@jami-studio/dispatch 0.13.14

package/src/lib/automations.ts

@@ -0,0 +1,60 @@
+import { agentNativePath } from "@agent-native/core/client";
+
+export interface DispatchAutomationItem {
+  id: string;
+  name: string;
+  path: string;
+  owner: string;
+  canUpdate?: boolean;
+  triggerType?: "schedule" | "event" | string;
+  event?: string;
+  schedule?: string;
+  scheduleDescription?: string;
+  condition?: string;
+  mode?: string;
+  domain?: string;
+  enabled?: boolean;
+  lastStatus?: string;
+  lastRun?: string;
+  lastError?: string;
+  nextRun?: string;
+  createdBy?: string;
+}
+
+export interface SetDispatchAutomationEnabledInput {
+  owner: string;
+  path: string;
+  enabled: boolean;
+}
+
+async function readAutomationResponse<T>(response: Response): Promise<T> {
+  const data = await response.json().catch(() => null);
+  if (!response.ok) {
+    const message =
+      data && typeof data === "object" && "error" in data
+        ? String((data as { error?: unknown }).error)
+        : "Automation request failed";
+    throw new Error(message);
+  }
+  return data as T;
+}
+
+export async function listDispatchAutomations(): Promise<
+  DispatchAutomationItem[]
+> {
+  const response = await fetch(agentNativePath("/_agent-native/automations"));
+  if (!response.ok) return [];
+  const rows = await response.json().catch(() => []);
+  return Array.isArray(rows) ? rows : [];
+}
+
+export async function setDispatchAutomationEnabled(
+  input: SetDispatchAutomationEnabledInput,
+): Promise<DispatchAutomationItem> {
+  const response = await fetch(agentNativePath("/_agent-native/automations"), {
+    method: "PATCH",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(input),
+  });
+  return readAutomationResponse<DispatchAutomationItem>(response);
+}

package/src/lib/catch-all-target.spec.ts

@@ -0,0 +1,156 @@
+import { describe, expect, it } from "vitest";
+
+import { resolveCatchAllTarget } from "./catch-all-target.js";
+
+describe("resolveCatchAllTarget", () => {
+  it("prefers the workspace manifest entry when one matches", () => {
+    expect(
+      resolveCatchAllTarget("todo", {
+        workspaceApps: [{ id: "todo", path: "/todo" }],
+        builtinAgents: [{ id: "todo", url: "https://todo.example.com" }],
+      }),
+    ).toBe("/todo");
+  });
+
+  it("falls back to the built-in template URL when no workspace manifest exists", () => {
+    expect(
+      resolveCatchAllTarget("forms", {
+        workspaceApps: null,
+        builtinAgents: [{ id: "forms", url: "http://localhost:8084" }],
+      }),
+    ).toBe("http://localhost:8084");
+  });
+
+  it("falls back to the built-in template URL when the workspace manifest does not include the app", () => {
+    expect(
+      resolveCatchAllTarget("forms", {
+        workspaceApps: [{ id: "dispatch", path: "/dispatch" }],
+        builtinAgents: [{ id: "forms", url: "http://localhost:8084" }],
+      }),
+    ).toBe("http://localhost:8084");
+  });
+
+  it("normalizes a manifest entry without a leading slash", () => {
+    expect(
+      resolveCatchAllTarget("todo", {
+        workspaceApps: [{ id: "todo", path: "todo" }],
+      }),
+    ).toBe("/todo");
+  });
+
+  it("uses app.path when id !== path (not /${appId})", () => {
+    // Before the fix, an entry whose mounted path differs from its id —
+    // e.g. id: "forms", path: "my-forms" without a leading slash — was
+    // silently rewritten to `/forms` (the appId) and routed to the wrong
+    // app. The normalizer now keeps the manifest path and only prepends
+    // the missing slash.
+    expect(
+      resolveCatchAllTarget("forms", {
+        workspaceApps: [{ id: "forms", path: "my-forms" }],
+      }),
+    ).toBe("/my-forms");
+  });
+
+  it("prefers app.url when the manifest entry has an externally-hosted URL", () => {
+    // Workspaces can point at remote deploys. The catch-all should bounce
+    // to the absolute URL instead of mounting a local path that doesn't
+    // exist inside the gateway.
+    expect(
+      resolveCatchAllTarget("forms", {
+        workspaceApps: [
+          {
+            id: "forms",
+            path: "/forms",
+            url: "https://forms.example.com",
+          },
+        ],
+      }),
+    ).toBe("https://forms.example.com");
+  });
+
+  it("ignores app.url that isn't an absolute http(s) URL and falls back to path", () => {
+    // Bare hostname — `new URL("forms.example.com")` throws, so the value
+    // is rejected and we fall through to the (validated) path. Without
+    // this, the catch-all would `throw redirect("forms.example.com")`
+    // and the browser would treat the value as a relative path inside the
+    // gateway, producing a broken redirect.
+    expect(
+      resolveCatchAllTarget("forms", {
+        workspaceApps: [
+          { id: "forms", path: "/forms", url: "forms.example.com" },
+        ],
+      }),
+    ).toBe("/forms");
+  });
+
+  it("rejects non-http(s) URL schemes (e.g. javascript:) and falls back to path", () => {
+    // Defense in depth — a hostile manifest entry can't produce a
+    // `javascript:` redirect target. Validation enforces http(s) only.
+    expect(
+      resolveCatchAllTarget("forms", {
+        workspaceApps: [
+          { id: "forms", path: "/forms", url: "javascript:alert(1)" },
+        ],
+      }),
+    ).toBe("/forms");
+  });
+
+  it("strips a trailing slash from app.url", () => {
+    expect(
+      resolveCatchAllTarget("forms", {
+        workspaceApps: [
+          { id: "forms", path: "/forms", url: "https://forms.example.com/" },
+        ],
+      }),
+    ).toBe("https://forms.example.com");
+  });
+
+  it("ignores an empty/whitespace app.url and falls back to path", () => {
+    expect(
+      resolveCatchAllTarget("forms", {
+        workspaceApps: [{ id: "forms", path: "/forms", url: "   " }],
+      }),
+    ).toBe("/forms");
+  });
+
+  it("collapses leading slashes/backslashes in app.path so `/\\evil.example` can't redirect off-origin", () => {
+    // Browsers normalize backslashes to forward slashes during URL
+    // parsing, so `throw redirect("/\\evil.example")` would resolve to
+    // `https://evil.example`. The regex covers both slash types.
+    expect(
+      resolveCatchAllTarget("forms", {
+        workspaceApps: [{ id: "forms", path: "/\\evil.example" }],
+      }),
+    ).toBe("/evil.example");
+  });
+
+  it("collapses leading double slashes in app.path so `//evil.example` can't redirect off-origin", () => {
+    // The manifest parser only checks `startsWith("/")`, so a path of
+    // `//evil.example` slips through. Browsers treat that as a network-
+    // path reference and `throw redirect("//evil.example")` would redirect
+    // to `https://evil.example` — the same phishing vector the `app.url`
+    // validator closes. Collapse the leading slashes so the redirect
+    // stays on the gateway.
+    expect(
+      resolveCatchAllTarget("forms", {
+        workspaceApps: [{ id: "forms", path: "//evil.example" }],
+      }),
+    ).toBe("/evil.example");
+  });
+
+  it("falls back to /${appId} when the manifest entry has neither path nor url", () => {
+    expect(
+      resolveCatchAllTarget("forms", {
+        workspaceApps: [{ id: "forms", path: "" }],
+      }),
+    ).toBe("/forms");
+  });
+
+  it("returns null when nothing matches", () => {
+    expect(
+      resolveCatchAllTarget("unknown-app", {
+        workspaceApps: [{ id: "dispatch", path: "/dispatch" }],
+      }),
+    ).toBeNull();
+  });
+});

package/src/lib/catch-all-target.ts

@@ -0,0 +1,125 @@
+interface WorkspaceAppManifestEntry {
+  id?: string;
+  path?: unknown;
+  url?: unknown;
+}
+
+interface BuiltinAgentEntry {
+  id: string;
+  url?: string | null;
+}
+
+interface ResolveCatchAllTargetOptions {
+  workspaceApps?: WorkspaceAppManifestEntry[] | null;
+  builtinAgents?: BuiltinAgentEntry[] | null;
+}
+
+/**
+ * Resolve where `/dispatch/<appId>` should bounce to when it doesn't match
+ * an explicit dispatch route. Used by the `$appId` catch-all route loader.
+ *
+ * Resolution order:
+ *
+ * 1. Workspace apps manifest (env, .agent-native/workspace-apps.json, or a
+ *    filesystem scan of `apps/`).
+ *    - `app.url` (absolute URL — externally hosted workspace app) wins if
+ *      present.
+ *    - Otherwise the `app.path` mounted under the workspace gateway is
+ *      used. Path is normalized to a leading slash if missing
+ *      (e.g. manifest entry `path: "my-forms"` -> `/my-forms`), so an app
+ *      whose mounted path differs from its id ends up at the right place
+ *      instead of being silently rewritten to `/${appId}`.
+ *    - Bare entry with no path / url falls back to `/${appId}`.
+ * 2. First-party template registry. When no workspace manifest matches
+ *    (framework dev with each template on its own port, hosted dispatch
+ *    with no sibling apps), return the matching template's deploy URL —
+ *    dev URL in development (e.g. http://localhost:8084 for forms), prod
+ *    URL in production (e.g. https://forms.jami.studio).
+ *
+ * Returns `null` if neither lookup matches, letting the route render its
+ * "Page not found" pane.
+ */
+/**
+ * Validate `app.url` is an absolute http(s) URL before we trust it as a
+ * redirect target. A bare hostname (`"forms.example.com"`) or a
+ * `javascript:` scheme would otherwise get returned verbatim from
+ * `resolveCatchAllTarget` and produce a broken redirect (or a phishing
+ * vector). Mirrors `normalizeWorkspaceAppUrl` in
+ * `packages/core/src/deploy/workspace-deploy.ts` — but inlined to avoid
+ * pulling the deploy CLI module into a runtime path.
+ */
+function validatedAbsoluteUrl(value: unknown): string | undefined {
+  if (typeof value !== "string" || !value.trim()) return undefined;
+  try {
+    const parsed = new URL(value.trim());
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return undefined;
+    }
+    return parsed.toString().replace(/\/$/, "");
+  } catch {
+    return undefined;
+  }
+}
+
+export function resolveCatchAllTarget(
+  appId: string,
+  options: ResolveCatchAllTargetOptions = {},
+): string | null {
+  const apps = options.workspaceApps;
+  if (apps) {
+    const app = apps.find((entry) => entry?.id === appId);
+    if (app) {
+      // Explicit externally-hosted URL wins. Workspaces that point at a
+      // remote deploy (e.g. a sibling app on Netlify) set `url` and we
+      // should bounce the user there rather than mounting a local path
+      // that doesn't exist inside the gateway. Validate the URL first —
+      // a bare hostname or non-http(s) scheme would produce a broken
+      // redirect (and a `javascript:` value would be a phishing vector).
+      const url = validatedAbsoluteUrl(app.url);
+      if (url) {
+        return url;
+      }
+      // Fall back to the mounted path. Normalize to leading slash so an
+      // entry whose path differs from its id (e.g. `id: "forms"`,
+      // `path: "my-forms"`) still lands on the correct gateway mount —
+      // not on `/${appId}`, which would silently route to the wrong app.
+      //
+      // Reject scheme-relative paths. Three variants reach this point —
+      // all of them get collapsed to a single leading slash so the
+      // redirect stays on the gateway:
+      //
+      //   `//evil.example`   — network-path reference, browser treats as
+      //                        absolute (https://evil.example).
+      //   `/\evil.example`   — browsers normalize backslashes to forward
+      //                        slashes during URL parsing, same result.
+      //   `\/evil.example`   — same idea, leading-backslash variant.
+      //
+      // The manifest parser only checks `startsWith("/")` for the first
+      // case, and even that allows `//evil...`. Defend in depth here by
+      // collapsing any run of leading slashes-or-backslashes to one
+      // forward slash. Same phishing vector that `validatedAbsoluteUrl`
+      // closes for `app.url`.
+      if (typeof app.path === "string" && app.path.trim()) {
+        const normalized = app.path.trim().replace(/^[/\\]+/, "/");
+        return normalized.startsWith("/") ? normalized : `/${normalized}`;
+      }
+      return `/${appId}`;
+    }
+  }
+  const builtin = (options.builtinAgents ?? []).find(
+    (agent) => agent.id === appId,
+  );
+  return builtin?.url ?? null;
+}
+
+export async function resolveServerCatchAllTarget(
+  appId: string,
+): Promise<string | null> {
+  if (!import.meta.env.SSR) return null;
+  const { getBuiltinAgents, loadWorkspaceAppsManifest } =
+    await import("@agent-native/core/server/agent-discovery");
+  return resolveCatchAllTarget(appId, {
+    workspaceApps: loadWorkspaceAppsManifest(),
+    builtinAgents: getBuiltinAgents("dispatch"),
+  });
+}

package/src/lib/overview-chat.spec.ts

@@ -0,0 +1,63 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const frameState = vi.hoisted(() => ({ inBuilderFrame: false }));
+const sendToAgentChatMock = vi.hoisted(() => vi.fn(() => "chat-tab"));
+
+vi.mock("@agent-native/core/client", () => ({
+  isInBuilderFrame: () => frameState.inBuilderFrame,
+  sendToAgentChat: sendToAgentChatMock,
+}));
+
+const { submitOverviewPrompt } = await import("./overview-chat.js");
+
+describe("submitOverviewPrompt", () => {
+  beforeEach(() => {
+    frameState.inBuilderFrame = false;
+    sendToAgentChatMock.mockClear();
+  });
+
+  it("sends overview prompts to a new local agent tab outside Builder", () => {
+    const tabId = submitOverviewPrompt(" build a metrics app ", "auto");
+
+    expect(tabId).toBe("chat-tab");
+    expect(sendToAgentChatMock).toHaveBeenCalledWith({
+      message: "build a metrics app",
+      submit: true,
+      newTab: true,
+      model: "auto",
+    });
+  });
+
+  it("can submit to a mounted page chat without opening the sidebar", () => {
+    const tabId = submitOverviewPrompt(" build a metrics app ", "auto", {
+      openSidebar: false,
+    });
+
+    expect(tabId).toBe("chat-tab");
+    expect(sendToAgentChatMock).toHaveBeenCalledWith({
+      message: "build a metrics app",
+      submit: true,
+      newTab: true,
+      model: "auto",
+      openSidebar: false,
+    });
+  });
+
+  it("routes overview prompts to Builder chat inside Builder", () => {
+    frameState.inBuilderFrame = true;
+
+    const tabId = submitOverviewPrompt("ship the onboarding flow", "auto");
+
+    expect(tabId).toBe("chat-tab");
+    expect(sendToAgentChatMock).toHaveBeenCalledWith({
+      message: "ship the onboarding flow",
+      submit: true,
+      type: "code",
+    });
+  });
+
+  it("ignores empty prompts", () => {
+    expect(submitOverviewPrompt("   ", "auto")).toBeNull();
+    expect(sendToAgentChatMock).not.toHaveBeenCalled();
+  });
+});

package/src/lib/overview-chat.ts

@@ -0,0 +1,26 @@
+import { isInBuilderFrame, sendToAgentChat } from "@agent-native/core/client";
+
+export function submitOverviewPrompt(
+  message: string,
+  selectedModel?: string | null,
+  options?: { openSidebar?: boolean },
+): string | null {
+  const trimmed = message.trim();
+  if (!trimmed) return null;
+
+  if (isInBuilderFrame()) {
+    return sendToAgentChat({
+      message: trimmed,
+      submit: true,
+      type: "code",
+    });
+  }
+
+  return sendToAgentChat({
+    message: trimmed,
+    submit: true,
+    newTab: true,
+    model: selectedModel || undefined,
+    ...(options?.openSidebar === false ? { openSidebar: false } : {}),
+  });
+}

package/src/lib/task-queue.spec.ts

@@ -0,0 +1,57 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  formatQueueAgeSeconds,
+  normalizeTaskQueueStats,
+  ZERO_TASK_QUEUE_STATS,
+} from "./task-queue";
+
+describe("normalizeTaskQueueStats", () => {
+  it("returns zeros for invalid payloads", () => {
+    expect(normalizeTaskQueueStats(null)).toEqual(ZERO_TASK_QUEUE_STATS);
+    expect(normalizeTaskQueueStats("bad")).toEqual(ZERO_TASK_QUEUE_STATS);
+  });
+
+  it("normalizes numeric fields and recent failures", () => {
+    expect(
+      normalizeTaskQueueStats({
+        pending: "2",
+        processing: 1,
+        completed_last_hour: 4,
+        failed_last_hour: "1",
+        oldest_pending_age_seconds: 90,
+        recent_failures: [
+          {
+            id: "f1",
+            platform: "slack",
+            error: "rate limited",
+            attempts: "3",
+          },
+        ],
+      }),
+    ).toEqual({
+      pending: 2,
+      processing: 1,
+      completed_last_hour: 4,
+      failed_last_hour: 1,
+      oldest_pending_age_seconds: 90,
+      recent_failures: [
+        {
+          id: "f1",
+          platform: "slack",
+          error: "rate limited",
+          attempts: 3,
+        },
+      ],
+    });
+  });
+});
+
+describe("formatQueueAgeSeconds", () => {
+  it("formats common ages", () => {
+    expect(formatQueueAgeSeconds(0)).toBe("none");
+    expect(formatQueueAgeSeconds(12)).toBe("12s");
+    expect(formatQueueAgeSeconds(120)).toBe("2m");
+    expect(formatQueueAgeSeconds(7200)).toBe("2.0h");
+  });
+});

package/src/lib/task-queue.ts

@@ -0,0 +1,72 @@
+import { agentNativePath } from "@agent-native/core/client";
+
+export interface TaskQueueFailure {
+  id: string;
+  platform: string;
+  error: string;
+  attempts: number;
+}
+
+export interface TaskQueueStats {
+  pending: number;
+  processing: number;
+  completed_last_hour: number;
+  failed_last_hour: number;
+  oldest_pending_age_seconds: number;
+  recent_failures: TaskQueueFailure[];
+}
+
+export const ZERO_TASK_QUEUE_STATS: TaskQueueStats = {
+  pending: 0,
+  processing: 0,
+  completed_last_hour: 0,
+  failed_last_hour: 0,
+  oldest_pending_age_seconds: 0,
+  recent_failures: [],
+};
+
+function asNumber(value: unknown): number {
+  const n = Number(value ?? 0);
+  return Number.isFinite(n) ? n : 0;
+}
+
+export function normalizeTaskQueueStats(value: unknown): TaskQueueStats {
+  if (!value || typeof value !== "object") return ZERO_TASK_QUEUE_STATS;
+  const stats = value as Record<string, unknown>;
+  return {
+    pending: asNumber(stats.pending),
+    processing: asNumber(stats.processing),
+    completed_last_hour: asNumber(stats.completed_last_hour),
+    failed_last_hour: asNumber(stats.failed_last_hour),
+    oldest_pending_age_seconds: asNumber(stats.oldest_pending_age_seconds),
+    recent_failures: Array.isArray(stats.recent_failures)
+      ? stats.recent_failures.map((failure, index) => {
+          const row =
+            failure && typeof failure === "object"
+              ? (failure as Record<string, unknown>)
+              : {};
+          return {
+            id: String(row.id ?? `failure-${index}`),
+            platform: String(row.platform ?? ""),
+            error: String(row.error ?? ""),
+            attempts: asNumber(row.attempts),
+          };
+        })
+      : [],
+  };
+}
+
+export async function getDispatchTaskQueueStats(): Promise<TaskQueueStats> {
+  const response = await fetch(
+    agentNativePath("/_agent-native/integrations/task-queue/status"),
+  );
+  if (!response.ok) return ZERO_TASK_QUEUE_STATS;
+  return normalizeTaskQueueStats(await response.json().catch(() => null));
+}
+
+export function formatQueueAgeSeconds(seconds: number): string {
+  if (!Number.isFinite(seconds) || seconds <= 0) return "none";
+  if (seconds < 60) return `${Math.round(seconds)}s`;
+  if (seconds < 3600) return `${Math.round(seconds / 60)}m`;
+  return `${(seconds / 3600).toFixed(1)}h`;
+}