@aiwg/cockpit 2026.7.0 → 2026.7.3

package/bridge/src/server.mjs

@@ -31,6 +31,7 @@ const RUNTIME_DIR = join(homedir(), '.aiwg', 'cockpit', 'runtime');
 // legacy vanilla page so the Bridge works even before a web build.
 const WEB_DIST = fileURLToPath(new URL('../../web/dist', import.meta.url));
 const MIME = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.css': 'text/css; charset=utf-8', '.svg': 'image/svg+xml', '.json': 'application/json', '.ico': 'image/x-icon', '.png': 'image/png', '.woff2': 'font/woff2', '.map': 'application/json' };
+const CAPABILITY_TYPES = new Set(['skill', 'agent', 'command', 'rule', 'flow']);
 
 /** Serve a static file from the built web app, sandboxed to WEB_DIST. Returns true if served. */
 async function serveDistFile(res, relPath) {
@@ -294,6 +295,26 @@ async function probeExecutor(executorUrl) {
   return false;
 }
 
+async function getExecutorCapabilities(executorUrl) {
+  const candidates = ['/healthz/deep', '/healthz', '/health'].map((path) => `${executorUrl}${path}`);
+  try {
+    const { target, body } = await fetchJsonFirst(candidates);
+    return {
+      status: 'ok',
+      source: new URL(target).pathname,
+      host_runtime_enabled: body.host_runtime_enabled === true || body.hostRuntimeEnabled === true,
+      raw_status: body.status ?? body.state ?? 'unknown',
+    };
+  } catch (err) {
+    return {
+      status: 'unreachable',
+      source: null,
+      host_runtime_enabled: false,
+      error: String(err?.message ?? err),
+    };
+  }
+}
+
 function defaultExecutorCommand() {
   if (EXECUTOR_COMMAND) return EXECUTOR_COMMAND.split(/\s+/).filter(Boolean);
   const candidates = [
@@ -1074,6 +1095,7 @@ export function createBridge({ executorUrl = EXECUTOR_URL, allowMockExecutor = A
         return;
       }
       if (url.pathname === '/api/inventory') return json(res, 200, await getInventory(upstreamUrl));
+      if (url.pathname === '/api/executor/capabilities') return json(res, 200, await getExecutorCapabilities(upstreamUrl));
       if (url.pathname === '/api/running') return json(res, 200, await getRunning(upstreamUrl));
       if (url.pathname === '/api/loadouts') return json(res, 200, await getLoadouts(upstreamUrl));
       let m;
@@ -1133,9 +1155,20 @@ export function createBridge({ executorUrl = EXECUTOR_URL, allowMockExecutor = A
       if (url.pathname === '/api/capabilities') {
         const q = (url.searchParams.get('q') || '').trim();
         if (!q) return json(res, 400, { error: 'q_required' });
-        const args = ['discover', q, '--json', '--limit', String(Number(url.searchParams.get('limit')) || 8)];
+        const rawLimit = url.searchParams.get('limit') ?? '8';
+        const limit = Number(rawLimit);
+        if (!Number.isInteger(limit) || limit < 1 || limit > 50) {
+          return json(res, 400, { error: 'invalid_limit', detail: 'limit must be an integer from 1 to 50' });
+        }
+        const args = ['discover', q, '--json', '--limit', String(limit)];
         const type = url.searchParams.get('type');
-        if (type && type !== 'all') args.push('--type', type);
+        if (type && type !== 'all') {
+          const types = type.split(',').map((t) => t.trim()).filter(Boolean);
+          if (!types.length || types.some((t) => !CAPABILITY_TYPES.has(t))) {
+            return json(res, 400, { error: 'invalid_type', detail: 'type must be all, skill, agent, command, rule, flow, or a comma list of those kinds' });
+          }
+          args.push('--type', types.join(','));
+        }
         const data = JSON.parse(await runAiwg(args));
         data.results = (data.results || []).map((r) => ({ ...r, name: deriveName(r.path) }));
         return json(res, 200, data);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cockpit",
-  "version": "2026.7.0",
+  "version": "2026.7.3",
   "description": "AIWG Cockpit — UX-first control plane over AIWG + multi-stack agentic sessions. Opt-in, separately published; NOT shipped in the base aiwg npm package (guarded by test/smoke/cockpit-base-footprint.test.js).",
   "type": "module",
   "license": "MIT",

package/web/src/components/LaunchInstanceModal.test.tsx

@@ -22,13 +22,22 @@ const LOADOUTS = [
   { id: 'agentic-dev', label: 'agentic-dev', description: 'Developer tools', runtimes: ['docker', 'container'] },
 ];
 
-function mockFetch() {
+function mockFetch({
+  instances = [HOST_INSTANCE],
+  executorCaps = null,
+  createdInstanceId = 'docker-1',
+}: {
+  instances?: unknown[];
+  executorCaps?: unknown;
+  createdInstanceId?: string;
+} = {}) {
   return vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
     const url = String(input);
     const ok = (body: unknown) => new Response(JSON.stringify(body), { status: 200, headers: { 'content-type': 'application/json' } });
     if (url.includes('/api/loadouts')) return ok({ loadouts: LOADOUTS });
-    if (url.includes('/api/inventory')) return ok({ instances: [HOST_INSTANCE] });
-    if (url.includes('/api/instances') && init?.method === 'POST') return ok({ instance_id: 'docker-1' });
+    if (url.includes('/api/inventory')) return ok({ instances });
+    if (url.includes('/api/executor/capabilities') && executorCaps) return ok(executorCaps);
+    if (url.includes('/api/instances') && init?.method === 'POST') return ok({ instance_id: createdInstanceId });
     return new Response('{}', { status: 404 });
   }) as unknown as typeof fetch;
 }
@@ -37,7 +46,7 @@ beforeEach(() => { (window as unknown as { __COCKPIT_TOKEN__: string }).__COCKPI
 afterEach(() => { cleanup(); vi.restoreAllMocks(); });
 
 describe('LaunchInstanceModal', () => {
-  it('uses an existing host target instead of provisioning unsupported host instances', async () => {
+  it('uses an existing host target when one is already registered', async () => {
     globalThis.fetch = mockFetch();
     const onLaunched = vi.fn();
     const onClose = vi.fn();
@@ -56,6 +65,30 @@ describe('LaunchInstanceModal', () => {
     expect(onClose).toHaveBeenCalled();
   });
 
+  it('provisions the first host instance when the executor host supervisor is enabled', async () => {
+    globalThis.fetch = mockFetch({
+      instances: [],
+      executorCaps: { status: 'ok', source: '/healthz/deep', host_runtime_enabled: true },
+      createdInstanceId: 'host-created-1',
+    });
+    const onLaunched = vi.fn();
+    const onClose = vi.fn();
+    render(<LaunchInstanceModal open onClose={onClose} onLaunched={onLaunched} />);
+
+    expect(await screen.findByRole('option', { name: /local host runtime - create new/i })).toBeTruthy();
+    fireEvent.click(screen.getByRole('button', { name: /start host session/i }));
+
+    await waitFor(() => expect(onLaunched).toHaveBeenCalledWith('host-created-1', true, undefined));
+    const postCall = (globalThis.fetch as unknown as ReturnType<typeof vi.fn>).mock.calls
+      .find((call) => String(call[0]).includes('/api/instances') && call[1]?.method === 'POST');
+    expect(JSON.parse(String(postCall?.[1]?.body))).toMatchObject({
+      runtime: 'host',
+      loadout: 'host-tools',
+      start: true,
+    });
+    expect(onClose).toHaveBeenCalled();
+  });
+
   it('keeps Docker on the real provisioning path with Docker loadouts and images', async () => {
     globalThis.fetch = mockFetch();
     const onLaunched = vi.fn();

package/web/src/components/LaunchInstanceModal.tsx

@@ -1,7 +1,7 @@
 import { useEffect, useState } from 'react';
 import { api } from '../api';
 import { fmtId } from '../util';
-import type { Instance, Loadout } from '../types';
+import type { ExecutorCapabilities, Instance, Loadout } from '../types';
 
 type Runtime = 'host' | 'docker' | 'qemu';
 
@@ -46,6 +46,7 @@ export function LaunchInstanceModal({
   const [loadouts, setLoadouts] = useState<Loadout[]>([]);
   const [instances, setInstances] = useState<Instance[]>([]);
   const [hostId, setHostId] = useState('');
+  const [executorCaps, setExecutorCaps] = useState<ExecutorCapabilities | null>(null);
   const [image, setImage] = useState('agentic/codex:latest');
   const [customImage, setCustomImage] = useState('');
   const [profile, setProfile] = useState('');
@@ -65,11 +66,13 @@ export function LaunchInstanceModal({
     Promise.all([
       api<{ loadouts: Loadout[] }>('/api/loadouts').catch(() => ({ loadouts: [] as Loadout[] })),
       api<{ instances: Instance[] }>('/api/inventory').catch(() => ({ instances: [] as Instance[] })),
+      api<ExecutorCapabilities>('/api/executor/capabilities').catch(() => null),
     ])
-      .then(([lo, inv]) => {
+      .then(([lo, inv, caps]) => {
         if (cancelled) return;
         setLoadouts(lo.loadouts ?? []);
         setInstances(inv.instances ?? []);
+        setExecutorCaps(caps);
         const firstHost = (inv.instances ?? []).find(isUsableHost);
         setHostId((current) => current || firstHost?.id || '');
       });
@@ -95,12 +98,36 @@ export function LaunchInstanceModal({
     try {
       if (runtime === 'host') {
         const host = hostTargets(instances).find((i) => i.id === hostId) ?? hostTargets(instances)[0];
-        if (!host) throw new Error('No registered host target is available. Start/register the host agent first, or choose Docker container.');
+        if (host) {
+          setResult(openSession
+            ? `Using host target ${host.launch_context?.name ?? fmtId(host.id)}; starting session...`
+            : `Using host target ${host.launch_context?.name ?? fmtId(host.id)}`);
+          await onLaunched(host.id, openSession);
+          if (openSession) onClose();
+          return;
+        }
+        if (!executorCaps?.host_runtime_enabled) {
+          throw new Error('Host runtime is not enabled on this executor. Enable the host supervisor or choose Docker container.');
+        }
+        const body = {
+          name: name.replace(/[^a-z0-9-]/g, '-').replace(/^-+/, 'a-').slice(0, 63),
+          runtime: 'host',
+          loadout: 'host-tools',
+          start: true,
+        };
+        const op = await api<{ id?: string; instance_id?: string; instanceId?: string; operation?: { id?: string }; result?: { instance_id?: string; instanceId?: string } }>('/api/instances', {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(body),
+        });
+        const instanceId = op.instance_id ?? op.instanceId ?? op.result?.instance_id ?? op.result?.instanceId;
+        const operationId = op.id ?? op.operation?.id;
         setResult(openSession
-          ? `Using host target ${host.launch_context?.name ?? fmtId(host.id)}; starting session...`
-          : `Using host target ${host.launch_context?.name ?? fmtId(host.id)}`);
-        await onLaunched(host.id, openSession);
+          ? `Host launch accepted: ${instanceId ?? operationId ?? 'operation pending'}; waiting for session...`
+          : `Host launch accepted: ${instanceId ?? operationId ?? 'operation pending'}`);
+        await onLaunched(instanceId, openSession, operationId);
         if (openSession) onClose();
+        else setName(genInstanceName());
         return;
       }
       const body: Record<string, unknown> = {
@@ -155,8 +182,15 @@ export function LaunchInstanceModal({
               <label htmlFor="li-host-target">Host target</label>
               <select id="li-host-target" value={hostId} onChange={(e) => setHostId(e.target.value)}>
                 {hostTargets(instances).map((i) => <option key={i.id} value={i.id}>{i.launch_context?.name ?? fmtId(i.id)} - {i.loadout}</option>)}
-                {!hostTargets(instances).length && <option value="">No registered host available</option>}
+                {!hostTargets(instances).length && executorCaps?.host_runtime_enabled && <option value="">Local host runtime - create new</option>}
+                {!hostTargets(instances).length && !executorCaps?.host_runtime_enabled && <option value="">Host runtime not enabled</option>}
               </select>
+              {!hostTargets(instances).length && executorCaps?.host_runtime_enabled && (
+                <>
+                  <label htmlFor="li-name">Name</label>
+                  <input id="li-name" value={name} onChange={(e) => setName(e.target.value)} />
+                </>
+              )}
             </>
           ) : (
             <>
@@ -218,7 +252,7 @@ export function LaunchInstanceModal({
         </div>
         <div className="modal-actions">
           <button onClick={onClose} disabled={busy}>Close</button>
-          <button className="cta" onClick={launch} disabled={busy || (runtime === 'host' && !hostId) || (runtime !== 'host' && !name.trim()) || (runtime === 'docker' && image === '__custom__' && !customImage.trim())}>
+          <button className="cta" onClick={launch} disabled={busy || (runtime === 'host' && !hostId && !executorCaps?.host_runtime_enabled) || (runtime === 'host' && !hostId && !name.trim()) || (runtime !== 'host' && !name.trim()) || (runtime === 'docker' && image === '__custom__' && !customImage.trim())}>
             {busy ? 'Working...' : runtime === 'host' ? (openSession ? 'Start host session' : 'Use host') : openSession ? 'Create + start session' : 'Create instance'}
           </button>
         </div>

package/web/src/types.ts

@@ -41,6 +41,7 @@ export interface ResponseNeeded { id: string; instance_id: string; prompt: strin
 export interface InstanceCost { instance_id: string; tenant: string; input_tokens: number; output_tokens: number; usd: number }
 export interface Cost { total: { input_tokens: number; output_tokens: number; usd: number }; per_instance: InstanceCost[] }
 export interface Loadout { id: string; label: string; description?: string; runtimes?: string[] }
+export interface ExecutorCapabilities { status: string; source?: string | null; host_runtime_enabled: boolean; raw_status?: string; error?: string }
 export interface CapabilityResult { path: string; type: string; title?: string; capability?: string; score?: number; name: string; triggers?: string[] }
 export interface ContribAction { id: string; title: string; icon?: string; group?: string; source: string; inject: { command: string; target?: string; needs_args?: boolean; args_hint?: string } }
 export type Role = 'controller' | 'observer' | null;