@blackbelt-technology/pi-agent-dashboard 0.4.1 → 0.4.3

package/packages/shared/src/__tests__/plugin-bridge-register.test.ts

@@ -0,0 +1,113 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+  registerPluginBridge,
+  deregisterPluginBridge,
+  listManagedBridges,
+} from "../plugin-bridge-register.js";
+
+let tmpDir: string;
+let homedir: string;
+
+beforeEach(() => {
+  tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "plugin-bridge-test-"));
+  homedir = tmpDir;
+});
+
+afterEach(() => {
+  fs.rmSync(tmpDir, { recursive: true, force: true });
+});
+
+function settingsPath() {
+  return path.join(homedir, ".pi", "agent", "settings.json");
+}
+
+function readSettings(): Record<string, unknown> {
+  return JSON.parse(fs.readFileSync(settingsPath(), "utf-8"));
+}
+
+describe("registerPluginBridge", () => {
+  it("writes dashboard-<id> entry under dashboardPluginBridges", () => {
+    const result = registerPluginBridge("demo", "/path/to/demo/bridge.js", { homedir });
+    expect(result.type).toBe("ok");
+    const s = readSettings();
+    const managed = s.dashboardPluginBridges as Record<string, string>;
+    expect(managed["dashboard-demo"]).toBe("/path/to/demo/bridge.js");
+  });
+
+  it("returns ok when entry already matches (idempotent)", () => {
+    registerPluginBridge("demo", "/path/to/bridge.js", { homedir });
+    const result = registerPluginBridge("demo", "/path/to/bridge.js", { homedir });
+    expect(result.type).toBe("ok");
+  });
+
+  it("returns conflict when entry exists with different path", () => {
+    registerPluginBridge("demo", "/old/bridge.js", { homedir });
+    const result = registerPluginBridge("demo", "/new/bridge.js", { homedir });
+    expect(result.type).toBe("conflict");
+    if (result.type === "conflict") {
+      expect(result.existingPath).toBe("/old/bridge.js");
+      expect(result.newPath).toBe("/new/bridge.js");
+    }
+    // Should not overwrite
+    const s = readSettings();
+    const managed = s.dashboardPluginBridges as Record<string, string>;
+    expect(managed["dashboard-demo"]).toBe("/old/bridge.js");
+  });
+
+  it("never touches user-owned packages array", () => {
+    // Pre-populate settings with user packages
+    fs.mkdirSync(path.join(homedir, ".pi", "agent"), { recursive: true });
+    fs.writeFileSync(
+      settingsPath(),
+      JSON.stringify({ packages: ["/user/extension1", "/user/extension2"] }),
+    );
+
+    registerPluginBridge("demo", "/demo/bridge.js", { homedir });
+    const s = readSettings();
+    const pkgs = s.packages as string[];
+    expect(pkgs).toEqual(["/user/extension1", "/user/extension2"]);
+  });
+});
+
+describe("deregisterPluginBridge", () => {
+  it("removes the managed entry", () => {
+    registerPluginBridge("demo", "/demo/bridge.js", { homedir });
+    deregisterPluginBridge("demo", { homedir });
+    const s = readSettings();
+    const managed = s.dashboardPluginBridges as Record<string, string>;
+    expect(managed["dashboard-demo"]).toBeUndefined();
+  });
+
+  it("is a no-op when entry does not exist", () => {
+    // Should not throw
+    expect(() => deregisterPluginBridge("nonexistent", { homedir })).not.toThrow();
+  });
+
+  it("does not remove other plugin entries", () => {
+    registerPluginBridge("a", "/a/bridge.js", { homedir });
+    registerPluginBridge("b", "/b/bridge.js", { homedir });
+    deregisterPluginBridge("a", { homedir });
+    const managed = listManagedBridges({ homedir });
+    expect(managed["dashboard-a"]).toBeUndefined();
+    expect(managed["dashboard-b"]).toBe("/b/bridge.js");
+  });
+});
+
+describe("listManagedBridges", () => {
+  it("returns all managed entries", () => {
+    registerPluginBridge("a", "/a/bridge.js", { homedir });
+    registerPluginBridge("b", "/b/bridge.js", { homedir });
+    const managed = listManagedBridges({ homedir });
+    expect(Object.keys(managed)).toHaveLength(2);
+    expect(managed["dashboard-a"]).toBe("/a/bridge.js");
+    expect(managed["dashboard-b"]).toBe("/b/bridge.js");
+  });
+
+  it("returns empty object when no plugins registered", () => {
+    const managed = listManagedBridges({ homedir });
+    expect(managed).toEqual({});
+  });
+});

package/packages/shared/src/__tests__/plugin-config-update-protocol.test.ts

@@ -0,0 +1,41 @@
+/**
+ * Type-level test ensuring plugin_config_update is in ServerToBrowserMessage.
+ *
+ * Prevents the recurring esbuild-strips-as-any-cases regression where message
+ * types not in the union get dead-code eliminated in production builds.
+ */
+import { describe, it, expect } from "vitest";
+import type { ServerToBrowserMessage, PluginConfigUpdateMessage } from "../browser-protocol.js";
+
+// Type-level assertion: if PluginConfigUpdateMessage is NOT in the union, this fails to compile.
+type AssertExtends<T, U> = T extends U ? true : never;
+type _PluginConfigUpdateInUnion = AssertExtends<PluginConfigUpdateMessage, ServerToBrowserMessage>;
+
+function extractPluginConfigId(msg: ServerToBrowserMessage): string | null {
+  switch (msg.type) {
+    case "plugin_config_update": return msg.id;
+    default: return null;
+  }
+}
+
+describe("ServerToBrowserMessage includes plugin_config_update", () => {
+  it("plugin_config_update is a valid discriminant", () => {
+    const msg: PluginConfigUpdateMessage = {
+      type: "plugin_config_update",
+      id: "demo",
+      config: { foo: 1 },
+    };
+    expect(extractPluginConfigId(msg)).toBe("demo");
+  });
+
+  it("config payload is only this plugin's namespace", () => {
+    const msg: PluginConfigUpdateMessage = {
+      type: "plugin_config_update",
+      id: "openspec",
+      config: { pollIntervalSeconds: 30 },
+    };
+    // The config is the plugin's namespace only — not the full config
+    expect((msg.config as any).pollIntervalSeconds).toBe(30);
+    expect((msg.config as any).plugins).toBeUndefined();
+  });
+});

package/packages/shared/src/__tests__/publish-workflow-contract.test.ts

@@ -0,0 +1,123 @@
+/**
+ * Repo-level invariant: `.github/workflows/publish.yml`'s `electron` job
+ * MUST `needs: [prepare, publish]` and MUST set `strategy.fail-fast: false`.
+ *
+ * Why: the bundled-server step in the electron matrix runs `npm install`
+ * against the live npm registry, which depends on `@blackbelt-technology/*`
+ * sub-packages being uploaded by the `publish` job FIRST. Without this gate
+ * the electron job races publish and ETARGETs on the just-bumped version
+ * (release run #34 — macOS hit ETARGET 1m 45s before publish finished).
+ *
+ * Without `fail-fast: false`, a single OS failure cascades and cancels the
+ * other four matrix variants — losing diagnostic output and wasting runner
+ * minutes.
+ *
+ * If this test fails, restore the two lines in `publish.yml`:
+ *   electron:
+ *     needs: [prepare, publish]
+ *     strategy:
+ *       fail-fast: false
+ *       matrix: ...
+ *
+ * See change: publish-fix-macos.
+ */
+import { describe, it, expect } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import url from "node:url";
+
+const __dirname = path.dirname(url.fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(__dirname, "..", "..", "..", "..");
+const WORKFLOW_PATH = path.join(REPO_ROOT, ".github", "workflows", "publish.yml");
+
+/**
+ * Extract the YAML body of a top-level job by name. Returns the lines
+ * between `  <jobName>:` and the next sibling-indent (`  `) job, or EOF.
+ *
+ * We avoid pulling in a YAML library — the test only needs to inspect two
+ * specific scalar/list keys on a known job, and the file format is stable
+ * (2-space indent, no tabs, no anchors). Same pattern as
+ * `no-direct-process-kill.test.ts` and `no-raw-node-import.test.ts`.
+ */
+function extractJobBlock(yaml: string, jobName: string): string {
+  const lines = yaml.split("\n");
+  const headerRe = new RegExp(`^  ${jobName}:\\s*$`);
+  let start = -1;
+  for (let i = 0; i < lines.length; i++) {
+    if (headerRe.test(lines[i])) {
+      start = i;
+      break;
+    }
+  }
+  if (start === -1) {
+    throw new Error(`job '${jobName}' not found in publish.yml`);
+  }
+  // Walk forward until next line at the same 2-space indent that is a
+  // job header (`^  [a-z][a-z0-9-]*:\s*$`) or EOF.
+  const siblingRe = /^  [a-z][a-z0-9-]*:\s*$/;
+  let end = lines.length;
+  for (let i = start + 1; i < lines.length; i++) {
+    if (siblingRe.test(lines[i])) {
+      end = i;
+      break;
+    }
+  }
+  return lines.slice(start, end).join("\n");
+}
+
+describe("publish.yml — electron job dependency-graph contract", () => {
+  const yaml = fs.readFileSync(WORKFLOW_PATH, "utf8");
+  const electronBlock = extractJobBlock(yaml, "electron");
+
+  it("electron job's `needs:` includes both `prepare` and `publish`", () => {
+    // Accept either flow-list (`needs: [prepare, publish]`) or
+    // block-list:
+    //   needs:
+    //     - prepare
+    //     - publish
+    // (Currently flow-list — but the test should not lock the surface
+    // syntax, only the dependency contract.)
+    const flowMatch = electronBlock.match(/^\s{4}needs:\s*\[([^\]]*)\]/m);
+    const blockMatch = electronBlock.match(
+      /^\s{4}needs:\s*\n((?:\s{6}-\s+\S+\s*\n)+)/m,
+    );
+
+    let names: string[] = [];
+    if (flowMatch) {
+      names = flowMatch[1]
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+    } else if (blockMatch) {
+      names = blockMatch[1]
+        .split("\n")
+        .map((l) => l.replace(/^\s*-\s+/, "").trim())
+        .filter(Boolean);
+    } else {
+      throw new Error(
+        "electron job has no `needs:` key — must declare `needs: [prepare, publish]`. " +
+          "See change: publish-fix-macos. Job block was:\n" +
+          electronBlock,
+      );
+    }
+
+    expect(names).toContain("prepare");
+    expect(names).toContain("publish");
+  });
+
+  it("electron job's `strategy.fail-fast` is `false`", () => {
+    // Match `fail-fast: false` (any whitespace after the colon, but the
+    // value must be the literal `false` — not `False`, not absent).
+    const m = electronBlock.match(/^\s{6}fail-fast:\s*(\S+)\s*$/m);
+    if (!m) {
+      throw new Error(
+        "electron job's `strategy.fail-fast` is absent — the GitHub Actions " +
+          "default of `true` would re-introduce the run-#34 cascade. " +
+          "Set `fail-fast: false`. See change: publish-fix-macos.\n" +
+          "Job block was:\n" +
+          electronBlock,
+      );
+    }
+    expect(m[1]).toBe("false");
+  });
+});

package/packages/shared/src/__tests__/recommended-extensions.test.ts

@@ -127,8 +127,12 @@ describe("RecommendedExtension type", () => {
 
 describe("BUNDLED_EXTENSION_IDS manifest", () => {
 	it("contains exactly the v0.x initial bundled set", () => {
+		// pi-flows temporarily removed: upstream repo lacks SPDX license,
+		// blocking the bundle-recommended-extensions.sh license check.
+		// Re-add when https://github.com/BlackBeltTechnology/pi-flows has
+		// a license declared.
 		expect([...BUNDLED_EXTENSION_IDS].sort()).toEqual(
-			["pi-anthropic-messages", "pi-flows"].sort(),
+			["pi-anthropic-messages"].sort(),
 		);
 	});
 

package/packages/shared/src/__tests__/spawn-session-attach-proposal.test.ts

@@ -0,0 +1,47 @@
+/**
+ * Type-level + structural tests for the `attachProposal` field on
+ * `SpawnSessionBrowserMessage`. See change:
+ * add-folder-task-checker-and-spawn-attach.
+ */
+import { describe, it, expect } from "vitest";
+import type {
+  SpawnSessionBrowserMessage,
+  BrowserToServerMessage,
+} from "../browser-protocol.js";
+
+describe("SpawnSessionBrowserMessage.attachProposal", () => {
+  it("is optional — the bare-spawn payload still type-checks", () => {
+    // Compile-time: omitting attachProposal is allowed.
+    const bare: SpawnSessionBrowserMessage = { type: "spawn_session", cwd: "/x" };
+    expect(bare.attachProposal).toBeUndefined();
+    const _inUnion: BrowserToServerMessage = bare;
+    void _inUnion;
+  });
+
+  it("accepts a string attachProposal when set", () => {
+    const withAttach: SpawnSessionBrowserMessage = {
+      type: "spawn_session",
+      cwd: "/x",
+      attachProposal: "add-foo",
+    };
+    expect(withAttach.attachProposal).toBe("add-foo");
+  });
+
+  it("JSON round-trip preserves the field", () => {
+    const sent: SpawnSessionBrowserMessage = {
+      type: "spawn_session",
+      cwd: "/project/foo",
+      attachProposal: "add-auth",
+    };
+    const parsed = JSON.parse(JSON.stringify(sent)) as SpawnSessionBrowserMessage;
+    expect(parsed.type).toBe("spawn_session");
+    expect(parsed.cwd).toBe("/project/foo");
+    expect(parsed.attachProposal).toBe("add-auth");
+  });
+
+  it("JSON round-trip without the field omits it", () => {
+    const sent: SpawnSessionBrowserMessage = { type: "spawn_session", cwd: "/x" };
+    const parsed = JSON.parse(JSON.stringify(sent)) as SpawnSessionBrowserMessage;
+    expect("attachProposal" in parsed).toBe(false);
+  });
+});

package/packages/shared/src/__tests__/tool-registry-strategies-appimage.test.ts

@@ -0,0 +1,118 @@
+/**
+ * Tests for the AppImage self-hit guard inside `whereStrategy`. Per
+ * design D2 (change: fix-electron-appimage-cli-self-detection), the
+ * guard runs after `whichSync(name)` returns and demotes self-hits to
+ * `{ ok: false, reason: "appimage-self-hit: <path>" }` so the
+ * registry's diagnostic trail records the rejection.
+ */
+import { describe, it, expect } from "vitest";
+import path from "node:path";
+import os from "node:os";
+
+import { whereStrategy } from "../tool-registry/strategies.js";
+import {
+  ToolRegistry,
+  OverridesStore,
+} from "../tool-registry/index.js";
+
+function tmpStore(): OverridesStore {
+  return new OverridesStore({
+    filePath: path.join(
+      os.tmpdir(),
+      `where-strategy-appimage-test-${process.pid}-${Math.random().toString(36).slice(2)}.json`,
+    ),
+    warn: () => {},
+  });
+}
+
+describe("whereStrategy AppImage self-hit guard", () => {
+  it("rejects an APPDIR-mount candidate", () => {
+    const savedAppDir = process.env.APPDIR;
+    const fakeAppDir = "/tmp/.mount_PI-DAS-TEST";
+    process.env.APPDIR = fakeAppDir;
+    try {
+      const strat = whereStrategy("pi-dashboard", {
+        which: () => fakeAppDir + "/pi-dashboard",
+      });
+      const r = strat.run({
+        overrides: {},
+        platform: "linux",
+      });
+      expect(r.ok).toBe(false);
+      if (!r.ok) {
+        expect(r.reason).toContain("appimage-self-hit");
+        expect(r.reason).toContain(fakeAppDir + "/pi-dashboard");
+      }
+    } finally {
+      if (savedAppDir === undefined) delete process.env.APPDIR;
+      else process.env.APPDIR = savedAppDir;
+    }
+  });
+
+  it("rejects a process.execPath self-hit", () => {
+    // Use the running process.execPath — realpath-equality matches.
+    const exec = process.execPath;
+    const strat = whereStrategy("pi-dashboard", {
+      which: () => exec,
+    });
+    const r = strat.run({
+      overrides: {},
+      platform: process.platform,
+    });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.reason).toContain("appimage-self-hit");
+    }
+  });
+
+  it("returns ok for unrelated paths when no AppImage env vars are set", () => {
+    const savedAppDir = process.env.APPDIR;
+    const savedAppImage = process.env.APPIMAGE;
+    delete process.env.APPDIR;
+    delete process.env.APPIMAGE;
+    try {
+      const candidate = "/usr/local/bin/git";
+      const strat = whereStrategy("git", { which: () => candidate });
+      const r = strat.run({ overrides: {}, platform: "linux" });
+      expect(r.ok).toBe(true);
+      if (r.ok) expect(r.path).toBe(candidate);
+    } finally {
+      if (savedAppDir !== undefined) process.env.APPDIR = savedAppDir;
+      if (savedAppImage !== undefined) process.env.APPIMAGE = savedAppImage;
+    }
+  });
+});
+
+describe("ToolRegistry diagnostic trail records appimage-self-hit", () => {
+  it("Resolution.tried includes a 'where' entry whose reason contains 'appimage-self-hit'", () => {
+    const savedAppDir = process.env.APPDIR;
+    const fakeAppDir = "/tmp/.mount_PI-REG-TEST";
+    process.env.APPDIR = fakeAppDir;
+    try {
+      const registry = new ToolRegistry({
+        overrides: tmpStore(),
+        platform: "linux",
+      });
+      registry.register({
+        name: "synthetic-tool",
+        kind: "binary",
+        strategies: [
+          // Final strategy in the chain is `where`, fed by an injected
+          // `which` that returns an APPDIR-mount candidate.
+          whereStrategy("synthetic-tool", {
+            which: () => fakeAppDir + "/synthetic-tool",
+          }),
+        ],
+      });
+
+      const res = registry.resolve("synthetic-tool");
+      expect(res.ok).toBe(false);
+      const whereEntry = res.tried.find((t) => t.strategy === "where");
+      expect(whereEntry).toBeDefined();
+      expect(String(whereEntry!.result)).toContain("appimage-self-hit");
+    } finally {
+      if (savedAppDir === undefined) delete process.env.APPDIR;
+      else process.env.APPDIR = savedAppDir;
+    }
+  });
+});

package/packages/shared/src/browser-protocol.ts

@@ -11,6 +11,8 @@ import type {
   OpenSpecData,
   ModelInfo,
   PiSessionInfo,
+  ExtensionUiModule,
+  DecoratorDescriptor,
 } from "./types.js";
 import type { TerminalSession } from "./terminal-types.js";
 import type { EditorInstanceStatus } from "./editor-types.js";
@@ -214,13 +216,24 @@ export interface BrowserPromptCancelMessage {
   promptId: string;
 }
 
-/** Progress event streamed during a package install/remove/update operation. */
+/** Progress event streamed during a package install/remove/update/move operation.
+ *
+ * `moveId` is set when this progress event is part of a move operation
+ * (which composes install + remove). Clients group events by `moveId`
+ * to display a single composite progress affordance instead of two
+ * separate operations. Consumers that ignore the field continue to
+ * render install + remove independently — graceful degradation.
+ *
+ * See change: unify-package-management-ui.
+ */
 export interface PackageProgressMessage {
   type: "package_progress";
   operationId: string;
+  /** Optional move grouping id when emitted as part of a move. */
+  moveId?: string;
   event: {
     type: "start" | "progress" | "complete" | "error";
-    action: "install" | "remove" | "update" | "clone" | "pull";
+    action: "install" | "remove" | "update" | "clone" | "pull" | "move";
     source: string;
     message?: string;
   };
@@ -297,16 +310,72 @@ export interface BootstrapTicketCompleteMessage {
 export interface PackageOperationCompleteMessage {
   type: "package_operation_complete";
   operationId: string;
-  action: "install" | "remove" | "update";
+  /** Optional move grouping id; set on every event of a composite move op. */
+  moveId?: string;
+  action: "install" | "remove" | "update" | "move";
   source: string;
   scope: "global" | "local";
   success: boolean;
   error?: string;
   /** Number of sessions reloaded (only on success). */
   sessionsReloaded?: number;
+  /** Set on a move op when install succeeded but remove failed.
+   * Indicates the package now exists in BOTH scopes; UI should surface
+   * a recovery action (POST /api/packages/remove against fromScope). */
+  partialSuccess?: {
+    installed: boolean;
+    removed: boolean;
+    removeError?: string;
+  };
+}
+
+// ── Extension UI System (Phase 1: management-modal slot) ───────────
+// See change: add-extension-ui-modal.
+
+/** Server → browser: cached extension-declared UI modules for a session. */
+export interface BrowserUiModulesListMessage {
+  type: "ui_modules_list";
+  sessionId: string;
+  modules: ExtensionUiModule[];
+}
+
+/** Server → browser: row data for a `view.dataEvent`. */
+export interface BrowserUiDataListMessage {
+  type: "ui_data_list";
+  sessionId: string;
+  event: string;
+  items: unknown[];
+}
+
+// ── Extension UI System (Phase 2: live in-page decorations) ──
+// See change: add-extension-ui-decorations.
+
+/**
+ * Server → browser: a live decorator descriptor (forwarded verbatim from the
+ * extension). `removed: true` instructs the client to unmount the matching
+ * descriptor.
+ */
+export interface BrowserExtUiDecoratorMessage {
+  type: "ext_ui_decorator";
+  sessionId: string;
+  descriptor: DecoratorDescriptor;
+  removed?: boolean;
+}
+
+/** Sent when a plugin's config changes; carries only that plugin's namespace. */
+export interface PluginConfigUpdateMessage {
+  type: "plugin_config_update";
+  /** Plugin id that was updated. */
+  id: string;
+  /**
+   * Only this plugin's namespace config (plugins.<id>.*).
+   * Never contains other plugins' configs.
+   */
+  config: unknown;
 }
 
 export type ServerToBrowserMessage =
+  | PluginConfigUpdateMessage
   | SessionAddedMessage
   | SessionUpdatedMessage
   | SessionRemovedMessage
@@ -344,7 +413,10 @@ export type ServerToBrowserMessage =
   | BrowserPromptCancelMessage
   | ModelsRefreshedMessage
   | BootstrapStatusUpdateMessage
-  | BootstrapTicketCompleteMessage;
+  | BootstrapTicketCompleteMessage
+  | BrowserUiModulesListMessage
+  | BrowserUiDataListMessage
+  | BrowserExtUiDecoratorMessage;
 
 // ── Browser → Server ────────────────────────────────────────────────
 
@@ -483,6 +555,16 @@ export interface ResumeSessionBrowserMessage {
   mode: "continue" | "fork";
   /** When forking, optionally fork from a specific session entry instead of the latest */
   entryId?: string;
+  /**
+   * Placement intent for the resumed session in the cwd's sessionOrder:
+   *   - "front" (default): move to top of alive tier (Resume button, REST,
+   *     prompt-auto-resume).
+   *   - "keep": leave order alone (drag-to-resume — drop position was already
+   *     persisted by an earlier `reorder_sessions` message).
+   * Server defaults to "front" when omitted, preserving prior behavior.
+   * See change: differentiate-resume-intent-by-trigger.
+   */
+  placement?: "front" | "keep";
 }
 
 export interface HideSessionBrowserMessage {
@@ -498,6 +580,15 @@ export interface UnhideSessionBrowserMessage {
 export interface SpawnSessionBrowserMessage {
   type: "spawn_session";
   cwd: string;
+  /**
+   * Optional kebab-case OpenSpec change name to attach to the spawned session
+   * once it registers. The server queues the intent in `pendingAttachByCwd`
+   * and consumes it on the next matching `session_register`.
+   * Old servers that ignore unknown fields produce a bare spawn (degraded but
+   * recoverable: the user attaches manually). See change:
+   * add-folder-task-checker-and-spawn-attach.
+   */
+  attachProposal?: string;
 }
 
 export interface AttachProposalBrowserMessage {
@@ -629,6 +720,20 @@ export interface RequestRolesBrowserMessage {
   sessionId: string;
 }
 
+/**
+ * Browser → server: the user invoked a Phase-1 module action / requested
+ * row data. Server forwards via `piGateway.sendToSession` to the bridge,
+ * which re-emits as `pi.events.emit(event, { ...params, action, _reply })`.
+ * See change: add-extension-ui-modal.
+ */
+export interface UiManagementBrowserMessage {
+  type: "ui_management";
+  sessionId: string;
+  action: string;
+  event: string;
+  params?: Record<string, unknown>;
+}
+
 export type BrowserToServerMessage =
   | SubscribeMessage
   | UnsubscribeMessage
@@ -669,4 +774,5 @@ export type BrowserToServerMessage =
   | RolePresetSaveBrowserMessage
   | RolePresetDeleteBrowserMessage
   | RequestRolesBrowserMessage
+  | UiManagementBrowserMessage
   | KillProcessBrowserMessage;