@hosty-sdk/app 0.28.0 → 0.30.0

package/dist/consumed-url.d.ts

@@ -0,0 +1,2 @@
+/** Remove consumed launch parameters immediately, then synchronize routers installed by parent effects. */
+export declare function replaceConsumedUrl(url: URL): void;

package/dist/consumed-url.js

@@ -0,0 +1,14 @@
+/** Remove consumed launch parameters immediately, then synchronize routers installed by parent effects. */
+export function replaceConsumedUrl(url) {
+    const browser = window;
+    const route = `${url.pathname}${url.search}${url.hash}`;
+    browser.history.replaceState(null, "", route);
+    // Next installs its History API adapter in a parent passive effect, after the SDK's child
+    // effects. Repeat the final cleanup once that effect flush ends so its canonical URL also
+    // changes. Otherwise HMR restores the original, already-consumed authorization callback.
+    // A later cleanup or navigation owns its own URL; never replace it with this older snapshot.
+    queueMicrotask(() => {
+        if (browser.location.href === url.href)
+            browser.history.replaceState(browser.history.state, "", route);
+    });
+}

package/dist/react.js

@@ -1,6 +1,7 @@
 "use client";
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { captureChromeHints } from "./ui-composition.js";
+import { replaceConsumedUrl } from "./consumed-url.js";
 // React slice: the client identity bridge — probe, silent recovery, and the fallback
 // cards. Prop-less by design: the app id and browser-reachable Core origin arrive in the
 // probe response's `recovery` field (request-time values, never build-time props).
@@ -161,7 +162,7 @@ export function HostLaunchBridge() {
         // ignored must not survive into a link someone copies.
         if (url.searchParams.has(LAUNCH_MODE_PARAM)) {
             url.searchParams.delete(LAUNCH_MODE_PARAM);
-            window.history.replaceState(null, "", `${url.pathname}${url.search}${url.hash}`);
+            replaceConsumedUrl(url);
         }
     }, []);
     return null;
@@ -403,7 +404,7 @@ export function useAppIdentity({ probePath = "/api/auth/identity", appCodePath =
             url.searchParams.delete("state");
             if (isSilentError || protocolRequired)
                 url.searchParams.delete("error");
-            window.history.replaceState(null, "", `${url.pathname}${url.search}${url.hash}`);
+            replaceConsumedUrl(url);
         }
         if (code && !error && !upgradedLegacy && attempt && !exchangeRef.current) {
             exchangeRef.current = {
@@ -550,7 +551,7 @@ export function HostThemeBridge({ followSystem = true, onTheme } = {}) {
         if (url.searchParams.has(THEME_PARAM) || url.searchParams.has(THEME_PREFERENCE_PARAM)) {
             url.searchParams.delete(THEME_PARAM);
             url.searchParams.delete(THEME_PREFERENCE_PARAM);
-            window.history.replaceState(null, "", `${url.pathname}${url.search}${url.hash}`);
+            replaceConsumedUrl(url);
         }
         const handleMessage = (event) => {
             const message = parseShellThemeMessage(event, window);

package/dist/sandbox-react.js

@@ -15,6 +15,7 @@ function link(value) {
 }
 /** Shared operator panel; each host supplies its authenticated same-origin Core transport. */
 export function CoreEnvironmentPanel({ request, storageKey, workspace, workspaceHref }) {
+    const [consents, setConsents] = useState([]);
     const [environments, setEnvironments] = useState([]);
     const [apps, setApps] = useState({});
     const [loading, setLoading] = useState(true);
@@ -45,6 +46,7 @@ export function CoreEnvironmentPanel({ request, storageKey, workspace, workspace
             if (signal?.aborted || !active.current || sequence !== refreshSequence.current)
                 return;
             const selected = result.environments.filter(e => !workspace || e.context?.workspaceId === workspace.id);
+            setConsents(result.consents ?? []);
             setEnvironments(selected.filter(e => e.state !== "finished"));
             setLoading(false);
             setReadError("");
@@ -53,10 +55,14 @@ export function CoreEnvironmentPanel({ request, storageKey, workspace, workspace
                 const item = selected.find(e => e.id === saved.id);
                 const operation = item?.operations.find(o => o.id.replaceAll("-", "") === String(saved.body.requestId).replaceAll("-", ""));
                 if (operation && ["succeeded", "failed"].includes(operation.state)) {
-                    savePending(null);
+                    const superseded = operation !== item?.operations.at(-1);
+                    if (operation.state === "succeeded" || saved.kind !== "finish" || superseded)
+                        savePending(null);
                     setError(operation.state === "failed" ? item?.error ?? "Sandbox operation failed." : "");
                     if (item?.state === "finished")
                         setNotice("Sandbox deleted. Workspace source is preserved.");
+                    else if (superseded)
+                        setNotice("A newer operation replaced the previous request. Review the current sandbox status.");
                 }
             }
             const results = await Promise.all(selected.filter(e => e.state === "running").map(async (e) => {
@@ -73,6 +79,7 @@ export function CoreEnvironmentPanel({ request, storageKey, workspace, workspace
         catch (cause) {
             if (!signal?.aborted && active.current && sequence === refreshSequence.current) {
                 setEnvironments([]);
+                setConsents([]);
                 setApps({});
                 setLoading(false);
                 setReadError(message(cause));
@@ -117,7 +124,8 @@ export function CoreEnvironmentPanel({ request, storageKey, workspace, workspace
         try {
             savePending(value);
             const result = await request(value.path, value.body);
-            savePending(null);
+            if (value.kind !== "finish" || result.state === "finished")
+                savePending(null);
             if (result.error)
                 throw new Error(result.error);
             if (result.state === "finished")
@@ -153,7 +161,7 @@ export function CoreEnvironmentPanel({ request, storageKey, workspace, workspace
         }
     }
     const disabled = busy || pending !== null;
-    return _jsxs("section", { className: "space-y-4 rounded-lg border bg-card p-4", "aria-label": "Sandbox environments", children: [_jsxs("header", { className: "flex flex-wrap items-center justify-between gap-3", children: [_jsxs("div", { children: [_jsx("h3", { className: "font-semibold", children: "Sandbox environments" }), _jsx("p", { className: "text-sm text-muted-foreground", children: "Separate Core instances with their own apps, users and temporary data." })] }), _jsxs("div", { className: "flex gap-2", children: [_jsx("button", { className: button, onClick: () => { setError(""); void refresh(); }, children: "Refresh sandboxes" }), workspace && _jsx("button", { className: button, disabled: disabled || !workspace.worktrees.some(t => t.state === "active"), onClick: () => setCreating(!creating), children: "Create sandbox" })] })] }), creating && workspace && _jsx(CreateEnvironment, { workspace: workspace, disabled: disabled, onCreate: create, onCancel: () => setCreating(false) }), notice && _jsx("p", { role: "status", className: "text-sm text-muted-foreground", children: notice }), (error || readError) && _jsx("p", { role: "alert", className: "text-sm text-destructive", children: error || readError }), pending && _jsxs("div", { className: "flex items-center gap-3 text-sm", children: [_jsx("span", { children: busy ? `Sandbox ${pending.kind} is in progress…` : "The request outcome is not confirmed." }), _jsx("button", { className: button, disabled: busy, onClick: () => void run(pending), children: "Retry same request" })] }), loading ? _jsx("p", { role: "status", className: "text-sm text-muted-foreground", children: "Loading sandboxes\u2026" }) : !environments.length && !error && !readError && _jsx("p", { className: "text-sm text-muted-foreground", children: "No active sandbox environments." }), environments.map(item => _jsxs("article", { className: "space-y-3 rounded-md border p-3", "aria-label": `Sandbox ${item.label}`, children: [_jsxs("header", { className: "flex flex-wrap items-start justify-between gap-3", children: [_jsxs("div", { children: [_jsxs("h4", { className: "font-medium", children: [item.label, " ", _jsx("span", { className: "ml-2 rounded border px-2 py-0.5 text-xs font-normal", children: item.state })] }), _jsxs("p", { className: "mt-1 text-xs text-muted-foreground", children: [item.mode === "source" ? "Core built from workspace source" : item.mode === "release" ? "Installed Core release" : "Current Core build", item.context?.workspaceId && workspaceHref && _jsxs(_Fragment, { children: [" \u00B7 ", _jsx("a", { className: "underline", href: workspaceHref(item.context.workspaceId), children: "Open workspace" })] })] })] }), _jsxs("div", { className: "flex flex-wrap gap-2", children: [item.state === "running" && link(item.previewUrl) && _jsx("a", { className: button, href: item.previewUrl + "/login", target: "_blank", rel: "noreferrer", children: "Open Core" }), _jsx("button", { className: button, disabled: disabled || ["building", "starting", "stopping", "finishing", "cleanup-failed"].includes(item.state), onClick: () => void command(item, item.state === "running" ? "stop" : "start"), children: item.state === "running" ? "Stop" : "Start" }), _jsx("button", { className: button + " text-destructive", disabled: disabled || item.state === "finishing", onClick: () => setRemoving(item.id), children: item.state === "cleanup-failed" ? "Retry deletion" : "Delete sandbox" })] })] }), item.error && _jsx("p", { role: "alert", className: "text-sm text-destructive", children: item.error }), item.state === "running" && _jsxs(_Fragment, { children: [_jsx(EnvironmentApplications, { value: apps[item.id] }), apps[item.id] && ["setup-required", "sign-in-required"].includes(apps[item.id].state) && _jsx(SetupAccount, { request: request, id: item.id, disabled: disabled, onDone: () => refresh() })] }), removing === item.id && _jsxs("div", { role: "alertdialog", "aria-label": `Delete ${item.label}`, className: "space-y-3 rounded-md border border-destructive p-3", children: [_jsx("p", { className: "text-sm", children: "Permanently delete this sandbox, all its apps, test users, data and caches? Workspace source and shared folders are preserved." }), _jsxs("div", { className: "flex gap-2", children: [_jsx("button", { className: button + " text-destructive", disabled: disabled, onClick: () => { setRemoving(null); void command(item, "finish"); }, children: "Delete permanently" }), _jsx("button", { className: button, onClick: () => setRemoving(null), children: "Cancel" })] })] })] }, item.id))] });
+    return _jsxs("section", { className: "space-y-4 rounded-lg border bg-card p-4", "aria-label": "Sandbox environments", children: [_jsxs("header", { className: "flex flex-wrap items-center justify-between gap-3", children: [_jsxs("div", { children: [_jsx("h3", { className: "font-semibold", children: "Sandbox environments" }), _jsx("p", { className: "text-sm text-muted-foreground", children: "Separate Core instances with their own apps, users and temporary data." })] }), _jsxs("div", { className: "flex gap-2", children: [_jsx("button", { className: button, onClick: () => { setError(""); void refresh(); }, children: "Refresh sandboxes" }), workspace && _jsx("button", { className: button, disabled: disabled || !workspace.worktrees.some(t => t.state === "active"), onClick: () => setCreating(!creating), children: "Create sandbox" })] })] }), creating && workspace && _jsx(CreateEnvironment, { workspace: workspace, disabled: disabled, onCreate: create, onCancel: () => setCreating(false) }), notice && _jsx("p", { role: "status", className: "text-sm text-muted-foreground", children: notice }), (error || readError) && _jsx("p", { role: "alert", className: "text-sm text-destructive", children: error || readError }), pending && _jsxs("div", { className: "flex items-center gap-3 text-sm", children: [_jsx("span", { children: busy ? `Sandbox ${pending.kind} is in progress…` : "The request outcome is not confirmed." }), _jsx("button", { className: button, disabled: busy, onClick: () => void run(pending), children: "Retry same request" })] }), loading ? _jsx("p", { role: "status", className: "text-sm text-muted-foreground", children: "Loading sandboxes\u2026" }) : !environments.length && !error && !readError && _jsx("p", { className: "text-sm text-muted-foreground", children: "No active sandbox environments." }), !workspace && consents.length > 0 && _jsxs("details", { className: "rounded-md border p-3", children: [_jsxs("summary", { className: "cursor-pointer text-sm font-medium", children: ["Saved launch permissions (", consents.length, ")"] }), _jsx("p", { className: "mt-2 text-xs text-muted-foreground", children: "Revocation affects all matching launches and delegated access. Running children and their own accounts remain; use Stop or Delete sandbox to end them." }), _jsx("ul", { className: "divide-y", children: consents.map(grant => _jsxs("li", { className: "space-y-2 py-3 text-sm", children: [_jsxs("p", { children: [grant.appId, " \u00B7 ", grant.mode, " \u00B7 ", grant.state] }), _jsx("p", { className: "break-all text-xs text-muted-foreground", children: grant.target }), _jsxs("button", { className: button, disabled: disabled, onClick: () => { setBusy(true); void request(`/consents/${grant.id}/revoke`, {}).then(() => refresh()).catch(cause => setError(message(cause))).finally(() => setBusy(false)); }, children: ["Revoke permission for ", grant.appId] })] }, grant.id)) })] }), environments.map(item => _jsxs("article", { className: "space-y-3 rounded-md border p-3", "aria-label": `Sandbox ${item.label}`, children: [_jsxs("header", { className: "flex flex-wrap items-start justify-between gap-3", children: [_jsxs("div", { children: [_jsxs("h4", { className: "font-medium", children: [item.label, " ", _jsx("span", { className: "ml-2 rounded border px-2 py-0.5 text-xs font-normal", children: item.state })] }), _jsxs("p", { className: "mt-1 text-xs text-muted-foreground", children: [item.mode === "source" ? "Core built from workspace source" : item.mode === "release" ? "Installed Core release" : "Current Core build", item.context?.workspaceId && workspaceHref && _jsxs(_Fragment, { children: [" \u00B7 ", _jsx("a", { className: "underline", href: workspaceHref(item.context.workspaceId), children: "Open workspace" })] })] })] }), _jsxs("div", { className: "flex flex-wrap gap-2", children: [item.state === "running" && link(item.previewUrl) && _jsx("a", { className: button, href: item.previewUrl + "/login", target: "_blank", rel: "noreferrer", children: "Open Core" }), _jsx("button", { className: button, disabled: disabled || ["building", "starting", "stopping", "finishing", "cleanup-failed"].includes(item.state), onClick: () => void command(item, item.state === "running" ? "stop" : "start"), children: item.state === "running" ? "Stop" : "Start" }), _jsx("button", { className: button + " text-destructive", disabled: disabled || item.state === "finishing", onClick: () => setRemoving(item.id), children: item.state === "cleanup-failed" ? "Retry deletion" : "Delete sandbox" })] })] }), item.limits && _jsxs("p", { className: "text-xs text-muted-foreground", children: ["Reserved: ", (item.limits.memoryBytes / 1073741824).toFixed(1), " GiB container memory \u00B7 ", item.limits.cpus, " CPUs \u00B7 ", item.limits.pids, " PIDs \u00B7 ", (item.limits.diskBytes / 1073741824).toFixed(1), " GiB soft disk limit. Released after deletion."] }), item.usage && _jsx("p", { className: "text-xs text-muted-foreground", children: item.usage.state === "unknown" ? "Resource usage unavailable; the reservation remains active." : `Observed: ${(item.usage.containerMemoryBytes / 1048576).toFixed(0)} MiB containers · ${(item.usage.coreMemoryBytes / 1048576).toFixed(0)} MiB Core process · ${(item.usage.ownedDiskBytes / 1073741824).toFixed(2)} GiB owned data.` }), item.access && _jsxs("div", { className: "space-y-2 text-sm", "aria-label": "Sandbox consent", children: [_jsx("p", { children: item.access.state === "operator" ? "Operator launch" : item.access.state === "active" ? item.access.saved ? "Saved launch permission" : "Permission for this run" : item.access.state === "target-changed" ? "Core target changed or unavailable; review launch permission" : "Launch permission revoked or unavailable" }), _jsx("p", { className: "text-xs text-muted-foreground", children: item.access.description }), item.access.grantId && ["active", "target-changed"].includes(item.access.state) && _jsx("button", { className: button, disabled: disabled, onClick: () => { setBusy(true); void request(`/${item.id}/consent/revoke`, {}).then(() => refresh()).catch(cause => setError(message(cause))).finally(() => setBusy(false)); }, children: "Revoke launch permission" })] }), item.error && _jsx("p", { role: "alert", className: "text-sm text-destructive", children: item.error }), item.state === "running" && _jsxs(_Fragment, { children: [_jsx(EnvironmentApplications, { value: apps[item.id] }), apps[item.id] && ["setup-required", "sign-in-required"].includes(apps[item.id].state) && _jsx(SetupAccount, { request: request, id: item.id, disabled: disabled, onDone: () => refresh() })] }), removing === item.id && _jsxs("div", { role: "alertdialog", "aria-label": `Delete ${item.label}`, className: "space-y-3 rounded-md border border-destructive p-3", children: [_jsx("p", { className: "text-sm", children: "Permanently delete this sandbox, all its apps, test users, data and caches? Workspace source and shared folders are preserved." }), _jsxs("div", { className: "flex gap-2", children: [_jsx("button", { className: button + " text-destructive", disabled: disabled, onClick: () => { setRemoving(null); void command(item, "finish"); }, children: "Delete permanently" }), _jsx("button", { className: button, onClick: () => setRemoving(null), children: "Cancel" })] })] })] }, item.id))] });
 }
 function EnvironmentApplications({ value }) {
     if (!value)

package/dist/sandbox-server.d.ts

@@ -131,8 +131,16 @@ export declare class SandboxClient {
     }): Promise<SandboxInstance>;
     call<T = unknown>(action: SandboxAction, input: Record<string, unknown>): Promise<T>;
 }
-export declare const coreEnvironmentActions: readonly ["environment-create", "environment-list", "environment-status", "environment-start", "environment-stop", "environment-restart", "environment-finish", "environment-setup", "environment-api"];
+export declare const coreEnvironmentActions: readonly ["environment-consent", "environment-create", "environment-list", "environment-status", "environment-start", "environment-stop", "environment-restart", "environment-finish", "environment-setup", "environment-api"];
 export type CoreEnvironmentAction = typeof coreEnvironmentActions[number];
+export interface CoreEnvironmentSavedConsent {
+    id: string;
+    appId: string;
+    label: string;
+    mode: string;
+    target: string;
+    state: string;
+}
 export interface CoreEnvironment {
     id: string;
     label: string;
@@ -150,6 +158,29 @@ export interface CoreEnvironment {
     };
     error?: string;
     operations: SandboxOperation[];
+    limits?: {
+        memoryBytes: number;
+        cpus: number;
+        pids: number;
+        diskBytes: number;
+        applicationMemoryBytes: number;
+        applicationCpus: number;
+        applicationPids: number;
+    };
+    access?: {
+        state: string;
+        grantId?: string;
+        saved: boolean;
+        description: string;
+    };
+    usage?: {
+        ownedDiskBytes: number;
+        containerMemoryBytes: number;
+        coreMemoryBytes: number;
+        state: string;
+        observedAt: string;
+        error?: string;
+    };
 }
 /** Full child Core transport. Requires core.environments permissions and live administrator authority.
  * Setup uses ordinary password authentication. Parent credentials are never forwarded to the child. */

package/dist/sandbox-server.js

@@ -93,7 +93,7 @@ export class SandboxClient {
         return result;
     }
 }
-export const coreEnvironmentActions = ["environment-create", "environment-list", "environment-status", "environment-start",
+export const coreEnvironmentActions = ["environment-consent", "environment-create", "environment-list", "environment-status", "environment-start",
     "environment-stop", "environment-restart", "environment-finish", "environment-setup", "environment-api"];
 /** Full child Core transport. Requires core.environments permissions and live administrator authority.
  * Setup uses ordinary password authentication. Parent credentials are never forwarded to the child. */
@@ -116,8 +116,8 @@ export class CoreEnvironmentClient {
             throw new SandboxError("environment_operation_invalid", "Unknown environment operation.", 400);
         const { environmentId, ...body } = input;
         const read = action === "environment-list" || action === "environment-status";
-        let suffix = "";
-        if (action !== "environment-list" && action !== "environment-create") {
+        let suffix = action === "environment-consent" ? "/consent" : "";
+        if (action !== "environment-list" && action !== "environment-create" && action !== "environment-consent") {
             if (typeof environmentId !== "string" || !/^[a-f0-9]{32}$/.test(environmentId))
                 throw new SandboxError("environment_id_invalid", "Select a Core-issued environment ID.", 400);
             suffix = `/${environmentId}` + (action === "environment-status" ? "" : action === "environment-api" ? "/api"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hosty-sdk/app",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "description": "Hosty app auth: session state machine, recovery bridge, Core revalidation, and the embedder responder.",
   "license": "AGPL-3.0-only",
   "type": "module",