@nanobpm/nano-workforce 0.85.2 → 0.85.3

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [0.85.3](https://github.com/nanobpm/nano-workforce/compare/v0.85.2...v0.85.3) (2026-08-18)
+
+
+### Bug Fixes
+
+* resolve cockpit endpoints base-relative so Studio App-View populates ([#280](https://github.com/nanobpm/nano-workforce/issues/280)) ([eb7b69b](https://github.com/nanobpm/nano-workforce/commit/eb7b69bf5e3df192205e5ac227e36a01ceb71a2b)), closes [#279](https://github.com/nanobpm/nano-workforce/issues/279)
+
 ## [0.85.2](https://github.com/nanobpm/nano-workforce/compare/v0.85.1...v0.85.2) (2026-08-18)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.85.2",
+  "version": "0.85.3",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",

package/pages/cockpit/embed.html

@@ -32,6 +32,7 @@
       const cfg = window.__NANO_APP_VIEW__ ?? {};
       mountCockpit(cfg.host ?? document.getElementById("cockpit-root"), {
         reportUrl: cfg.reportUrl,
+        transcriptsUrl: cfg.transcriptsUrl,
         relayUrl: cfg.relayUrl,
         hookSecret: cfg.hookSecret,
         relayToken: cfg.relayToken,

package/pages/cockpit/mount.js

@@ -318,7 +318,8 @@ function relaySocketFactory(url) {
  *
  * @param {Element} host — where the cockpit renders (standalone: document.body; embedded: the App-View host).
  * @param {object} [opts]
- * @param {string} [opts.reportUrl] — the supply JSON endpoint the app serves.
+ * @param {string} [opts.reportUrl] — the supply JSON endpoint the app serves (default
+ *   `"app/api/agentic/supply"`, base-relative).
  * @param {string} [opts.relayUrl]  — the agentic channel WebSocket URL (with auth token + capability query).
  * @param {string} [opts.hookSecret] — shared secret sent as `x-hook-secret` on the report fetch when the
  *   app's supply endpoint is guarded by NANO_PR_WEBHOOK_SECRET (omit for open deployments).
@@ -329,8 +330,8 @@ function relaySocketFactory(url) {
  *   least this many ms old (default 15000).
  * @param {number} [opts.pastFetchTimeoutMs] — upper bound (ms) on a single past-sessions transcripts
  *   fetch; the fetch is aborted past this so a hung endpoint can't wedge the past panel (default 15000).
- * @param {string} [opts.transcriptsUrl] — the captured-session list endpoint (default
- *   /app/api/agentic/transcripts) backing the always-on "past sessions" history + replay.
+ * @param {string} [opts.transcriptsUrl] — the captured-session list endpoint backing the always-on
+ *   "past sessions" history + replay (default `"app/api/agentic/transcripts"`, base-relative).
  * @returns a handle with `.dispose()`.
  */
 export function mountCockpit(host, opts = {}) {
@@ -340,8 +341,16 @@ export function mountCockpit(host, opts = {}) {
     );
   }
   const doc = document;
-  const reportUrl = opts.reportUrl ?? "/app/api/agentic/supply";
-  const transcriptsUrl = opts.transcriptsUrl ?? "/app/api/agentic/transcripts";
+  // Base-relative defaults (no leading slash) so the browser resolves them against the document's
+  // baseURI. Standalone (served at the app root) this is the origin root; through the Studio console
+  // App-View the document base is the app-view path (`/console/app-view/<AppName>/`) while the iframe
+  // ORIGIN is the console (:8080) — an absolute (leading-slash) path would resolve against the console
+  // origin root (`:8080/app/api/agentic/supply` → 404) instead of the app-view base that proxies the
+  // API, leaving the cockpit empty (#279). A base-relative default lands on the right endpoint both
+  // ways, so the cockpit populates identically standalone and embedded even though the console never
+  // injects window.__NANO_APP_VIEW__.
+  const reportUrl = opts.reportUrl ?? "app/api/agentic/supply";
+  const transcriptsUrl = opts.transcriptsUrl ?? "app/api/agentic/transcripts";
   const hookSecret = opts.hookSecret;
   const relayUrl = opts.relayUrl ?? defaultRelayUrl(opts.relayToken, opts.relayCapability);
   const refreshMs = opts.refreshMs ?? DEFAULT_REFRESH_MS;

package/test/cockpit-embed-endpoints.test.ts

@@ -0,0 +1,73 @@
+// Regression guard for issue #279: the cockpit renders empty when viewed through the Studio console
+// App-View because its default supply/transcript endpoints were ABSOLUTE (leading-slash) paths.
+//
+// Studio frames the app in an iframe whose document base is the app-view path
+// (`/console/app-view/<AppName>/`) but whose ORIGIN is the console (`:8080`). A leading-slash fetch
+// therefore resolves against the console origin root — `:8080/app/api/agentic/supply` → 404 — instead
+// of the app-view base that actually serves the API. The console does NOT inject
+// `window.__NANO_APP_VIEW__`, so `mount.js` falls back to its default; the default must be
+// BASE-RELATIVE (no leading slash) so the browser resolves it against `document.baseURI` and it lands
+// on the app-view base standalone AND embedded alike. This test pins that resolution behaviour so the
+// absolute-path regression can't return.
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import { readFileSync } from "node:fs";
+
+const ROOT = decodeURIComponent(new URL("../", import.meta.url).pathname);
+const MOUNT_JS = readFileSync(`${ROOT}pages/cockpit/mount.js`, "utf8");
+const EMBED_HTML = readFileSync(`${ROOT}pages/cockpit/embed.html`, "utf8");
+
+// Pull the string default out of `const <name> = opts.<name> ?? "<default>";` in mount.js.
+function defaultEndpoint(name: string): string {
+  const m = MOUNT_JS.match(new RegExp(`opts\\.${name}\\s*\\?\\?\\s*"([^"]*)"`));
+  assert(m, `mount.js must default opts.${name} to a string literal`);
+  return m![1];
+}
+
+// The two surfaces mount.js serves, per the issue's URL table:
+const APP_VIEW_BASE = "http://studio-host:8080/console/app-view/Workforce/"; // Studio iframe base
+const STANDALONE_BASE = "http://127.0.0.1:3000/"; // standalone shell served at the app root
+
+for (const name of ["reportUrl", "transcriptsUrl"] as const) {
+  test(`#279: mount.js default ${name} is base-relative (no leading slash)`, () => {
+    const def = defaultEndpoint(name);
+    assert(
+      !def.startsWith("/"),
+      `default ${name} "${def}" must not start with "/": a leading-slash path resolves against the ` +
+        `iframe ORIGIN (console :8080), not the app-view base, so every fetch 404s through Studio (#279)`,
+    );
+  });
+
+  test(`#279: default ${name} resolves onto the app-view base inside the Studio iframe`, () => {
+    const def = defaultEndpoint(name);
+    // The bug: the default resolved to the console origin root (dropping /console/app-view/Workforce/).
+    // The fix: it must resolve UNDER the app-view base so it hits the endpoint the console proxies.
+    assertEquals(
+      new URL(def, APP_VIEW_BASE).href,
+      `http://studio-host:8080/console/app-view/Workforce/${def}`,
+      `default ${name} must resolve under the app-view base, not the console origin root (#279)`,
+    );
+  });
+
+  test(`#279: default ${name} still resolves to the origin root standalone`, () => {
+    const def = defaultEndpoint(name);
+    assertEquals(
+      new URL(def, STANDALONE_BASE).href,
+      `http://127.0.0.1:3000/${def}`,
+      `default ${name} must keep working for the standalone shell at the app root`,
+    );
+  });
+}
+
+test("#279: embed.html forwards BOTH reportUrl and transcriptsUrl from the injected config", () => {
+  // embed.html previously forwarded only reportUrl, so even if the console injected endpoint config
+  // the transcripts panel kept its (formerly absolute) default. Both must be forwarded.
+  assert(
+    /transcriptsUrl:\s*cfg\.transcriptsUrl/.test(EMBED_HTML),
+    "embed.html must forward transcriptsUrl: cfg.transcriptsUrl so the injected config reaches the past-sessions panel (#279)",
+  );
+  assert(
+    /reportUrl:\s*cfg\.reportUrl/.test(EMBED_HTML),
+    "embed.html must forward reportUrl: cfg.reportUrl",
+  );
+});