `accept-encoding` negotiation (`br` preferred, then `gzip`, else\n *     identity) with `vary: accept-encoding` on every response.\n *   - A strong `etag` (sha256 of the exact bytes served) answered with 304\n *     on a matching `if-none-match`.\n *   - An LRU of encoded representations keyed by a caller-chosen key and\n *     invalidated by a caller-chosen stamp (path + mtime + size for files),\n *     so neither the digest nor the compression reruns until the file\n *     changes.\n *\n * Deliberately scoped to the shell: SSE, MCP and every API route keep their\n * own framing and never go through here.\n */\n\nimport { createHash } from \"node:crypto\"\nimport type { IncomingMessage, ServerResponse } from \"node:http\"\nimport { brotliCompressSync, constants as zlibConstants, gzipSync } from \"node:zlib\"\n\nexport type ContentCoding = \"br\" | \"gzip\" | \"identity\"\n\n/** Pick the response coding from an `accept-encoding` header: `br` when\n *  acceptable, then `gzip`, else identity. q-values are honoured only as\n *  acceptable (`q>0`) vs refused (`q=0`) — the preference order is ours, not\n *  the client's. A `*` entry covers codings the header doesn't name. */\nexport function negotiateContentEncoding(header: string | string[] | undefined): ContentCoding {\n  const raw = Array.isArray(header) ? header.join(\",\") : header\n  if (!raw) return \"identity\"\n  const q = new Map<string, number>()\n  for (const part of raw.split(\",\")) {\n    const [name, ...params] = part.trim().toLowerCase().split(\";\")\n    if (!name) continue\n    let weight = 1\n    for (const p of params) {\n      const m = p.trim().match(/^q=([0-9.]+)$/)\n      if (m) weight = Number(m[1])\n    }\n    q.set(name === \"x-gzip\" ? \"gzip\" : name, Number.isFinite(weight) ? weight : 0)\n  }\n  const acceptable = (coding: string): boolean => {\n    const v = q.get(coding) ?? q.get(\"*\")\n    return v !== undefined && v > 0\n  }\n  if (acceptable(\"br\")) return \"br\"\n  if (acceptable(\"gzip\")) return \"gzip\"\n  return \"identity\"\n}\n\n/** Strong entity tag over `body` (sha256, base64url). `variant`, when set,\n *  is appended so two representations of the same bytes that carry\n *  different response headers (e.g. with/without frame headers) never\n *  validate each other's cache entry. */\nexport function strongEtag(body: Buffer | string, variant?: string): string {\n  const digest = createHash(\"sha256\").update(body).digest(\"base64url\")\n  return variant ? `\"${digest}-${variant}\"` : `\"${digest}\"`\n}\n\n/** `if-none-match` evaluation (RFC 9110 §13.1.2): `*` or any listed tag\n *  equal to `etag` under weak comparison. */\nexport function ifNoneMatchHits(header: string | string[] | undefined, etag: string): boolean {\n  const raw = Array.isArray(header) ? header.join(\",\") : header\n  if (!raw) return false\n  const bare = etag.replace(/^W\\//, \"\")\n  for (const part of raw.split(\",\")) {\n    const tag = part.trim()\n    if (tag === \"*\") return true\n    if (tag.replace(/^W\\//, \"\") === bare) return true\n  }\n  return false\n}\n\n/** Content types the app-UI routes serve, by lowercase extension. */\nexport const APP_UI_MIME_BY_EXT: Readonly<Record<string, string>> = {\n  \".html\": \"text/html; charset=utf-8\",\n  \".htm\": \"text/html; charset=utf-8\",\n  \".js\": \"text/javascript; charset=utf-8\",\n  \".mjs\": \"text/javascript; charset=utf-8\",\n  \".css\": \"text/css; charset=utf-8\",\n  \".json\": \"application/json; charset=utf-8\",\n  \".webmanifest\": \"application/manifest+json; charset=utf-8\",\n  \".map\": \"application/json; charset=utf-8\",\n  \".svg\": \"image/svg+xml\",\n  \".png\": \"image/png\",\n  \".jpg\": \"image/jpeg\",\n  \".jpeg\": \"image/jpeg\",\n  \".gif\": \"image/gif\",\n  \".webp\": \"image/webp\",\n  \".ico\": \"image/x-icon\",\n  \".woff\": \"font/woff\",\n  \".woff2\": \"font/woff2\",\n  \".ttf\": \"font/ttf\",\n  \".txt\": \"text/plain; charset=utf-8\",\n  \".wasm\": \"application/wasm\",\n}\n\n/** Content type for an extension (with or without the leading dot). */\nexport function appUiContentType(ext: string): string {\n  const key = (ext.startsWith(\".\") ? ext : `.${ext}`).toLowerCase()\n  return APP_UI_MIME_BY_EXT[key] ?? \"application/octet-stream\"\n}\n\n/** Whether a content type is worth compressing — text-ish only; woff2/png\n *  and friends are already compressed. */\nexport function isCompressibleContentType(contentType: string): boolean {\n  const base = contentType.split(\";\")[0]!.trim().toLowerCase()\n  return (\n    base.startsWith(\"text/\") ||\n    base === \"application/json\" ||\n    base === \"application/javascript\" ||\n    base === \"image/svg+xml\" ||\n    base === \"application/wasm\"\n  )\n}\n\n/** `:file` segment of the assets route: a flat name from `[A-Za-z0-9._-]`,\n *  not starting with `.` (so no `.`/`..`, no dotfiles), no separators. */\nexport function isValidAppUiAssetName(file: string): boolean {\n  return /^[A-Za-z0-9_-][A-Za-z0-9._-]*$/.test(file)\n}\n\n/** Assets route cache policy — Vite emits content-hashed file names. */\nexport const IMMUTABLE_CACHE_CONTROL = \"public, max-age=31536000, immutable\"\n\n/** One servable body, its strong etag, and its encodings (computed lazily,\n *  memoized — a representation that is never requested as gzip never pays\n *  for it). */\nexport interface EncodedRepresentation {\n  readonly etag: string\n  readonly compressible: boolean\n  body(coding: ContentCoding): Buffer\n}\n\nexport function createEncodedRepresentation(\n  identity: Buffer,\n  opts: { compressible: boolean; etag?: string },\n): EncodedRepresentation {\n  const encoded = new Map<ContentCoding, Buffer>([[\"identity\", identity]])\n  return {\n    etag: opts.etag ?? strongEtag(identity),\n    compressible: opts.compressible,\n    body(coding) {\n      const hit = encoded.get(coding)\n      if (hit) return hit\n      const out =\n        coding === \"br\"\n          ? brotliCompressSync(identity, {\n              params: {\n                [zlibConstants.BROTLI_PARAM_QUALITY]: 5,\n                [zlibConstants.BROTLI_PARAM_SIZE_HINT]: identity.length,\n              },\n            })\n          : gzipSync(identity, { level: 6 })\n      encoded.set(coding, out)\n      return out\n    },\n  }\n}\n\n/** Small LRU of representations. `stamp` is whatever identifies the source\n *  version (e.g. `${mtimeMs}:${size}`); a stamp mismatch rebuilds. Bounded\n *  because some keys fold in request-derived input (the injected base URL). */\nexport interface RepresentationCache {\n  get(\n    key: string,\n    stamp: string,\n    build: () => Promise<EncodedRepresentation> | EncodedRepresentation,\n  ): Promise<EncodedRepresentation>\n  readonly size: number\n}\n\nexport function createRepresentationCache(maxEntries = 64): RepresentationCache {\n  const entries = new Map<string, { stamp: string; rep: EncodedRepresentation }>()\n  return {\n    async get(key, stamp, build) {\n      const hit = entries.get(key)\n      if (hit && hit.stamp === stamp) {\n        entries.delete(key)\n        entries.set(key, hit)\n        return hit.rep\n      }\n      const rep = await build()\n      entries.delete(key)\n      entries.set(key, { stamp, rep })\n      while (entries.size > maxEntries) {\n        const oldest = entries.keys().next().value\n        if (oldest === undefined) break\n        entries.delete(oldest)\n      }\n      return rep\n    },\n    get size() {\n      return entries.size\n    },\n  }\n}\n\n/** Write `rep` to `res` with `headers` (content-type, cache-control, frame\n *  headers — whatever the route decided), adding `etag`, `vary:\n *  accept-encoding`, `content-encoding` and `content-length`. A matching\n *  `if-none-match` answers 304 with the same headers and no body, so a\n *  revalidation refreshes the stored headers exactly as a 200 would. */\nexport function sendRepresentation(\n  req: IncomingMessage,\n  res: ServerResponse,\n  rep: EncodedRepresentation,\n  headers: Record<string, string>,\n): void {\n  // Merge, don't clobber: the daemon's CORS layer may already have set\n  // `Vary: Origin` via setHeader, which a writeHead `vary` would replace.\n  const prior = res.getHeader(\"vary\")\n  const priorVary = Array.isArray(prior) ? prior.join(\", \") : prior === undefined ? \"\" : String(prior)\n  const vary = /(^|,)\\s*accept-encoding\\s*(,|$)/i.test(priorVary)\n    ? priorVary\n    : priorVary\n      ? `${priorVary}, accept-encoding`\n      : \"accept-encoding\"\n  const out: Record<string, string> = { ...headers, etag: rep.etag, vary }\n  if (ifNoneMatchHits(req.headers[\"if-none-match\"], rep.etag)) {\n    res.writeHead(304, out)\n    res.end()\n    return\n  }\n  const coding = rep.compressible ? negotiateContentEncoding(req.headers[\"accept-encoding\"]) : \"identity\"\n  const body = rep.body(coding)\n  if (coding !== \"identity\") out[\"content-encoding\"] = coding\n  out[\"content-length\"] = String(body.length)\n  res.writeHead(200, out)\n  res.end(req.method === \"HEAD\" ? undefined : body)\n}\n"]}

package/dist/app-ui-placeholder.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Self-contained HTML pages served in place of an installed app's real UI
+ * bundle while it's building, or when it can never be served (missing file
+ * with no `ui.build`, a failed build, a removed app dir). Both surfaces that
+ * serve an app's UI as a PAGE — the `ui://app_ui_<id>/view` MCP resource
+ * (app-ui-apps.ts) and `GET /apps/:appId/ui` (http-server.ts) — render
+ * through here instead of ever putting raw `{"error":...}` JSON in a page
+ * body. That JSON shape is kept exactly as-is for MCP TOOL callers (e.g.
+ * `app_install`'s error result) — this module is for the two PAGE routes
+ * only.
+ *
+ * Reload strategy — deliberately two different mechanisms for the two
+ * hosts, because neither works everywhere:
+ *
+ *   - The VS Code webview panel (packages/vscode appPanel.ts) embeds this
+ *     page as an inner `srcdoc` iframe of an outer document it fully
+ *     controls (buildAppHostHtml). `srcdoc` has no URL, so a navigation
+ *     inside it (meta-refresh) just re-parses the SAME string — it can
+ *     never pick up new content on its own. The extension host is what can:
+ *     appPanel.ts detects `BUILDING_STATUS_ATTR` on the returned html and
+ *     re-issues `resources/read` on a timer, replacing `panel.webview.html`
+ *     wholesale until the marker is gone (see appPanel.logic.ts's
+ *     `isAppUiBuilding`).
+ *   - `GET /apps/:appId/ui` (http-server.ts) IS a real top-level navigation
+ *     target, so this page's own `<meta http-equiv="refresh">` re-requests
+ *     the same URL from the server directly — no host cooperation needed.
+ *
+ * Both mechanisms are outside this module's own script, which is
+ * deliberate: the page also has to survive the strictest CSP either host
+ * imposes — the VS Code outer document sets `default-src 'none'; script-src
+ * 'unsafe-inline'; style-src 'unsafe-inline'` with NO `connect-src`, and the
+ * srcdoc iframe inherits it verbatim, so nothing here may `fetch`, open a
+ * `WebSocket`/`EventSource`, or load an external image/font. The one bit of
+ * live JS this page does carry — the elapsed-time counter — only touches
+ * `Date.now()` and the DOM off a baked-in timestamp, neither of which needs
+ * network access.
+ */
+/** `data-agentproto-ui-status` value while a build is in flight (or about to
+ *  start) — `appPanel.logic.ts`'s `isAppUiBuilding` matches on this exact
+ *  attribute/value pair; keep the two in lockstep (same cross-package
+ *  duplication the file's own `appUiToolId` already accepts, since a
+ *  `ui://`-served page can't import back into `@agentproto/vscode`). */
+declare const APP_UI_BUILDING_STATUS_ATTR = "data-agentproto-ui-status=\"building\"";
+interface AppUiBuildingHtmlInput {
+    readonly appName: string;
+    /** `Date.now()`-style epoch ms the build actually started — the elapsed
+     *  counter is computed client-side off this, not baked in as static text,
+     *  so it keeps ticking between reloads. */
+    readonly startedAt: number;
+    /** Last lines of `.agentproto/ui-build.log`, if cheap to read. */
+    readonly logTail?: string;
+}
+/** The "still building" placeholder — see the module doc for the reload
+ *  strategy. Never blocks on the build itself; the caller decides when to
+ *  show this (app-ui-build.ts's `resolveAppUiBuildState`). */
+declare function renderAppUiBuildingHtml(input: AppUiBuildingHtmlInput): string;
+interface AppUiErrorHtmlInput {
+    readonly appName: string;
+    readonly message: string;
+    /** A path worth showing verbatim (the missing file, the removed app dir,
+     *  the build log). */
+    readonly detailPath?: string;
+    readonly logTail?: string;
+    /** Defaults to the generic reinstall/APP.md pointer. */
+    readonly fix?: string;
+}
+/** A readable terminal-failure page — never auto-reloads (unlike the
+ *  building placeholder): the failure already happened, and refreshing a
+ *  failed `ui.build` run on a timer would just re-run it forever. A human
+ *  reloading the panel/tab gets a fresh attempt instead. */
+declare function renderAppUiErrorHtml(input: AppUiErrorHtmlInput): string;
+
+export { APP_UI_BUILDING_STATUS_ATTR, type AppUiBuildingHtmlInput, type AppUiErrorHtmlInput, renderAppUiBuildingHtml, renderAppUiErrorHtml };

package/dist/app-ui-placeholder.mjs

@@ -0,0 +1,89 @@
+/**
+ * @agentproto/runtime v0.1.0-alpha
+ * Long-running gateway: MCP server + HTTP transport + HEARTBEAT autonomy + conversation persistence over a workspace dir.
+ */
+
+// src/app-ui-placeholder.ts
+var APP_UI_BUILDING_STATUS_ATTR = 'data-agentproto-ui-status="building"';
+var REFRESH_SECONDS = 3;
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function pageShell(opts) {
+  return `<!DOCTYPE html>
+<html lang="en"${opts.statusAttr ? ` ${opts.statusAttr}` : ""}>
+<head>
+<meta charset="UTF-8">
+${opts.refresh ? `<meta http-equiv="refresh" content="${REFRESH_SECONDS}">` : ""}
+<title>${escapeHtml(opts.title)}</title>
+<style>
+  :root { color-scheme: light dark; }
+  html, body { height: 100%; }
+  body {
+    margin: 0; padding: 2rem; box-sizing: border-box;
+    display: flex; flex-direction: column; align-items: center; justify-content: center;
+    font: 14px -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+    color: #ccc; background: #1e1e1e; text-align: center;
+  }
+  h1 { font-size: 1rem; font-weight: 600; margin: 0 0 0.5rem; }
+  p { margin: 0.25rem 0; color: #999; max-width: 34rem; }
+  .spinner {
+    width: 22px; height: 22px; margin-bottom: 1rem;
+    border: 2px solid #444; border-top-color: #8ab4f8; border-radius: 50%;
+    animation: agentproto-spin 0.8s linear infinite;
+  }
+  @keyframes agentproto-spin { to { transform: rotate(360deg); } }
+  pre {
+    margin-top: 1rem; padding: 0.75rem; max-width: 42rem; width: 90%;
+    max-height: 12rem; overflow: auto; text-align: left; white-space: pre-wrap;
+    word-break: break-word; background: #111; border: 1px solid #333;
+    border-radius: 4px; font: 12px ui-monospace, SFMono-Regular, Menlo, monospace; color: #d99;
+  }
+  code { color: #ccc; }
+</style>
+</head>
+<body>
+${opts.body}
+${opts.script ? `<script>${opts.script}</script>` : ""}
+</body>
+</html>`;
+}
+function renderAppUiBuildingHtml(input) {
+  const body = `
+  <div class="spinner" role="status" aria-label="Building"></div>
+  <h1>Building ${escapeHtml(input.appName)} UI&hellip;</h1>
+  <p id="agentproto-elapsed">elapsed 0s</p>
+  ${input.logTail ? `<pre>${escapeHtml(input.logTail)}</pre>` : ""}`;
+  const script = `(function () {
+  var startedAt = ${JSON.stringify(input.startedAt)};
+  var el = document.getElementById("agentproto-elapsed");
+  function tick() {
+    if (!el) return;
+    var secs = Math.max(0, Math.round((Date.now() - startedAt) / 1000));
+    el.textContent = "elapsed " + secs + "s";
+  }
+  tick();
+  setInterval(tick, 1000);
+})();`;
+  return pageShell({
+    statusAttr: APP_UI_BUILDING_STATUS_ATTR,
+    refresh: true,
+    title: `Building ${input.appName}\u2026`,
+    body,
+    script
+  });
+}
+function renderAppUiErrorHtml(input) {
+  const fix = input.fix ?? "Reinstall the app with `app_install <dir>`, or check its APP.md `ui` block.";
+  const body = `
+  <h1>${escapeHtml(input.appName)} UI is unavailable</h1>
+  <p>${escapeHtml(input.message)}</p>
+  ${input.detailPath ? `<p><code>${escapeHtml(input.detailPath)}</code></p>` : ""}
+  <p>${escapeHtml(fix)}</p>
+  ${input.logTail ? `<pre>${escapeHtml(input.logTail)}</pre>` : ""}`;
+  return pageShell({ title: `${input.appName}: UI unavailable`, body });
+}
+
+export { APP_UI_BUILDING_STATUS_ATTR, renderAppUiBuildingHtml, renderAppUiErrorHtml };
+//# sourceMappingURL=app-ui-placeholder.mjs.map
+//# sourceMappingURL=app-ui-placeholder.mjs.map

package/dist/app-ui-placeholder.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/app-ui-placeholder.ts"],"names":[],"mappings":";;;;;;AA2CO,IAAM,2BAAA,GAA8B;AAE3C,IAAM,eAAA,GAAkB,CAAA;AAExB,SAAS,WAAW,IAAA,EAAsB;AACxC,EAAA,OAAO,IAAA,CACJ,OAAA,CAAQ,IAAA,EAAM,OAAO,EACrB,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA,CACpB,QAAQ,IAAA,EAAM,MAAM,CAAA,CACpB,OAAA,CAAQ,MAAM,QAAQ,CAAA;AAC3B;AAEA,SAAS,UAAU,IAAA,EAMR;AACT,EAAA,OAAO,CAAA;AAAA,eAAA,EACQ,KAAK,UAAA,GAAa,CAAA,CAAA,EAAI,IAAA,CAAK,UAAU,KAAK,EAAE,CAAA;AAAA;AAAA;AAAA,EAG3D,IAAA,CAAK,OAAA,GAAU,CAAA,oCAAA,EAAuC,eAAe,OAAO,EAAE;AAAA,OAAA,EACvE,UAAA,CAAW,IAAA,CAAK,KAAK,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA4B7B,KAAK,IAAI;AAAA,EACT,KAAK,MAAA,GAAS,CAAA,QAAA,EAAW,IAAA,CAAK,MAAM,cAAc,EAAE;AAAA;AAAA,OAAA,CAAA;AAGtD;AAeO,SAAS,wBAAwB,KAAA,EAAuC;AAC7E,EAAA,MAAM,IAAA,GAAO;AAAA;AAAA,eAAA,EAEE,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA;AAAA,EAAA,EAEtC,KAAA,CAAM,UAAU,CAAA,KAAA,EAAQ,UAAA,CAAW,MAAM,OAAO,CAAC,WAAW,EAAE,CAAA,CAAA;AAChE,EAAA,MAAM,MAAA,GAAS,CAAA;AAAA,kBAAA,EACG,IAAA,CAAK,SAAA,CAAU,KAAA,CAAM,SAAS,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KAAA,CAAA;AAUjD,EAAA,OAAO,SAAA,CAAU;AAAA,IACf,UAAA,EAAY,2BAAA;AAAA,IACZ,OAAA,EAAS,IAAA;AAAA,IACT,KAAA,EAAO,CAAA,SAAA,EAAY,KAAA,CAAM,OAAO,CAAA,MAAA,CAAA;AAAA,IAChC,IAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAiBO,SAAS,qBAAqB,KAAA,EAAoC;AACvE,EAAA,MAAM,GAAA,GACJ,MAAM,GAAA,IACN,6EAAA;AACF,EAAA,MAAM,IAAA,GAAO;AAAA,MAAA,EACP,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,KAAA,EAC1B,UAAA,CAAW,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,EAAA,EAC5B,KAAA,CAAM,aAAa,CAAA,SAAA,EAAY,UAAA,CAAW,MAAM,UAAU,CAAC,gBAAgB,EAAE;AAAA,KAAA,EAC1E,UAAA,CAAW,GAAG,CAAC,CAAA;AAAA,EAAA,EAClB,KAAA,CAAM,UAAU,CAAA,KAAA,EAAQ,UAAA,CAAW,MAAM,OAAO,CAAC,WAAW,EAAE,CAAA,CAAA;AAChE,EAAA,OAAO,SAAA,CAAU,EAAE,KAAA,EAAO,CAAA,EAAG,MAAM,OAAO,CAAA,gBAAA,CAAA,EAAoB,MAAM,CAAA;AACtE","file":"app-ui-placeholder.mjs","sourcesContent":["/**\n * Self-contained HTML pages served in place of an installed app's real UI\n * bundle while it's building, or when it can never be served (missing file\n * with no `ui.build`, a failed build, a removed app dir). Both surfaces that\n * serve an app's UI as a PAGE — the `ui://app_ui_<id>/view` MCP resource\n * (app-ui-apps.ts) and `GET /apps/:appId/ui` (http-server.ts) — render\n * through here instead of ever putting raw `{\"error\":...}` JSON in a page\n * body. That JSON shape is kept exactly as-is for MCP TOOL callers (e.g.\n * `app_install`'s error result) — this module is for the two PAGE routes\n * only.\n *\n * Reload strategy — deliberately two different mechanisms for the two\n * hosts, because neither works everywhere:\n *\n *   - The VS Code webview panel (packages/vscode appPanel.ts) embeds this\n *     page as an inner `srcdoc` iframe of an outer document it fully\n *     controls (buildAppHostHtml). `srcdoc` has no URL, so a navigation\n *     inside it (meta-refresh) just re-parses the SAME string — it can\n *     never pick up new content on its own. The extension host is what can:\n *     appPanel.ts detects `BUILDING_STATUS_ATTR` on the returned html and\n *     re-issues `resources/read` on a timer, replacing `panel.webview.html`\n *     wholesale until the marker is gone (see appPanel.logic.ts's\n *     `isAppUiBuilding`).\n *   - `GET /apps/:appId/ui` (http-server.ts) IS a real top-level navigation\n *     target, so this page's own `<meta http-equiv=\"refresh\">` re-requests\n *     the same URL from the server directly — no host cooperation needed.\n *\n * Both mechanisms are outside this module's own script, which is\n * deliberate: the page also has to survive the strictest CSP either host\n * imposes — the VS Code outer document sets `default-src 'none'; script-src\n * 'unsafe-inline'; style-src 'unsafe-inline'` with NO `connect-src`, and the\n * srcdoc iframe inherits it verbatim, so nothing here may `fetch`, open a\n * `WebSocket`/`EventSource`, or load an external image/font. The one bit of\n * live JS this page does carry — the elapsed-time counter — only touches\n * `Date.now()` and the DOM off a baked-in timestamp, neither of which needs\n * network access.\n */\n\n/** `data-agentproto-ui-status` value while a build is in flight (or about to\n *  start) — `appPanel.logic.ts`'s `isAppUiBuilding` matches on this exact\n *  attribute/value pair; keep the two in lockstep (same cross-package\n *  duplication the file's own `appUiToolId` already accepts, since a\n *  `ui://`-served page can't import back into `@agentproto/vscode`). */\nexport const APP_UI_BUILDING_STATUS_ATTR = 'data-agentproto-ui-status=\"building\"'\n\nconst REFRESH_SECONDS = 3\n\nfunction escapeHtml(text: string): string {\n  return text\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n}\n\nfunction pageShell(opts: {\n  statusAttr?: string\n  refresh?: boolean\n  title: string\n  body: string\n  script?: string\n}): string {\n  return `<!DOCTYPE html>\n<html lang=\"en\"${opts.statusAttr ? ` ${opts.statusAttr}` : \"\"}>\n<head>\n<meta charset=\"UTF-8\">\n${opts.refresh ? `<meta http-equiv=\"refresh\" content=\"${REFRESH_SECONDS}\">` : \"\"}\n<title>${escapeHtml(opts.title)}</title>\n<style>\n  :root { color-scheme: light dark; }\n  html, body { height: 100%; }\n  body {\n    margin: 0; padding: 2rem; box-sizing: border-box;\n    display: flex; flex-direction: column; align-items: center; justify-content: center;\n    font: 14px -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n    color: #ccc; background: #1e1e1e; text-align: center;\n  }\n  h1 { font-size: 1rem; font-weight: 600; margin: 0 0 0.5rem; }\n  p { margin: 0.25rem 0; color: #999; max-width: 34rem; }\n  .spinner {\n    width: 22px; height: 22px; margin-bottom: 1rem;\n    border: 2px solid #444; border-top-color: #8ab4f8; border-radius: 50%;\n    animation: agentproto-spin 0.8s linear infinite;\n  }\n  @keyframes agentproto-spin { to { transform: rotate(360deg); } }\n  pre {\n    margin-top: 1rem; padding: 0.75rem; max-width: 42rem; width: 90%;\n    max-height: 12rem; overflow: auto; text-align: left; white-space: pre-wrap;\n    word-break: break-word; background: #111; border: 1px solid #333;\n    border-radius: 4px; font: 12px ui-monospace, SFMono-Regular, Menlo, monospace; color: #d99;\n  }\n  code { color: #ccc; }\n</style>\n</head>\n<body>\n${opts.body}\n${opts.script ? `<script>${opts.script}</script>` : \"\"}\n</body>\n</html>`\n}\n\nexport interface AppUiBuildingHtmlInput {\n  readonly appName: string\n  /** `Date.now()`-style epoch ms the build actually started — the elapsed\n   *  counter is computed client-side off this, not baked in as static text,\n   *  so it keeps ticking between reloads. */\n  readonly startedAt: number\n  /** Last lines of `.agentproto/ui-build.log`, if cheap to read. */\n  readonly logTail?: string\n}\n\n/** The \"still building\" placeholder — see the module doc for the reload\n *  strategy. Never blocks on the build itself; the caller decides when to\n *  show this (app-ui-build.ts's `resolveAppUiBuildState`). */\nexport function renderAppUiBuildingHtml(input: AppUiBuildingHtmlInput): string {\n  const body = `\n  <div class=\"spinner\" role=\"status\" aria-label=\"Building\"></div>\n  <h1>Building ${escapeHtml(input.appName)} UI&hellip;</h1>\n  <p id=\"agentproto-elapsed\">elapsed 0s</p>\n  ${input.logTail ? `<pre>${escapeHtml(input.logTail)}</pre>` : \"\"}`\n  const script = `(function () {\n  var startedAt = ${JSON.stringify(input.startedAt)};\n  var el = document.getElementById(\"agentproto-elapsed\");\n  function tick() {\n    if (!el) return;\n    var secs = Math.max(0, Math.round((Date.now() - startedAt) / 1000));\n    el.textContent = \"elapsed \" + secs + \"s\";\n  }\n  tick();\n  setInterval(tick, 1000);\n})();`\n  return pageShell({\n    statusAttr: APP_UI_BUILDING_STATUS_ATTR,\n    refresh: true,\n    title: `Building ${input.appName}…`,\n    body,\n    script,\n  })\n}\n\nexport interface AppUiErrorHtmlInput {\n  readonly appName: string\n  readonly message: string\n  /** A path worth showing verbatim (the missing file, the removed app dir,\n   *  the build log). */\n  readonly detailPath?: string\n  readonly logTail?: string\n  /** Defaults to the generic reinstall/APP.md pointer. */\n  readonly fix?: string\n}\n\n/** A readable terminal-failure page — never auto-reloads (unlike the\n *  building placeholder): the failure already happened, and refreshing a\n *  failed `ui.build` run on a timer would just re-run it forever. A human\n *  reloading the panel/tab gets a fresh attempt instead. */\nexport function renderAppUiErrorHtml(input: AppUiErrorHtmlInput): string {\n  const fix =\n    input.fix ??\n    \"Reinstall the app with `app_install <dir>`, or check its APP.md `ui` block.\"\n  const body = `\n  <h1>${escapeHtml(input.appName)} UI is unavailable</h1>\n  <p>${escapeHtml(input.message)}</p>\n  ${input.detailPath ? `<p><code>${escapeHtml(input.detailPath)}</code></p>` : \"\"}\n  <p>${escapeHtml(fix)}</p>\n  ${input.logTail ? `<pre>${escapeHtml(input.logTail)}</pre>` : \"\"}`\n  return pageShell({ title: `${input.appName}: UI unavailable`, body })\n}\n"]}

package/dist/catalog-models.d.ts

@@ -1,8 +1,10 @@
 import { AuthProfile } from '@agentproto/auth';
-import { A as AdapterAuthDescriptor } from './spawn-defaults-CwI9Puwy.js';
-import { R as RouteSpec } from './session-config-DbWP9RRj.js';
+import { A as AdapterAuthDescriptor } from './spawn-defaults-CZj39Znq.js';
+import { R as RouteSpec } from './session-config-ByfVeEQJ.js';
+import './context-continuity-Bn99UtVC.js';
+import '@agentproto/acp';
+import '@agentproto/command-sandbox';
 import '@agentproto/model-catalog';
-import './context-continuity-ib9_bVYM.js';
 
 /**
  * Read-only catalog/vendor endpoint (`agentproto-session-config-axes`