@hosty-sdk/app 0.37.0 → 0.39.0

package/dist/tasks-server.js

@@ -55,3 +55,18 @@ export class TaskExecutorClient {
         return this.call(`/executions/${encodeURIComponent(executionId)}/cancel`, "POST", { requestId }, signal);
     }
 }
+/** Core-mediated child calls retain the original caller and the exact task-provider attribution. */
+export class MediatedTaskExecutorClient {
+    providers;
+    executor;
+    dispatch;
+    constructor(providers, executor, dispatch) {
+        this.providers = providers;
+        this.executor = executor;
+        this.dispatch = dispatch;
+    }
+    options(signal) { return this.providers.taskDispatch({ dispatch: this.dispatch, executor: this.executor, operation: "options" }, signal); }
+    get(executionId, signal) { return this.providers.taskDispatch({ dispatch: this.dispatch, executor: this.executor, operation: "get", executionId }, signal); }
+    accept(executionId, input, signal) { return this.providers.taskDispatch({ dispatch: this.dispatch, executor: this.executor, operation: "accept", executionId, input }, signal); }
+    cancel(executionId, requestId, signal) { return this.providers.taskDispatch({ dispatch: this.dispatch, executor: this.executor, operation: "cancel", executionId, requestId }, signal); }
+}

package/dist/ui-frame.js

@@ -137,5 +137,5 @@ export function HostyAppFrame(props) {
     const insecure = typeof window !== "undefined" && window.location.protocol === "https:" && new URL(surface.origin).protocol === "http:";
     if (insecure)
         return _jsxs("div", { "data-hosty-sdk": true, role: "status", className: "hosty-panel-notice", children: [_jsx(SdkChromeStyles, {}), _jsxs("strong", { children: [title, " needs HTTPS to appear here"] }), _jsx("p", { children: "This app publishes an HTTP address. Configure its public HTTPS origin in Hosty." }), /^(localhost|127\.|\[::1\])/.test(new URL(surface.origin).hostname) && _jsx("p", { children: "This local address is reachable only from the Hosty computer." }), standaloneHref && _jsx("a", { href: standaloneHref, target: "_blank", rel: "noopener noreferrer", children: "Open separately" })] });
-    return _jsxs(_Fragment, { children: [review && _jsxs(_Fragment, { children: [_jsx(SdkChromeStyles, {}), _jsx("a", { "data-hosty-sdk": true, className: "hosty-panel-review", href: review, target: "_blank", rel: "noopener noreferrer", children: "Review access in Core" })] }), _jsx("iframe", { ref: ref, className: className, title: title, src: launch, sandbox: frameSandbox(surface.framePolicy), allow: surface.framePolicy.microphone ? "clipboard-write; microphone 'src'" : "clipboard-write", style: { border: 0, height: "100%", width: "100%", colorScheme: resolvedTheme }, onLoad: () => setLoaded(true) })] });
+    return _jsxs(_Fragment, { children: [review && _jsxs(_Fragment, { children: [_jsx(SdkChromeStyles, {}), _jsx("a", { "data-hosty-sdk": true, className: "hosty-panel-review", href: review, target: "_blank", rel: "noopener noreferrer", children: "Review access in Core" })] }), _jsx("iframe", { ref: ref, className: className, title: title, src: launch, sandbox: frameSandbox(surface.framePolicy), allow: surface.framePolicy.microphone ? "clipboard-write; display-capture 'src'; microphone 'src'" : "clipboard-write; display-capture 'src'", style: { border: 0, height: "100%", width: "100%", colorScheme: resolvedTheme }, onLoad: () => setLoaded(true) })] });
 }

package/dist/ui-react.js

@@ -1,5 +1,6 @@
 "use client";
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { FeedbackCapture } from "./feedback-react.js";
 import { SdkChromeStyles, SdkIcon } from "./sdk-chrome.js";
 import { useContext, useEffect, useId, useLayoutEffect, useRef, useState, useSyncExternalStore } from "react";
 import { bindUiClient, ui } from "./ui.js";
@@ -53,7 +54,7 @@ export function HostyUiRoot({ children, uiPath, panelLayout = "auto", active = t
     if (allowed)
         mounted.current = true;
     const content = _jsxs("div", { className: "hosty-app-layout", children: [navigation?.renderer !== "custom" && _jsx(HostyNavigation, {}), _jsxs("div", { className: "hosty-app-content", "data-hosty-content": true, tabIndex: -1, children: [_jsx(HostyToolLauncher, {}), children] })] });
-    return _jsx(UiHostContext.Provider, { value: host, children: _jsx(UiCompositionContext.Provider, { value: clientRef.current?.composition ?? null, children: _jsxs(UiFrameLayerContext.Provider, { value: layer, children: [_jsx("style", { children: `.hosty-app-layout{display:flex;width:100%;height:100%;min-width:0;min-height:0}.hosty-app-content{flex:1;min-width:0;min-height:0;overflow:auto;outline:none}` }), _jsx("div", { hidden: !allowed, inert: !allowed, style: { display: allowed ? "contents" : "none" }, children: mounted.current && (panelLayout === "auto" && host ? _jsx(HostyPanelWorkspace, { children: content }) : content) }), !allowed && _jsxs("div", { "data-hosty-sdk": true, role: "status", className: "hosty-panel-notice", children: [_jsx(SdkChromeStyles, {}), environment?.connection === "blocked" ? _jsxs(_Fragment, { children: [_jsx("strong", { children: environment.code === "actor_mismatch" ? "Use the same Hosty account in this app and its host" : "Cannot verify this app’s host" }), _jsx("p", { children: "Check your account and access in Hosty Core, then reconnect. Your existing discussion is unchanged." }), _jsx("button", { type: "button", onClick: () => window.location.reload(), children: "Reconnect" })] }) : "Connecting to the workspace…"] }), host && _jsx(HostyPresentationLayer, { layer: layer, host: host, active: !!allowed })] }) }) });
+    return _jsx(UiHostContext.Provider, { value: host, children: _jsx(UiCompositionContext.Provider, { value: clientRef.current?.composition ?? null, children: _jsxs(UiFrameLayerContext.Provider, { value: layer, children: [_jsx("style", { children: `.hosty-app-layout{display:flex;width:100%;height:100%;min-width:0;min-height:0}.hosty-app-content{flex:1;min-width:0;min-height:0;overflow:auto;outline:none}` }), _jsx("div", { hidden: !allowed, inert: !allowed, style: { display: allowed ? "contents" : "none" }, children: mounted.current && (panelLayout === "auto" && host ? _jsx(HostyPanelWorkspace, { children: content }) : content) }), !allowed && _jsxs("div", { "data-hosty-sdk": true, role: "status", className: "hosty-panel-notice", children: [_jsx(SdkChromeStyles, {}), environment?.connection === "blocked" ? _jsxs(_Fragment, { children: [_jsx("strong", { children: environment.code === "actor_mismatch" ? "Use the same Hosty account in this app and its host" : "Cannot verify this app’s host" }), _jsx("p", { children: "Check your account and access in Hosty Core, then reconnect. Your existing discussion is unchanged." }), _jsx("button", { type: "button", onClick: () => window.location.reload(), children: "Reconnect" })] }) : "Connecting to the workspace…"] }), _jsx(FeedbackCapture, { active: active && !!allowed, uiPath: uiPath }), host && _jsx(HostyPresentationLayer, { layer: layer, host: host, active: !!allowed })] }) }) });
 }
 const empty = { bootstrap: null, catalog: [], tools: [], selected: null, expanded: false, width: 360, error: null };
 const noop = () => () => { };

package/dist/ui-server.js

@@ -1,3 +1,7 @@
+import { FeedbackServerClient } from "@hosty-sdk/app/feedback/server";
+import { FeedbackError } from "@hosty-sdk/app/feedback";
+import { ProviderClient } from "@hosty-sdk/app/providers/server";
+import { ProviderError } from "@hosty-sdk/app/providers";
 import { UiError } from "@hosty-sdk/app/ui/types";
 /** Server transport for generic UI metadata. Credentials never appear in returned metadata. */
 export class UiServerClient {
@@ -63,7 +67,38 @@ export async function createHostyUiResponse(request, context, options = {}) {
         const route = url.pathname.startsWith(prefix + "/") ? url.pathname.slice(prefix.length + 1) : "";
         const client = new UiServerClient(options);
         let result;
-        if (request.method === "GET" && route === "bootstrap") {
+        if (/^feedback\/[a-f0-9]{64}\/review-targets$/.test(route) && request.method === "GET") {
+            result = await new FeedbackServerClient(options).reviewTargets(route.split("/")[1], context.token, request.signal);
+        }
+        else if (route === "feedback/speech" && request.method === "GET") {
+            const speech = new ProviderClient(options), permissions = await speech.permissions(request.signal);
+            const granted = permissions.granted.includes("providers.speech-to-text");
+            result = { granted, providers: granted ? await speech.list("speech-to-text", request.signal) : [] };
+        }
+        else if (route === "feedback/speech" && request.method === "POST") {
+            if (!sameOrigin(request) || request.headers.get("content-type")?.split(";", 1)[0]?.trim() !== "application/json")
+                throw new UiError("origin_denied", "Dictate from this application page.", 403);
+            const speech = new ProviderClient(options), roster = await speech.list("speech-to-text", request.signal);
+            const input = JSON.parse(await boundedBody(request, 6 * 1024 * 1024));
+            if (!input || typeof input.appId !== "string" || typeof input.key !== "string" || typeof input.audio !== "string")
+                throw new UiError("speech_invalid", "Choose a speech provider and a recording.", 400);
+            if (!roster.some(p => p.appId === input.appId && p.key === input.key && p.available))
+                throw new UiError("speech_unavailable", "The selected speech provider is unavailable.", 409);
+            const bytes = Uint8Array.from(Buffer.from(input.audio, "base64"));
+            if (bytes.length < 44 || bytes.length > 120 * 16000 * 2 + 4096 || String.fromCharCode(...bytes.subarray(0, 4)) !== "RIFF" || String.fromCharCode(...bytes.subarray(8, 12)) !== "WAVE")
+                throw new UiError("speech_invalid", "Use a bounded WAV recording.", 400);
+            result = await speech.transcribe(input, new Blob([bytes], { type: "audio/wav" }), { signal: request.signal });
+        }
+        else if (route === "feedback" && request.method === "GET") {
+            result = await new FeedbackServerClient(options).capabilities(context.token, request.signal);
+        }
+        else if (route === "feedback" && request.method === "POST") {
+            if (!sameOrigin(request) || request.headers.get("content-type")?.split(";", 1)[0]?.trim() !== "application/json")
+                throw new UiError("origin_denied", "Submit feedback from this application page.", 403);
+            const body = await boundedBody(request, 12 * 1024 * 1024);
+            result = await new FeedbackServerClient(options).submit(JSON.parse(body), context.token, request.signal);
+        }
+        else if (request.method === "GET" && route === "bootstrap") {
             if ([...url.searchParams.keys()].some(k => k !== "parentOrigin") || url.searchParams.getAll("parentOrigin").length > 1)
                 throw new UiError("ui_request_invalid", "Invalid bootstrap request.", 400);
             result = await client.bootstrap({ parentOrigin: url.searchParams.get("parentOrigin") ?? undefined }, context.token, request.signal);
@@ -93,12 +128,12 @@ export async function createHostyUiResponse(request, context, options = {}) {
         return Response.json(result, { headers: responseHeaders });
     }
     catch (error) {
-        const known = error instanceof UiError;
+        const known = error instanceof UiError || error instanceof FeedbackError || error instanceof ProviderError;
         return Response.json({ code: known ? error.code : error instanceof SyntaxError ? "ui_request_invalid" : "ui_unavailable",
             message: known ? error.message : "Application panels are unavailable. Retry opening the same target." }, { status: known ? error.status : error instanceof SyntaxError ? 400 : 503, headers: responseHeaders });
     }
 }
-async function boundedBody(request) {
+async function boundedBody(request, limit = 16_384) {
     const reader = request.body?.getReader();
     if (!reader)
         return "";
@@ -110,7 +145,7 @@ async function boundedBody(request) {
             if (done)
                 break;
             length += value.byteLength;
-            if (length > 16_384) {
+            if (length > limit) {
                 await reader.cancel();
                 throw new UiError("ui_request_invalid", "Panel request is too large.", 413);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hosty-sdk/app",
-  "version": "0.37.0",
+  "version": "0.39.0",
   "description": "Hosty app auth: session state machine, recovery bridge, Core revalidation, and the embedder responder.",
   "license": "AGPL-3.0-only",
   "type": "module",
@@ -140,6 +140,22 @@
     "./tasks/server": {
       "types": "./dist/tasks-server.d.ts",
       "default": "./dist/tasks-server.js"
+    },
+    "./feedback": {
+      "types": "./dist/feedback-types.d.ts",
+      "default": "./dist/feedback-types.js"
+    },
+    "./feedback/server": {
+      "types": "./dist/feedback-server.d.ts",
+      "default": "./dist/feedback-server.js"
+    },
+    "./agent-sessions": {
+      "types": "./dist/agent-sessions.d.ts",
+      "default": "./dist/agent-sessions.js"
+    },
+    "./history": {
+      "types": "./dist/history.d.ts",
+      "default": "./dist/history.js"
     }
   },
   "scripts": {