@agentproto/runtime 5.10.0 → 5.11.1

package/dist/index.mjs

@@ -30,7 +30,7 @@ import { APP_UI_DISCOVERY_TOOLS, RUNNER_SELECT_SCRIPT } from '@agentproto/app-cl
 import { DISPLAY_MODE_SCRIPT } from '@agentproto/app-client/display-mode';
 import { defineTool, catchErrors, ToolError, pageParamsShape, paginated, toToolResult, paginate, toolText } from '@agentproto/tool';
 import { toMcpTool, createMcpServer, registerBuiltinTool, registerUiResource, registerEventsMethods } from '@agentproto/mcp-server';
-import { SESSION_CHAT_APP_ID, liveSessionApp, makeLiveSessionApp, sessionsPanelApp, agentsOverviewApp, bureauSessionsApp, sessionStoryApp, workBoardApp, reviewPanelApp, makeSessionsPanelApp, makeAgentsOverviewApp, makeBureauSessionsApp, makeSessionStoryPanelApp, makeSessionChatApp, makeWorkBoardApp, makeReviewPanelApp, sessionChatApp } from '@agentproto/apps';
+import { storeApp, SESSION_CHAT_APP_ID, liveSessionApp, makeLiveSessionApp, sessionsPanelApp, agentsOverviewApp, bureauSessionsApp, sessionStoryApp, workBoardApp, reviewPanelApp, makeSessionsPanelApp, makeAgentsOverviewApp, makeBureauSessionsApp, makeSessionStoryPanelApp, makeSessionChatApp, makeWorkBoardApp, makeReviewPanelApp, makeStoreApp, sessionChatApp } from '@agentproto/apps';
 import { EventEmitter } from 'events';
 import { inferLegacyModeKind, parseModelSwitchCommand, isModelSwitchAcknowledgement } from '@agentproto/driver-agent-cli';
 import { lookup } from 'dns/promises';
@@ -27928,6 +27928,185 @@ init_context_continuity();
 // src/session-capabilities.ts
 init_canonical_posture();
 init_conversation_store();
+
+// src/mcp-session-observer.ts
+var OBSERVED_METHODS = /* @__PURE__ */ new Set([
+  "initialize",
+  "server/discover",
+  "tools/list"
+]);
+var MAX_DESCRIPTION_CHARS = 200;
+var DEFAULT_MAX_SESSIONS = 500;
+function createMcpObservationStore(opts = {}) {
+  const maxSessions = opts.maxSessions ?? DEFAULT_MAX_SESSIONS;
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const bySession = /* @__PURE__ */ new Map();
+  const touch = (sessionId) => {
+    const at = now().toISOString();
+    let obs = bySession.get(sessionId);
+    if (!obs) {
+      obs = { firstSeenAt: at, lastSeenAt: at };
+      bySession.set(sessionId, obs);
+      if (bySession.size > maxSessions) {
+        const oldest = bySession.keys().next().value;
+        if (oldest !== void 0) bySession.delete(oldest);
+      }
+    }
+    obs.lastSeenAt = at;
+    return obs;
+  };
+  const record2 = (sessionId, method, message, clientProtocolVersion) => {
+    const obs = touch(sessionId);
+    const at = obs.lastSeenAt;
+    const result = message.result && typeof message.result === "object" ? message.result : void 0;
+    const isExpectedDiscoverMiss = method === "server/discover" && message.error?.code === -32601;
+    const error = message.error && !isExpectedDiscoverMiss ? `${String(message.error.code ?? "error")}: ${String(message.error.message ?? "")}` : void 0;
+    const answeredVersion = typeof result?.["protocolVersion"] === "string" ? result["protocolVersion"] : void 0;
+    const protocolVersion = method === "initialize" ? answeredVersion : clientProtocolVersion;
+    const base = {
+      at,
+      ok: error === void 0,
+      ...error !== void 0 ? { error } : {},
+      ...protocolVersion ? { protocolVersion } : {}
+    };
+    if (method === "initialize") obs.initialize = base;
+    else if (method === "server/discover") obs.discover = base;
+    else {
+      const rawTools = Array.isArray(result?.["tools"]) ? result["tools"] : [];
+      const tools = [];
+      for (const t of rawTools) {
+        if (!t || typeof t !== "object") continue;
+        const name = t.name;
+        if (typeof name !== "string") continue;
+        const description = t.description;
+        tools.push({
+          name,
+          ...typeof description === "string" && description.length > 0 ? { description: description.slice(0, MAX_DESCRIPTION_CHARS) } : {}
+        });
+      }
+      obs.toolsList = {
+        ...base,
+        toolCount: tools.length,
+        deferred: tools.some((t) => t.name === "tool_search"),
+        tools
+      };
+    }
+  };
+  return {
+    observe(transport, ctx) {
+      const pending = /* @__PURE__ */ new Map();
+      const innerOnMessage = transport.onmessage;
+      transport.onmessage = (message, extra) => {
+        try {
+          if ("method" in message && "id" in message && message.id !== void 0 && OBSERVED_METHODS.has(message.method)) {
+            pending.set(message.id, message.method);
+          }
+        } catch {
+        }
+        innerOnMessage?.(message, extra);
+      };
+      const innerSend = transport.send.bind(transport);
+      transport.send = async (message, options) => {
+        try {
+          if ("id" in message && message.id !== void 0 && ("result" in message || "error" in message)) {
+            const method = pending.get(message.id);
+            if (method) {
+              pending.delete(message.id);
+              record2(ctx.sessionId, method, message, ctx.clientProtocolVersion);
+            }
+          }
+        } catch {
+        }
+        return innerSend(message, options);
+      };
+    },
+    recordHttpError(sessionId, status) {
+      const obs = touch(sessionId);
+      obs.httpError = { at: obs.lastSeenAt, status };
+    },
+    get: (sessionId) => bySession.get(sessionId),
+    delete: (sessionId) => {
+      bySession.delete(sessionId);
+    }
+  };
+}
+function isDaemonMountFor(sessionId, entry) {
+  if (entry.transport !== "http" || typeof entry.ref !== "string") return false;
+  try {
+    const url = new URL(entry.ref);
+    return url.pathname === "/mcp" && url.searchParams.get("callerSessionId") === sessionId;
+  } catch {
+    return false;
+  }
+}
+function daemonMountStatus(obs, turnsCompleted) {
+  if (!obs) return (turnsCompleted ?? 0) > 0 ? "never-contacted" : "declared";
+  if (obs.toolsList) return obs.toolsList.ok ? "listed" : "error";
+  if (obs.initialize?.ok === false || obs.discover?.ok === false || obs.httpError) return "error";
+  if (obs.initialize || obs.discover) return "connected";
+  return (turnsCompleted ?? 0) > 0 ? "never-contacted" : "declared";
+}
+function assessDaemonMount(obs) {
+  const tl = obs?.toolsList;
+  if (tl) {
+    if (!tl.ok) return { reason: "error", ...tl.error ? { detail: tl.error } : {} };
+    if (tl.toolCount === 0) return { reason: "zero-tools" };
+    return void 0;
+  }
+  if (obs?.initialize?.ok === false) {
+    return { reason: "error", ...obs.initialize.error ? { detail: `initialize ${obs.initialize.error}` } : {} };
+  }
+  if (obs?.discover?.ok === false) {
+    return { reason: "error", ...obs.discover.error ? { detail: `server/discover ${obs.discover.error}` } : {} };
+  }
+  if (obs?.httpError) return { reason: "error", detail: `HTTP ${obs.httpError.status}` };
+  return {
+    reason: "never-listed",
+    ...obs?.initialize || obs?.discover ? { detail: "handshake seen but no tools/list" } : {}
+  };
+}
+var ABNORMAL_TURN_REASONS = /* @__PURE__ */ new Set(["error", "cancelled", "watchdog-timeout", "aborted"]);
+function wireMcpDegradedWarnings(opts) {
+  const lastEmitted = /* @__PURE__ */ new Map();
+  const offTurnEnd = opts.sessionEvents.on("session:turn-end", (ev) => {
+    if (ev.reason !== void 0 && ABNORMAL_TURN_REASONS.has(ev.reason)) return;
+    const desc = opts.getSession(ev.sessionId);
+    if (!desc || desc.kind !== "agent-cli") return;
+    const mount = (desc.mcpServers ?? []).find((s) => isDaemonMountFor(ev.sessionId, s));
+    if (!mount) return;
+    const assessment = assessDaemonMount(opts.store.get(ev.sessionId));
+    if (!assessment) {
+      lastEmitted.delete(ev.sessionId);
+      return;
+    }
+    const key = `${assessment.reason}|${assessment.detail ?? ""}`;
+    if (lastEmitted.get(ev.sessionId) === key) return;
+    lastEmitted.set(ev.sessionId, key);
+    opts.sessionEvents.emit({
+      type: "mcp:degraded",
+      sessionId: ev.sessionId,
+      server: mount.name,
+      reason: assessment.reason,
+      ...assessment.detail ? { detail: assessment.detail } : {},
+      ...desc.label ? { label: desc.label } : {},
+      ts: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  });
+  const offExit = opts.sessionEvents.on("session:exited", (ev) => {
+    lastEmitted.delete(ev.sessionId);
+  });
+  const offResumed = opts.sessionEvents.on("session:resumed", (ev) => {
+    lastEmitted.delete(ev.sessionId);
+    opts.store.delete(ev.sessionId);
+  });
+  return () => {
+    offTurnEnd();
+    offExit();
+    offResumed();
+  };
+}
+
+// src/session-capabilities.ts
 var SKILLS_APPLYING_ADAPTERS = /* @__PURE__ */ new Set(["hermes"]);
 function sessionArm(desc) {
   if (desc.kind === "terminal") return "pty";
@@ -27936,7 +28115,7 @@ function sessionArm(desc) {
   }
   return "other";
 }
-function buildSessionCapabilities(desc, pendingPermissions) {
+function buildSessionCapabilities(desc, pendingPermissions, mcpObservation) {
   return {
     sessionId: desc.id,
     adapter: desc.adapterSlug ?? conversationTerminalSlugFor(desc) ?? "unknown",
@@ -27959,7 +28138,8 @@ function buildSessionCapabilities(desc, pendingPermissions) {
     mcpServers: (desc.mcpServers ?? []).map((s) => ({
       name: s.name,
       transport: s.transport,
-      ...s.ref ? { ref: s.ref } : {}
+      ...s.ref ? { ref: s.ref } : {},
+      ...isDaemonMountFor(desc.id, s) ? daemonMountFields(mcpObservation, desc.turnsCompleted) : { status: "declared" }
     })),
     skills: desc.skills ?? [],
     skillsApplied: desc.adapterSlug !== void 0 && SKILLS_APPLYING_ADAPTERS.has(desc.adapterSlug),
@@ -27967,6 +28147,20 @@ function buildSessionCapabilities(desc, pendingPermissions) {
     pendingPermissions
   };
 }
+function daemonMountFields(obs, turnsCompleted) {
+  const status = daemonMountStatus(obs, turnsCompleted);
+  const tl = obs?.toolsList;
+  const failing = tl ? tl.ok ? void 0 : tl : [obs?.initialize, obs?.discover].find((c) => c && !c.ok);
+  const error = failing?.error ?? (obs?.httpError ? `HTTP ${obs.httpError.status}` : void 0);
+  const protocolVersion = tl?.protocolVersion ?? obs?.initialize?.protocolVersion ?? obs?.discover?.protocolVersion;
+  return {
+    status,
+    ...tl?.ok ? { toolCount: tl.toolCount, tools: tl.tools, deferred: tl.deferred } : {},
+    ...protocolVersion ? { protocolVersion } : {},
+    ...obs ? { lastSeenAt: obs.lastSeenAt } : {},
+    ...error ? { error } : {}
+  };
+}
 
 // src/session-tools.ts
 init_context_checkpoint();
@@ -30769,7 +30963,7 @@ function registerSessionTools(rawServer, opts) {
       const pendingPermissions = registry.listPendingPermissions({ sessionId: fresh.id }).length;
       return {
         content: [
-          { type: "text", text: JSON.stringify(buildSessionCapabilities(fresh, pendingPermissions)) }
+          { type: "text", text: JSON.stringify(buildSessionCapabilities(fresh, pendingPermissions, opts.mcpObservations?.get(fresh.id))) }
         ]
       };
     }
@@ -36193,6 +36387,20 @@ function registerMcpApps(server, apps) {
     );
   }
 }
+
+// src/store-panel-allowlist.ts
+var STORE_UI_TOOLS = [
+  "app_catalog",
+  "app_list",
+  "app_install",
+  "app_resync",
+  "app_updates",
+  "app_uninstall",
+  "app_status"
+];
+
+// src/builtin-apps.ts
+var STORE_PANEL_APP_ID = storeApp.id ?? "@agentproto/store";
 function makeBuiltinPanelApps(ops) {
   const sessionChatNativeInstalled = ops.isSessionChatInstalled();
   return [
@@ -36236,7 +36444,18 @@ function makeBuiltinPanelApps(ops) {
     // building `makeBuiltinPanelApps` without one — e.g.
     // `builtinPanelCatalogEntries`'s stub ops below — still gets a
     // deterministic, small app list).
-    ...ops.listReviews ? [makeReviewPanelApp({ listReviews: ops.listReviews })] : []
+    ...ops.listReviews ? [makeReviewPanelApp({ listReviews: ops.listReviews })] : [],
+    // App Store widget — the browser/launcher over app_catalog + installed
+    // apps (see apps/src/store). Initial snapshot only when the ops are
+    // wired; writes (install/update/uninstall) always go through the SAME
+    // MCP verbs every other caller uses — no second install path.
+    ...ops.listCatalog && ops.listInstalled && ops.listUpdates ? [
+      makeStoreApp({
+        listCatalog: ops.listCatalog,
+        listInstalled: ops.listInstalled,
+        listUpdates: ops.listUpdates
+      })
+    ] : []
   ];
 }
 var PANEL_APP_HANDLES = [
@@ -36247,7 +36466,8 @@ var PANEL_APP_HANDLES = [
   liveSessionApp,
   sessionChatApp,
   workBoardApp,
-  reviewPanelApp
+  reviewPanelApp,
+  storeApp
 ];
 var DEEP_LINK_SESSION_ID_RE = /^sess_[A-Za-z0-9_-]+$/;
 function isValidDeepLinkSessionId(id) {
@@ -36260,6 +36480,9 @@ function resolveBuiltinPanelUi(appId, httpBaseUrl, sessionId) {
     const html = typeof app.html === "function" ? app.html({ httpBaseUrl, sessionId: pinnedSessionId }) : app.html;
     return { html, tools: liveSessionApp.ui?.tools ?? [] };
   }
+  if (appId === storeApp.id) {
+    return { html: storeApp.ui?.html ?? "", tools: STORE_UI_TOOLS };
+  }
   const handle = [sessionsPanelApp, agentsOverviewApp, bureauSessionsApp, sessionStoryApp, workBoardApp, reviewPanelApp].find(
     (h) => h.id === appId
   );
@@ -36274,10 +36497,14 @@ function builtinPanelCatalogEntries() {
     listTasks: (boardId) => ({ boardId: boardId ?? "ws:default", tasks: [] }),
     // Always provided (never omitted) here, same reasoning as
     // `isSessionChatInstalled: () => false` above: `PANEL_APP_HANDLES` is
-    // zipped against this call's output BY INDEX, so the review panel must
-    // always be present in this specific call regardless of whether the
-    // real daemon happens to have a review runner wired.
-    listReviews: async () => ({ total: 0, attestations: [] })
+    // zipped against this call's output BY INDEX, so the review panel and
+    // the store must always be present in this specific call regardless of
+    // whether the real daemon happens to have a review runner wired or any
+    // store ops at all.
+    listReviews: async () => ({ total: 0, attestations: [] }),
+    listCatalog: async () => [],
+    listInstalled: () => [],
+    listUpdates: () => []
   });
   return apps.map((app, i) => {
     const handle = PANEL_APP_HANDLES[i];
@@ -45778,7 +46005,7 @@ function registerOrchestrationTools(rawServer, opts) {
         "Opaque cursor from a prior call's `nextCursor`. Omit (or pass 0) to start from the current tail \u2014 returns events emitted after this call."
       ),
       sessionIds: z.array(z.string()).optional().describe("Filter to these session ids. Omit \u2192 all sessions."),
-      types: z.array(z.enum(["turn-end", "awaiting-input", "permission-request", "permission-resolved", "exited", "session:spawned", "command-done", "policy:passed", "policy:failed", "policy:commit-ready", "policy:committed", "cron:fired", "cron:succeeded", "cron:failed", "cron:unhealthy", "activity:changed", "task:changed"])).optional().describe("Filter to these event types. Omit \u2192 all types."),
+      types: z.array(z.enum(["turn-end", "awaiting-input", "permission-request", "permission-resolved", "exited", "session:spawned", "command-done", "policy:passed", "policy:failed", "policy:commit-ready", "policy:committed", "cron:fired", "cron:succeeded", "cron:failed", "cron:unhealthy", "activity:changed", "task:changed", "mcp:degraded"])).optional().describe("Filter to these event types. Omit \u2192 all types."),
       limit: z.number().int().min(1).max(200).optional().describe("Max events to return. Default 50."),
       full: z.boolean().optional().describe(
         "Request verbose per-event detail. Accepted for forward compatibility \u2014 this build always returns the same compact event shape regardless of the flag. Default false."
@@ -47332,7 +47559,7 @@ var RemoteCatalogSchema = z.object({
   generatedAt: z.string().optional(),
   entries: z.array(z.unknown())
 });
-var DEFAULT_CATALOG_SOURCE_URL = "https://cli.agentproto.sh/catalog/v1/apps.json";
+var DEFAULT_CATALOG_SOURCE_URL = "https://agentproto.sh/catalog/v1/apps.json";
 var EMPTY_CATALOG = { apps: [] };
 function defaultAppCatalogPath() {
   return join(homedir(), ".agentproto", "app-catalog.json");
@@ -47655,6 +47882,82 @@ function notEnabled(tool) {
     `${tool} is not enabled \u2014 the daemon was started without an adapter resolver. Re-run the daemon with the \`@agentproto/cli\` shim wired (see playground/scripts/gateway.ts).`
   );
 }
+function confirmTokenOf(args) {
+  const digest = createHash("sha256");
+  digest.update(
+    JSON.stringify([
+      "agentproto-app-install-confirm-v1",
+      args.url,
+      isAgentappUrl(args.url) ? "agentapp" : "git",
+      args.sha256 ?? null,
+      args.sha ?? null,
+      args.ref ?? null,
+      args.subdir ?? null,
+      args.allowBuild === true
+    ])
+  );
+  return digest.digest("hex").slice(0, 32);
+}
+var appInstallNonces = /* @__PURE__ */ new Map();
+var APP_INSTALL_NONCE_MAX = 256;
+var APP_INSTALL_NONCE_TTL_MS = 5 * 60 * 1e3;
+function issueInstallNonce(args) {
+  const now = Date.now();
+  for (const [nonce2, entry] of appInstallNonces) {
+    if (entry.expiresAt <= now) appInstallNonces.delete(nonce2);
+  }
+  if (appInstallNonces.size >= APP_INSTALL_NONCE_MAX) {
+    const oldest = appInstallNonces.keys().next().value;
+    if (oldest !== void 0) appInstallNonces.delete(oldest);
+  }
+  const nonce = randomBytes(16).toString("hex");
+  appInstallNonces.set(nonce, {
+    fingerprint: confirmTokenOf({
+      url: typeof args.url === "string" ? args.url : "",
+      sha256: typeof args.sha256 === "string" ? args.sha256 : void 0,
+      sha: typeof args.sha === "string" ? args.sha : void 0,
+      ref: typeof args.ref === "string" ? args.ref : void 0,
+      subdir: typeof args.subdir === "string" ? args.subdir : void 0,
+      allowBuild: args.allowBuild === true
+    }),
+    expiresAt: now + APP_INSTALL_NONCE_TTL_MS
+  });
+  return nonce;
+}
+function appInstallConfirmationClass(args) {
+  const url = args.url;
+  if (typeof url !== "string" || url.trim() === "" || args.dir !== void 0 || args.file !== void 0) {
+    return void 0;
+  }
+  if (typeof args.confirm !== "string") return { confirmed: false };
+  const nonce = appInstallNonces.get(args.confirm);
+  appInstallNonces.delete(args.confirm);
+  const fingerprint = confirmTokenOf({
+    url,
+    sha256: typeof args.sha256 === "string" ? args.sha256 : void 0,
+    sha: typeof args.sha === "string" ? args.sha : void 0,
+    ref: typeof args.ref === "string" ? args.ref : void 0,
+    subdir: typeof args.subdir === "string" ? args.subdir : void 0,
+    allowBuild: args.allowBuild === true
+  });
+  const valid = nonce !== void 0 && nonce.fingerprint === fingerprint && Date.now() < nonce.expiresAt;
+  return valid ? { confirmed: true } : { confirmed: false };
+}
+function buildAppInstallPreview(args) {
+  const url = typeof args.url === "string" ? args.url : "";
+  const isAgentapp = isAgentappUrl(url);
+  return {
+    needsConfirmation: true,
+    confirm: issueInstallNonce(args),
+    kind: isAgentapp ? "agentapp" : "git",
+    url,
+    ...typeof args.sha256 === "string" ? { sha256: args.sha256 } : {},
+    ...typeof args.sha === "string" ? { sha: args.sha } : {},
+    ...typeof args.ref === "string" ? { ref: args.ref } : {},
+    ...typeof args.subdir === "string" ? { subdir: args.subdir } : {},
+    runsBuildCommand: !isAgentapp && args.allowBuild === true
+  };
+}
 async function dispatchAllowlistedAppTool(declaredAllowlist, input, deps2) {
   const effectiveAllowlist = [...declaredAllowlist, ...APP_UI_DISCOVERY_TOOLS];
   if (!effectiveAllowlist.includes(input.tool)) {
@@ -47663,6 +47966,9 @@ async function dispatchAllowlistedAppTool(declaredAllowlist, input, deps2) {
     );
   }
   const args = input.args ?? {};
+  if (input.tool === "app_install" && appInstallConfirmationClass(args)?.confirmed === false) {
+    return textResult2(buildAppInstallPreview(args));
+  }
   try {
     if (input.tool.startsWith("imported:")) {
       if (!deps2.callImportedTool) return notEnabled("app_tool_call");
@@ -50263,16 +50569,7 @@ function projectSessionForHttp(session, fields) {
 var DEFAULT_ALLOWED_ORIGINS = [
   "http://localhost:*",
   "http://127.0.0.1:*",
-  "https://localhost:*",
-  // The canonical hosted agentproto panel (github.com/agentproto/cli-site,
-  // deployed at cli.agentproto.sh). It drives the user's OWN local daemon
-  // from the browser: read-only GETs (session list, SSE stream) are ungated
-  // and already work, but the /sessions/:id/pty WebSocket upgrade IS gated —
-  // so a PTY terminal in the panel 401s unless this first-party origin is
-  // trusted like localhost. A malicious page can't forge this Origin (the
-  // browser sets it), so the trust is scoped to agentproto's own panel,
-  // matching how guilde.work is trusted. Drop it via `strictOrigins`.
-  "https://cli.agentproto.sh"
+  "https://localhost:*"
 ];
 var DEFAULT_FRAME_ANCESTORS = ["vscode-webview:", "vscode-file:"];
 var EVENTS_KEEPALIVE_MS = 25e3;
@@ -50447,7 +50744,9 @@ async function startHttpServer(opts) {
       }
     }
   }
-  async function serveMcp(req, res, server2) {
+  async function serveMcp(req, res, server2, observedSessionId) {
+    const rawVersionHeader = req.headers["mcp-protocol-version"];
+    const clientProtocolVersion = Array.isArray(rawVersionHeader) ? rawVersionHeader[0] : rawVersionHeader;
     coerceUnsupportedProtocolVersionHeader(req);
     const transport = new StreamableHTTPServerTransport({
       sessionIdGenerator: void 0
@@ -50466,9 +50765,25 @@ async function startHttpServer(opts) {
       void transport.close();
       void server2.close();
     });
+    const observations = observedSessionId ? opts.mcpObservations : void 0;
+    let sawMessage = false;
     try {
       await server2.connect(transport);
+      if (observations && observedSessionId) {
+        observations.observe(transport, {
+          sessionId: observedSessionId,
+          ...clientProtocolVersion ? { clientProtocolVersion } : {}
+        });
+        const innerOnMessage = transport.onmessage;
+        transport.onmessage = (message, extra) => {
+          sawMessage = true;
+          innerOnMessage?.(message, extra);
+        };
+      }
       await transport.handleRequest(req, res);
+      if (observations && observedSessionId && !sawMessage && req.method === "POST" && res.statusCode >= 400) {
+        observations.recordHttpError(observedSessionId, res.statusCode);
+      }
     } catch (err) {
       const line = mcpErrorLogGate.onFailure(
         "mcp:handleRequest",
@@ -50539,7 +50854,7 @@ async function startHttpServer(opts) {
       return;
     }
     const server2 = await opts.mcpServerFactory(denyTools, callerSessionId, origin, deferred, allowTools, surface);
-    await serveMcp(req, res, server2);
+    await serveMcp(req, res, server2, callerSessionId);
   }
   async function handleOrchestratorMcp(req, res) {
     if (!opts.orchestratorMcpServerFactory || !opts.verifyOrchestratorScope) {
@@ -51195,7 +51510,8 @@ async function startHttpServer(opts) {
             opts.webhookNotifier,
             opts.ensureLlmEndpointRunning,
             opts.listAgentAdapters,
-            opts.deviceMirrorSync
+            opts.deviceMirrorSync,
+            opts.mcpObservations
           );
           if (handled) return;
         }
@@ -52421,6 +52737,12 @@ async function startHttpServer(opts) {
           });
           return;
         }
+        if (path === "/store" && req.method === "GET") {
+          const target = normalizeStoreRedirectUrl(req.url ?? "/store");
+          res.writeHead(302, { location: target });
+          res.end();
+          return;
+        }
         if (opts.appRegistry && path.startsWith("/apps/")) {
           const appUiShellBlocked = (appId) => !iframeEmbedOriginAllowed(req, opts.appRegistry.getApp(appId) ?? {}) && !isValidAppEmbedToken(requestEmbedToken(req)) && guardBrowserOrigin(req, res);
           const assetMatch = path.match(APP_UI_ASSET_RE);
@@ -53281,7 +53603,7 @@ async function handleSandboxes(_req, res, path, resolveSandboxProvider2) {
   json3(200, { alive: true, ...probe.state ? { state: probe.state } : { state: row.state }, checkedAt });
   return true;
 }
-async function handleSessions(req, res, path, registry, resolveAgentAdapter, ptyEnabled = false, resolveBrowserAdapter, listBrowserAdapters, sessionEvents, eventRing, buildOrchestratorMcp, daemonMcpUrl, provisionWorktree, listCatalogModels, resolveSandboxProvider2, webhookNotifier, ensureLlmEndpointRunning, listAgentAdapters, deviceMirrorSync) {
+async function handleSessions(req, res, path, registry, resolveAgentAdapter, ptyEnabled = false, resolveBrowserAdapter, listBrowserAdapters, sessionEvents, eventRing, buildOrchestratorMcp, daemonMcpUrl, provisionWorktree, listCatalogModels, resolveSandboxProvider2, webhookNotifier, ensureLlmEndpointRunning, listAgentAdapters, deviceMirrorSync, mcpObservations) {
   const json3 = (status, body) => {
     res.writeHead(status, { "content-type": "application/json" });
     res.end(JSON.stringify(body));
@@ -54329,7 +54651,7 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
     }
     const fresh = registry.get(desc.id) ?? desc;
     const pendingPermissions = registry.listPendingPermissions({ sessionId: fresh.id }).length;
-    json3(200, buildSessionCapabilities(fresh, pendingPermissions));
+    json3(200, buildSessionCapabilities(fresh, pendingPermissions, mcpObservations?.get(fresh.id)));
     return true;
   }
   const renameMatch = path.match(/^\/sessions\/([^/]+)$/);
@@ -56690,6 +57012,11 @@ async function handleAppUiPage(req, res, appId, appRegistry, frameAncestors) {
   sendRepresentation(req, res, rep, headers);
 }
 var APP_UI_PAGE_RE = /^\/apps\/(.+)\/ui\/?$/;
+function normalizeStoreRedirectUrl(rawUrl) {
+  const queryIndex = rawUrl.indexOf("?");
+  const query = queryIndex >= 0 ? rawUrl.slice(queryIndex) : "";
+  return `/apps/${STORE_PANEL_APP_ID.split("/")[0]}/${STORE_PANEL_APP_ID.split("/")[1]}/ui${query}`;
+}
 var APP_UI_ASSET_RE = /^\/apps\/(.+?)\/ui\/assets\/([^/]*)$/;
 function isAppUiShellRequest(method, path) {
   if (method !== "GET") return false;
@@ -64021,7 +64348,9 @@ var RemoteController = class {
       result.bearerToken = bearerToken;
       result.mcpEndpoint = mcpEndpoint;
       result.mcpConfigSnippet = buildMcpConfigSnippet2(mcpEndpoint, bearerToken);
-      result.phoneUrl = this.opts.isSessionChatInstalled?.() ? `${started.publicUrl}/apps/${SESSION_CHAT_APP_ID}/ui#token=${bearerToken}` : `https://cli.agentproto.sh/panel#daemon=${encodeURIComponent(started.publicUrl)}&token=${bearerToken}`;
+      if (this.opts.isSessionChatInstalled?.()) {
+        result.phoneUrl = `${started.publicUrl}/apps/${SESSION_CHAT_APP_ID}/ui#token=${bearerToken}`;
+      }
     } else {
       const warning = `\u26A0 ${started.publicUrl} forwards to ${target.host}:${target.port} with NO authentication from the daemon \u2014 anyone with the URL can reach it. Ensure the upstream service enforces its own auth, and run remote_disable when done.`;
       result.warning = warning;
@@ -64115,7 +64444,7 @@ function registerRemoteTools(server, opts) {
   const { controller } = opts;
   server.tool(
     "remote_enable",
-    "Publish a local port to the internet via Cloudflare. By default exposes this gateway and gates it with a bearer token (returned ONCE in the response \u2014 store it; only its hash is persisted). Pass `targetPort` to tunnel a different local service (Supabase, dev server, \u2026); in that mode the daemon does not gate the proxied traffic \u2014 the upstream service handles its own auth. Returns the public URL plus a paste-ready `.mcp.json` snippet and a `phoneUrl` \u2014 a single link to open on a phone, with the token in a URL fragment (gateway mode only). Re-running while a tunnel is already up errors; call `remote_disable` first to rotate.",
+    "Publish a local port to the internet via Cloudflare. By default exposes this gateway and gates it with a bearer token (returned ONCE in the response \u2014 store it; only its hash is persisted). Pass `targetPort` to tunnel a different local service (Supabase, dev server, \u2026); in that mode the daemon does not gate the proxied traffic \u2014 the upstream service handles its own auth. Returns the public URL plus a paste-ready `.mcp.json` snippet and a `phoneUrl` \u2014 a single link to open on a phone, with the token in a URL fragment (gateway mode, and only when the @agentik/session-chat app is installed). Re-running while a tunnel is already up errors; call `remote_disable` first to rotate.",
     {
       provider: z.enum(["quick"]).optional().describe(
         "Tunnel backend. `quick` = Cloudflare Quick Tunnel (no API key, ephemeral *.trycloudflare.com URL). Defaults to `quick`. Named-CF / Tailscale providers TBD."
@@ -66904,6 +67233,7 @@ async function createGateway(opts) {
   });
   const sessionEvents = createSessionEventBus();
   const eventRing = createEventRing();
+  const mcpObservations = createMcpObservationStore();
   eventRing.wire(sessionEvents);
   const webhookNotifier = createWebhookNotifier();
   sessionEvents.onAny((ev) => webhookNotifier.onSessionEvent(ev));
@@ -67235,6 +67565,11 @@ async function createGateway(opts) {
     webOrigins: daemonConfig.approvals?.webOrigins ?? []
   });
   wireSupervisorNotify({ registry: sessions, sessionEvents });
+  wireMcpDegradedWarnings({
+    sessionEvents,
+    getSession: (id) => sessions.get(id),
+    store: mcpObservations
+  });
   const activityProjector = createActivityProjector({
     registry: sessions,
     sessionEvents,
@@ -67435,6 +67770,7 @@ async function createGateway(opts) {
     }
     registerSessionTools(server, {
       registry: sessions,
+      mcpObservations,
       workspace,
       mcpProxy,
       ptyEnabled: opts.spawnPty != null,
@@ -67539,6 +67875,21 @@ async function createGateway(opts) {
     registerAppDataTools(server, { appRegistry });
     registerAppExternalTools(server, { appRegistry });
     registerTelegramBotTools(server, { telegramCreds: telegramBotCreds });
+    const listCatalogRows = async () => {
+      const rows = await dispatchTool("app_catalog", {});
+      if (typeof rows !== "string") return [];
+      try {
+        const parsed = JSON.parse(rows);
+        return Array.isArray(parsed) ? parsed : [];
+      } catch {
+        return [];
+      }
+    };
+    const listInstalledRows = () => {
+      const apps = appRegistry.listApps();
+      return apps;
+    };
+    const listUpdateRows = () => appRegistry.listApps().filter((a) => a.source !== void 0 && a.source.kind !== "local" && a.source.catalogId !== void 0).map((a) => ({ appId: a.appId, updateAvailable: true, ...a.version !== void 0 ? { version: a.version } : {} }));
     const listSessionsFiltered = (filter) => {
       let rows = sessions.list().filter((s) => s.kind !== "command");
       if (filter === "running") {
@@ -67579,7 +67930,14 @@ async function createGateway(opts) {
           reviewRunner,
           { ...input, includeRunning: true },
           { resolveSubtree: (sessionId) => [...collectSubtree(sessionId, sessions.list({ includeArchived: true }))] }
-        )
+        ),
+        // Store widget's read paths — app_catalog's rows (via the SAME
+        // `dispatchTool` the panel's own apply verbs will route through, so
+        // its snapshot can never disagree with what the tool call returns),
+        // and the registry's installed apps.
+        listCatalog: listCatalogRows,
+        listInstalled: listInstalledRows,
+        listUpdates: listUpdateRows
       }),
       // Same ptyEnabled gate as terminal_start/terminal_input/… in
       // session-tools.ts — the panel would be able to open the WS but
@@ -67745,6 +68103,7 @@ async function createGateway(opts) {
   const http = await startHttpServer({
     port,
     bind: opts.bind,
+    mcpObservations,
     // Auth is read on every request via this getter. `opts.auth`
     // (when provided) is the startup default and represents the
     // operator's intent — bearer-only deployments stay bearer-only