@k2b/cloud 0.40.0 → 0.42.0

package/src/api/search.ts

@@ -2,7 +2,7 @@ import { Hono, type MiddlewareHandler } from "hono";
 import { describeRoute, resolver } from "hono-openapi";
 import { readBoundedJson } from "../_internal/bounded-json";
 import { resolveCapabilityManifestPresentation } from "../_internal/capabilities";
-import { listCapabilities } from "../_internal/registry";
+import { type listApps, listCapabilities } from "../_internal/registry";
 import type { CapabilityRegistryEntry } from "../contracts";
 import {
   CAPABILITY_FRAMEWORK_ERROR_CODES,
@@ -14,9 +14,12 @@ import {
 import { type AuthContext, auth, expectUserBackedActor, jsonResponse, preferredLocale, requiresAuth, v } from "../server";
 import { noTransform } from "../server/middleware/no-transform";
 import { logger } from "../services";
+import { appAccessAuthority } from "../services/app-access";
+import { discoverableAppEntries } from "../services/app-discovery";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { searchInvocationOperation } from "../services/identity/invocation-operations";
-import { normalizeInvocationRequestId, signInvocationToken } from "../services/identity/invocation-token";
+import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
+import { issueInvocationToken as signInvocationToken } from "../services/identity/issue-invocation";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
 import { LOCALE_HEADER } from "../shared/locale";
 import { ndjsonLine, ndjsonStream, ndjsonStreamHeaders, startBounded, waitWithin } from "./fanout";
@@ -83,6 +86,7 @@ type SearchRouteDependencies = {
   listCapabilities?: () => Promise<CapabilityRegistryEntry[]>;
   fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
   authenticate?: MiddlewareHandler<AuthContext>;
+  listApps?: typeof listApps;
   signInvocation?: typeof signInvocationToken;
   withActiveSigner?: typeof withActiveIdentitySigner;
 };
@@ -137,7 +141,7 @@ export const createSearchRoutes = (dependencies: SearchRouteDependencies = {}) =
       const invocationAuthority = invocationAuthorityFromRequest(auth.getAuthority(c));
       let entries: CapabilityRegistryEntry[];
       try {
-        entries = await registry();
+        entries = await discoverableAppEntries(appAccessAuthority(c), await registry(), dependencies.listApps);
       } catch (error) {
         log.warn("Search capability registry unavailable", { error: error instanceof Error ? error.message : String(error) });
         return c.json(
@@ -237,22 +241,25 @@ export const createSearchRoutes = (dependencies: SearchRouteDependencies = {}) =
           signedInvocations = await waitWithin(
             (dependencies.withActiveSigner ?? withActiveIdentitySigner)(
               "invocation",
-              (signer) =>
+              (signer, db) =>
                 Promise.all(
                   startBounded(
                     active,
                     PROVIDER_CONCURRENCY,
                     (provider) =>
-                      (dependencies.signInvocation ?? signInvocationToken)({
-                        targetAppId: provider.appId,
-                        callingAppId: "core",
-                        operation: searchInvocationOperation,
-                        schemaHash: provider.schemaHash,
-                        authority: invocationAuthority,
-                        requestId,
-                        signer,
-                        issuer: signer.issuer,
-                      }),
+                      (dependencies.signInvocation ?? signInvocationToken)(
+                        {
+                          targetAppId: provider.appId,
+                          callingAppId: "core",
+                          operation: searchInvocationOperation,
+                          schemaHash: provider.schemaHash,
+                          authority: invocationAuthority,
+                          requestId,
+                          signer,
+                          issuer: signer.issuer,
+                        },
+                        { db, groupsAdmin: signer.groupsAdmin },
+                      ),
                     fanoutSignal,
                   ),
                 ),

package/src/api/sync-ops.ts

@@ -2,10 +2,12 @@ import { Hono, type MiddlewareHandler } from "hono";
 import { readBoundedJson } from "../_internal/bounded-json";
 import { getApp, listApps } from "../_internal/registry";
 import { type AuthContext, auth, rejectReservedWorkloadCredential } from "../server";
+import { AppAccessDeniedError, appAccessDeniedBody } from "../server/middleware/app-access";
 import { noTransform } from "../server/middleware/no-transform";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { syncInvocationOperation } from "../services/identity/invocation-operations";
-import { normalizeInvocationRequestId, signInvocationToken } from "../services/identity/invocation-token";
+import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
+import { issueInvocationToken as signInvocationToken } from "../services/identity/issue-invocation";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
 
 type Dependencies = {
@@ -53,17 +55,20 @@ export const createSyncOpsProxyRoutes = (dependencies: Dependencies = {}) =>
       try {
         const signed = await (dependencies.withActiveSigner ?? withActiveIdentitySigner)(
           "invocation",
-          (signer) =>
-            (dependencies.signInvocation ?? signInvocationToken)({
-              targetAppId: app.id,
-              callingAppId: "core",
-              operation,
-              schemaHash: null,
-              authority: invocationAuthorityFromRequest(auth.getAuthority(c)),
-              requestId,
-              signer,
-              issuer: signer.issuer,
-            }),
+          (signer, db) =>
+            (dependencies.signInvocation ?? signInvocationToken)(
+              {
+                targetAppId: app.id,
+                callingAppId: "core",
+                operation,
+                schemaHash: null,
+                authority: invocationAuthorityFromRequest(auth.getAuthority(c)),
+                requestId,
+                signer,
+                issuer: signer.issuer,
+              },
+              { db, groupsAdmin: signer.groupsAdmin },
+            ),
           { signal, timeoutMs: 5_000 },
         );
         const headers = new Headers({ authorization: `Bearer ${signed.token}`, accept: "application/json" });
@@ -75,7 +80,8 @@ export const createSyncOpsProxyRoutes = (dependencies: Dependencies = {}) =>
         const result = await readBoundedJson(response, 4 * 1024 * 1024);
         if (!result.ok) return c.json({ message: "Invalid Sync operations response" }, 502);
         return Response.json(result.data, { status: response.status, headers: { "cache-control": "no-store" } });
-      } catch {
+      } catch (error) {
+        if (error instanceof AppAccessDeniedError) return c.json(appAccessDeniedBody(error.app), 403);
         return c.json({ message: "Sync operations unavailable" }, 502);
       }
     });

package/src/api/widgets.ts

@@ -1,8 +1,9 @@
+import type { SQL } from "bun";
 import { type Context, Hono, type MiddlewareHandler } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { z } from "zod";
 import { readBoundedJson } from "../_internal/bounded-json";
-import { type DashboardWidget, listWidgets } from "../_internal/registry";
+import { type DashboardWidget, type listApps, listWidgets } from "../_internal/registry";
 import { parseWidgetSettings } from "../_internal/widget-settings";
 import {
   type DashboardWidgetSize,
@@ -20,12 +21,16 @@ import {
   widgetKey,
 } from "../contracts/widgets";
 import { type AuthContext, auth, preferredLocale, rejectReservedWorkloadCredential } from "../server";
+import { AppAccessDeniedError, appAccessDeniedBody } from "../server/middleware/app-access";
 import { noTransform } from "../server/middleware/no-transform";
 import { WIDGET_SETTINGS_PARAM, WIDGET_SETTINGS_PARAM_MAX_LENGTH, WIDGET_SIZE_PARAM } from "../server/widget-request";
+import { appAccessAuthority } from "../services/app-access";
+import { discoverableAppEntries } from "../services/app-discovery";
 import { CLOUD_INVOCATION_TOKEN_TTL_SECONDS } from "../services/identity/constants";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { widgetInvocationOperation } from "../services/identity/invocation-operations";
-import { normalizeInvocationRequestId, signInvocationToken } from "../services/identity/invocation-token";
+import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
+import { issueInvocationToken as signInvocationToken } from "../services/identity/issue-invocation";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
 import { logger } from "../services/logging";
 import { LOCALE_HEADER } from "../shared/locale";
@@ -35,6 +40,7 @@ type WidgetRouteDependencies = {
   listWidgets?: typeof listWidgets;
   fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
   authenticate?: MiddlewareHandler<AuthContext>;
+  listApps?: typeof listApps;
   signInvocation?: typeof signInvocationToken;
   withActiveSigner?: typeof withActiveIdentitySigner;
   timeoutMs?: number;
@@ -196,17 +202,21 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
     widget: DashboardWidget,
     requestId: string | undefined,
     signer: Parameters<Parameters<typeof withActiveIdentitySigner>[1]>[0],
+    db: SQL,
   ) =>
-    signInvocation({
-      targetAppId: widget.appId,
-      callingAppId: "core",
-      operation: widgetInvocationOperation(widget.widgetId),
-      schemaHash: null,
-      authority: invocationAuthorityFromRequest(auth.getAuthority(c)),
-      requestId,
-      signer,
-      issuer: signer.issuer,
-    });
+    signInvocation(
+      {
+        targetAppId: widget.appId,
+        callingAppId: "core",
+        operation: widgetInvocationOperation(widget.widgetId),
+        schemaHash: null,
+        authority: invocationAuthorityFromRequest(auth.getAuthority(c)),
+        requestId,
+        signer,
+        issuer: signer.issuer,
+      },
+      { db, groupsAdmin: signer.groupsAdmin },
+    );
 
   const stream = async (c: Context<AuthContext>, entries: WidgetEntry[], requestId: string | undefined) => {
     const streamDeadline = AbortSignal.timeout(WIDGET_STREAM_DEADLINE_MS);
@@ -221,8 +231,10 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
         tokens = await waitWithin(
           withActiveSigner(
             "invocation",
-            (signer) =>
-              Promise.all(startBounded(entries, WIDGET_CONCURRENCY, async (entry) => sign(c, entry.widget, requestId, signer), signing)),
+            (signer, db) =>
+              Promise.all(
+                startBounded(entries, WIDGET_CONCURRENCY, async (entry) => sign(c, entry.widget, requestId, signer, db), signing),
+              ),
             { signal: signing, timeoutMs },
           ),
           signing,
@@ -316,7 +328,10 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
         let requested = new Map<string, DashboardWidgetSize | undefined>();
         try {
           const keys = new Set<string>();
-          const declared = await waitWithin(registry(), setup);
+          const declared = await waitWithin(
+            registry().then((entries) => discoverableAppEntries(appAccessAuthority(c), entries, dependencies.listApps)),
+            setup,
+          );
           const declaredKeys = new Set(declared.map((widget) => widgetKey(widget.appId, widget.widgetId)));
           requested = new Map((c.req.queries("widget") ?? []).map((value) => parseRequestedWidget(value, declaredKeys)));
           widgets = declared.filter((widget) => {
@@ -351,7 +366,10 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
           const setup = AbortSignal.any([c.req.raw.signal, AbortSignal.timeout(timeoutMs)]);
           let declared: DashboardWidget[];
           try {
-            declared = await waitWithin(registry(), setup);
+            declared = await waitWithin(
+              registry().then((entries) => discoverableAppEntries(appAccessAuthority(c), entries, dependencies.listApps)),
+              setup,
+            );
           } catch {
             log.warn("Widget registry unavailable", { reason: setup.aborted ? "deadline_exceeded" : "operation_failed" });
             return c.json({ message: "Widget registry is currently unavailable" }, 503);
@@ -372,12 +390,17 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
         const requestId = normalizeInvocationRequestId(c.req.header("x-request-id"));
         let phase: WidgetPhase = "registry";
         try {
-          const widget = (await waitWithin(registry(), signal)).find((entry) => entry.appId === appId && entry.widgetId === widgetId);
+          const widget = (
+            await waitWithin(
+              registry().then((entries) => discoverableAppEntries(appAccessAuthority(c), entries, dependencies.listApps)),
+              signal,
+            )
+          ).find((entry) => entry.appId === appId && entry.widgetId === widgetId);
           if (!widget) return c.json({ message: "Widget not found" }, 404);
 
           phase = "signing";
           const signed = await waitWithin(
-            withActiveSigner("invocation", (signer) => sign(c, widget, requestId, signer), { signal, timeoutMs }),
+            withActiveSigner("invocation", (signer, db) => sign(c, widget, requestId, signer, db), { signal, timeoutMs }),
             signal,
           );
 
@@ -405,6 +428,7 @@ export const createWidgetRoutes = (dependencies: WidgetRouteDependencies = {}) =
                 : "Widget is unavailable";
           return Response.json({ message }, { status: 502 });
         } catch (error) {
+          if (error instanceof AppAccessDeniedError) return Response.json(appAccessDeniedBody(error.app), { status: 403 });
           const isTimeout = timeout.aborted || (error instanceof Error && error.name === "TimeoutError");
           const reason: WidgetRejectionReason = isTimeout ? "deadline_exceeded" : signal.aborted ? "request_cancelled" : "operation_failed";
           logRejection({ appId, widgetId }, phase, reason);

package/src/approvals/Approvals.tsx

@@ -1,12 +1,9 @@
 import { dates } from "@k2b/stdlib";
 import { Button, dialogCore, PanelDialog, Placeholder, panelDialogOptions, prompts, useLocale } from "@k2b/ui";
 import { createMemo, createSignal, For, type JSX, onCleanup, onMount, Show } from "solid-js";
-import { capabilityQuestionText, capabilityUnknownText } from "../_internal/capability-sentences";
-import { isLegacyActionReview, storedActionReview } from "../ai/action-review";
-import { type ActionCard, legacyActionCard, reviewActionCard } from "../ai/chat/action-card";
+import type { ActionCard } from "../ai/chat/action-card";
 import { actionMessages } from "../ai/chat/action-messages";
 import { ActionQuestion, ActionReceipt } from "../ai/chat/action-question";
-import { aiChatMessages } from "../ai/chat/messages";
 import { refreshAppBadges } from "../browser/app-badges";
 import { coreClient } from "../clients/core";
 import {
@@ -17,6 +14,7 @@ import {
   ApprovalPageSchema,
   type PendingApproval,
 } from "../contracts/approvals";
+import { approvalCard } from "./approval-card";
 import { approvalMessages } from "./messages";
 
 /** How a decided request ends in this list. It stays in place as a receipt until the next load. */
@@ -57,60 +55,13 @@ const useMessages = () => {
   return () => approvalMessages.resolve([locale()]).t;
 };
 
-const lines = (item: PendingApproval) =>
-  item.sentence
-    .split("\n")
-    .map((line) => line.trim())
-    .filter(Boolean);
-
-/** The first line names the app and the Action; the app already shows as the row's icon and origin. */
-const approvalTitle = (item: PendingApproval): string => {
-  const first = lines(item)[0] ?? item.action;
-  const prefix = `${item.app.name}: `;
-  return first.startsWith(prefix) && first.length > prefix.length ? first.slice(prefix.length) : first;
-};
-
-/** Without a review, the sentence's later `Label: value` lines are what the person approves. */
-const sentenceRows = (item: PendingApproval) =>
-  lines(item)
-    .slice(1)
-    .map((line) => {
-      const match = /^([^:]{1,40}):\s+(.+)$/.exec(line);
-      return match ? { label: match[1]!, value: match[2] ?? "" } : { label: "", value: line };
-    });
-
-/**
- * The same card as the chat: a new review gives the app's sentence, reason, and preview; an old review its literal
- * message and rows; a request without a review its sentence. Times show in the reader's zone (UTC until the page
- * passes one, the same on the server and in the first browser render).
- */
-const approvalCard = (item: PendingApproval, locale: string, timeZone: string): ActionCard => {
-  const app = { name: item.app.name, icon: item.app.icon ?? "ti ti-shield-check" };
-  const context = { locale, timeZone, app };
-  const review = item.review ? storedActionReview(item.review) : null;
-  if (review && !isLegacyActionReview(review)) return reviewActionCard(review, context);
-  const title = approvalTitle(item);
-  const t = aiChatMessages(locale);
-  return legacyActionCard(
-    {
-      question: review?.legacy.question ?? capabilityQuestionText(title, locale),
-      rows: review?.legacy.rows ?? sentenceRows(item),
-      ...(review?.legacy.markdown ? { markdown: review.legacy.markdown } : {}),
-      ...(review?.legacy.links ? { links: review.legacy.links } : {}),
-      subject: title,
-      title,
-      outcome: {
-        running: t.receiptRunning({ title }),
-        done: t.receiptDone({ title }),
-        rejected: t.receiptRejected({ title }),
-        notRun: t.receiptNotRun({ title, stopped: false }),
-        unknown: capabilityUnknownText(title, locale),
-        unknownStill: capabilityUnknownText(title, locale, true),
-      },
-    },
-    context,
-  );
-};
+const cardInput = (item: PendingApproval) => ({
+  sentence: item.sentence,
+  action: item.action,
+  appName: item.app.name,
+  appIcon: item.app.icon,
+  review: item.review,
+});
 
 /** Origin of the request: owning app, the chat it waits in, when Cloud asked, and when it expires. */
 function Origin(props: { item: PendingApproval; withApp?: boolean }) {
@@ -170,7 +121,7 @@ function ApprovalCard(props: {
 }) {
   const t = useMessages();
   const locale = useLocale();
-  const card = createMemo(() => approvalCard(props.item, locale(), READER_TIME_ZONE));
+  const card = createMemo(() => approvalCard(cardInput(props.item), locale(), READER_TIME_ZONE));
   const current = () => props.outcome ?? (props.failed ? "failed" : "sending");
   const state = () => (props.outcome || props.busy || props.failed ? "decided" : "open");
   // `confirm` asks every time, whatever the stored options say.
@@ -228,9 +179,11 @@ function BandDecision(props: {
       <Button size="sm" variant="ghost" disabled={props.busy} onClick={() => props.decide({ approved: false })}>
         {t().reject}
       </Button>
-      <Button size="sm" variant="primary" loading={props.busy} onClick={() => props.decide({ approved: true })}>
-        {t().approve}
-      </Button>
+      <Show when={!(props.item.review && "contentRef" in props.item.review && props.item.review.contentRef)}>
+        <Button size="sm" variant="primary" loading={props.busy} onClick={() => props.decide({ approved: true })}>
+          {t().approve}
+        </Button>
+      </Show>
     </div>
   );
 }
@@ -251,7 +204,7 @@ const openDetails = (item: PendingApproval, locale: string) =>
   dialogCore.open<ApprovalDecisionInput>(
     (close) => {
       const t = () => approvalMessages.resolve([locale]).t;
-      const card = approvalCard(item, locale, READER_TIME_ZONE);
+      const card = approvalCard(cardInput(item), locale, READER_TIME_ZONE);
       return (
         <PanelDialog>
           <PanelDialog.Header
@@ -290,7 +243,13 @@ const openDetails = (item: PendingApproval, locale: string) =>
         </PanelDialog>
       );
     },
-    { ...panelDialogOptions, history: true, ariaLabel: approvalMessages.resolve([locale]).t.approvalFor({ title: approvalTitle(item) }) },
+    {
+      ...panelDialogOptions,
+      history: true,
+      ariaLabel: approvalMessages
+        .resolve([locale])
+        .t.approvalFor({ title: approvalCard(cardInput(item), locale, READER_TIME_ZONE).questionText }),
+    },
   );
 
 function Row(props: {
@@ -304,6 +263,8 @@ function Row(props: {
 }) {
   const t = useMessages();
   const locale = useLocale();
+  // The band words the request as the card does: the plain question and Cloud's reason line.
+  const card = createMemo(() => approvalCard(cardInput(props.item), locale(), READER_TIME_ZONE));
   const details = async () => {
     const input = await openDetails(props.item, locale());
     if (input) props.decide(input);
@@ -322,10 +283,13 @@ function Row(props: {
         />
       }
     >
-      <article class="cloud-approval-band" data-decided={props.outcome} aria-label={t().approvalFor({ title: approvalTitle(props.item) })}>
+      <article class="cloud-approval-band" data-decided={props.outcome} aria-label={t().approvalFor({ title: card().questionText })}>
         <i class={props.outcome ? outcomeIcon(props.outcome, true) : "ti ti-alert-triangle"} aria-hidden="true" />
         <div class="cloud-approval-band__text">
-          <strong>{approvalTitle(props.item)}</strong>
+          <strong lang={card().locale}>{card().questionText}</strong>
+          <span class="cloud-approval-band__reason" lang={card().locale}>
+            {card().reason.text}
+          </span>
           <Origin item={props.item} withApp={false} />
         </div>
         <div class="cloud-approval__foot">

package/src/approvals/approval-card.ts

@@ -0,0 +1,68 @@
+import { capabilityQuestionText, capabilityUnknownText } from "../_internal/capability-sentences";
+import { type AiStoredActionReview, isLegacyActionReview, storedActionReview } from "../ai/action-review";
+import { type ActionCard, legacyActionCard, reviewActionCard } from "../ai/chat/action-card";
+import { aiChatMessages } from "../ai/chat/messages";
+import type { CapabilityActionReviewData } from "../contracts/capabilities";
+
+export type ApprovalCardInput = {
+  sentence: string;
+  action: string;
+  appName: string;
+  appIcon?: string | null;
+  review: CapabilityActionReviewData | AiStoredActionReview | null;
+};
+
+const lines = (item: ApprovalCardInput) =>
+  item.sentence
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+
+/** The first line names the app and the Action; the app already shows as the row's icon and origin. */
+const approvalTitle = (item: ApprovalCardInput): string => {
+  const first = lines(item)[0] ?? item.action;
+  const prefix = `${item.appName}: `;
+  return first.startsWith(prefix) && first.length > prefix.length ? first.slice(prefix.length) : first;
+};
+
+/** Without a review, the sentence's later `Label: value` lines are what the person approves. */
+const sentenceRows = (item: ApprovalCardInput) =>
+  lines(item)
+    .slice(1)
+    .map((line) => {
+      const match = /^([^:]{1,40}):\s+(\S.*)$/.exec(line);
+      return match ? { label: match[1]!, value: match[2] ?? "" } : { label: "", value: line };
+    });
+
+/**
+ * The same card as the chat: a new review gives the app's sentence, reason, and preview; an old review its literal
+ * message and rows; a request without a review its sentence. Times show in the reader's zone (UTC until the page
+ * passes one, the same on the server and in the first browser render).
+ */
+export const approvalCard = (item: ApprovalCardInput, locale: string, timeZone: string): ActionCard => {
+  const app = { name: item.appName, icon: item.appIcon ?? "ti ti-shield-check" };
+  const context = { locale, timeZone, app };
+  const review = item.review ? ("legacy" in item.review ? item.review : storedActionReview(item.review)) : null;
+  if (review && !isLegacyActionReview(review)) return reviewActionCard(review, context);
+  const title = approvalTitle(item);
+  const t = aiChatMessages(locale);
+  return legacyActionCard(
+    {
+      question: review?.legacy.question ?? capabilityQuestionText(title, locale),
+      rows: review?.legacy.rows ?? sentenceRows(item),
+      ...(review?.legacy.markdown ? { markdown: review.legacy.markdown } : {}),
+      ...(review?.legacy.links ? { links: review.legacy.links } : {}),
+      subject: title,
+      title,
+      outcome: {
+        running: t.receiptRunning({ title }),
+        done: t.receiptDone({ title }),
+        rejected: t.receiptRejected({ title }),
+        notRun: t.receiptNotRun({ title, stopped: false }),
+        unknown: capabilityUnknownText(title, locale),
+        unknownStill: capabilityUnknownText(title, locale, true),
+      },
+    },
+    context,
+  );
+};

package/src/browser/CloudResourceSearch.browser-harness.tsx

@@ -1,6 +1,12 @@
+import { LocaleProvider } from "@k2b/ui";
+import { render } from "solid-js/web";
 import { appAccentStyle } from "../ssr/app-appearance";
 import { createGlobalSearchHost } from "../ssr/global-search-host";
+import { platformMessages } from "../ssr/platform-messages";
+import ShellRuntime from "../ssr/ShellRuntime.island";
+import type { ShellData } from "../ssr/shell-data";
 import { openCloudResourcePicker } from "./resource-picker";
+import { openGlobalSearch } from "./search";
 
 /**
  * Opens the real global search, or with `?picker` the resource picker, for a browser test that answers
@@ -8,7 +14,53 @@ import { openCloudResourcePicker } from "./resource-picker";
  */
 const params = new URLSearchParams(location.search);
 const app = params.get("app") ?? undefined;
-if (params.has("picker")) {
+if (params.has("launcher")) {
+  // Invented authorized shell data, rendered by the real ShellRuntime and global-search host.
+  // Role filtering itself is covered at Layout's SSR seam; this harness does not simulate authentication.
+  const locale = document.documentElement.lang || "en";
+  const de = locale === "de";
+  const data: ShellData = {
+    apps: [
+      { id: "tools", label: de ? "Werkzeuge" : "Tools", iconClass: "ti ti-tools", href: "/tools", match: "/tools", defaultVisible: false },
+      ...(params.has("admin")
+        ? [
+            {
+              id: "admin",
+              label: platformMessages.resolve([locale]).t.admin,
+              iconClass: "ti ti-settings",
+              href: "/admin",
+              match: "/admin",
+              defaultVisible: false,
+            },
+          ]
+        : []),
+    ],
+    searchLinks: {
+      tools: [
+        { label: "Tools", href: "/tools", keywords: ["utilities", "werkzeuge"] },
+        { label: "QR Code", href: "/tools/qr", keywords: ["qr"] },
+      ],
+    },
+    legalLinks: [],
+    theme: "light",
+  };
+  const script = document.createElement("script");
+  script.id = "cloud-shell-data";
+  script.type = "application/json";
+  script.textContent = JSON.stringify(data);
+  document.body.append(script);
+  const host = document.createElement("div");
+  document.body.append(host);
+  render(
+    () => (
+      <LocaleProvider locale={locale}>
+        <ShellRuntime commands={{ searchResources: !params.has("public") }} />
+      </LocaleProvider>
+    ),
+    host,
+  );
+  openGlobalSearch(app ? { scope: { appId: app, label: app } } : { query: params.get("q") ?? "" });
+} else if (params.has("picker")) {
   // The page shell renders `<body class="k2b-ui app-accent-scope" style="…">` for an app page.
   const style = appAccentStyle(params.get("accent") ?? undefined);
   if (style) {

package/src/browser/CloudResourceSearch.tsx

@@ -51,15 +51,6 @@ const isLinkableCommand = (command: PaletteCommand) => typeof command.action !==
 
 const itemKey = (item: SearchItem) => `${item.ref.type}:${item.ref.id}`;
 const URL_BASE = "https://cloud.invalid";
-const groupByApp = (items: SearchItem[]) => {
-  const groups = new Map<string, SearchItem[]>();
-  for (const item of items) {
-    const group = groups.get(item.appId) ?? [];
-    group.push(item);
-    groups.set(item.appId, group);
-  }
-  return [...groups.values()].flat();
-};
 
 export default function CloudResourceSearch(props: CloudResourceSearchProps) {
   const locale = useLocale();
@@ -236,9 +227,7 @@ export default function CloudResourceSearch(props: CloudResourceSearchProps) {
   /** Rows of the run for the current input; anything older is visible but cannot be chosen. */
   const freshResults = () => current() && shownRun();
   const results = createMemo(() =>
-    canSearch()
-      ? [...groupByApp(navigation()), ...shownBlocks().flatMap((block) => filterCloudResourceSearchItems(block.items, props))]
-      : [],
+    canSearch() ? [...navigation(), ...shownBlocks().flatMap((block) => filterCloudResourceSearchItems(block.items, props))] : [],
   );
   const searchContext = () => JSON.stringify([desiredUrl(), commandMode(), commandQuery()]);
   /**
@@ -460,6 +449,7 @@ export default function CloudResourceSearch(props: CloudResourceSearchProps) {
     }
   };
   const updateCaret = () => setCaret(inputRef.selectionStart ?? input().length);
+  const isApp = (item: SearchItem) => navigation().some((link) => link === item && link.kind === "app");
   const previewMetadata = () => (previewItem()?.metadata ?? []).filter((entry) => entry.label.trim() && entry.value.trim()).slice(0, 5);
 
   return (
@@ -670,7 +660,7 @@ export default function CloudResourceSearch(props: CloudResourceSearchProps) {
                           <i class={item.icon ?? item.appIcon} aria-hidden="true" />
                           <span class="cloud-resource-search__result-copy">
                             <span>{item.title}</span>
-                            <small>{item.preview ?? item.appName}</small>
+                            <small>{isApp(item) ? t().app : (item.preview ?? item.appName)}</small>
                           </span>
                           <Show when={commandFor(item)?.shortcut}>{(shortcut) => <Kbd keys={shortcut()} />}</Show>
                           <Show when={props.selectionMode && selectedKey() === itemKey(item)}>

package/src/browser/PanelLeaveNotice.tsx

@@ -0,0 +1,18 @@
+import { Button, NoticeCard } from "@k2b/ui";
+import { Show } from "solid-js";
+import { platformMessages } from "../ssr/platform-messages";
+
+export default function PanelLeaveNotice(props: { blocked: boolean; locale: string; resume: () => void }) {
+  const t = () => platformMessages.resolve([props.locale]).t;
+  return (
+    <Show when={props.blocked}>
+      <div role="status" data-cloud-panel-leave="blocked">
+        <NoticeCard tone="warning" title={t().panelLeaveBlocked} detail={t().panelLeaveDetail}>
+          <Button variant="ghost" onClick={props.resume}>
+            {t().panelLeaveResume}
+          </Button>
+        </NoticeCard>
+      </div>
+    </Show>
+  );
+}