@glassly/engine 0.3.0-dev.460 → 0.3.0-dev.465

package/build/services/LocalMiniappRuntime.js

@@ -42,7 +42,9 @@ import dashboardOpenTrace from "./debug/DashboardOpenTrace";
 import { isAppForegrounded, isPhoneActive, onAppForegroundChange, onPhoneActivityChange } from "./PhoneActivity";
 import { installedNotificationApps } from "./PhoneNotificationsSync";
 import { DERIVED_SETTINGS_KEYS, SETTINGS_BRIDGE_KEYS, isDerivedSettingsKey, ringBatteryFrom, selectSettingsBridgeKeys, validateSettingsSet, } from "./settingsBridge";
-import { addOverlayApp, displayViewsFor, isOverlayApp, removeOverlayApp, setOverlayViewer } from "./pages/overlayApps";
+import { mayUsePermission } from "./miniappPermissions";
+import { activeDashboardAmong } from "./pages/activeDashboard";
+import { activeDashboard, addDashboardApp, displayViewsFor, isDashboardApp, isOverlayApp, onOverlayAppsChange, removeDashboardApp, setActiveDashboard, setOverlayViewer, } from "./pages/overlayApps";
 import { pagesEligible } from "./pages/pageEligibility";
 import nativeNavigationService from "./NativeNavigationService";
 import headingService from "./HeadingService";
@@ -130,9 +132,6 @@ const SYSTEM_MINIAPP_PACKAGES = new Set([
     "com.glassly.ai",
     "com.glassly.feedback",
     "com.glassly.miniappdev",
-    // The dashboard: the settings bridge and the miniapp list/start/stop are its side menu and settings
-    // page, and the notification app list is its notification settings' per-app filter.
-    "com.glassly.dashboard",
 ]);
 const PING_INTERVAL_MS = 5_000;
 // Min gap between "transcription limit reached" notices on the glasses. A
@@ -214,6 +213,8 @@ const PERMISSION_TYPE_TO_CANONICAL = {
     MEMORY: "memory",
     AI: "ai",
     SPEAKERS: "speakers",
+    MANAGE_MINIAPPS: "manageMiniapps",
+    PLATFORM_SETTINGS: "platformSettings",
 };
 /**
  * User API keys (Settings > API Keys) a miniapp may read via
@@ -313,6 +314,8 @@ const ALL_CANONICAL_PERMISSIONS = [
     "ai",
     "speakers",
     "displayMirror",
+    "manageMiniapps",
+    "platformSettings",
 ];
 /**
  * Build the {location, microphone, camera, notifications, calendar, apiKeys}
@@ -961,11 +964,11 @@ class LocalMiniappRuntime {
         // Drop this app's transcription hints; the cloud subscription rebuild
         // below (via replaceStreamSubscribers) re-derives the hint union without it.
         this.transcriptionHintsByApp.delete(packageName);
-        // An overlay app is going: release the slot if it holds it, and drop the
+        // A dashboard is going: release the slot if it holds it, and drop the
         // dashboard view from its capabilities record.
-        if (isOverlayApp(packageName)) {
+        if (isDashboardApp(packageName)) {
             overlayPages.remove(packageName);
-            removeOverlayApp(packageName);
+            removeDashboardApp(packageName);
         }
         // Its gesture claims go back to whoever claimed them before.
         this.applyGestureClaimChanges(dropGestureClaims(this.gestureClaims, packageName));
@@ -1478,10 +1481,12 @@ class LocalMiniappRuntime {
         // Update lastPongAt so it doesn't time out right away
         existing.lastPongAt = Date.now();
         existing.unansweredPingRounds = 0;
-        // A system_dashboard app may take the overlay slot: its capabilities
-        // carry the dashboard view from the start.
-        if (existing.installedManifest?.type === "system_dashboard")
-            addOverlayApp(packageName);
+        // The dashboard that holds the role may take the overlay slot: its
+        // capabilities carry the dashboard view from the start.
+        if (existing.installedManifest?.type === "dashboard") {
+            addDashboardApp(packageName);
+            this.syncActiveDashboard();
+        }
         const capabilities = this.capabilitiesFor(packageName);
         // Build the declared-permission record for the SDK's session.permissions
         // module. Lower-cased to match v3's PermissionType union (microphone,
@@ -1836,12 +1841,9 @@ class LocalMiniappRuntime {
                 return;
             }
         }
-        // The settings stream carries the wearer's settings: system apps only.
-        if (streams.includes(MiniappStreamType.SETTINGS_CHANGED) && !this.isSystemPackage(packageName)) {
-            this.sendResult(packageName, requestId, false, undefined, {
-                code: MiniappErrorCode.NOT_PERMITTED,
-                message: "The settings stream is restricted to system apps",
-            });
+        // The settings stream carries the wearer's settings.
+        if (streams.includes(MiniappStreamType.SETTINGS_CHANGED) &&
+            !this.requirePermission(packageName, requestId, "PLATFORM_SETTINGS", "to subscribe to the settings stream")) {
             return;
         }
         // Add new subscriptions
@@ -1850,8 +1852,9 @@ class LocalMiniappRuntime {
         app.forceLocalTranscriptionStreams = new Set([...forceLocalTranscriptionStreams].filter((stream) => app.subscriptions.has(stream)));
         app.cloudTranscriptionStreams = new Set([...cloudTranscriptionStreams].filter((stream) => app.subscriptions.has(stream)));
         this.replaceStreamSubscribers(packageName, previousSubscriptions, app.subscriptions);
-        // An overlay app that listens to phone notifications presents them on the glasses.
-        if (isOverlayApp(packageName)) {
+        // The overlay app presents phone notifications on the glasses while it
+        // listens to them; recorded for every dashboard so the role can move.
+        if (isDashboardApp(packageName)) {
             setOverlayViewer(packageName, app.subscriptions.has(MiniappStreamType.PHONE_NOTIFICATION));
         }
         this.recomputeMicRequirements();
@@ -2073,13 +2076,13 @@ class LocalMiniappRuntime {
                 });
                 return;
             }
-            // The dashboard view is the overlay apps' alone; anyone else's frame
+            // The dashboard view is the overlay app's alone; anyone else's frame
             // is dropped, reported rather than silently lost.
             if (payload.view === "dashboard" && !isOverlayApp(packageName)) {
                 this.sendResult(packageName, requestId, true, {
                     status: "displayed",
                     presented: false,
-                    reason: "not the dashboard app",
+                    reason: "not the active dashboard",
                 });
                 return;
             }
@@ -2098,10 +2101,11 @@ class LocalMiniappRuntime {
         }
     }
     /**
-     * display.showView: the designated dashboard app takes or releases the
-     * overlay slot. Refused (NOT_PERMITTED) for any other app; "unsupported"
-     * while the glasses cannot show the dashboard view. Idempotent either way;
-     * the slot's state comes back to the app as a display_view change.
+     * display.showView: the active dashboard takes or releases the overlay
+     * slot. Refused (NOT_PERMITTED) for an app that is not a dashboard;
+     * "unsupported" for a dashboard without the role and while the glasses
+     * cannot show the dashboard view. Idempotent either way; the slot's state
+     * comes back to the app as a display_view change.
      */
     handleShowView(packageName, payload, requestId) {
         if (!this.connectedApps.has(packageName)) {
@@ -2116,13 +2120,17 @@ class LocalMiniappRuntime {
             });
             return;
         }
-        if (!isOverlayApp(packageName)) {
+        if (!isDashboardApp(packageName)) {
             this.sendResult(packageName, requestId, false, undefined, {
                 code: MiniappErrorCode.NOT_PERMITTED,
-                message: "The dashboard view belongs to system_dashboard apps",
+                message: 'The dashboard view belongs to miniapps of type "dashboard"',
             });
             return;
         }
+        if (!isOverlayApp(packageName)) {
+            this.sendResult(packageName, requestId, true, { status: "unsupported", reason: "not the active dashboard" });
+            return;
+        }
         if (view === "main") {
             overlayPages.hide(packageName);
             this.sendResult(packageName, requestId, true, { status: "shown" });
@@ -2141,18 +2149,31 @@ class LocalMiniappRuntime {
             dashboardOpenTrace.slotGranted();
         this.sendResult(packageName, requestId, true, shown ? { status: "shown" } : { status: "unsupported", reason: "the overlay slot was refused" });
     }
-    // ---------------------------------------------------------------------------
-    // Settings bridge (session.settings) — system apps only
-    // ---------------------------------------------------------------------------
-    requireSystemForSettings(packageName, requestId) {
-        if (this.isSystemPackage(packageName))
+    /**
+     * Reject the request with PERMISSION_NOT_DECLARED unless the caller's
+     * manifest declares `permission`. System apps pass without declaring it.
+     */
+    requirePermission(packageName, requestId, permission, context) {
+        const caller = {
+            system: this.isSystemPackage(packageName),
+            permissions: this.connectedApps.get(packageName)?.installedManifest?.permissions,
+        };
+        if (mayUsePermission(caller, permission))
             return true;
+        logPermissionNotDeclared(packageName, permission, context, `{"type": "${permission}"}`);
         this.sendResult(packageName, requestId, false, undefined, {
-            code: MiniappErrorCode.NOT_PERMITTED,
-            message: "The settings bridge is restricted to system apps",
+            code: MiniappErrorCode.PERMISSION_NOT_DECLARED,
+            message: `${permission} permission not declared in miniapp.json. Add {"type": "${permission}"} to the "permissions" array.`,
+            permission,
         });
         return false;
     }
+    // ---------------------------------------------------------------------------
+    // Settings bridge (session.settings) — PLATFORM_SETTINGS permission
+    // ---------------------------------------------------------------------------
+    requireSettingsPermission(packageName, requestId) {
+        return this.requirePermission(packageName, requestId, "PLATFORM_SETTINGS", "to use the settings bridge");
+    }
     /** A bridged key's current value: the store's, or the engine's for a derived key. */
     settingsBridgeValue(key) {
         if (isDerivedSettingsKey(key))
@@ -2167,10 +2188,12 @@ class LocalMiniappRuntime {
                 return localDisplayManager.foregroundAppOnScreen();
             case "ring_battery":
                 return ringBatteryFrom(useGlassesStore.getState());
+            case "active_dashboard":
+                return activeDashboard();
         }
     }
     handleSettingsGet(packageName, payload, requestId) {
-        if (!this.requireSystemForSettings(packageName, requestId))
+        if (!this.requireSettingsPermission(packageName, requestId))
             return;
         const values = {};
         for (const key of selectSettingsBridgeKeys(payload.keys))
@@ -2178,7 +2201,7 @@ class LocalMiniappRuntime {
         this.sendResult(packageName, requestId, true, { values });
     }
     async handleSettingsSet(packageName, payload, requestId) {
-        if (!this.requireSystemForSettings(packageName, requestId))
+        if (!this.requireSettingsPermission(packageName, requestId))
             return;
         const validated = validateSettingsSet(payload);
         if (!validated.ok) {
@@ -2198,8 +2221,9 @@ class LocalMiniappRuntime {
         this.sendResult(packageName, requestId, true);
     }
     async handleNotificationAppsList(packageName, requestId) {
-        if (!this.requireSystemForSettings(packageName, requestId))
+        if (!this.requirePermission(packageName, requestId, "READ_NOTIFICATIONS", "to list the apps that post notifications")) {
             return;
+        }
         try {
             this.sendResult(packageName, requestId, true, await installedNotificationApps());
         }
@@ -2213,8 +2237,9 @@ class LocalMiniappRuntime {
     /**
      * Push bridged settings as they change: stored keys from the store, the
      * derived keys whenever their inputs move (phone activity, the display,
-     * the apps store, the ring). Subscribers are system apps only (gated at
-     * SUBSCRIBE), so this is a no-op fan-out for everyone else.
+     * the apps store, the ring, the dashboard role). Subscribers declared
+     * PLATFORM_SETTINGS (gated at SUBSCRIBE), so this is a no-op fan-out for
+     * everyone else.
      */
     ensureSettingsBridgeWired() {
         if (this.settingsBridgeWired)
@@ -2249,6 +2274,7 @@ class LocalMiniappRuntime {
         onAppForegroundChange((foregrounded) => this.broadcastVisibility(foregrounded));
         localDisplayManager.onActiveDisplayChange(pushDerived);
         useAppStatusStore.subscribe(pushDerived);
+        onOverlayAppsChange(pushDerived);
         useGlassesStore.subscribe((s) => `${s.ringConnected}:${s.ringBatteryLevel}:${s.controllerConnected}:${s.controllerBatteryLevel}`, pushDerived);
     }
     /**
@@ -4562,6 +4588,33 @@ class LocalMiniappRuntime {
         useSettingsStore.subscribe((s) => s.getSetting(SETTINGS.cfw_native_navigation.key), broadcast);
         // The dashboard master switch flips the dashboard view.
         useSettingsStore.subscribe((s) => s.getSetting(SETTINGS.custom_dashboard_enabled.key), broadcast);
+        // The wearer's choice and the installed dashboards decide who holds the role.
+        const syncRole = () => this.syncActiveDashboard();
+        useSettingsStore.subscribe((s) => s.getSetting(SETTINGS.active_dashboard.key), syncRole);
+        useAppStatusStore.subscribe(syncRole);
+        syncRole();
+    }
+    /**
+     * Recompute who holds the dashboard role (ADR-0009). The previous holder
+     * gives up the slot first, so it hears the view change while it is still
+     * the overlay app; then every app sees its views again.
+     */
+    syncActiveDashboard() {
+        const candidates = [...useAppStatusStore.getState().apps];
+        // A dashboard can connect at launch before the apps store has listed it.
+        for (const [packageName, app] of this.connectedApps) {
+            if (candidates.some((candidate) => candidate.packageName === packageName))
+                continue;
+            candidates.push({ packageName, type: app.installedManifest?.type });
+        }
+        const next = activeDashboardAmong(candidates);
+        const previous = activeDashboard();
+        if (next === previous)
+            return;
+        if (previous !== null)
+            overlayPages.hide(previous, "replaced");
+        setActiveDashboard(next);
+        this.broadcastCapabilities();
     }
     /** Capabilities as `packageName` sees them: the model profile plus the views this app may draw. */
     capabilitiesFor(packageName) {
@@ -4988,14 +5041,16 @@ class LocalMiniappRuntime {
             /* telemetry must never break an interop call */
         }
     }
-    /** Reject the request with NOT_PERMITTED unless the caller is a system app. */
-    requireSystemCaller(packageName, requestId, op, target) {
-        if (this.isSystemPackage(packageName))
+    /** Reject the request unless the caller may list, start and stop other miniapps (MANAGE_MINIAPPS). */
+    requireMiniappsPermission(packageName, requestId, op, target) {
+        if (this.requirePermission(packageName, requestId, "MANAGE_MINIAPPS", `to ${op} miniapps`))
             return true;
-        this.auditInterop({ caller: packageName, op, target, ok: false, errorCode: MiniappErrorCode.NOT_PERMITTED });
-        this.sendResult(packageName, requestId, false, undefined, {
-            code: MiniappErrorCode.NOT_PERMITTED,
-            message: "Inter-miniapp APIs are restricted to system apps",
+        this.auditInterop({
+            caller: packageName,
+            op,
+            target,
+            ok: false,
+            errorCode: MiniappErrorCode.PERMISSION_NOT_DECLARED,
         });
         return false;
     }
@@ -5018,7 +5073,7 @@ class LocalMiniappRuntime {
         };
     }
     handleMiniappsList(packageName, payload, requestId) {
-        if (!this.requireSystemCaller(packageName, requestId, "list"))
+        if (!this.requireMiniappsPermission(packageName, requestId, "list"))
             return;
         const includeIncompatible = payload.includeIncompatible === true;
         const infos = this.interopApps()
@@ -5032,7 +5087,7 @@ class LocalMiniappRuntime {
     }
     async handleMiniappsStart(packageName, payload, requestId) {
         const target = payload.packageName;
-        if (!this.requireSystemCaller(packageName, requestId, "start", target))
+        if (!this.requireMiniappsPermission(packageName, requestId, "start", target))
             return;
         const app = target ? this.interopApps().find((a) => a.packageName === target) : undefined;
         if (!target || !app) {
@@ -5121,7 +5176,7 @@ class LocalMiniappRuntime {
     }
     async handleMiniappsStop(packageName, payload, requestId) {
         const target = payload.packageName;
-        if (!this.requireSystemCaller(packageName, requestId, "stop", target))
+        if (!this.requireMiniappsPermission(packageName, requestId, "stop", target))
             return;
         if (!target) {
             this.sendResult(packageName, requestId, false, undefined, {